Function at 0x14001c4f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rdi
push r12
push r15
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov r15, rcx
xor r12d, r12d
nop word [rax + rax]
mov rcx, qword [0x140035020]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14001c5f2
nop word [rax + rax]
mov rcx, qword [0x140034fd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14001c520
lea rcx, [0x140034fe0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movsxd rdx, dword [0x14003501c]
lea rcx, [0x140034fe0]
mov rax, qword [0x140035010]
mov rdi, qword [rax + rdx*8]
lea eax, [rdx + 1]
cdq
idiv dword [0x140035008]
mov dword [0x14003501c], edx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x140034fd0]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test rdi, rdi
je 0x14001c520
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r12d
mov rcx, rdi
call fcn.14001b650
test eax, eax
je 0x14001c5d1
inc dword [rbx + 0x14]
mov edx, eax
mov rcx, rdi
call fcn.14001a310
jmp 0x14001c5db
inc dword [rbx + 0x18]
mov eax, dword [rsp + 0x24]
add dword [rbx + 0x10], eax
mov rcx, qword [0x140034fc0]
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14001c540
lea rcx, [0x140035030]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9, r12
test r15, r15
je 0x14001c667
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [0x140034fc0]
mov edx, 8
lea eax, [rax*2 + 2]
mov r8d, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [rsp + 0x20], r12d
mov r9, rax
movsxd rcx, dword [rsp + 0x20]
cmp rcx, rdi
jae 0x14001c667
movsxd r8, dword [rsp + 0x20]
movsxd rcx, dword [rsp + 0x20]
movzx eax, byte [r8 + r15]
mov byte [rcx + r9], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp rax, rdi
jb 0x14001c640
movsxd r8, dword [0x140035068]
lea rcx, [0x140035030]
mov rax, qword [0x140035060]
mov qword [rax + r8*8], r9
mov eax, dword [0x140035068]
inc eax
cdq
idiv dword [0x140035058]
mov dword [0x140035068], edx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x140035028]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rcx, qword [0x140034fc0]
mov edx, 8
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x14001c84b
mov rdx, r15
mov qword [rsp + 0x290], r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14000ee5c]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x14001c831
mov qword [rsp + 0x2e0], rsi
mov qword [rsp + 0x298], r13
lea r13, [0x14000c3b0]
nop dword [rax]
mov ecx, dword [rsp + 0x30]
and ecx, 0x1410
cmp ecx, 0x10
jne 0x14001c802
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x14001c802
lea ecx, [rax - 1]
movsxd rdx, ecx
movzx r8d, word [rsp + rdx*2 + 0x5c]
movsxd rdx, eax
add rdx, rdx
cmp r8w, 0x2e
jne 0x14001c77b
cmp word [rsp + rdx + 0x5c], r12w
je 0x14001c802
cmp eax, 1
jle 0x14001c79d
add eax, 0xfffffffe
movsxd rcx, eax
cmp word [rsp + rcx*2 + 0x5c], 0x2e
jne 0x14001c79d
cmp r8w, 0x2e
jne 0x14001c79d
cmp word [rsp + rdx + 0x5c], r12w
je 0x14001c802
mov edi, r12d
mov rsi, r13
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rsi]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14001c802
inc edi
add rsi, 8
cmp edi, 0x21
jb 0x14001c7b0
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x14000ee64]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x5c]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rdx, rbx
mov rcx, rbp
call fcn.14001c4f0
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001c730
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r13, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x2e0]
mov rcx, qword [0x140034fc0]
mov r8, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [rsp + 0x290]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14001d940
add rsp, 0x2a0
pop r15
pop r12
pop rdi
pop rbp
pop rbx
ret