Function at 0x180044ca0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x218]
sub rsp, 0x318
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov qword [rsp + 0x78], r9
mov qword [rbp - 0x78], r8
mov rbx, rdx
mov r15, rcx
mov qword [rsp + 0x70], rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x34], 1
call fcn.1800f3548
mov rcx, rax
test rax, rax
je 0x180045546
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
call fcn.1800f3548
mov rcx, rax
test rax, rax
je 0x180045551
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea r13, [r14 - 1]
test rbx, rbx
je 0x1800454d6
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x180044d50
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.180007b10
mov rdi, qword [rbp - 0x60]
movsxd rbx, dword [rdi - 0x10]
lea r12, [rdi - 0x18]
cmp ebx, 1
jg 0x180044d8d
mov rcx, r12
call fcn.18000f360
add rax, 0x18
mov qword [rsp + 0x60], rax
jmp 0x180044dcf
mov rcx, qword [r12]
test rcx, rcx
je 0x180044da1
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x180044daf
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
lea rcx, [rdi - 2]
lea rdx, [rcx + rbx*2]
mov r9, rax
mov r8d, 1
lea rcx, [rsp + 0x60]
call fcn.18001cbf0
mov rax, qword [rsp + 0x60]
mov dword [rsp + 0x30], 1
cmp dword [rax - 0x10], 1
jne 0x180044de7
cmp word [rax], 0x5c
jne 0x180044de7
mov bl, 1
jmp 0x180044de9
xor bl, bl
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180044e03
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
je 0x180044f0e
mov qword [rsp + 0x38], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x180044e27
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x180044e38
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x18004555c
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
lea r9, [0x180156698]
mov rax, r13
inc rax
cmp word [r9 + rax*2], 0
jne 0x180044e62
mov dword [rsp + 0x20], eax
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x38]
call fcn.18000f130
mov rdx, qword [rsp + 0x38]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp - 0x68]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x180044ee7
cmp dword [rsi + 0x10], 0
jl 0x180044ed9
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x180044ed9
mov rcx, rbx
call fcn.18000f360
mov r14, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x180044ecc
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [r14 + 0x18]
mov qword [rbp - 0x68], rax
xor r14d, r14d
jmp 0x180044ee7
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.180007b10
nop
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x180044f00
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov ebx, 1
mov dword [rsp + 0x30], ebx
jmp 0x18004501a
mov qword [rsp + 0x40], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x180044f2a
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x180044f3b
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x180045567
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 5
lea r9, [0x180155a80]
mov rax, r13
inc rax
cmp word [r9 + rax*2], 0
jne 0x180044f65
mov dword [rsp + 0x20], eax
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.18000f130
mov rdx, qword [rsp + 0x40]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp - 0x68]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x180044fea
cmp dword [rsi + 0x10], 0
jl 0x180044fdc
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x180044fdc
mov rcx, rbx
call fcn.18000f360
mov r14, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x180044fcf
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [r14 + 0x18]
mov qword [rbp - 0x68], rax
xor r14d, r14d
jmp 0x180044fea
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.180007b10
nop
mov dword [rsp + 0x30], 1
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x180045016
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov ebx, 1
mov dword [rsp + 0x30], ebx
jmp 0x18004501a
mov ebx, dword [rsp + 0x30]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp - 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1800454d6
mov rcx, qword [r15 + 0x340]
call fcn.180023fd0
mov r14d, ebx
cmp dword [r15 + 0x220], 0
jne 0x1800454b3
movzx ecx, word [rbp - 0x24]
movzx eax, word [rbp - 0x22]
cmp cx, word [0x180155a8c]
jne 0x180045071
cmp ax, word [0x180155a8e]
je 0x180045498
cmp cx, word [0x180155a90]
jne 0x180045094
cmp ax, word [0x180155a92]
jne 0x180045094
movzx eax, word [rbp - 0x20]
cmp ax, word [0x180155a94]
je 0x180045498
movsxd rsi, dword [rdi - 0x10]
cmp esi, 1
jg 0x1800450b0
mov rcx, r12
call fcn.18000f360
add rax, 0x18
mov qword [rsp + 0x68], rax
jmp 0x1800450f6
mov rcx, qword [r12]
test rcx, rcx
je 0x1800450c4
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1800450d2
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, qword [rbp - 0x60]
sub rcx, 2
lea rdx, [rcx + rsi*2]
mov r9, rax
mov r8d, 1
lea rcx, [rsp + 0x68]
call fcn.18001cbf0
mov rax, qword [rsp + 0x68]
or ebx, 8
mov dword [rsp + 0x30], ebx
cmp dword [rax - 0x10], 1
jne 0x18004510d
cmp word [rax], 0x5c
jne 0x18004510d
mov bl, 1
