Function at 0x140156a40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x388]
sub rsp, 0x488
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov r13, r9
mov rsi, r8
mov qword [rsp + 0x30], r8
mov r12, rdx
mov qword [rsp + 0x40], rcx
xor r14d, r14d
cmp qword [r9 + 0x30], r14
jne 0x140156b69
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xe8], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0xe8], xmm1
mov word [rbp + 0xd8], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], r14w
jne 0x140156ac0
lea rcx, [rbp + 0xd8]
call fcn.140006d60
nop
lea rcx, [r13 + 0x58]
lea rax, [rbp + 0xd8]
cmp rcx, rax
je 0x140156b0b
lea rdx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae rdx, qword [rbp + 0xd8]
mov r8, qword [rbp + 0xe8]
call fcn.140006d60
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 8
jb 0x140156b51
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140156b4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576be
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp + 0xe8], xmm0
mov word [rbp + 0xd8], r14w
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], r14
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x140156b90
mov rdx, r12
lea rcx, [rbp + 0x10]
call fcn.140006d60
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140156bd8
mov r8d, 1
lea rdx, [0x1401e42c8]
lea rcx, [rbp + 0x10]
call fcn.140006a90
mov r8d, 3
lea rdx, [0x1401e42d0]
lea rcx, [rbp + 0x10]
call fcn.140006a90
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
lea rdx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14015706b
mov ecx, dword [rbp + 0x120]
test cl, 0x10
je 0x140156fab
movzx edi, byte [rbp + 0x3f8]
test dil, dil
jne 0x140156c3c
test cl, 2
jne 0x140157072
movzx ebx, byte [rbp + 0x3f0]
test bl, bl
je 0x140157079
lea rdx, [0x1401e3cd0]
lea rcx, [rbp + 0x14c]
call fcn.140027970
test eax, eax
je 0x140157079
lea rdx, [0x1401e42d8]
lea rcx, [rbp + 0x14c]
call fcn.140027970
test eax, eax
je 0x140157079
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [r12 + r8*2], 0
jne 0x140156ca1
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.140006d60
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140156ce9
mov r8d, 1
lea rdx, [0x1401e42c8]
lea rcx, [rbp - 0x30]
call fcn.140006a90
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140156d00
lea rdx, [rbp + 0x14c]
lea rcx, [rbp - 0x30]
call fcn.140006a90
mov r8d, 1
lea rdx, [0x1401e42c8]
lea rcx, [rbp - 0x30]
call fcn.140006a90
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], r14w
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140156d60
lea rdx, [rbp + 0x14c]
lea rcx, [rbp - 0x10]
call fcn.140006d60
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x78], r14
mov qword [rbp + 0x80], r14
lea r14, [rbp - 0x10]
mov rdi, qword [rbp - 0x10]
mov r15, qword [rbp + 8]
cmp r15, 8
cmovae r14, rdi
mov rsi, qword [rbp]
cmp rsi, 8
jae 0x140156dd3
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x80], 7
jmp 0x140156e1d
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x68]
call fcn.140006990
mov qword [rbp + 0x68], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14019dbf0
mov qword [rbp + 0x80], rbx
movzx ebx, byte [rbp + 0x3f0]
mov qword [rbp + 0x78], rsi
xor r14d, r14d
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r14w
cmp r15, 8
jb 0x140156e87
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140156e7f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576c4
mov rcx, rdi
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
movzx edi, byte [rbp + 0x3f8]
mov byte [rsp + 0x28], dil
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0x30]
mov rsi, qword [rsp + 0x30]
mov r8, rsi
mov rcx, qword [rsp + 0x40]
call fcn.140156a40
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140154cb0
nop
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140154c00
nop
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.140002f40
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x50]
call fcn.140002f40
nop
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.1401560d0
nop
lea rcx, [rbp + 0x88]
call fcn.1400068c0
nop
lea rcx, [rbp + 0x68]
call fcn.1400068c0
nop
lea rcx, [rbp + 0x48]
call fcn.1400a22a0
nop
lea rcx, [rbp + 0x30]
call fcn.1401552b0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140156f95
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140156f90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576ca
call fcn.14017f5e4
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
jmp 0x140157079
mov rdx, rsi
lea rcx, [rbp + 0x14c]
call fcn.14002a510
test al, al
je 0x14015706b
xorps xmm0, xmm0
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm1
mov word [rbp - 0x10], r14w
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140156ff0
lea rdx, [rbp + 0x14c]
lea rcx, [rbp - 0x10]
call fcn.140006d60
nop
lea rdx, [rbp - 0x10]
mov rcx, r13
call fcn.140155360
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140157059
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140157054
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576d0
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r14w
movzx edi, byte [rbp + 0x3f8]
movzx ebx, byte [rbp + 0x3f0]
lea rdx, [rbp + 0x120]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14015763c
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp + 0x120]
test al, 0x10
je 0x140157452
test dil, dil
jne 0x1401570bb
test al, 2
jne 0x14015761a
