Function at 0x140085ea0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x22e8
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rsp + 0x22c0], rax
mov rbx, qword [rsp + 0x2348]
mov r12, r9
mov rdi, qword [rsp + 0x2350]
mov rsi, r8
mov r13, qword [rsp + 0x2340]
mov r14, qword [rsp + 0x2358]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
test rdx, rdx
jne 0x140085f0f
xor eax, eax
jmp 0x1400861f1
mov qword [rsp + 0x22e0], rbp
mov ecx, 0x2000
mov qword [rsp + 0x22d8], r15
call fcn.1400164e0
mov ecx, 0x2000
mov qword [rsp + 0x50], rax
mov r15, rax
call fcn.1400164e0
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x250
mov rbp, rax
call fcn.140241ba0
mov r9, qword [rsp + 0x58]
lea r8, str._s.
mov edx, 0x1000
mov rcx, r15
call fcn.140055b60
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140085fa0
mov rcx, qword [rsp + 0x50]
call fcn.140095d64
mov rcx, rbp
call fcn.140095d64
jmp 0x1400861df
mov rax, qword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rax + 8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400861c4
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x9c]
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call fcn.140055b60
mov eax, dword [rsp + 0x70]
bt eax, 0xa
jb 0x14008618c
test al, 0x10
je 0x140086059
movzx ecx, word [rsp + 0x9c]
movzx eax, word [rsp + 0x9e]
cmp cx, 0x2e
jne 0x14008602d
test ax, ax
je 0x14008618c
cmp cx, cx
jne 0x14008602d
cmp ax, cx
jne 0x14008602d
cmp word [rsp + 0xa0], 0
je 0x14008618c
mov rcx, qword [rsp + 0x60]
mov r9, r12
mov qword [rsp + 0x38], r14
mov r8, rsi
mov qword [rsp + 0x30], rdi
mov rdx, rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r13
call fcn.140085ea0
jmp 0x14008618c
xor edx, edx
lea rcx, [rsp + 0x2c0]
mov r8d, 0x2000
call fcn.140241ba0
mov r9d, 0x3e8
lea rdx, [rsp + 0x2c0]
mov r8d, 0x1000
mov rcx, rbp
call fcn.14002bd50
lea rcx, [rsp + 0x2c0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400860a0
test rax, rax
je 0x14008618c
mov rdx, r12
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008618c
mov rdx, rbx
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14008618c
mov rdx, r13
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140086113
mov rdx, rdi
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x14008618c
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test rsi, rsi
je 0x14008618c
mov rcx, qword [rsi + 0x10]
xor edi, edi
xor ebx, ebx
test rcx, rcx
jle 0x140086182
test rbx, rbx
js 0x140086212
cmp rbx, rcx
jge 0x140086212
mov rax, qword [rsi + 8]
lea rcx, [rsp + 0x2c0]
mov rdx, qword [rax + rbx*8]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140086173
mov rcx, qword [rsi + 0x10]
inc edi
movsxd rax, edi
inc rbx
cmp rax, rcx
jl 0x140086133
jmp 0x140086182
mov rdx, qword [r14 + 0x10]
mov r8, rbp
mov rcx, r14
call fcn.1400a6854
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140085fa0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x50]
call fcn.140095d64
mov rcx, rbp
call fcn.140095d64
mov eax, 1
jmp 0x1400861e1
mov rcx, qword [rsp + 0x50]
call fcn.140095d64
mov rcx, rbp
call fcn.140095d64
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rbp, qword [rsp + 0x22e0]
mov r15, qword [rsp + 0x22d8]
mov rcx, qword [rsp + 0x22c0]
xor rcx, rsp
call fcn.1402155d0
add rsp, 0x22e8
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400a2cd8
int3