Function at 0x140023080
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2210]
mov eax, 0x2310
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x2200], rax
mov ebx, r9d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x78], r8d
mov r13, rdx
mov qword [rbp - 0x80], rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov r14, qword [rbp + 0x2270]
mov qword [rsp + 0x58], r14
mov rax, qword [rbp + 0x2278]
mov qword [rbp - 0x78], rax
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x34], edi
mov rcx, qword [rdx]
add rcx, 0xffffffffffffffe8
cmp dword [rcx + 8], edi
je 0x140023307
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [0x1402ed690]
mov r12, 0xffffffffffffffff
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023120
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.1400157c0
lea rdx, [0x1402ed968]
mov rax, r12
inc rax
cmp word [rdx + rax*2], 0
jne 0x140023144
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.1400157c0
lea rdx, [rbp - 0x50]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp - 0x60], rax
cmp rax, r12
je 0x1400232df
nop word [rax + rax]
mov rax, qword [r14]
cmp dword [rax - 0x10], 0
jne 0x1400232e9
mov eax, dword [rbp - 0x50]
bt eax, 0xa
jb 0x1400232c5
test al, 0x10
je 0x140023331
movzx ecx, word [rbp - 0x24]
movzx eax, word [rbp - 0x22]
cmp cx, 0x2e
jne 0x1400231ce
test ax, ax
je 0x1400232c5
cmp cx, cx
jne 0x1400231ce
cmp ax, cx
jne 0x1400231ce
cmp word [rbp - 0x20], 0
je 0x1400232c5
xor ebx, ebx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jle 0x14002321c
nop dword [rax]
test rbx, rbx
js 0x1400238b0
cmp rbx, rcx
jge 0x1400238b0
mov rax, qword [rsi + 8]
lea rdx, [rbp - 0x24]
mov rcx, qword [rax + rbx*8]
call fcn.14024bf20
test eax, eax
je 0x1400237e5
inc edi
inc rbx
mov rcx, qword [rsi + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x1400231e0
cmp dword [rsp + 0x78], 0
je 0x1400232bf
mov rcx, qword [r13]
sub rcx, 0x18
call fcn.14000de80
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8d, 1
lea rdx, [0x1402ed690]
lea rcx, [rsp + 0x40]
call fcn.1400157c0
lea rcx, [rbp - 0x24]
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023260
mov r8d, eax
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x40]
call fcn.1400157c0
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140023080
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400232bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor edi, edi
mov ebx, dword [rsp + 0x30]
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140023180
mov rax, qword [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140023307
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x2200]
xor rcx, rsp
call fcn.1402155d0
mov rbx, qword [rsp + 0x2360]
add rsp, 0x2310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test ebx, ebx
je 0x1400232c5
call fcn.1400a2364
nop
test rax, rax
je 0x1400238a5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x24]
cmp rax, 0x10000
jae 0x140023375
lea rax, [rbp - 0x24]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.14000d610
jmp 0x14002339c
lea rcx, [rbp - 0x24]
mov rax, r12
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023380
mov r8d, eax
lea rdx, [rbp - 0x24]
lea rcx, [rsp + 0x38]
call fcn.14000df90
nop
mov rbx, qword [rsp + 0x38]
lea rsi, [rbx - 0x18]
mov qword [rsp + 0x50], rsi
movsxd rdi, dword [rsi + 8]
cmp edi, 4
jg 0x1400233c5
mov rcx, rsi
call fcn.14000de80
lea rbx, [rax + 0x18]
mov qword [rbp - 0x70], rbx
jmp 0x140023405
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400233d8
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400233e7
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
add rbx, 0xfffffffffffffff8
lea rdx, [rbx + rdi*2]
mov r9, rax
mov r8d, 4
lea rcx, [rbp - 0x70]
call fcn.140015720
mov rbx, qword [rbp - 0x70]
or r15d, 1
lea rdx, str..lnk
mov rcx, rbx
call fcn.14024bf20
test eax, eax
sete dil
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023438
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x34], r15d
test dil, dil
je 0x1400237ab
mov edx, dword [rsi + 8]
lea eax, [rdx - 4]
xor edi, edi
mov r14d, edi
test eax, eax
cmovns r14d, eax
cmp r14d, 0x7ffffffb
jg 0x14002389a
lea eax, [r14 + 4]
mov ebx, edx
sub ebx, r14d
cmp eax, edx
jle 0x140023483
mov esi, ebx
test ebx, ebx
jg 0x140023488
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
jmp 0x1400234ff
mov esi, 4
mov edi, edx
sub edi, esi
sub ebx, esi
inc ebx
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 1
jle 0x1400234a5
lea rcx, [rsp + 0x38]
call fcn.14000dd30
movsxd r8, ebx
movsxd rcx, r14d
mov eax, esi
add rax, rcx
mov rbx, qword [rsp + 0x38]
