Function at 0x140002eaa
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
jmp 0x14012de30
push rbp
push rbx
push rsi
push rdi
push r12
sub rsp, 0x270
lea rbp, [rsp + 0x30]
mov rsi, r8
mov rdi, rdx
mov rbx, r9
mov r12, rcx
mov rdx, qword [rsi]
call sub.KERNEL32.dll_FindFirstFileA
mov rcx, rax
cmp rcx, 0xffffffffffffffff
je 0x14012e6c9
movsxd rax, ebx
xor edx, edx
add rax, 0xfffffffffffffffc
mov qword [rbp + 0x1e8], rcx
cmovle rax, rdx
xor ebx, ebx
mov qword [rbp + 0x1d8], r12
mov qword [rbp + 0x1d0], rdi
mov qword [rbp + 0x1c8], r13
mov r13, rsi
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1b8], r15
mov r15, rax
mov r14, qword [r13]
test r14, r14
jne 0x14012dee1
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rdi, [0x1404d7748]
lea r10, [0x1404d7750]
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x28], r10
call fcn.140002199
mov rdi, rsp
lea r12, [r14 + 0x2c]
mov rcx, r12
mov edx, 0x104
mov r9d, 1
lea r8, [rbp + 0x230]
mov byte [r8], bl
mov dword [rdi + 0x20], ebx
call fcn.140006019
mov esi, eax
test r14, r14
je 0x14012e02d
cmp byte [r14 + 0x2c], 0x2e
je 0x14012e071
test byte [r14], 0x10
je 0x14012e0e3
mov r9, qword [rbp + 0x1d8]
mov rdi, rsp
mov qword [rbp + 0x158], r9
mov qword [rbp + 0x160], r15
test r14, r14
jne 0x14012df7b
mov r14, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea r10, [0x1404d7758]
lea r11, [0x1404d7760]
mov qword [r14 + 0x20], r10
mov qword [r14 + 0x28], r11
call fcn.140002199
movsxd rsi, esi
xor edx, edx
dec rsi
lea rcx, [rbp + 0x220]
mov qword [rbp + 0x168], r12
lea r12, str.__.
cmovle rsi, rdx
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x180], 5
mov byte [rcx], 0
lea r14, [r15 + rsi + 6]
mov rax, r14
mov qword [rbp + 0x188], rcx
mov qword [rbp + 0x190], 1
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x30]
mov r12, rax
lea rcx, [rbp + 0x158]
mov edx, 4
mov r8, r12
mov r9, r14
call fcn.1400048cc
mov rcx, r12
mov r8, r13
mov r9, r14
mov rdx, qword [rbp + 0x1d0]
call fcn.140002eaa
mov edx, eax
mov rax, rdi
mov rsp, rax
test dl, 1
jne 0x14012e0ba
mov r14, qword [r13]
jmp 0x14012e071
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rdi, [0x1404d7768]
lea r10, [0x1404d7770]
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x28], r10
call fcn.140002199
cmp byte [0x2c], 0x2e
jne 0x14012e686
mov rdx, r14
mov rcx, qword [rbp + 0x1e8]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x14012dea2
mov rcx, qword [rbp + 0x1e8]
mov r13, qword [rbp + 0x1c8]
mov r14, qword [rbp + 0x1c0]
mov r15, qword [rbp + 0x1b8]
call sub.KERNEL32.dll_FindClose
nop
mov eax, ebx
lea rsp, [rbp + 0x240]
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, qword [rbp + 0x1e8]
mov ebx, 0xffffffff
mov r13, qword [rbp + 0x1c8]
mov r14, qword [rbp + 0x1c0]
mov r15, qword [rbp + 0x1b8]
call sub.KERNEL32.dll_FindClose
nop
jmp 0x14012e0aa
cmp esi, 8
jle 0x14012e071
movsxd rsi, esi
xor r10d, r10d
xor edi, edi
test rsi, rsi
