Function at 0x140005970
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x88
mov rax, qword [0x1401507e0]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor eax, eax
mov qword [r11 + 8], rbp
mov qword [r11 - 0x18], rsi
mov rsi, rdx
mov qword [rsp + 0x38], rdx
xor edx, edx
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x34], r8d
mov rbp, rcx
mov qword [rsp + 0x48], rdx
mov rbx, rdx
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x68], dl
mov qword [rsp + 0x58], 0xffffffffffffffff
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
test rcx, rcx
je 0x140005cb8
test rsi, rsi
je 0x140005cb8
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
je 0x140005cb8
mov ebx, r8d
test ebx, ebx
je 0x140005a29
cmp ebx, 0x400
jbe 0x140005a17
and ebx, 0x3ff
mov dword [rsp + 0x34], ebx
call fcn.140013e44
xor edx, edx
div ebx
lea eax, [rdx + 1]
mov dword [rsp + 0x30], eax
jmp 0x140005a34
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x30], eax
mov ecx, 0x104
mov byte [rsi], 0
call fcn.140003f58
mov rbx, rax
test rax, rax
je 0x140005cd0
xor edx, edx
mov r8d, 0x104
mov rcx, rax
call fcn.140013580
mov rcx, rbx
mov rdx, rbp
sub rcx, rbp
mov qword [rsp + 0x60], rcx
nop dword [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x140005a70
cmp byte [rdi + rbx - 1], 0x5c
je 0x140005a9b
xor eax, eax
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14002267c]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
mov byte [rsp + 0x68], 0x2a
mov byte [rsp + 0x69], 0x2e
xor ecx, ecx
mov byte [rsp + 0x6a], 0x2a
mov byte [rsp + 0x6b], 0
lea rdx, [rsp + 0x68]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140005ac1
mov ecx, 0x140
call fcn.140013ee8
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140005cc3
xor edx, edx
mov r8d, 0x140
mov rcx, rax
call fcn.140013580
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov byte [rbx], 0
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x140005b30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
xor edi, edi
jmp 0x140005cdb
test byte [rdi], 0x10
je 0x140005c40
lea rsi, [rdi + 0x2c]
mov rcx, rsi
call fcn.140005750
test eax, eax
jne 0x140005c6e
cmp dword [rsp + 0xc8], eax
je 0x140005b66
mov rcx, rsi
call fcn.140005660
test eax, eax
jne 0x140005c75
mov rdx, qword [rsp + 0x60]
mov rcx, rbp
nop
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140005b70
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rbx - 2], 0x5c
je 0x140005ba7
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14002267c]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rsi + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x140005bc0
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x140005bef
mov rcx, rbx
call fcn.140005580
test eax, eax
jne 0x140005c94
mov byte [rbx], al
mov eax, dword [rsp + 0x30]
jmp 0x140005bf5
dec eax
mov dword [rsp + 0x30], eax
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x140005c88
cmp byte [rbx], 0
je 0x140005c7c
mov rsi, qword [rsp + 0x38]
lea r9d, [rcx - 1]
mov ecx, dword [rsp + 0xc8]
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], eax
call fcn.140005970
mov edx, eax
mov qword [rsp + 0x48], rdx
test eax, eax
jne 0x140005d85
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140005b30
mov rdi, qword [rsp + 0x48]
test edi, edi
jne 0x140005d98
mov eax, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
jmp 0x140005cdb
mov rsi, qword [rsp + 0x38]
jmp 0x140005c40
mov rsi, qword [rsp + 0x38]
jmp 0x140005c40
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
jmp 0x140005c40
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
jmp 0x140005c40
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
sub rdx, rbx
nop
movzx eax, byte [rcx]
inc rcx
mov byte [rdx + rcx - 1], al
test al, al
jne 0x140005ca0
mov edi, 1
jmp 0x140005d98
mov eax, dword [rsp + 0xc0]
xor edi, edi
jmp 0x140005cdb
mov eax, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
xor edi, edi
jmp 0x140005cdb
mov eax, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
xor edi, edi
test r8d, r8d
jne 0x140005ce8
test eax, eax
jne 0x140005d98
test rbp, rbp
je 0x140005d98
test rsi, rsi
je 0x140005d98
test rbx, rbx
je 0x140005d98
cmp byte [rbx], 0
jne 0x140005d53
mov rcx, rbx
sub rcx, rbp
nop
movzx eax, byte [rbp]
inc rbp
mov byte [rcx + rbp - 1], al
test al, al
jne 0x140005d10
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
je 0x140005d4e
cmp byte [rcx + rbx - 1], 0x5c
jne 0x140005d4e
mov rdi, rbx
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14002267c]
mov word [rdi - 1], ax
cmp byte [rbx], 0
je 0x140005d8c
mov rcx, rbx
call fcn.140005580
test eax, eax
je 0x140005d93
mov rcx, rbx
sub rsi, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rsi + rcx - 1], al
test al, al
jne 0x140005d70
mov edi, 1
jmp 0x140005d98
mov rdi, qword [rsp + 0x48]
jmp 0x140005d98
mov rdi, qword [rsp + 0x48]
jmp 0x140005d98
mov rdi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xa0]
cmp rax, 0xffffffffffffffff
je 0x140005dbc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140005dce
mov rcx, rax
call fcn.140013e70
test rbx, rbx
je 0x140005ddb
mov rcx, rbx
call fcn.140013e24
mov eax, edi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140013680
add rsp, 0x88
pop rdi
pop rbx
ret