Function at 0x140004230
Capabilities:
Enumerate files on windows
Enumerate files recursively
Read file on windows

Disassembly:
cmp r9d, 3
jg 0x1400046cd
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x248]
sub rsp, 0x348
mov rax, qword [0x14007e018]
xor rax, rsp
mov qword [rbp + 0x230], rax
mov edi, r9d
mov dword [rsp + 0x30], r9d
mov r15, r8
mov r14, rdx
mov r12, rcx
xor esi, esi
cmp qword [rdx], 0xbb8
ja 0x1400046ab
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], si
lea r8, [0x140074810]
mov rdx, rcx
lea rcx, [rbp - 0x40]
call fcn.14000b780
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140004623
test byte [rbp - 0x20], 0x10
je 0x140004470
movzx ecx, word [rbp + 0xc]
movzx eax, word [rbp + 0xe]
cmp cx, 0x2e
jne 0x140004309
test ax, ax
je 0x140004604
cmp cx, cx
jne 0x140004309
cmp ax, cx
jne 0x140004309
cmp word [rbp + 0x10], 0
je 0x140004604
lea r8, [0x140074760]
mov rdx, r12
lea rcx, [rsp + 0x38]
call fcn.14000b780
mov rbx, rax
lea rax, [rbp + 0xc]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140004330
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140004380
lea rsi, [rcx + rdx]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp r8, 8
jb 0x140004361
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0xc]
call fcn.140036b80
xor eax, eax
mov word [rdi + rsi*2], ax
mov edi, dword [rsp + 0x30]
xor esi, esi
jmp 0x140004394
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc]
mov rcx, rbx
call fcn.14000c010
mov rbx, rax
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140004400
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046da
call fcn.140034c90
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
lea r9d, [rdi + 1]
mov r8, r15
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.140004230
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140004604
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004466
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046e0
call fcn.140034c90
jmp 0x140004604
lea r8, [0x140074760]
mov rdx, r12
lea rcx, [rsp + 0x58]
call fcn.14000b780
mov rbx, rax
lea rax, [rbp + 0xc]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140004492
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400044e2
lea rsi, [rcx + rdx]
mov qword [rbx + 0x10], rsi
mov rdi, rbx
cmp r8, 8
jb 0x1400044c3
mov rdi, qword [rbx]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0xc]
call fcn.140036b80
xor eax, eax
mov word [rdi + rsi*2], ax
mov edi, dword [rsp + 0x30]
xor esi, esi
jmp 0x1400044f6
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc]
mov rcx, rbx
call fcn.14000c010
mov rbx, rax
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14000455e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004550
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046e6
call fcn.140034c90
movups xmm0, xmmword [rsp + 0x38]
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm1
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400045a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046ec
call fcn.140034c90
mov qword [rsp + 0x78], rsi
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rdx, qword [rbp - 0x80]
lea r8, [0x14007481c]
lea rcx, [rsp + 0x78]
call fcn.14003b524
mov r9, qword [rsp + 0x78]
test r9, r9
je 0x1400045f1
mov edx, 1
mov r8d, edx
lea rcx, [rbp - 0x60]
call fcn.140041234
mov rcx, qword [rsp + 0x78]
call fcn.14003b658
inc qword [r14]
mov ecx, dword [rbp - 4]
shl rcx, 0x20
mov eax, dword [rbp]
add rcx, rax
add qword [r15], rcx
lea rdx, [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400042d3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000465f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000465a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046d4
call fcn.140034c90
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x1400046ab
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046ce
call fcn.140034c90
mov rcx, qword [rbp + 0x230]
xor rcx, rsp
call fcn.140034c70
add rsp, 0x348
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
nop
call fcn.140041530
int3