Function at 0x140029190
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
lea rbp, [rsp - 0x650]
sub rsp, 0x750
xor r12d, r12d
mov r13, 0xffffffffffffffff
mov dword [rbp - 0x70], r12d
inc r13
cmp byte [rcx + r13], r12b
jne 0x1400291c6
cmp r13, 0x203
jb 0x1400291f9
mov r8, rcx
lea rdx, str.Path_too_long:__s
mov ecx, 2
call fcn.140014f80
add rsp, 0x750
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x748], rbx
mov rdx, rcx
mov qword [rsp + 0x740], rsi
lea rcx, [rbp - 0x40]
mov r8, r13
mov qword [rsp + 0x728], r15
call fcn.14004fbf0
movzx eax, word [0x14008d374]
mov word [rbp + r13 - 0x40], ax
movzx eax, byte [0x14008d376]
mov byte [rbp + r13 - 0x3e], al
mov rax, r12
nop dword [rax]
movzx ecx, byte [rbp + rax - 0x40]
cmp cl, 0x2f
jne 0x140029251
mov byte [rbp + rax - 0x40], 0x5c
jmp 0x140029255
test cl, cl
je 0x140029260
inc rax
cmp rax, 0x200
jl 0x140029240
lea rax, [rbp - 0x40]
mov r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], r12b
jne 0x140029270
mov dword [rsp + 0x28], r12d
lea r8, [rbp - 0x40]
xor edx, edx
mov qword [rsp + 0x20], r12
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movabs r15, 0x7ffffffffffffffe
mov qword [rsp + 0x60], r12
movsxd rsi, eax
xorps xmm0, xmm0
mov rbx, rsi
movups xmmword [rsp + 0x50], xmm0
cmp rsi, r15
ja 0x140029e57
mov qword [rsp + 0x738], rdi
mov qword [rsp + 0x730], r14
mov qword [rsp + 0x68], 7
cmp rbx, 8
jae 0x1400292f3
mov qword [rsp + 0x60], rbx
test eax, eax
je 0x140029358
movzx eax, r12w
lea rdi, [rsp + 0x50]
mov rcx, rbx
rep stosw word [rdi], ax
jmp 0x140029353
mov rdi, rbx
lea rcx, [rsp + 0x50]
or rdi, 7
cmp rdi, r15
jbe 0x14002931a
movabs rdx, 0x7fffffffffffffff
call fcn.140016040
mov qword [rsp + 0x68], r15
jmp 0x140029334
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
call fcn.140016040
mov qword [rsp + 0x68], rdi
mov rdx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
mov rdi, rdx
movzx eax, r12w
mov rcx, rbx
rep stosw word [rdi], ax
mov word [rdx + rsi*2], r12w
mov rbx, qword [rsp + 0x60]
test esi, esi
je 0x1400293a8
cmp qword [rsp + 0x68], 8
lea rax, [rsp + 0x50]
lea rdx, [rbp - 0x40]
mov r9, 0xffffffffffffffff
cmovae rax, qword [rsp + 0x50]
nop dword [rax + rax]
inc r9
cmp byte [rdx + r9], r12b
jne 0x140029380
mov dword [rsp + 0x28], esi
lea r8, [rbp - 0x40]
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
mov esi, 2
lea r10, str._UNC_
lea r14d, [rsi + 2]
lea r11d, [rsi + 6]
test rbx, rbx
je 0x14002961b
cmp rbx, r14
lea r8, [rsp + 0x50]
mov r9d, r14d
lea rcx, str.._
cmovb r9, rbx
cmp qword [rsp + 0x68], r11
mov rdx, r9
cmovae r8, rdi
cmp r9, r14
cmova rdx, r14
test rdx, rdx
je 0x140029413
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14002941c
add rcx, rsi
sub rdx, 1
jne 0x140029400
cmp r9, r14
je 0x1400294ad
cmp rbx, r14
lea r8, [rsp + 0x50]
mov r9, r14
lea rcx, str.__
cmovb r9, rbx
cmp qword [rsp + 0x68], r11
mov rdx, r9
cmovae r8, rdi
cmp r9, r14
cmova rdx, r14
test rdx, rdx
je 0x140029463
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140029468
add rcx, rsi
sub rdx, 1
jne 0x140029450
cmp r9, r14
je 0x1400294ad
cmp rbx, r11
lea r8, [rsp + 0x50]
mov r9, r11
mov rcx, r10
cmovb r9, rbx
cmp qword [rsp + 0x68], r11
mov rdx, r9
cmovae r8, rdi
cmp r9, r11
cmova rdx, r11
test rdx, rdx
je 0x1400294a8
sub r8, r10
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x1400294dd
add rcx, rsi
sub rdx, 1
jne 0x140029495
cmp r9, r11
jne 0x1400294dd
test rbx, rbx
je 0x14002961b
cmp qword [rsp + 0x68], r11
lea rcx, [rsp + 0x50]
lea r8, [rbp - 0x68]