mov r11, rsp
lea rcx, [rbp]
cmovg rdi, rsi
mov edx, 0x104
mov r8, r12
mov r9, rdi
mov qword [r11 + 0x20], r10
call fcn.1400025f4
mov edx, 0x104
lea rcx, [rbp]
call fcn.140003233
mov r11, rsp
lea rdx, [rsi - 5]
neg rdx
xor r10d, r10d
add rdx, rsi
lea rcx, [rbp + rsi - 5]
dec rdx
lea r8, [0x1404d7870]
cmovle rdx, r10
mov r9d, 4
mov qword [r11 + 0x20], 2
call fcn.140003ef4
test eax, eax
je 0x14012e027
xor edx, edx
dec rsi
mov r12, qword [rbp + 0x1d0]
cmovle rsi, rdx
mov al, 1
mov r14d, 0x208
mov qword [rbp + 0x198], rsi
mov r12, qword [r12]
mov qword [rbp + 0x1b0], rdi
lea rdx, [r15 + rsi + 0xa]
mov sil, al
mov qword [rbp + 0x1a0], rdx
test r12, r12
jne 0x14012e1d2
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rbx, [0x1404d7778]
lea rdi, [0x1404d7784]
mov qword [r10 + 0x20], rbx
mov qword [r10 + 0x28], rdi
call fcn.140002199
mov rbx, rsp
lea r8, [r12 + r14 - 0x208]
mov r9d, 0x104
lea rcx, [rbp]
mov qword [rbx + 0x20], 2
mov rdx, qword [rbp + 0x1b0]
call fcn.140003ef4
test eax, eax
je 0x14012e485
test r12, r12
jne 0x14012e23e
mov r10, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rbx, [0x1404d7790]
lea rdi, [0x1404d779c]
mov qword [r10 + 0x20], rbx
mov qword [r10 + 0x28], rdi
call fcn.140002199
mov rdi, rsp
lea rbx, [r12 + r14 - 0x104]
mov rcx, rbx
mov edx, 0x104
mov r9d, 1
lea r8, [rbp + 0x210]
mov byte [r8], 0
mov qword [rdi + 0x20], 2
call fcn.140003ef4
mov rdi, rax
test r12, r12
jne 0x14012e2ad
mov rdx, rsp
lea r10, [0x1404d77a8]
lea r11, [0x1404d77b4]
mov ecx, 0x10100009
mov r8d, 3
mov r9d, 9
mov qword [rdx + 0x20], r10
mov qword [rdx + 0x28], r11
lea rdx, [0x1404d76e0]
call fcn.140002199
mov r10, rsp
mov rcx, rbx
mov edx, 0x104
lea r8, [0x1404d7878]
mov r9d, 0xb
mov dword [r10 + 0x20], 0
call fcn.140006019
test edi, edi
je 0x14012e47b
test r12, r12
jne 0x14012e315
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rdi, [0x1404d77c0]
lea r10, [0x1404d77cc]
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x28], r10
call fcn.140002199
mov rdx, qword [rbp + 0x1d8]
mov rdi, qword [r13]
mov qword [rbp + 0x138], rdx
mov qword [rbp + 0x140], r15
test rdi, rdi
jne 0x14012e36b
mov r12, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea r10, [0x1404d77d8]
lea r11, [0x1404d77e0]
mov qword [r12 + 0x20], r10
mov qword [r12 + 0x28], r11
call fcn.140002199
add rdi, 0x2c
lea rcx, [rbp + 0x138]
mov qword [rcx + 0x10], rdi
mov edx, 2
mov rdi, qword [rcx + 0x78]
mov r8, rbx
mov r9d, 0x104
mov qword [rcx + 0x18], rdi
call fcn.1400048cc
mov rdx, qword [rbp + 0x1d8]
mov rdi, rsp
mov rbx, qword [r13]
mov qword [rbp + 0x108], rdx
mov qword [rbp + 0x110], r15
test rbx, rbx
jne 0x14012e3ee
mov r12, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea r10, [0x1404d77e8]
lea r11, [0x1404d77f0]
mov qword [r12 + 0x20], r10
mov qword [r12 + 0x28], r11
call fcn.140002199
mov rdx, qword [rbp + 0x198]
add rbx, 0x2c
mov rax, qword [rbp + 0x1a0]
lea rcx, str._found_...
