Function at 0x14008c690
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xff0]
mov eax, 0x10f0
call fcn.140247340
sub rsp, rax
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x1120], rbx
mov qword [rsp + 0x1130], rsi
mov r15, r8
mov rdi, rdx
mov r13, rcx
cmp byte [rdx], 0
je 0x14008caad
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x3c0]
call fcn.140249b10
mov rbx, rdi
lea rdx, str.REGEXPSTART
mov rcx, rdi
call fcn.140248db4
cmp rax, rdi
jne 0x14008c715
lea rdx, str.REGEXPEND
mov rcx, rdi
call fcn.140248db4
mov rbx, rax
lea rdx, [0x140287e84]
mov rcx, rbx
call fcn.140248db4
mov rsi, rax
xor ebx, ebx
mov r14d, ebx
test rax, rax
je 0x14008c737
mov byte [rax], bl
lea r14d, [rbx + 1]
mov rdx, rdi
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
test r14d, r14d
je 0x14008c74f
mov byte [rsi], 0x5c
lea rcx, [rbp + 0x3c0]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x14008c760
add rdi, rax
lea r14, [rdi + 1]
cmp byte [rdi], bl
cmove r14, rdi
lea rdx, str.REGEXPSTART
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
lea rcx, [rbp + 0x3c0]
cmp rax, rcx
jne 0x14008ca4e
lea rdx, str.REGEXPEND
lea rcx, [rbp + 0x3c0]
call fcn.140248db4
test rax, rax
je 0x14008c7b3
mov byte [rax], bl
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov dword [rbp - 0x70], ebx
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x60], 1
mov dword [rsp + 0x70], ebx
mov r8d, 1
lea rdx, [rbp + 0x3cd]
lea rcx, [rsp + 0x70]
call fcn.140019d70
test eax, eax
jne 0x14008ca36
xor edx, edx
mov r8d, 0x140
lea rcx, [rbp - 0x50]
call fcn.140249b10
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x7d0]
call fcn.140249b10
mov rdx, r15
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, [0x14028a3f8]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x7d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14008ca36
nop word [rax + rax]
mov ecx, dword [rbp - 0x50]
and ecx, 0x410
cmp ecx, 0x410
je 0x14008ca17
lea rcx, [rbp + 0xe0]
call fcn.140250f2c
lea rcx, [rbp - 0x24]
call fcn.140250f2c
test byte [rbp - 0x50], 0x10
je 0x14008ca17
lea rcx, [rbp - 0x24]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x14008c8b0
movzx ecx, byte [rbp - 0x24]
cmp rax, 1
jne 0x14008c8cc
cmp cl, 0x2e
je 0x14008ca17
cmp rax, 2
jne 0x14008c8e0
cmp cl, 0x2e
jne 0x14008c8e0
cmp byte [rbp - 0x23], cl
je 0x14008ca17
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x68], rbx
mov edx, 0x100
lea rcx, [rsp + 0x48]
call fcn.1400174b0
test al, al
je 0x14008c93d
mov edx, 0x100
mov rcx, qword [rsp + 0x50]
sub rdx, rcx
mov rax, qword [rsp + 0x48]
lea rcx, [rax + rcx*8]
call fcn.14000f1b0
mov qword [rsp + 0x50], 0x100
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0xe0]
call fcn.140250f2c
lea rcx, [rbp - 0x24]
call fcn.140250f2c
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x70]
call fcn.140017f50
test eax, eax
je 0x14008c97c
lea rdi, [rbp - 0x24]
jmp 0x14008c9a0
xor r9d, r9d
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x70]
call fcn.140017f50
test eax, eax
je 0x14008c9f4
lea rdi, [rbp + 0xe0]
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xbe0]
call fcn.140249b10
mov rdx, r15
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov rdx, rdi
lea rcx, [rbp + 0xbe0]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea r8, [rbp + 0xbe0]
mov rdx, r14
mov rcx, r13
call fcn.14008c690
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14008ca03
call fcn.14024c3e8
mov rcx, qword [rsp + 0x40]
call fcn.140247060
mov rcx, qword [rsp + 0x38]
call fcn.140247060
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14008c870
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14008cb32
call fcn.14024c3e8
jmp 0x14008cb32
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x50]
call fcn.140249b10
mov rdx, r15
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rcx, [rbp - 0x50]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x14008cb32
lea r8, [rbp - 0x50]
mov rdx, r14
mov rcx, r13
call fcn.14008c690
jmp 0x14008cb32
mov ecx, 0x28
call fcn.14018ef40
mov rbx, rax
mov qword [rbp + 0x1028], rax
test rax, rax
je 0x14008cae5
lea rax, vtable.CSABEnumFileObjectsFromEnvironmentExpandedRegExp::CFileObject.0
mov qword [rbx], rax
mov dword [rbx + 8], 1
lea rcx, [rbx + 0x10]
mov rdx, r15
call fcn.140006f70
jmp 0x14008cae7
xor ebx, ebx
mov qword [rbp + 0x1028], rbx
mov rdi, qword [r13 + 8]
mov rsi, qword [rdi + 8]
lea r9, [rbp + 0x1028]
mov r8, rsi
mov rdx, rdi
lea rcx, [r13 + 8]
call fcn.140009370
mov rdx, qword [r13 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rdx
cmp rcx, 1
jb 0x14008cb53
lea rcx, [rdx + 1]
mov qword [r13 + 0x10], rcx
mov qword [rdi + 8], rax
mov qword [rsi], rax
mov eax, 1
lea r11, [rsp + 0x10f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3