cmovae rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140029616
mov rdi, qword [rsp + 0x50]
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
lea r8, [rbp + 0x410]
mov edx, 0x104
cmovae rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x140029616
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
mov qword [rsp + 0x48], 7
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x30], r12w
cmp eax, 0xf8
jae 0x140029560
lea rax, [rbp + 0x410]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140029540
lea rdx, [rbp + 0x410]
lea rcx, [rsp + 0x30]
call fcn.140015f10
jmp 0x140029991
mov edx, eax
add rdx, 8
cmp rdx, 7
ja 0x140029588
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x30]
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rsp + rdx*2 + 0x30], r12w
jmp 0x14002959b
mov r9, rdx
mov word [rsp + 0x20], r12w
lea rcx, [rsp + 0x30]
call fcn.1400161b0
cmp qword [rsp + 0x48], 8
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
cmovae r8, qword [rsp + 0x30]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
test eax, eax
jne 0x1400296d0
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140029616
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140029611
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e63
mov rcx, rdi
call fcn.14004d934
mov rdi, qword [rsp + 0x50]
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
lea rdx, [rbp + 0x1c0]
cmovae rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140029ae6
mov r8, qword [rbp + 0x670]
lea rdx, str.FindFirstFile___failed:__s
mov ecx, esi
call fcn.140014f80
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14002969b
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140029696
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e51
mov rcx, rdi
call fcn.14004d934
mov r14, qword [rsp + 0x730]
mov rdi, qword [rsp + 0x738]
mov rsi, qword [rsp + 0x740]
mov rbx, qword [rsp + 0x748]
mov r15, qword [rsp + 0x728]
add rsp, 0x750
pop r13
pop r12
pop rbp
ret
mov ecx, 2
mov qword [rsp + 0x78], r12
cmp qword [rsp + 0x40], rcx
lea r9, [rsp + 0x30]
mov r10d, ecx
mov qword [rbp - 0x80], r14
cmovb r10, qword [rsp + 0x40]
mov r11d, 7
cmp qword [rsp + 0x48], 8
mov rdi, r10
movabs rsi, 0x5c003f005c005c
mov qword [rbp - 0x78], r11
cmovae r9, qword [rsp + 0x30]
cmp r10, rcx
mov qword [rsp + 0x70], rsi
cmova rdi, rcx
lea rcx, [0x14008c014]
test rdi, rdi
je 0x140029744
sub r9, rcx
nop
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x1400297aa
add rcx, 2
sub rdi, 1
jne 0x140029730
cmp r10, 2
jne 0x1400297aa
lea r8d, [r10 + 6]
lea rdx, str._UNC_
lea rcx, [rsp + 0x70]
call fcn.140015f10
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov eax, 2
cmp rdi, rax
cmovb rax, rdi
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
sub rdi, rax
lea r8, [rdi*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14004fbf0
mov r11, qword [rbp - 0x78]
add ebx, 0xfffffffe
mov r14, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rdi
cmp r11, 8
lea r8, [rsp + 0x70]
mov r9, r14
lea rcx, [rsp + 0x30]
cmovae r8, rsi
call fcn.140015d30
mov r8, qword [rsp + 0x40]
mov ecx, ebx
add rcx, qword [rbp - 0x80]
cmp rcx, r8
ja 0x1400297f1
cmp qword [rsp + 0x48], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rcx
cmovae rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r12w
jmp 0x14002984c
mov rdi, qword [rsp + 0x48]
mov rdx, rcx
mov rax, rdi
sub rdx, r8
sub rax, r8
cmp rdx, rax
ja 0x140029839
cmp rdi, 8
mov qword [rsp + 0x40], rcx
lea r9, [rsp + 0x30]
