Function at 0x140001ad0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r14, rcx
mov qword [rsp + 0x68], rcx
mov rsi, qword [rcx + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 2
jb 0x140002075
mov r12, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x140001b3b
mov r12, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea r15, [rsi + 2]
mov ebx, 0xf
lea rdi, [rsp + 0x28]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r15, rbx
jbe 0x140001bd9
mov rbx, r15
or rbx, 0xf
cmp rbx, r13
jbe 0x140001ba0
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.140004070
test rax, rax
je 0x140001c53
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001bd4
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001bb4
xor edi, edi
jmp 0x140001bd4
cmp rcx, 0x1000
jb 0x140001bcc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002069
jmp 0x140001b81
call fcn.140004070
mov rdi, rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], rbx
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x2a5c
mov byte [rdi + r15], 0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rcx, qword [rsp + 0x28]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140001c5f
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400040ac
movdqa xmm0, xmmword [0x1400067a0]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
cmp r15, 0xffffffffffffffff
je 0x140002017
xor r12d, r12d
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r12
lea rax, [rbp - 0x14]
mov rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001ca0
cmp rdi, r13
ja 0x14000206f
cmp rdi, 0xf
ja 0x140001cec
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], 0xf
mov r8, rdi
lea rdx, [rbp - 0x14]
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x78], 0
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
mov rbx, qword [rsp + 0x78]
jmp 0x140001d83
mov rsi, rdi
or rsi, 0xf
cmp rsi, r13
jbe 0x140001d0b
mov rsi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001d3c
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x140001d26
mov rbx, r12
jmp 0x140001d63
cmp rcx, 0x1000
jb 0x140001d5b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000207b
mov rcx, rax
call fcn.140004070
test rax, rax
je 0x14000205c
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001d63
call fcn.140004070
mov rbx, rax
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rsi
mov r8, rdi
lea rdx, [rbp - 0x14]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x78]
cmp rsi, 0xf
cmova rax, rbx
cmp rdi, 1
jne 0x140001d9f
cmp byte [rax], 0x2e
je 0x140001fc6
lea rax, [rsp + 0x78]
cmp rsi, 0xf
cmova rax, rbx
cmp rdi, 2
jne 0x140001dbd
cmp word [rax], 0x2e2e
je 0x140001fc6
mov r13, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x140002063
mov qword [rsp + 0x20], r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140001def
mov rax, qword [r14]
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea r12, [r13 + 1]
mov r14d, 0xf
lea r15, [rsp + 0x48]
cmp r12, r14
jbe 0x140001e91
mov r14, r12
or r14, 0xf
cmp r14, rcx
jbe 0x140001e34
mov r14, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140001e65
cmp r14, 0x16
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
test rcx, rcx
jne 0x140001e4f
xor r15d, r15d
jmp 0x140001e8c
cmp rcx, 0x1000
jb 0x140001e84
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002081
mov rcx, rax
call fcn.140004070
test rax, rax
je 0x140002047
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140001e8c
call fcn.140004070
mov r15, rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r14
mov r8, r13
mov rdx, qword [rsp + 0x20]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r13], 0x5c
mov byte [r15 + r12], 0
lea rdx, [rsp + 0x78]
cmp rsi, 0xf
cmova rdx, rbx
mov r8, rdi
lea rcx, [rsp + 0x48]
call fcn.140003760
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor r12d, r12d
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140001f3c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000204e
call fcn.1400040ac
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
test byte [rbp - 0x40], 0x10
je 0x140001f65
lea rcx, [rbp - 0x68]
call fcn.140001ad0
mov r14, qword [rsp + 0x68]
jmp 0x140001f73
mov r14, qword [rsp + 0x68]
mov rcx, r14
call fcn.140001370
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140001fae
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002055
call fcn.1400040ac
movabs r13, 0x7fffffffffffffff
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rbp - 0x70]
cmp rsi, 0xf
jbe 0x140001ff9
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001ff1
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000205c
mov rcx, rbx
call fcn.1400040ac
lea rdx, [rbp - 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001c80
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140004050
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400011b0
nop
call fcn.140001110
int3
call fcn.1400011b0
int3
call fcn.1400011b0
int3
call fcn.140001110
nop
call fcn.140001110
int3