Function at 0x140099dc0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x308], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov rsi, r8
mov qword [rsp + 0x30], r8
mov rbx, rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r8
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14009a0af
nop word [rax + rax]
test byte [rsp + 0x70], 0x10
je 0x140099f87
lea rsi, [rbp - 0x64]
lea rdi, [0x14012ffcc]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14009a07a
lea rsi, [rbp - 0x64]
lea rdi, [0x14012ffd0]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14009a07a
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x140099eca
test rbx, 0xffffffffffff0000
jne 0x140099eb6
movzx edi, bx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140099edd
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400029f0
jmp 0x140099edd
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140099ecc
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140002120
nop
mov rax, qword [rsp + 0x20]
mov edx, dword [rax - 0x10]
dec edx
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.14005d700
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x64]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call fcn.14003bd50
mov r8d, 2
lea rdx, [0x14012ffc4]
lea rcx, [rsp + 0x20]
call fcn.14003bd50
mov rdi, qword [rsp + 0x20]
cmp dword [rdi - 8], 1
jle 0x140099f4d
mov edx, dword [rdi - 0x10]
lea rcx, [rsp + 0x20]
call fcn.140001fb0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov r8, rsi
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call fcn.140099dc0
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14009a07f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
jmp 0x14009a07f
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
test rbx, rbx
je 0x140099fe4
test rbx, 0xffffffffffff0000
jne 0x140099fd0
movzx edi, bx
mov ecx, edi
call fcn.140002830
test rax, rax
je 0x140099ff7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400029f0
jmp 0x140099ff7
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140099fe6
xor ecx, ecx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140002120
nop
mov rax, qword [rsp + 0x28]
mov edx, dword [rax - 0x10]
dec edx
mov r8d, 1
lea rcx, [rsp + 0x28]
call fcn.14005d700
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x64]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x28]
call fcn.14003bd50
mov rdi, qword [rsi + 8]
mov qword [rsp + 0x50], rdi
cmp rdi, qword [rsi + 0x10]
jb 0x14009a052
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.14009b070
test al, al
je 0x14009a09b
mov rax, qword [rsi]
lea rcx, [rax + rdi*8]
mov qword [rsp + 0x58], rcx
mov rdi, qword [rsp + 0x28]
test rcx, rcx
je 0x14009a071
mov rdx, rdi
call fcn.140002ad0
nop
inc qword [rsi + 8]
jmp 0x140099f63
mov rsi, qword [rsp + 0x30]
lea rdx, [rsp + 0x70]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14009a0a6
jmp 0x140099e30
mov ecx, 0x8007000e
call fcn.1400022b0
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x308]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret