Function at 0x14002bb5c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r12, qword [rsp + 0x310]
xor ebx, ebx
mov qword [rsp + 0x38], r8
mov r13, rdx
movzx r8d, bx
mov dword [rsp + 0x30], r9d
or rdx, 0xffffffffffffffff
mov r15, rcx
inc rdx
cmp word [rcx + rdx*2], bx
jne 0x14002bba4
mov rcx, r12
cmp word [r12], bx
je 0x14002bf38
mov r9, rcx
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x14002bbbe
mov rax, rcx
sub rax, r9
sar rax, 1
add ax, dx
add r8w, ax
cmp word [rcx], bx
jne 0x14002bbbb
cmp bx, r8w
je 0x14002bf38
inc r8w
movzx r14d, r8w
lea ecx, [r14 + r14]
call fcn.140011100
mov rbp, rax
test rax, rax
je 0x14002bf31
mov rsi, r12
mov rdi, rax
cmp word [r12], bx
je 0x14002bc73
mov eax, r14d
mov rcx, rdi
sub rcx, rbp
mov r8, r15
sar rcx, 1
sub eax, ecx
mov rcx, rdi
movsxd rbx, eax
mov rdx, rbx
call fcn.1400158f0
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.1400157fc
or rcx, 0xffffffffffffffff
mov rax, rcx
xor ebx, ebx
inc rax
cmp word [rsi + rax*2], bx
jne 0x14002bc49
lea rsi, [rsi + rax*2]
mov rax, rcx
add rsi, 2
inc rax
cmp word [rdi + rax*2], bx
jne 0x14002bc5d
lea rdi, [rdi + rax*2]
add rdi, 2
cmp word [rsi], bx
jne 0x14002bc13
mov r8d, dword [rsp + 0x30]
mov r9, rbp
mov rdx, qword [rsp + 0x38]
mov rcx, r13
mov word [rdi], bx
call fcn.14001c020
mov rcx, rbp
mov r14d, eax
call fcn.140014240
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r15 + rsi*2], bx
jne 0x14002bc9a
add esi, 2
lea ecx, [rsi + rsi]
call fcn.140011100
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002bf31
movsxd rdi, esi
mov r8, r15
mov rdx, rdi
mov rcx, rax
call fcn.1400158f0
mov rcx, rbx
call fcn.140016ca4
lea r15, [rax + 2]
lea rax, [rdi - 1]
cmp rax, 0x7ffffffe
ja 0x14002bd60
mov rcx, rdi
mov rax, rbx
cmp word [rax], bp
je 0x14002bcfb
add rax, 2
sub rcx, 1
jne 0x14002bcec
test rcx, rcx
je 0x14002bd08
mov rax, rdi
sub rax, rcx
jmp 0x14002bd0b
mov rax, rbp
test rcx, rcx
je 0x14002bd60
mov rdx, rdi
lea rcx, [rbx + rax*2]
sub rdx, rax
je 0x14002bd52
sub rax, rdi
lea r8, [rdx + 0x7ffffffe]
add r8, rax
lea r9, [0x1400385a4]
sub r9, rcx
test r8, r8
je 0x14002bd52
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14002bd52
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x14002bd33
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bp
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
nop dword [rax + rax]
xor edi, edi
mov rbp, rax
mov word [r15], di
cmp rax, 0xffffffffffffffff
je 0x14002bf24
test byte [rsp + 0x40], 0x10
mov edx, 0x2e
je 0x14002bef2
movzx ecx, word [rsp + 0x6c]
movzx eax, dx
sub ecx, eax
jne 0x14002bdad
movzx ecx, word [rsp + 0x6e]
movzx eax, di
sub ecx, eax
test ecx, ecx
je 0x14002bef2
movzx ecx, word [rsp + 0x6c]
movzx eax, dx
sub ecx, eax
jne 0x14002bdd7
movzx ecx, word [rsp + 0x6e]
movzx eax, dx
sub ecx, eax
jne 0x14002bdd7
movzx ecx, word [rsp + 0x70]
movzx eax, di
sub ecx, eax
test ecx, ecx
je 0x14002bef2
or rcx, 0xffffffffffffffff
xor r14d, r14d
inc rcx
cmp word [rbx + rcx*2], r14w
jne 0x14002bde6
lea rdx, [rsp + 0x6c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r14w
jne 0x14002bdf9
lea edi, [rax + 2]
add edi, ecx
cmp edi, esi
jle 0x14002be34
movsxd rdx, edi
mov rcx, rbx
add rdx, rdx
call fcn.14000ef70
test rax, rax
je 0x14002bf0f
mov rcx, rax
mov rbx, rax
mov esi, edi
call fcn.140016ca4
lea r15, [rax + 2]
movsxd rdi, esi
lea r8, [rsp + 0x6c]
mov rdx, rdi
mov rcx, rbx
call fcn.1400157fc
lea rax, [rdi - 1]
cmp rax, 0x7ffffffe
ja 0x14002becf
mov rcx, rdi
mov rax, rbx
cmp word [rax], r14w
je 0x14002be69
add rax, 2
sub rcx, 1
jne 0x14002be59
test rcx, rcx
je 0x14002be76
mov rax, rdi
sub rax, rcx
jmp 0x14002be79
mov rax, r14
test rcx, rcx
je 0x14002becf
mov rdx, rdi
lea rcx, [rbx + rax*2]
sub rdx, rax
je 0x14002bec0
sub rax, rdi
lea r8, [rdx + 0x7ffffffe]
add r8, rax
lea r9, [0x140037cbc]
sub r9, rcx
test r8, r8
je 0x14002bec0
movzx eax, word [r9 + rcx]
test ax, ax
je 0x14002bec0
mov word [rcx], ax
dec r8
add rcx, 2
sub rdx, 1
jne 0x14002bea1
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov r9d, dword [rsp + 0x30]
mov rdx, r13
mov r8, qword [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], r12
call fcn.14002bb5c
xor edi, edi
mov r14d, eax
mov word [r15], di
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
je 0x14002bf15
jmp 0x14002bd87
mov r14d, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
mov rcx, rbx
call fcn.140014240
mov eax, r14d
jmp 0x14002bf3a
mov eax, 1
jmp 0x14002bf3a
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14001f920
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret