Function at 0x140004ce0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x14003f190]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, r8
mov qword [rbp - 0x78], rbx
mov rdi, rdx
mov qword [rbp - 0x80], rdx
mov r14, rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 8], rdx
mov qword [rbp], rbx
xor r15d, r15d
mov esi, r15d
mov dword [rsp + 0x68], r15d
lea rdx, [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x48], rax
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400057bb
movabs r13, 0x8000000000000000
lea rcx, str..txt
mov ebx, 0x2a5c
lea rdi, str.Windows
test byte [rbp + 0x50], 0x10
je 0x140005108
movzx eax, byte [rbp + 0x7c]
cmp al, 0x24
je 0x140005108
movzx ecx, byte [rbp + 0x7d]
cmp al, 0x2e
jne 0x140004db1
test cl, cl
je 0x140005101
cmp al, al
jne 0x140004db1
cmp cl, al
jne 0x140004db1
cmp byte [rbp + 0x7e], 0
je 0x140005101
mov rcx, r15
lea rdx, [rbp + 0x7c]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rdi + rcx - 1]
jne 0x140004dd8
cmp rcx, 8
jne 0x140004dc0
jmp 0x140005101
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x140004df0
mov rdx, r14
lea rcx, [rbp + 8]
call fcn.14000abc0
nop
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov r8d, 1
lea rdx, [0x140030fac]
lea rcx, [rsp + 0x48]
call fcn.14000abc0
nop
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r15
lea rax, [rbp + 0x7c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140004e45
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x28]
call fcn.14000abc0
nop
mov rcx, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x40]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x140004e95
lea rax, [rcx + 2]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x28]
cmp rdx, 0x10
cmovae rax, qword [rbp + 0x28]
mov word [rax + rcx], bx
mov byte [rax + rcx + 2], 0
lea rax, [rbp + 0x28]
jmp 0x140004eb3
mov qword [rsp + 0x20], 2
lea r9, [0x140031138]
mov edx, 2
lea rcx, [rbp + 0x28]
call fcn.14000b4d0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 1
mov dword [rsp + 0x68], esi
lea rsi, [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
cmp rdi, 0x10
setae byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
cmovae rsi, r13
lea r12, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r12, qword [rbp + 8]
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbp + 0x18]
cmp rbx, rax
ja 0x140004fb5
sub rax, rbx
test rbx, rbx
jne 0x140004f21
mov rdi, r15
jmp 0x140004f8a
lea r14, [rax + r12]
movsx r15d, byte [rsi]
lea r8, [r14 + 1]
sub r8, r12
mov edx, r15d
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x140004fb0
nop dword [rax]
nop word [rax + rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004f81
inc rdi
lea r8, [r14 + 1]
sub r8, rdi
mov edx, r15d
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x140004f50
jmp 0x140004fb0
sub rdi, r12
cmp rdi, 0xffffffffffffffff
je 0x140004fb0
lea r9, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae r9, qword [rbp - 0x40]
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.14000a1d0
mov rdi, qword [rsp + 0x60]
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140004ff1
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004feb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000576d
call fcn.140027ff0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14000502c
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005027
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005774
call fcn.140027ff0
xor r15d, r15d
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], r15b
cmp byte [rsp + 0x40], r15b
je 0x140005077
lea rdx, [rdi + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000506f
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000577b
mov rcx, r13
call fcn.140027ff0
lea rax, [rbp - 0x68]
mov qword [rbp - 0x70], rax
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x68]
call fcn.140008cb0
mov rdi, rax
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x48]
call fcn.140008cb0
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
mov r8, rdi
mov rdx, rax
call fcn.140004ce0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x1400050f2
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005782
call fcn.140027ff0
movabs r13, 0x8000000000000000
mov r14, qword [rsp + 0x70]
lea rcx, str..txt
mov dword [rsp + 0x78], r15d
mov rax, r15
mov qword [rbp - 0x70], rax
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rcx + rax*8]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140005140
lea rcx, [rsp + 0x48]
call fcn.14000abc0
nop
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
lea rax, [rbp + 0x7c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005170
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 8]
call fcn.14000abc0
mov rbx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
mov rsi, qword [rbp + 0x20]
mov r11, qword [rbp + 8]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rbp + 0x18]
cmp rdi, rcx
jbe 0x1400051ac
xor dil, dil
jmp 0x140005218
lea rax, [rbp + 8]
cmp rsi, 0x10
cmovae rax, r11
add rcx, rax
lea r8, [rsp + 0x48]
cmp rbx, 0x10
setae al
cmovae r8, r9
lea r10, [rsp + 0x48]
test al, al
cmovne r10, r9
lea rax, [r10 + rdi]
mov rdx, rax
sub rdx, r8
cmp rdx, r13
je 0x1400057ac
cmp rax, r8
je 0x140005215
sub rcx, r10
sub rcx, rdi
nop dword [rax]
nop dword [rax + rax]
lea rdi, [rax - 1]
movzx edx, byte [rax + rcx - 1]
cmp byte [rdi], dl
jne 0x1400051a7
mov rax, rdi
cmp rdi, r8
jne 0x140005200
mov dil, 1
cmp rsi, 0x10
jb 0x140005259
lea rdx, [rsi + 1]
mov rax, r11
cmp rdx, 0x1000
jb 0x140005247
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057ac
mov rcx, r11
call fcn.140027ff0
mov rbx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], 0
cmp rbx, 0x10
jb 0x1400052a0
lea rdx, [rbx + 1]
mov rax, r9
cmp rdx, 0x1000
jb 0x140005298
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005789