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x120], rdx
mov qword [rbp + 0x128], rcx
mov qword [rbp + 0x130], 0xa
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140001e38
sub rsp, rax
lea rax, [rsp + 0x30]
mov rbx, rax
lea rcx, [rbp + 0x108]
mov edx, 3
mov r8, rbx
mov r9, qword [rbp + 0x1a0]
call fcn.1400048cc
mov rcx, rbx
mov rdx, qword [rbp + 0x1a0]
call fcn.140004ad9
mov rax, rdi
mov rsp, rax
mov rdx, qword [rbp + 0x1d0]
mov r12, qword [rdx]
jmp 0x14012e485
cmp sil, 1
je 0x14012e679
inc sil
add r14, 0x208
cmp sil, 3
jle 0x14012e197
xor ebx, ebx
test r12, r12
jne 0x14012e4d6
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rdi, [0x1404d77f8]
lea r10, [0x1404d7804]
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x28], r10
call fcn.140002199
mov rdi, rsp
lea rsi, [r12 + 0x104]
mov rcx, rsi
mov edx, 0x104
mov r9d, 1
lea r8, [rbp + 0x1e0]
mov byte [r8], 0
mov qword [rdi + 0x20], 2
call fcn.140003ef4
mov r14, rax
test r12, r12
jne 0x14012e545
mov r11, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea rdi, [0x1404d7810]
lea r10, [0x1404d781c]
mov qword [r11 + 0x20], rdi
mov qword [r11 + 0x28], r10
call fcn.140002199
mov rdi, rsp
lea rcx, [r12 + 0x30c]
mov edx, 0x104
lea r8, [rbp + 0x1f0]
mov r9d, 1
mov byte [r8], 0
mov qword [rdi + 0x20], 2
call fcn.140003ef4
mov rdi, rax
test r12, r12
jne 0x14012e5b1
mov rdx, rsp
lea r10, [0x1404d7828]
lea r11, [0x1404d7834]
mov ecx, 0x10100009
mov r8d, 3
mov r9d, 9
mov qword [rdx + 0x20], r10
mov qword [rdx + 0x28], r11
lea rdx, [0x1404d76e0]
call fcn.140002199
mov r10, rsp
lea rcx, [r12 + 0x514]
mov edx, 0x104
lea r8, [rbp + 0x200]
mov r9d, 1
mov byte [r8], 0
mov qword [r10 + 0x20], 2
call fcn.140003ef4
mov qword [rbp + 0x1a8], rax
test r12, r12
jne 0x14012e623
mov r12, rsp
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
mov r8d, 3
mov r9d, 9
lea r10, str.SFARRAY
lea r11, str.PSFARRAY
mov qword [r12 + 0x20], r10
mov qword [r12 + 0x28], r11
call fcn.140002199
mov r10, rsp
mov rcx, rsi
mov edx, 0x104
lea r8, str.Accessories
mov r9d, 0xb
mov dword [r10 + 0x20], 0
call fcn.140006019
test r14d, r14d
jne 0x14012e027
test edi, edi
jne 0x14012e027
mov rdx, qword [rbp + 0x1a8]
test edx, edx
jne 0x14012e027
test eax, eax
jne 0x14012e0ba
mov r14, qword [r13]
jmp 0x14012e071
test eax, eax
je 0x14012e2da
jmp 0x14012e485
mov rcx, rsp
lea rax, [0x1404d7858]
lea rdx, str.POFN
mov r8d, 3
mov r9d, 9
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
mov ecx, 0x10100009
lea rdx, [0x1404d76e0]
call fcn.140002199
mov al, byte [pe_dos_header]
call fcn.14000236a
nop
xor ebx, ebx
jmp 0x14012e0aa