Function at 0x14006d940
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1410]
mov eax, 0x1510
call fcn.14006f190
sub rsp, rax
mov rax, qword [0x1400d1608]
xor rax, rsp
mov qword [rbp + 0x13f0], rax
cmp dword [rcx + 0xf0], 0
mov rbx, rcx
jne 0x14006d9cd
mov r10, qword [rcx + 0x18]
mov edi, 0xffffffa9
test r10, r10
je 0x14006d9c6
mov rax, qword [rcx + 0x80]
lea rdx, [rcx + 0x100]
mov r8d, dword [rcx + 0x88]
mov r9d, edi
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x68]
mov rcx, qword [rcx + 0x58]
mov qword [rsp + 0x28], rax
lea rax, str.send_folder:_Invalid_file_data
mov qword [rsp + 0x20], rax
call r10
mov eax, edi
jmp 0x14006dc0e
xor r9d, r9d
mov qword [rsp + 0x1548], r13
xor r8d, r8d
mov qword [rsp + 0x1508], r14
lea edx, [r9 + 5]
call fcn.14006e300
lea rcx, [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc qword [rbx + 0x80]
lea rcx, [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8d, 0x3fe
lea rdx, [rbp + 0x3f0]
lea rcx, [rbx + 0x100]
call fcn.14004fdf0
movsxd rdi, eax
test eax, eax
jns 0x14006dab4
mov ecx, edi
lea rdx, [rbp + 0x2f0]
neg ecx
mov r8d, 0x100
call fcn.140044d90
mov r9, rax
lea r8, [0x1400d0c20]
mov edx, 0x100
lea rcx, [rbp + 0x1f0]
call fcn.140044c10
mov r10, qword [rbx + 0x18]
test r10, r10
je 0x14006daad
mov rax, qword [rbx + 0x80]
lea rdx, [rbx + 0x100]
mov r8d, dword [rbx + 0x88]
mov r9d, edi
mov rcx, qword [rbx + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call r10
mov eax, edi
jmp 0x14006dbfe
mov qword [rsp + 0x1540], r12
lea r8, [rbp + 0x3f0]
lea eax, [rdi + 1]
movsxd r9, eax
lea r8, [r8 + rdi*2]
test edi, edi
jle 0x14006db2a
lea eax, [rdi - 1]
movsxd rcx, eax
lea rdx, [r9 + r9]
cmp word [rbp + rcx*2 + 0x3f0], 0x5c
jne 0x14006db0a
mov eax, 0x2a
mov word [r8], ax
cmp rdx, 0x800
jae 0x14006e2eb
xor r12d, r12d
mov word [rbp + rdx + 0x3f0], r12w
jmp 0x14006db4f
mov eax, 0x5c
lea r9, [r9*2 + 2]
mov word [r8], ax
mov eax, 0x2a
mov word [rbp + rdx + 0x3f0], ax
jmp 0x14006db36
mov eax, 0x2a
add r9, r9
mov word [r8], ax
cmp r9, 0x800
jae 0x14006e2eb
xor r12d, r12d
mov word [rbp + r9 + 0x3f0], r12w
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
jne 0x14006dc28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rbp + 0x2f0]
mov edi, eax
neg edi
mov ecx, edi
neg ecx
call fcn.140044d90
mov r9, rax
lea r8, str.FindFirstFile:__s
mov edx, 0x100
lea rcx, [rbp + 0x1f0]
call fcn.140044c10
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14006dbf4
mov rcx, qword [rbx + 0x80]
lea rdx, [rbx + 0x100]
mov r8d, dword [rbx + 0x88]
mov r9d, edi
mov qword [rsp + 0x38], rcx
mov rcx, qword [rbx + 0x78]
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbx + 0x68]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x58]
call rax
mov eax, edi
mov r12, qword [rsp + 0x1540]
mov r13, qword [rsp + 0x1548]
mov r14, qword [rsp + 0x1508]
mov rcx, qword [rbp + 0x13f0]
xor rcx, rsp
call fcn.14006f1f0
add rsp, 0x1510
pop rdi
pop rbx
pop rbp
ret
mov eax, dword [rbx + 0xf8]
mov edi, r12d
mov r14, qword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov eax, dword [rbx + 0xf4]
mov qword [rsp + 0x1538], rsi
mov dword [rbx + 0xf8], eax
mov qword [rsp + 0x1500], r15
nop word [rax + rax]
cmp dword [rbx + 0xec], 0
jne 0x14006e2a0
cmp word [rbp - 0x34], 0x2e
