Function at 0x140030a00
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x88], 0
je 0x140030bbb
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
xor eax, eax
test eax, eax
jne 0x140030a1d
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x288]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x30], 0xffffffffffffffff
inc qword [rsp + 0x30]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x30]
cmp word [rcx + rdx*2], 0
jne 0x140030a63
mov rcx, qword [rsp + 0x30]
lea rax, [rax + rcx + 2]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140036c10
mov qword [rsp + 0x48], 0
mov rax, qword [rsp + 0x80]
add rax, 0x280
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140036a80
mov dx, 0x5c
lea rcx, [rsp + 0x40]
call fcn.1400362a0
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x40]
call fcn.140036dc0
mov rax, qword [rsp + 0x80]
add rax, 0x18
mov rdx, rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x10], rax
lea rcx, [rsp + 0x40]
call fcn.140036e40
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x10], 0xffffffffffffffff
jne 0x140030b92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140041ed0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rcx, qword [rsp + 0x80]
mov eax, dword [rax]
mov dword [rcx + 0x278], eax
mov rcx, qword [rsp + 0x80]
call fcn.140034cf0
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x80]
call fcn.140034d50
cmp dword [rsp + 0x28], 0
je 0x140030b65
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x2c], eax
jmp 0x140030b6d
mov dword [rsp + 0x2c], 0xffffffff
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x2c]
mov dword [rax + 0x274], ecx
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x274]
jmp 0x140030d55
mov rax, qword [rsp + 0x80]
add rax, 0x18
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x268], rax
mov qword [rsp + 0x88], 0
jmp 0x140030c1c
mov rax, qword [rsp + 0x80]
add rax, 0x18
mov rdx, rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140030c1c
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x80]
mov qword [rax + 0x10], 0xffffffffffffffff
mov rax, qword [rsp + 0x80]
mov qword [rax + 0x268], 0
xor eax, eax
jmp 0x140030d55
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x268]
add rax, 0x2c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x38]
cmp word [rax + rcx*2], 0
jne 0x140030c47
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x270]
and eax, 0xffffffdf
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x270], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x270]
and eax, 0xffffffef
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x270], eax
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax]
cmp eax, 0x2e
jne 0x140030cd7
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x140030cd7
jmp 0x140030a0e
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax]
cmp eax, 0x2e
jne 0x140030d20
mov eax, 2
imul rax, rax, 1
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax]
cmp eax, 0x2e
jne 0x140030d20
mov eax, 2
imul rax, rax, 2
mov rcx, qword [rsp + 0x20]
movzx eax, word [rcx + rax]
test eax, eax
jne 0x140030d20
jmp 0x140030a0e
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call fcn.140034a40
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x274], 1
mov eax, 1
jmp 0x140030d55
add rsp, 0x78
ret