Function at 0x140001030
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x728
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x710], rax
mov rbx, qword [rsp + 0x770]
mov rax, qword [rsp + 0x780]
xor ebp, ebp
test rbx, rbx
mov qword [rsp + 0x88], rcx
mov rcx, qword [rsp + 0x778]
mov dword [rsp + 0x68], r9d
mov dword [rsp + 0x60], r8d
mov rdi, rdx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rax
mov esi, ebp
je 0x140001378
test rcx, rcx
mov qword [rbx], rbp
je 0x1400010ac
mov dword [rcx], ebp
test rax, rax
je 0x1400010b3
mov dword [rax], ebp
test r9d, r9d
je 0x140001110
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 4
jae 0x14000110d
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], rbp
call qword [sym.imp.SHELL32.dll_SHGetDiskFreeSpaceExW]
mov edx, eax
mov rax, qword [rsp + 0x68]
sub rax, qword [rsp + 0x60]
mov qword [rbx], rax
mov eax, edx
jmp 0x14000137a
mov rdi, rdx
lea rcx, [rsp + 0xa4]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0xa0], ebp
call fcn.140041940
lea rcx, [rsp + 0x2f2]
xor edx, edx
mov r8d, 0x410
mov word [rsp + 0x2f0], si
call fcn.140041940
lea rcx, [rsp + 0x2f0]
mov r8d, 0x208
mov rdx, rdi
mov rbx, rbp
mov dword [rsp + 0x44], ebp
call fcn.1400454e0
lea r8, [0x1401cd154]
lea rcx, [rsp + 0x2f0]
mov edx, 0x209
call fcn.1400445a0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
je 0x14000134e
mov dword [rsp + 0x40], 1
nop
lea rcx, [rsp + 0x2f0]
mov r8d, 0x208
mov rdx, rdi
call fcn.1400454e0
lea r8, [0x1401cd148]
lea rcx, [rsp + 0x2f0]
mov edx, 0x209
call fcn.1400445a0
lea r8, [rsp + 0xcc]
lea rcx, [rsp + 0x2f0]
mov edx, 0x209
call fcn.1400445a0
test byte [rsp + 0xa0], 0x10
je 0x1400012b8
lea rsi, [rsp + 0xcc]
lea rdi, [0x1401cd15c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14000131f
lea rsi, [rsp + 0xcc]
lea rdi, [0x1401cd160]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14000131f
mov edi, dword [rsp + 0x60]
test edi, edi
je 0x14000131f
mov r9d, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
xor eax, eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0x2f0]
mov r8d, edi
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001030
mov ecx, dword [rsp + 0x54]
add rbx, qword [rsp + 0x48]
add ebp, dword [rsp + 0x50]
mov esi, eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x44]
lea eax, [rax + rcx + 1]
mov dword [rsp + 0x44], eax
jmp 0x140001323
xor eax, eax
lea rcx, [rsp + 0x2f0]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov edx, 0x20000
mov dword [rsp + 0x20], 3
mov esi, eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x140001315
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rdi
mov esi, eax
mov dword [rsp + 0x40], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, qword [rsp + 0x48]
add ebp, 1
jmp 0x140001323
mov esi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdi, qword [rsp + 0x70]
test eax, eax
jne 0x1400011b0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
mov rax, qword [rsp + 0x90]
test rax, rax
je 0x140001369
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x140001378
mov dword [rax], ebp
mov eax, esi
mov rcx, qword [rsp + 0x710]
xor rcx, rsp
call fcn.140041910
add rsp, 0x728
pop rdi
pop rsi
pop rbp
pop rbx
ret