jmp 0x18004510f
xor bl, bl
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180045129
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
je 0x180045244
mov qword [rsp + 0x48], 0
mov rcx, qword [r12]
test rcx, rcx
je 0x18004514e
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x180045165
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x180045572
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
or r14d, 0x18
mov dword [rsp + 0x30], r14d
lea rcx, [rbp - 0x24]
mov rax, r13
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180045190
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x24]
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x48]
call fcn.18000f130
mov rdx, qword [rsp + 0x48]
lea rsi, [rdx - 0x18]
mov rbx, qword [rbp - 0x68]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x180045219
cmp dword [rbx + 0x10], 0
jl 0x18004520c
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x18004520c
mov rcx, rsi
call fcn.18000f360
mov r15, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x1800451fd
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x68], rax
mov r15, qword [rsp + 0x70]
jmp 0x180045219
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.180007b10
and r14d, 0xffffffef
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1800453e3
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
jmp 0x1800453e3
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov rcx, qword [r12]
test rcx, rcx
je 0x18004525f
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x180045276
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x18004553b
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
or r14d, 0x28
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x20], 1
lea r9, [0x180155ad4]
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.18000f130
nop
mov qword [rsp + 0x58], rbx
mov rbx, qword [rsp + 0x50]
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x1800452d5
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1800452ec
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x18004557d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
or r14d, 0x40
mov dword [rsp + 0x30], r14d
lea rcx, [rbp - 0x24]
mov rax, r13
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x180045310
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x24]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.18000f130
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx - 0x18]
mov rbx, qword [rbp - 0x68]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x180045398
cmp dword [rbx + 0x10], 0
jl 0x18004538b
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x18004538b
mov rcx, rsi
call fcn.18000f360
mov r15, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18004537c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x68], rax
mov r15, qword [rsp + 0x70]
jmp 0x180045398
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x68]
call fcn.180007b10
and r14d, 0xffffffbf
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1800453ba
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
and r14d, 0xffffffdf
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x1800453df
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
lea r12, [rdi - 0x18]
test byte [rbp - 0x50], 0x10
je 0x180045406
mov r9, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x68]
mov rcx, r15
call sym.SafeBase64.dll_private:_int___cdecl_CSearchFile::FindAllFiles_wchar_t_const____ptr64__class_std::vector_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____class_std::allocator_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t______const____ptr64____ptr64__int____cdecl___unsigned_long_int__unsigned_long_int_____ptr64
mov esi, eax
mov dword [rsp + 0x34], eax
jmp 0x18004544c
inc dword [r15 + 0x224]
mov rbx, qword [r15 + 0x340]
mov rsi, qword [rbx + 8]
cmp qword [rbx + 0x10], rsi
je 0x180045439
mov rcx, qword [rbp - 0x68]
add rcx, 0xffffffffffffffe8
call fcn.18000f360
add rax, 0x18
mov qword [rsi], rax
add qword [rbx + 8], 8
jmp 0x180045448
lea r8, [rbp - 0x68]
mov rdx, rsi
mov rcx, rbx
call fcn.180024110
mov esi, dword [rsp + 0x34]
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x180045492
mov rax, qword [r15 + 0x340]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
sar rcx, 3
test rcx, 0x3ff
jne 0x180045492
mov edx, ecx
mov ecx, dword [r15 + 0x224]
call r8
mov esi, eax
mov dword [rsp + 0x34], eax
test eax, eax
jne 0x180045492
mov dword [r15 + 0x220], 1
mov ebx, dword [rsp + 0x30]
jmp 0x18004549c
mov esi, dword [rsp + 0x34]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1800454b8
jmp 0x180045042
mov esi, 1
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
je 0x1800454d9
mov rax, qword [r15 + 0x340]
mov rcx, qword [rbp - 0x78]
mov qword [rcx], rax
jmp 0x1800454d9
mov esi, r14d
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800454f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x180045516
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, esi
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
int3