mov rcx, r9
call fcn.140027ff0
test dil, dil
je 0x14000571e
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r15
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x1400052c0
mov rdx, r14
lea rcx, [rbp + 0x28]
call fcn.14000abc0
nop
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov r8d, 1
lea rdx, [0x140030fac]
lea rcx, [rsp + 0x48]
call fcn.14000abc0
nop
mov qword [rbp + 8], r15
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], r15
lea rax, [rbp + 0x7c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140005315
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 8]
call fcn.14000abc0
nop
lea rsi, [rsp + 0x48]
mov rdi, qword [rsp + 0x60]
cmp rdi, 0x10
setae byte [rsp + 0x40]
mov r13, qword [rsp + 0x48]
cmovae rsi, r13
lea r12, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae r12, qword [rbp + 0x28]
mov rbx, qword [rsp + 0x58]
mov rax, qword [rbp + 0x38]
cmp rbx, rax
ja 0x140005405
sub rax, rbx
test rbx, rbx
jne 0x140005376
mov rdi, r15
jmp 0x1400053da
lea r14, [r12 + rax]
movsx r15d, byte [rsi]
lea r8, [r14 + 1]
sub r8, r12
mov edx, r15d
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
je 0x140005400
nop dword [rax + rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400053d1
inc rdi
lea r8, [r14 + 1]
sub r8, rdi
mov edx, r15d
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rdi, rax
test rax, rax
jne 0x1400053a0
jmp 0x140005400
sub rdi, r12
cmp rdi, 0xffffffffffffffff
je 0x140005400
lea r9, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r9, qword [rbp + 8]
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp + 0x28]
call fcn.14000a1d0
mov rdi, qword [rsp + 0x60]
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140005441
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000543b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005790
call fcn.140027ff0
nop
cmp byte [rsp + 0x40], 0
je 0x140005479
lea rdx, [rdi + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140005471
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005797
mov rcx, r13
call fcn.140027ff0
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rcx, qword [rbp + 0x28]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r15 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400056d5
lea rdx, [rbp + 0x7c]
lea rcx, str.Filename:__s_n
call fcn.140001380
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 8]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x68]
mov qword [rbp - 0x18], rax
mov rdi, qword [rbp - 0x78]
mov rax, qword [rdi + 8]
mov qword [rbp + 0x10], rax
mov rcx, qword [rdi + 0x10]
mov qword [rbp + 0x18], rcx
test rcx, rcx
jne 0x140005506
mov qword [rbp + 0x20], r15
jmp 0x140005559
call fcn.140015820
mov qword [rbp + 0x20], rax
test rax, rax
je 0x140005559
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x140005559
mov r8, qword [rdi + 0x10]
mov rcx, qword [rbp + 0x18]
test r8, r8
je 0x140005559
cmp rcx, r8
jb 0x140005539
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140005559
mov r8, rcx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
nop
mov rdi, qword [rbp - 0x80]
mov rax, qword [rdi + 8]
mov qword [rbp - 0x60], rax
mov rcx, qword [rdi + 0x10]
mov qword [rbp - 0x58], rcx
test rcx, rcx
jne 0x140005578
mov qword [rbp - 0x50], r15
jmp 0x1400055cb
call fcn.140015820
mov qword [rbp - 0x50], rax
test rax, rax
je 0x1400055cb
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x1400055cb
mov r8, qword [rdi + 0x10]
mov rcx, qword [rbp - 0x58]
test r8, r8
je 0x1400055cb
cmp rcx, r8
jb 0x1400055ab
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400055cb
mov r8, rcx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
nop
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea rsi, [rbp + 0x28]
cmp qword [rbp + 0x40], 0x10
cmovae rsi, qword [rbp + 0x28]
mov rbx, qword [rbp + 0x38]
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x140005841
mov qword [rsp + 0x60], 0xf
cmp rbx, 0x10
jae 0x14000562b
mov qword [rsp + 0x58], rbx
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400056c1
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x14000564a
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140005671
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140005693
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140005847
mov rcx, rax
call fcn.140028008
mov rcx, rax
test rax, rax
je 0x14000579e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400056a2
test rcx, rcx
je 0x14000569f
call fcn.140028008
jmp 0x1400056a2
mov rax, r15
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea r8, [rbp + 8]
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400044a0
jmp 0x1400056e3
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14000571e
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005719
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400057a5
call fcn.140027ff0
mov ecx, dword [rsp + 0x78]
inc ecx
mov dword [rsp + 0x78], ecx
mov rax, qword [rbp - 0x70]
inc rax
mov qword [rbp - 0x70], rax
cmp ecx, 0xb
mov r14, qword [rsp + 0x70]
movabs r13, 0x8000000000000000
lea rcx, str..txt
jb 0x140005120
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400057b3
mov esi, dword [rsp + 0x68]
jmp 0x140004d66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdi, qword [rbp - 0x80]
mov rbx, qword [rbp - 0x78]
lea rcx, [rdi + 8]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx]
cmp qword [rcx], rax
cmovb rdx, rcx
mov rcx, qword [rdx]
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x1400057e9
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx]
cmp qword [rcx], rax
cmovb rdx, rcx
mov rcx, qword [rdx]
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140005817
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140027fd0
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001580
nop
call fcn.1400014e0
int3