jne 0x14006dc92
movzx eax, word [rbp - 0x32]
test ax, ax
je 0x14006e0aa
cmp ax, 0x2e
jne 0x14006dc92
cmp word [rbp - 0x30], 0
je 0x14006e0aa
movsxd rax, dword [rbx + 0xf8]
lea rdx, [rbx + 0x100]
mov r8d, 0x400
lea rcx, [rbp - 0x34]
sub r8d, eax
add rdx, rax
call fcn.14004fee0
mov esi, eax
test eax, eax
js 0x14006e220
movsxd rcx, dword [rbx + 0xf8]
add eax, ecx
cmp eax, 0x3fe
jge 0x14006e1c7
cmp dword [rbx + 8], 0
mov edx, dword [rbp - 0x60]
mov dword [rbx + 0xf4], eax
je 0x14006dceb
test dl, 2
jne 0x14006e0aa
mov rax, rcx
lea rcx, [rbx + 0x100]
add rcx, rax
movzx eax, byte [rcx]
test al, al
je 0x14006dd28
nop
cmp al, 0x2e
jne 0x14006dd1d
cmp byte [rcx + 1], al
jne 0x14006dd1d
movzx eax, byte [rcx + 2]
cmp al, 0x2f
je 0x14006e0cc
cmp al, 0x5c
je 0x14006e0cc
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14006dd00
test dl, 0x10
je 0x14006dd7f
xor edx, edx
mov rcx, rbx
call fcn.14006e760
mov edi, eax
test eax, eax
js 0x14006e2a5
movsxd rax, dword [rbx + 0xf4]
mov byte [rax + rbx + 0x100], gethostbyname
movsxd rcx, dword [rbx + 0xf4]
lea eax, [rcx + 1]
mov dword [rbx + 0xf4], eax
mov byte [rcx + rbx + 0x101], 0
mov rcx, rbx
call fcn.14006d940
mov edi, eax
test eax, eax
js 0x14006e2a5
jmp 0x14006e0aa
mov rax, qword [rbx + 0x30]
lea r15, [rbx + 0x100]
test rax, rax
je 0x14006de3a
lea rcx, [rbp + 0x1f0]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x40]
mov rcx, qword [rbx + 0x58]
mov rdx, r15
call rax
mov edi, eax
cmp eax, 0xffff0000
jne 0x14006de2b
cmp byte [rbp + 0x1f0], 0
jne 0x14006dddb
mov r8d, 0x100
lea rdx, str.Skipping
lea rcx, [rbp + 0x1f0]
call fcn.1400498e0
mov r10, qword [rbx + 0x18]
test r10, r10
je 0x14006e0aa
mov rax, qword [rbx + 0x80]
xor r9d, r9d
mov r8d, dword [rbx + 0x88]
mov rdx, r15
mov rcx, qword [rbx + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call r10
jmp 0x14006e0aa
test edi, edi
js 0x14006e108
mov rax, qword [rsp + 0x40]
jmp 0x14006de95
mov r8d, 0x400
lea rdx, [rbp + 0xbf0]
mov rcx, r15
call fcn.14004fdf0
mov edi, eax
test eax, eax
js 0x14006e1a5
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0xbf0]
mov dword [rsp + 0x28], 0x8000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14006e17c
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14006df39
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rbp + 0x2f0]
mov edi, eax
neg edi
mov ecx, edi
neg ecx
call fcn.140044d90
mov r9, rax
lea r8, str.GetFileInformationByHandle:__s
mov edx, 0x100
lea rcx, [rbp + 0x1f0]
call fcn.140044c10
mov r10, qword [rbx + 0x18]
test r10, r10
je 0x14006df2d
mov rax, qword [rbx + 0x80]
mov r9d, edi
mov r8d, dword [rbx + 0x88]
mov rdx, r15
mov rcx, qword [rbx + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call r10
mov dword [rbx + 0xf0], r12d
jmp 0x14006e072
mov eax, dword [rsp + 0x60]
xor r9d, r9d
mov dword [rbx + 0xc8], eax
xor r8d, r8d
mov rax, qword [rsp + 0x64]
mov rcx, rbx
mov qword [rbx + 0xcc], rax
mov rax, qword [rsp + 0x6c]
lea edx, [r9 + 4]
mov qword [rbx + 0xd4], rax
mov rax, qword [rsp + 0x74]
mov qword [rbx + 0xdc], rax
mov eax, dword [rbp - 0x80]
mov dword [rbx + 0xe4], eax
mov eax, dword [rbp - 0x7c]
mov dword [rbx + 0xe8], eax
mov dword [rbx + 0xf0], 1
call fcn.14006e300
mov edi, eax
test eax, eax
js 0x14006e072
mov esi, dword [rbx + 0xe4]