lea rdx, [rbx + rax*2]
lea rcx, [rbx + rcx*2]
add r8, r8
je 0x1400234d9
test rcx, rcx
je 0x1400238b6
test rdx, rdx
je 0x1400238b6
call fcn.1402414f0
test edi, edi
js 0x1400238f3
lea rsi, [rbx - 0x18]
mov qword [rsp + 0x50], rsi
cmp edi, dword [rsi + 0xc]
jg 0x1400238f3
mov dword [rsi + 8], edi
movsxd rax, edi
xor edi, edi
mov word [rbx + rax*2], di
mov r13d, edi
mov r14, rdi
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdx + 0x10]
mov dword [rsp + 0x34], r15d
test rcx, rcx
jle 0x1400237b4
nop dword [rax]
test r14, r14
js 0x1400238ed
cmp r14, rcx
jge 0x1400238ed
mov rax, qword [rdx + 8]
test rbx, rbx
je 0x1400238e2
mov rdx, rbx
mov rcx, qword [rax + r14*8]
call fcn.14024bf20
test eax, eax
jne 0x140023787
mov rdx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.14000d7c0
mov r8d, 1
lea rdx, [0x1402ed690]
mov rcx, rdi
call fcn.1400157c0
lea rcx, [rbp - 0x24]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023580
mov r8d, eax
lea rdx, [rbp - 0x24]
mov rcx, rdi
call fcn.1400157c0
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x200]
call fcn.140241ba0
mov r9d, 0x3e8
mov r8d, 0x1000
lea rdx, [rbp + 0x200]
mov rcx, qword [rdi]
call fcn.14002bd50
lea rax, [rsp + 0x48]
mov qword [rbp - 0x58], rax
call fcn.1400a2364
nop
test rax, rax
je 0x1400238d7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdi, [rbp + 0x200]
lea rax, [rbp + 0x200]
cmp rax, 0x10000
jae 0x140023617
movzx edx, di
lea rcx, [rsp + 0x48]
call fcn.14000d610
jmp 0x140023640
lea rcx, [rbp + 0x200]
mov rax, r12
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023621
mov r8d, eax
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x48]
call fcn.14000df90
nop
lea rcx, [rsp + 0x48]
call fcn.140032ea0
test eax, eax
je 0x14002377d
call fcn.1400a2364
nop
test rax, rax
je 0x1400238cc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x200]
cmp rax, 0x10000
jae 0x140023691
movzx edx, di
lea rcx, [rsp + 0x68]
call fcn.14000d610
jmp 0x1400236bf
lea rcx, [rbp + 0x200]
mov rax, r12
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400236a0
mov r8d, eax
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.14000df90
nop
mov rbx, qword [rsp + 0x68]
lea rdi, [rbx - 0x18]
movsxd rsi, dword [rdi + 8]
cmp esi, 4
jg 0x1400236e3
mov rcx, rdi
call fcn.14000de80
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
jmp 0x140023723
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400236f6
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140023705
call fcn.1400a2364
nop
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
add rbx, 0xfffffffffffffff8
lea rdx, [rbx + rsi*2]
mov r9, rax
mov r8d, 4
lea rcx, [rbp - 0x68]
call fcn.140015720
mov rbx, qword [rbp - 0x68]
or r15d, 2
lea rdx, str..exe
mov rcx, rbx
call fcn.14024bf20
test eax, eax
sete sil
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023756
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
jne 0x140023848
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140023778
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
call fcn.14000e0b0
inc r13d
inc r14
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rdx + 0x10]
movsxd rax, r13d
cmp rax, rcx
jl 0x140023520
mov rsi, qword [rsp + 0x50]
xor edi, edi
jmp 0x1400237b9
mov r15d, dword [rsp + 0x34]
xor edi, edi
jmp 0x1400237c2
mov r15d, dword [rsp + 0x34]
mov r13, qword [rbp - 0x80]
mov r14, qword [rsp + 0x58]
mov eax, r12d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1400237db
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x60]
jmp 0x1400232c1
mov rdx, r13
mov rcx, r14
call fcn.14000d7c0
mov rax, r12
lea rcx, [0x1402ed690]
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023800
mov r8d, eax
mov rdx, rcx
mov rcx, r14
call fcn.1400157c0
lea rcx, [rbp - 0x24]
mov rax, r12
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140023820
mov r8d, eax
lea rdx, [rbp - 0x24]
mov rcx, r14
call fcn.1400157c0
mov rax, qword [rbp - 0x78]
mov dword [rax], 1
jmp 0x1400232e9
mov rax, qword [rbp - 0x78]
mov dword [rax], 1
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023872
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400232e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400232e9
mov ecx, 0x80070216
call fcn.1400080b0
nop
mov ecx, 0x80004005
call fcn.1400080b0
int3
call fcn.1400a2cd8
nop
call fcn.14024b680
mov dword [rax], reloc.Cabinet.dll_FDICopy
call fcn.14024b514
call fcn.1400a2cd8
int3
mov ecx, 0x80004005
call fcn.1400080b0
int3
mov ecx, 0x80004005
call fcn.1400080b0
int3
mov ecx, 0x80004005
call fcn.1400080b0
int3
call fcn.1400a2cd8
int3
mov ecx, 0x80070057
call fcn.1400080b0
int3