cmovae r9, qword [rsp + 0x30]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14002982e
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x14002984c
mov r9, rdx
mov word [rsp + 0x20], r12w
lea rcx, [rsp + 0x30]
call fcn.1400161b0
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rax, 8
jb 0x140029950
cmp rbx, 8
jae 0x1400298c4
mov rdi, qword [rsp + 0x30]
lea r8, [rbx*2 + 2]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14004fbf0
mov rax, qword [rsp + 0x48]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400298b2
mov rcx, qword [rdi - 8]
add rdx, 0x27
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140029e63
mov rdi, rcx
mov rcx, rdi
call fcn.14004d934
mov eax, 7
jmp 0x140029946
mov rdi, rbx
or rdi, 7
cmp rdi, r15
cmova rdi, r15
cmp rdi, rax
jae 0x140029950
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x30]
call fcn.140016040
mov r8, qword [rsp + 0x40]
mov rcx, rax
mov rdx, qword [rsp + 0x30]
mov rbx, rax
lea r8, [r8*2 + 2]
call fcn.14004fbf0
mov rcx, qword [rsp + 0x48]
lea rdx, [rcx*2 + 2]
mov rcx, qword [rsp + 0x30]
cmp rdx, 0x1000
jb 0x140029939
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e63
mov rcx, r8
call fcn.14004d934
mov rax, rdi
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14002999b
mov rcx, qword [rsp + 0x70]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14002998c
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e63
mov rcx, rdi
call fcn.14004d934
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x68]
lea r14, [rsp + 0x30]
cmp rax, 8
cmovae r14, qword [rsp + 0x30]
cmp rbx, rsi
ja 0x1400299e6
cmp rsi, 8
mov qword [rsp + 0x60], rbx
lea rdi, [rsp + 0x50]
mov rdx, r14
cmovae rdi, qword [rsp + 0x50]
lea r8, [rbx + rbx]
mov rcx, rdi
call fcn.14004fbf0
mov word [rdi + rbx*2], r12w
mov rdi, qword [rsp + 0x50]
jmp 0x140029a90
cmp rbx, r15
ja 0x140029e5d
mov rdx, rbx
or rdx, 7
cmp rdx, r15
ja 0x140029a1f
mov rcx, rsi
mov rax, r15
shr rcx, 1
sub rax, rcx
cmp rsi, rax
ja 0x140029a1f
mov rax, rsi
mov r15, rdx
shr rax, 1
add rax, rsi
cmp rdx, rax
cmovb r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x50]
call fcn.140016040
lea r8, [rbx + rbx]
mov qword [rsp + 0x60], rbx
mov rdx, r14
mov qword [rsp + 0x68], r15
mov rcx, rax
mov rdi, rax
call fcn.14004fbf0
mov word [rdi + rbx*2], r12w
cmp rsi, 8
jb 0x140029a8b
mov rcx, qword [rsp + 0x50]
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x140029a86
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e63
mov rcx, r8
call fcn.14004d934
mov qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140029adc
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140029acd
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e63
mov rcx, rdi
call fcn.14004d934
mov esi, 2
jmp 0x140029616
mov esi, 2
jmp 0x14002961b
mov rsi, qword [rbp + 0x690]
mov r15, qword [rbp + 0x670]
lea rdx, [rbp + 0x1ec]
lea rcx, [rsp + 0x70]
call fcn.140015300
mov r8, qword [rbp - 0x78]
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x10
mov rcx, 0xffffffffffffffff
cmovae rax, rdi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140029b22
cmp r8, 0x10
lea rdx, [rsp + 0x70]
cmovae rdx, rdi
cmp rcx, 1
jne 0x140029b43
cmp byte [rdx], 0x2e
jmp 0x140029ba0
cmp rcx, 2
jne 0x140029b59
cmp byte [rdx], 0x2e
jne 0x140029b9b
cmp byte [rdx + 1], 0x2e
jne 0x140029b9b
jmp 0x140029ddb
cmp rcx, 4
jb 0x140029b72
cmp byte [rdx], 0x2e
jne 0x140029b72
cmp dword [rdx + rcx - 4], 0x7077732e
je 0x140029ddb
cmp rcx, 9
jb 0x140029b95
mov rax, qword [rdx]
cmp rax, qword [str..tundra2.]
