Function at 0x140018ec0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xb58
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x140134780]
xor rax, rsp
mov qword [rsp + 0xb40], rax
mov qword [rsp + 0x70], r9
mov rax, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], r9
mov rax, qword [rsp + 0xba0]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 0
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140018f48
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbx, [0x1400ee798]
mov rsi, rbx
or rbp, 0xffffffffffffffff
shr rsi, 0x10
jne 0x140018f8c
movzx edi, bx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140018fac
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400060c0
jmp 0x140018fac
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006310
nop
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140018fcb
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rsi, rsi
jne 0x140019000
movzx edi, bx
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140019020
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400060c0
jmp 0x140019020
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140006310
nop
call fcn.14003c3f0
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x14001903f
mov ecx, 0x80004005
call fcn.140001120
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
cmp qword [rsp + 0x60], 0
jne 0x140019179
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140019088
cmp rax, qword [rdi - 0x18]
jne 0x140019088
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rbx, qword [rsp + 0x38]
jmp 0x1400190c6
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x1400190a4
call fcn.140002f80
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.14009f640
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x78]
mov qword [rsi], rax
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400190ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001910f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rdi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001912c
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r8, qword [rsp + 0x48]
mov rdx, qword [r8]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019150
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140019171
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
jmp 0x140019917
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0xd0]
call fcn.1400a09f0
mov r8, qword [rsp + 0x48]
mov r8, qword [r8]
lea rdx, str._s.
lea rcx, [rsp + 0x730]
call fcn.1400030e0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x730]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1400197fd
nop
nop
nop
nop
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0xfc]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140019255
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400192e3
cmp dword [rdx + 0x10], eax
jge 0x140019227
cmp dword [rbx - 0xc], eax
jl 0x1400196ca
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x1400192e3
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001923e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x1400192e3
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xfc]
sub rbp, rbx
sar rbp, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140019288
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004410
mov rbx, qword [rsp + 0x38]
cmp rbp, rsi
ja 0x1400192a8
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009f850
jmp 0x1400192c5
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xfc]
mov rdx, rsi
mov rcx, rbx
call fcn.14009f640
test edi, edi
js 0x1400197f2
cmp edi, dword [rbx - 0xc]
jg 0x1400197f2
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
or rbp, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400ee8ac]
mov rsi, rbx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1400192fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x1400196a7
xor eax, eax
lea rdi, [0x1400f023c]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140019326
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x1400196a7
mov r9, rbx
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
lea rdx, [0x1400efcb0]
lea rcx, [rsp + 0x320]
call fcn.1400030e0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xb0], rdx
call fcn.14003c3f0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1400197d7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x320]
lea rsi, [rsp + 0x320]
shr rsi, 0x10
mov qword [rsp + 0xa0], rsi
jne 0x1400193c5
movzx edi, ax
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x1400193ef
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400060c0
jmp 0x1400193ef
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x320]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x50]
call fcn.140006310
nop
lea rcx, [rsp + 0x50]
call fcn.1400058b0
test eax, eax
je 0x1400195de
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x70]
mov rdi, qword [rax]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14001944a
cmp rax, qword [rdi - 0x18]
jne 0x14001944a
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x140019486
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14001975c
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009f640
lea rax, [rsi + 0x18]
mov qword [rsp + 0x88], rax
call fcn.14003c3f0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140019751
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x320]
cmp qword [rsp + 0xa0], 0
jne 0x1400194ed
movzx edi, ax
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x140019517
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400060c0
jmp 0x140019517
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x320]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x68]
call fcn.140006310
nop
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.140018ec0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x40]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400195a8
cmp dword [rdi + 0x10], 0
jl 0x140019599
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140019599
call fcn.140004470
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140019589
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0x60]
jmp 0x1400195a8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.140006310
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400195cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rsi], 0
jne 0x1400196d5
mov rbx, qword [rsp + 0x38]
jmp 0x1400196a7
mov rax, qword [rsp + 0x70]
mov r9, qword [rax]
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
lea rdx, [0x1400efcb0]
lea rcx, [rsp + 0x320]
call fcn.1400030e0
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xa8], rdx
call fcn.14003c3f0
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x1400197cc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x320]
test rsi, rsi
jne 0x140019664
movzx edi, ax
mov ecx, edi
call fcn.14003c170
test rax, rax
je 0x14001968e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400060c0
jmp 0x14001968e
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x320]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x58]
call fcn.140006310
nop
lea rcx, [rsp + 0x58]
call fcn.1400059b0
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
test eax, eax
jne 0x140019762
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400197e2
jmp 0x1400191e0
mov ecx, 0x80070057
call fcn.140001120
int3
mov rdx, qword [rsp + 0x40]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x30]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140019747
cmp dword [rdi + 0x10], 0
jl 0x14001972f
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001972f
call fcn.140004470
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001971c
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x38]
jmp 0x1400197e2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.140006310
mov rbx, qword [rsp + 0x38]
jmp 0x1400197e2
mov rbx, qword [rsp + 0x38]
jmp 0x1400197e2
mov ecx, 0x80004005
call fcn.140001120
nop
call fcn.140002f80
int3
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x30]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400197e2
cmp dword [rdi + 0x10], 0
jl 0x1400197bc
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400197bc
call fcn.140004470
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x1400197ac
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x38]
jmp 0x1400197e2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.140006310
jmp 0x1400197e2
mov ecx, 0x80004005
call fcn.140001120
int3
mov ecx, 0x80004005
call fcn.140001120
int3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400197fd
mov ecx, 0x80070057
call fcn.140001120
int3
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14001982b
cmp rax, qword [rdi - 0x18]
jne 0x14001982b
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rbx, qword [rsp + 0x38]
jmp 0x140019869
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x140019847
call fcn.140002f80
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.14009f640
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x78]
mov qword [rsi], rax
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019891
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400198b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rdi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400198cf
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400198f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140019914
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rcx, qword [rsp + 0xb40]
xor rcx, rsp
call fcn.1400a1970
add rsp, 0xb58
pop rdi
pop rsi
pop rbp
pop rbx
ret