Function at 0x140018c80
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xb58
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x14012e6d8]
xor rax, rsp
mov qword [rsp + 0xb40], rax
mov qword [rsp + 0x70], r9
mov rax, r8
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], r9
mov rax, qword [rsp + 0xba0]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 0
call fcn.140055b68
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140018d08
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbx, [0x1400e9c18]
mov rsi, rbx
or rbp, 0xffffffffffffffff
shr rsi, 0x10
jne 0x140018d4c
movzx edi, bx
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x140018d6c
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140006090
jmp 0x140018d6c
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400062e0
nop
call fcn.140055b68
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140018d8b
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rsi, rsi
jne 0x140018dc0
movzx edi, bx
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x140018de0
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140006090
jmp 0x140018de0
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400062e0
nop
call fcn.140055b68
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140018dff
mov ecx, 0x80004005
call fcn.140001610
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
cmp qword [rsp + 0x60], 0
jne 0x140018f39
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x140018e48
cmp rax, qword [rdi - 0x18]
jne 0x140018e48
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rbx, qword [rsp + 0x38]
jmp 0x140018e86
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x140018e64
call fcn.140003380
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.14009b270
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x78]
mov qword [rsi], rax
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018eae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018ecf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rdi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018eec
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r8, qword [rsp + 0x48]
mov rdx, qword [r8]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018f10
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140018f31
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
jmp 0x1400196d7
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0xd0]
call fcn.14009c4e0
mov r8, qword [rsp + 0x48]
mov r8, qword [r8]
lea rdx, str._s.
lea rcx, [rsp + 0x730]
call fcn.1400034e0
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x730]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
je 0x1400195bd
nop
nop
nop
nop
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0xfc]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140019015
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1400190a3
cmp dword [rdx + 0x10], eax
jge 0x140018fe7
cmp dword [rbx - 0xc], eax
jl 0x14001948a
mov dword [rbx - 0x10], eax
mov word [rbx], ax
jmp 0x1400190a3
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140018ffe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
jmp 0x1400190a3
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xfc]
sub rbp, rbx
sar rbp, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140019048
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.140004670
mov rbx, qword [rsp + 0x38]
cmp rbp, rsi
ja 0x140019068
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.14009b340
jmp 0x140019085
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xfc]
mov rdx, rsi
mov rcx, rbx
call fcn.14009b270
test edi, edi
js 0x1400195b2
cmp edi, dword [rbx - 0xc]
jg 0x1400195b2
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
or rbp, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1400e9d14]
mov rsi, rbx
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1400190be
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x140019467
xor eax, eax
lea rdi, [0x1400eb87c]
mov rsi, rbx
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1400190e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x140019467
mov r9, rbx
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
lea rdx, [0x1400eb388]
lea rcx, [rsp + 0x320]
call fcn.1400034e0
lea rdx, [rsp + 0x50]
mov qword [rsp + 0xb0], rdx
call fcn.140055b68
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140019597
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x320]
lea rsi, [rsp + 0x320]
shr rsi, 0x10
mov qword [rsp + 0xa0], rsi
jne 0x140019185
movzx edi, ax
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x1400191af
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140006090
jmp 0x1400191af
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x320]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x50]
call fcn.1400062e0
nop
lea rcx, [rsp + 0x50]
call fcn.140005880
test eax, eax
je 0x14001939e
lea rax, [rsp + 0x88]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x70]
mov rdi, qword [rax]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14001920a
cmp rax, qword [rdi - 0x18]
jne 0x14001920a
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x140019246
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x14001951c
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14009b270
lea rax, [rsi + 0x18]
mov qword [rsp + 0x88], rax
call fcn.140055b68
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x140019511
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x320]
cmp qword [rsp + 0xa0], 0
jne 0x1400192ad
movzx edi, ax
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x1400192d7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140006090
jmp 0x1400192d7
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x320]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x68]
call fcn.1400062e0
nop
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.140018c80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x40]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140019368
cmp dword [rdi + 0x10], 0
jl 0x140019359
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x140019359
call fcn.1400046d0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140019349
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0x60]
jmp 0x140019368
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400062e0
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001938b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rsi], 0
jne 0x140019495
mov rbx, qword [rsp + 0x38]
jmp 0x140019467
mov rax, qword [rsp + 0x70]
mov r9, qword [rax]
mov rax, qword [rsp + 0x48]
mov r8, qword [rax]
lea rdx, [0x1400eb388]
lea rcx, [rsp + 0x320]
call fcn.1400034e0
lea rdx, [rsp + 0x58]
mov qword [rsp + 0xa8], rdx
call fcn.140055b68
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
je 0x14001958c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x320]
test rsi, rsi
jne 0x140019424
movzx edi, ax
mov ecx, edi
call fcn.140055990
test rax, rax
je 0x14001944e
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.140006090
jmp 0x14001944e
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x320]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x320]
lea rcx, [rsp + 0x58]
call fcn.1400062e0
nop
lea rcx, [rsp + 0x58]
call fcn.140005980
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
test eax, eax
jne 0x140019522
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400195a2
jmp 0x140018fa0
mov ecx, 0x80070057
call fcn.140001610
int3
mov rdx, qword [rsp + 0x40]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x30]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x140019507
cmp dword [rdi + 0x10], 0
jl 0x1400194ef
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x1400194ef
call fcn.1400046d0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x1400194dc
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x38]
jmp 0x1400195a2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400062e0
mov rbx, qword [rsp + 0x38]
jmp 0x1400195a2
mov rbx, qword [rsp + 0x38]
jmp 0x1400195a2
mov ecx, 0x80004005
call fcn.140001610
nop
call fcn.140003380
int3
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x30]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x1400195a2
cmp dword [rdi + 0x10], 0
jl 0x14001957c
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14001957c
call fcn.1400046d0
mov rsi, rax
mov ecx, ebp
lock xadd dword [rdi + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x14001956c
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x38]
jmp 0x1400195a2
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400062e0
jmp 0x1400195a2
mov ecx, 0x80004005
call fcn.140001610
int3
mov ecx, 0x80004005
call fcn.140001610
int3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400195bd
mov ecx, 0x80070057
call fcn.140001610
int3
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400195eb
cmp rax, qword [rdi - 0x18]
jne 0x1400195eb
lea rsi, [rdi - 0x18]
lock add dword [rdi - 8], 1
mov rbx, qword [rsp + 0x38]
jmp 0x140019629
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rsi, rax
test rax, rax
jne 0x140019607
call fcn.140003380
int3
mov eax, dword [rdi - 0x10]
mov dword [rsi + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rdi
add rdx, rdx
lea rcx, [rsi + 0x18]
call fcn.14009b270
lea rax, [rsi + 0x18]
mov rsi, qword [rsp + 0x78]
mov qword [rsi], rax
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019651
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140019672
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, ebp
lock xadd dword [rdi - 8], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001968f
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x48]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400196b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x1400196d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rcx, qword [rsp + 0xb40]
xor rcx, rsp
call fcn.14009af10
add rsp, 0xb58
pop rdi
pop rsi
pop rbp
pop rbx
ret