Function at 0x140017d70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xb00
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0xb30], rbx
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0xaf0], rax
mov rsi, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rdx
xor edi, edi
mov dword [rsp + 0x20], edi
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140017dd5
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x80]
call fcn.1400a09f0
mov r8, qword [rsi]
lea rdx, str._s.
lea rcx, [rsp + 0x6e0]
call fcn.1400030e0
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x6e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x68], rax
or rbp, 0xffffffffffffffff
cmp rax, rbp
je 0x1400182cf
nop
nop
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0xac]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140017eb5
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140017f43
cmp dword [rdx + 0x10], eax
jge 0x140017e87
cmp dword [rbx - 0xc], eax
jl 0x140018282
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x140017f43
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140017e9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x140017f43
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xac]
sub rbp, rbx
sar rbp, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140017ee8
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140004410
mov rbx, qword [rsp + 0x30]
cmp rbp, rsi
ja 0x140017f08
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009f850
jmp 0x140017f25
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xac]
mov rdx, rsi
mov rcx, rbx
call fcn.14009f640
test edi, edi
js 0x1400182c4
cmp edi, dword [rbx - 0xc]
jg 0x1400182c4
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
or rbp, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400ee8ac]
mov rsi, rbx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x140017f5e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x140018253
xor eax, eax
lea rdi, [0x1400f023c]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140017f86
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x140018259
mov r9, rbx
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
lea rdx, [0x1400efcb0]
lea rcx, [rsp + 0x2d0]
call fcn.1400030e0
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x50], rdx
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
je 0x1400182a9
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x2d0]
lea rsi, [rsp + 0x2d0]
shr rsi, 0x10
jne 0x14001801a
movzx edi, ax
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140018044
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400060c0
jmp 0x140018044
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x2d0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x48]
call fcn.140006310
nop
lea rcx, [rsp + 0x48]
call fcn.1400058b0
test eax, eax
je 0x140018104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
je 0x14001828d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2d0]
test rsi, rsi
jne 0x1400180b5
movzx edi, ax
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400180df
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400060c0
jmp 0x1400180df
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x2d0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x38]
call fcn.140006310
nop
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140017d70
test eax, eax
je 0x14001824d
mov edi, 1
mov dword [rsp + 0x20], edi
jmp 0x140018263
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
lea rdx, str._sIntcOED.inf
lea rcx, [rsp + 0x2d0]
call fcn.1400030e0
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x50], rdx
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
je 0x14001829e
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
test rsi, rsi
jne 0x14001817f
movzx edi, ax
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400181a9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400060c0
jmp 0x1400181a9
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x2d0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x28]
call fcn.140006310
nop
lea rcx, [rsp + 0x28]
call fcn.1400059b0
test eax, eax
je 0x14001825f
mov rax, qword [rsp + 0x40]
mov rdi, qword [rax]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400181ec
cmp rax, qword [rdi - 0x18]
jne 0x1400181ec
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rbx, qword [rsp + 0x30]
jmp 0x140018228
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140018298
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.14009f640
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
lea rcx, [0x14013a5f0]
call fcn.140007f30
mov edi, 1
mov dword [rsp + 0x20], edi
jmp 0x140018263
mov edi, dword [rsp + 0x20]
jmp 0x140018263
mov edi, dword [rsp + 0x20]
jmp 0x140018263
mov edi, dword [rsp + 0x20]
jmp 0x140018263
mov edi, dword [rsp + 0x20]
lea rdx, [rsp + 0x80]
mov rsi, qword [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400182b4
jmp 0x140017e40
mov ecx, 0x80070057
call fcn.140001120
int3
mov ecx, 0x80004005
call fcn.140001120
int3
call fcn.140002f80
int3
mov ecx, 0x80004005
call fcn.140001120
int3
mov ecx, 0x80004005
call fcn.140001120
int3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x40]
jmp 0x1400182cf
mov ecx, 0x80070057
call fcn.140001120
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400182eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsi]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140018307
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
mov rcx, qword [rsp + 0xaf0]
xor rcx, rsp
call fcn.1400a1970
mov rbx, qword [rsp + 0xb30]
add rsp, 0xb00
pop rdi
pop rsi
pop rbp
ret