Function at 0x1400d2c90
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3f0
mov rax, qword [0x1402a7d08]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov r15, r8
mov qword [rsp + 0x88], r8
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0xd8], r8
xor esi, esi
mov dword [rsp + 0x30], esi
lea rcx, [rsp + 0x130]
call fcn.14000a400
nop
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
cmp rcx, rdx
jae 0x1400d2d36
lea rax, [rcx + 1]
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x130]
cmp rdx, 8
cmovae rax, qword [rsp + 0x130]
mov dword [rax + rcx*2], 0x2a
jmp 0x1400d2d50
mov r9d, 0x2a
xor r8d, r8d
lea edx, [r9 - 0x29]
lea rcx, [rsp + 0x130]
call fcn.140023520
mov rcx, qword [r12 + 0x10]
dec rcx
mov qword [r12 + 0x10], rcx
mov rax, r12
cmp qword [r12 + 0x18], 8
jb 0x1400d2d6c
mov rax, qword [r12]
mov word [rax + rcx*2], si
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rcx, qword [rsp + 0x130]
lea rdx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x1400d3418
movabs r13, 0x7ffffffffffffffe
mov rbx, rax
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rsp + 0x1bc]
movzx eax, word [rsp + 0x1be]
cmp cx, 0x2e
jne 0x1400d2df8
test ax, ax
je 0x1400d33f5
cmp cx, cx
jne 0x1400d2df8
cmp ax, cx
jne 0x1400d2df8
cmp word [rsp + 0x1c0], 0
je 0x1400d33f5
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x110], rax
mov qword [rsp + 0x100], rsi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], si
lea rax, [rsp + 0x1bc]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400d2e33
lea rdx, [rsp + 0x1bc]
lea rcx, [rsp + 0xf0]
call fcn.140007240
nop
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rsi
mov rbx, qword [r12 + 0x10]
mov r14, r12
cmp qword [r12 + 0x18], 8
jb 0x1400d2e78
mov r14, qword [r12]
cmp rbx, 8
jae 0x1400d2e98
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa8], 7
jmp 0x1400d2ef0
mov rdi, rbx
or rdi, 7
cmp rdi, r13
cmova rdi, r13
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400d34a5
lfence
add rcx, rcx
call fcn.140008f80
mov qword [rsp + 0x90], rax
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140132e10
mov qword [rsp + 0xa8], rdi
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0xa0], rbx
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x90]
call fcn.140055970
nop
cmp rax, 0xffffffffffffffff
jne 0x1400d2f5a
mov rcx, qword [0x1402aa8a0]
lea r14, [0x1402aa8a0]
cmp rcx, r14
je 0x1400d33f0
test dword [rcx + 0x44], 0x1000000
je 0x1400d33f0
cmp byte [rcx + 0x41], 2
jb 0x1400d33f0
lea edx, [rax + 0xe]
lea r8, [0x140236f28]
mov rcx, qword [rcx + 0x38]
call fcn.140024300
jmp 0x1400d33f0
mov rdx, rax
mov rcx, rdi
test byte [rsp + 0x190], 0x10
je 0x1400d33b5
call fcn.1400d34d0
test eax, eax
jne 0x1400d33f0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
or dword [rsp + 0x30], 1
mov rdx, qword [r12 + 0x10]
inc rdx
lea rcx, [rsp + 0x40]
call fcn.140033b60
mov r9, r12
cmp qword [r12 + 0x18], 8
jb 0x1400d2fb4
mov r9, qword [r12]
mov rdx, qword [r12 + 0x10]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400d2ffc
lea rdi, [rcx + rdx]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp r8, 8
cmovae rbx, qword [rsp + 0x40]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call fcn.140132e10
mov word [rbx + rdi*2], si
jmp 0x1400d3011
lfence
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.14001c380
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x1400d3050
lea rcx, [rdx + 1]
mov qword [rsp + 0x50], rcx
lea rax, [rsp + 0x40]
cmp r8, 8
cmovae rax, qword [rsp + 0x40]
mov r14d, 0x5c
mov word [rax + rdx*2], r14w
mov word [rax + rcx*2], si
jmp 0x1400d307a
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x14025b700]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x40]
call fcn.14001c380
mov r14d, 0x5c
lea rax, [rsp + 0x1bc]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400d3090
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400d30e7
lea rdi, [rcx + rdx]
mov qword [rsp + 0x50], rdi
lea rbx, [rsp + 0x40]
cmp r8, 8
cmovae rbx, qword [rsp + 0x40]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
lea rdx, [rsp + 0x1bc]
call fcn.140132e10
mov word [rbx + rdi*2], si
lea rax, [rsp + 0x40]
jmp 0x1400d3104
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x1bc]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.14001c380
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or dword [rsp + 0x30], 2
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x1400d3177
lea rcx, [rdx + 1]
mov qword [rsp + 0x78], rcx
lea rax, [rsp + 0x68]
cmp r8, 8
cmovae rax, qword [rsp + 0x68]
mov word [rax + rdx*2], r14w
mov word [rax + rcx*2], si
lea rax, [rsp + 0x68]
jmp 0x1400d319b
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x14025b700]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rsp + 0x68]
call fcn.14001c380
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x160], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov ebx, dword [rsp + 0x30]
or ebx, 4
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x1400d320d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d3208
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d34ab
call fcn.14013ff64
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], si
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400d326c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d3267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d34b1
call fcn.14013ff64
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], rsi
lea r15, [rsp + 0x150]
mov rbx, qword [rsp + 0x150]
mov r14, qword [rsp + 0x168]
cmp r14, 8
cmovae r15, rbx
mov rdi, qword [rsp + 0x160]
cmp rdi, 8
jae 0x1400d32df
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 7
jmp 0x1400d334f
or rdi, 7
cmp rdi, r13
cmova rdi, r13
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400d34b7
lfence
add rcx, rcx
call fcn.140008f80
mov qword [rsp + 0xb0], rax
mov rbx, qword [rsp + 0x160]
lea r8, [rbx*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140132e10
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rdi
mov r14, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x150]
mov r15, qword [rsp + 0x88]
mov r8, r15
lea rdx, [rsp + 0xb0]
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call fcn.1400d2c90
nop
cmp r14, 8
jb 0x1400d33ab
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400d33a3
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d34bd
mov rcx, rbx
call fcn.14013ff64
mov word [rsp + 0x150], si
jmp 0x1400d33f0
mov r8, r15
call fcn.1400d4890
jmp 0x1400d33f0
mov rbx, qword [rsp + 0x38]
lea rdx, [rsp + 0x190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x1400d2dc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindClose]
nop
mov rdx, qword [rsp + 0x148]
cmp rdx, 8
jb 0x1400d345c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400d3457
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400d34c3
call fcn.14013ff64
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], si
mov rcx, r12
call fcn.140007180
xor eax, eax
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.140140100
add rsp, 0x3f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400024d0
nop
call fcn.1400e0284
nop
call fcn.1400e0284
int3
call fcn.1400024d0
nop
call fcn.1400e0284
nop
call fcn.1400e0284
int3