lea r9, [rsp + 0x58]
mov eax, dword [rbx + 0xe8]
mov rcx, rbx
mov r8, qword [rsp + 0x40]
shl rsi, 0x20
or rsi, rax
mov rdx, rsi
call fcn.14006c2b0
mov edi, eax
test eax, eax
js 0x14006e072
mov r14, qword [rsp + 0x58]
cmp r14, rsi
jge 0x14006e04c
mov r9, r14
mov qword [rsp + 0x20], rsi
lea r8, str.send_file_underwrite__I64u__I64u
mov edx, 0x100
lea rcx, [rbp + 0x1f0]
call fcn.140044c10
mov r10, qword [rbx + 0x18]
test r10, r10
je 0x14006e045
mov rax, qword [rbx + 0x80]
mov r9d, 0xffffff93
mov r8d, dword [rbx + 0x88]
mov rdx, r15
mov rcx, qword [rbx + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call r10
mov edi, 0xffffff93
jmp 0x14006e072
lea rcx, [rbx + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add qword [rbx + 0x68], r14
lea rcx, [rbx + 0x90]
inc qword [rbx + 0x78]
mov qword [rbx + 0x70], r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rbx + 0x38]
test rax, rax
je 0x14006e09a
mov r8, qword [rsp + 0x40]
mov rdx, r15
mov rcx, qword [rbx + 0x58]
call rax
test eax, eax
jns 0x14006e0a5
mov r14, qword [rsp + 0x48]
test edi, edi
js 0x14006e0aa
mov edi, eax
jmp 0x14006e0aa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x48]
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14006e2a5
test edi, edi
je 0x14006dc60
jmp 0x14006e2a5
mov r10, qword [rbx + 0x18]
mov edi, 0xffffffa9
test r10, r10
je 0x14006e2a5
mov rax, qword [rbx + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [0x1400d0c78]
jmp 0x14006e1fe
cmp byte [rbp + 0x1f0], 0
jne 0x14006e142
mov ecx, edi
lea rdx, [rbp + 0x2f0]
neg ecx
mov r8d, 0x100
call fcn.140044d90
lea r8, str.openread:__s
mov r9, rax
lea rcx, [rbp + 0x1f0]
mov edx, 0x100
call fcn.140044c10
mov r10, qword [rbx + 0x18]
test r10, r10
je 0x14006e2a5
mov rax, qword [rbx + 0x80]
mov rdx, r15
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
jmp 0x14006e205
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rbp + 0x2f0]
mov edi, eax
neg edi
mov ecx, edi
neg ecx
call fcn.140044d90
lea r8, str.open:__s
jmp 0x14006e12e
mov ecx, edi
lea rdx, [rbp + 0x2f0]
neg ecx
mov r8d, 0x100
call fcn.140044d90
lea r8, [0x1400d0cb8]
jmp 0x14006e12e
mov r10, qword [rbx + 0x18]
mov edi, 0xffffff91
test r10, r10
je 0x14006e2a5
mov rax, qword [rbx + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, str.Path_too_long
lea rdx, [rbx + 0x100]
mov r8d, dword [rbx + 0x88]
mov r9d, edi
mov rcx, qword [rbx + 0x58]
mov qword [rsp + 0x20], rax
call r10
jmp 0x14006e2a5
mov ecx, esi
lea rdx, [rbp + 0x2f0]
neg ecx
mov r8d, 0x100
call fcn.140044d90
mov r9, rax
lea r8, str.EXP_WinW2Path:__s
mov edx, 0x100
lea rcx, [rbp + 0x1f0]
call fcn.140044c10
mov r10, qword [rbx + 0x18]
test r10, r10
je 0x14006e29c
mov rax, qword [rbx + 0x80]
lea rdx, [rbx + 0x100]
mov r8d, dword [rbx + 0x88]
mov r9d, esi
mov rcx, qword [rbx + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
call r10
mov edi, esi
jmp 0x14006e2a5
mov edi, 0xfffffc1d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
movsxd rax, dword [rbx + 0xf8]
mov r15, qword [rsp + 0x1500]
mov rsi, qword [rsp + 0x1538]
mov dword [rbx + 0xf4], eax
mov dword [rbx + 0xf0], r12d
mov byte [rax + rbx + 0x100], 0
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0xf8], eax
mov eax, edi
jmp 0x14006dbf6
call fcn.14006ef6c
int3