test bl, bl
je 0x14015761a
lea rdx, [0x1401e3cd0]
lea rcx, [rbp + 0x14c]
call fcn.140027970
test eax, eax
je 0x14015761a
lea rdx, [0x1401e42d8]
lea rcx, [rbp + 0x14c]
call fcn.140027970
test eax, eax
je 0x14015761a
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x140157120
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.140006d60
nop
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x20]
cmp word [rcx + rax*2 - 2], 0x5c
je 0x140157168
mov r8d, 1
lea rdx, [0x1401e42c8]
lea rcx, [rbp - 0x30]
call fcn.140006a90
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140157180
lea rdx, [rbp + 0x14c]
lea rcx, [rbp - 0x30]
call fcn.140006a90
mov r8d, 1
lea rdx, [0x1401e42c8]
lea rcx, [rbp - 0x30]
call fcn.140006a90
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], r14w
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1401571f0
lea rdx, [rbp + 0x14c]
lea rcx, [rbp + 0xf8]
call fcn.140006d60
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], r14
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x78], r14
mov qword [rbp + 0x80], r14
lea r14, [rbp + 0xf8]
mov rdi, qword [rbp + 0xf8]
mov r15, qword [rbp + 0x110]
cmp r15, 8
cmovae r14, rdi
mov rsi, qword [rbp + 0x108]
cmp rsi, 8
jae 0x140157272
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x80], 7
jmp 0x1401572bc
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0x68]
call fcn.140006990
mov qword [rbp + 0x68], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14019dbf0
mov qword [rbp + 0x80], rbx
movzx ebx, byte [rbp + 0x3f0]
mov qword [rbp + 0x78], rsi
xor r14d, r14d
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0x98], r14
mov qword [rbp + 0xa0], 7
mov word [rbp + 0x88], r14w
cmp r15, 8
jb 0x140157326
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14015731e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576d6
mov rcx, rdi
call fcn.14017f5e4
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], r14w
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
movzx edi, byte [rbp + 0x3f8]
mov byte [rsp + 0x28], dil
mov byte [rsp + 0x20], bl
lea r9, [rbp + 0x30]
mov rsi, qword [rsp + 0x30]
mov r8, rsi
mov rcx, qword [rsp + 0x40]
call fcn.140156a40
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140154cb0
nop
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.140154c00
nop
mov rax, qword [rbp + 0x60]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x70]
call fcn.140002f40
nop
lea rdx, [rbp + 0x88]
lea rcx, [rbp - 0x50]
call fcn.140002f40
nop
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.1401560d0
nop
lea rcx, [rbp + 0x88]
call fcn.1400068c0
nop
lea rcx, [rbp + 0x68]
call fcn.1400068c0
nop
lea rcx, [rbp + 0x48]
call fcn.1400a22a0
nop
lea rcx, [rbp + 0x30]
call fcn.1401552b0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14015743c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140157437
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576dc
call fcn.14017f5e4
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
jmp 0x14015761a
mov rdx, rsi
lea rcx, [rbp + 0x14c]
call fcn.14002a510
test al, al
je 0x14015761a
mov qword [rbp], r14
mov qword [rbp + 8], r14
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
lea rax, [rbp + 0x14c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140157490
lea rdx, [rbp + 0x14c]
lea rcx, [rbp - 0x10]
call fcn.140006d60
nop
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xc8], r14
mov qword [rbp + 0xd0], r14
lea r14, [rbp - 0x10]
mov rdi, qword [rbp - 0x10]
mov r15, qword [rbp + 8]
cmp r15, 8
cmovae r14, rdi
mov rsi, qword [rbp]
cmp rsi, 8
jae 0x1401574f7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xd0], 7
jmp 0x140157540
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp + 0xb8]
call fcn.140006990
mov qword [rbp + 0xb8], rax
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14019dbf0
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xc8], rsi
lea rcx, [r13 + 0x18]
mov rdx, qword [rcx + 8]
cmp qword [rcx + 0x10], rdx
je 0x1401575a6
mov qword [rsp + 0x48], rdx
mov rax, qword [rbp + 0xb0]
mov qword [rdx], rax
xor r14d, r14d
mov qword [rdx + 0x18], r14
mov qword [rdx + 0x20], r14
movups xmm0, xmmword [rbp + 0xb8]
movups xmmword [rdx + 8], xmm0
movups xmm1, xmmword [rbp + 0xc8]
movups xmmword [rdx + 0x18], xmm1
mov qword [rbp + 0xc8], r14
mov qword [rbp + 0xd0], 7
mov word [rbp + 0xb8], r14w
add qword [rcx + 8], 0x28
jmp 0x1401575b5
lea r8, [rbp + 0xb0]
call fcn.1401546e0
xor r14d, r14d
lea rcx, [rbp + 0xb8]
call fcn.1400068c0
nop
cmp r15, 8
jb 0x1401575fd
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1401575f5
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576e2
mov rcx, rdi
call fcn.14017f5e4
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
movzx edi, byte [rbp + 0x3f8]
mov rsi, qword [rsp + 0x30]
lea rdx, [rbp + 0x120]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14015763c
movzx ebx, byte [rbp + 0x3f0]
jmp 0x1401570a0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140157684
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14015767f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401576b8
call fcn.14017f5e4
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x488
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a10ac
int3
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
int3
call fcn.1401a10ac
nop
call fcn.1401a10ac
nop
call fcn.1401a10ac
int3
call fcn.1401a10ac
int3