jne 0x140029b9b
movzx eax, byte [rdx + 8]
cmp al, byte [0x14008d480]
jne 0x140029b9b
jmp 0x140029ddb
cmp rcx, 1
jbe 0x140029ba6
cmp byte [rdx + rcx - 1], 0x7e
je 0x140029ddb
mov rax, qword [rbp + 0x678]
test rax, rax
je 0x140029bed
mov rdx, rax
lea rcx, [rbp - 0x68]
or r12d, 1
call fcn.1400151a0
cmp qword [rax + 0x18], 8
jb 0x140029bcc
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x1ec]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov r8, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x70]
test eax, eax
jne 0x140029bed
xor bl, bl
jmp 0x140029bef
mov bl, 1
test r12b, 1
je 0x140029c42
mov rdx, qword [rbp - 0x50]
and r12d, 0xfffffffe
cmp rdx, 8
jb 0x140029c42
mov rcx, qword [rbp - 0x68]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140029c34
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e38
mov rcx, rdi
call fcn.14004d934
mov r8, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x70]
test bl, bl
jne 0x140029c52
cmp byte [rbp + 0x680], bl
je 0x140029ddb
cmp r8, 0x10
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
cmovae rcx, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140029c66
add rax, 2
add rax, r13
cmp rax, 0x200
jbe 0x140029cda
lea r9, [rbp + 0x1ec]
mov r8, r15
lea rdx, str.Path_too_long:__s__s
mov ecx, 2
call fcn.140014f80
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140029e0e
mov rcx, qword [rsp + 0x70]
inc rdx
cmp rdx, 0x1000
jb 0x140029e09
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029e3e
jmp 0x140029e06
mov eax, dword [rbp + 0x1e0]
mov ecx, dword [rbp + 0x1dc]
shl rcx, 0x20
or rcx, rax
mov eax, dword [rbp + 0x1d4]
mov qword [rsp + 0x38], rcx
mov ecx, dword [rbp + 0x1d8]
shl rcx, 0x20
or rcx, rax
movabs rax, 0x19db1ded53e8000
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
test byte [rbp + 0x1c0], 0x10
mov qword [rsp + 0x40], rdx
je 0x140029d42
mov r9d, 9
mov qword [rsp + 0x40], 1
jmp 0x140029d48
mov r9d, 5
cmp r8, 0x10
mov dword [rsp + 0x30], r9d
lea rcx, [rsp + 0x70]
cmovae rcx, rdi
lea rdx, [rbp - 0x3f]
sub rdx, rcx
add rdx, r13
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140029d70
test bl, bl
mov rbx, qword [rbp + 0x688]
je 0x140029da5
lea r8, [rbp - 0x40]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call rsi
mov r8, qword [rbp - 0x78]
mov r9d, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
movzx eax, byte [rbp + 0x680]
test al, al
je 0x140029ddb
test r9b, 8
je 0x140029ddb
mov rdx, qword [rbp + 0x678]
lea rcx, [rbp - 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rsi
movzx r8d, al
call fcn.140029190
mov r8, qword [rbp - 0x78]
mov rdi, qword [rsp + 0x70]
cmp r8, 0x10
jb 0x140029e0e
lea rdx, [r8 + 1]
cmp rdx, 0x1000
jb 0x140029e06
mov rcx, qword [rdi - 8]
add rdx, 0x27
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140029e3e
mov rdi, rcx
mov rcx, rdi
call fcn.14004d934
lea rdx, [rbp + 0x1c0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140029af4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x140029e44
jmp 0x140029659
call fcn.140055668
int3
call fcn.140055668
int3
lea rcx, str.couldnt_close_FindFile_handle
call fcn.140014f00
int3
call fcn.140055668
int3
call fcn.140001350
int3
call fcn.140001350
int3
call fcn.140055668
int3