Function at 0x18003b800
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x2e0
mov rax, qword [0x18011a300]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x320]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x328]
mov rbp, r8
mov qword [rsp + 0x48], rax
mov eax, 0x1f3
mov rbx, rcx
sub eax, edx
mov rdx, r8
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rcx, rax
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x18003b870
lea eax, [rcx + 2]
jmp 0x18003ba74
movsxd r10, dword [rsp + 0x34]
mov qword [rsp + 0x2d8], rdi
mov esi, 1
mov rdi, r10
mov qword [rsp + 0x58], r10
xor r11d, r11d
nop dword [rax]
mov r8d, dword [rbp]
mov dword [rsp + 0x50], r8d
test r8b, 0x10
je 0x18003ba02
cmp word [rbp + 0x2c], 0x2e
jne 0x18003b8c8
movzx eax, word [rbp + 0x2e]
test ax, ax
je 0x18003ba3a
cmp ax, 0x2e
jne 0x18003b8c8
cmp word [rbp + 0x30], 0
je 0x18003ba3a
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x2c]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r9, rcx
mov qword [rsp + 0x68], rcx
lea eax, [rcx + 1]
cmp dword [rsp + 0x60], eax
jb 0x18003ba30
mov rax, qword [rsp + 0x58]
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov word [rbx + rax*2 - 2], r11w
xor eax, eax
repne scasw ax, word [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, word [rbp + rcx + 0x2c]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x18003b910
mov eax, dword [rsp + 0x30]
test al, 0x10
je 0x18003b94c
mov r9, qword [rsp + 0x48]
xor edx, edx
mov rcx, rbx
call qword [rsp + 0x40]
mov r9, qword [rsp + 0x68]
mov r10d, dword [rsp + 0x34]
mov esi, eax
mov eax, dword [rsp + 0x30]
xor r11d, r11d
test esi, esi
je 0x18003b9b8
test al, 0x40
jne 0x18003b9b8
lea edx, [r10 + r9]
mov eax, 0x5c
lea edi, [r10 + r9 + 1]
lea ecx, [rdx - 1]
mov r8d, 0x24c
mov dword [rsp + 0x70], r11d
mov word [rbx + rcx*2], ax
mov ecx, 0x2a
mov word [rbx + rdi*2], r11w
mov word [rbx + rdx*2], cx
lea rcx, [rsp + 0x74]
xor edx, edx
call fcn.180043ef0
mov rax, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, edi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.18003b800
mov esi, eax
test byte [rsp + 0x30], 0x20
je 0x18003b9eb
test esi, esi
je 0x18003b9eb
mov rax, qword [rsp + 0x68]
mov edx, dword [rsp + 0x34]
mov r9, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
lea ecx, [rdx + rax - 1]
xor eax, eax
mov word [rbx + rcx*2], ax
mov rcx, rbx
xor edx, edx
call qword [rsp + 0x40]
mov esi, eax
mov rdi, qword [rsp + 0x58]
mov eax, 0x2a
mov word [rbx + rdi*2 - 2], ax
xor eax, eax
mov word [rbx + rdi*2], ax
jmp 0x18003ba35
mov r9, qword [rsp + 0x48]
lea rdx, [rbp + 0x2c]
mov rcx, rbx
mov word [rbx + rdi*2 - 4], r11w
call qword [rsp + 0x40]
mov esi, eax
mov eax, 0x5c
mov word [rbx + rdi*2 - 4], ax
mov eax, 0x2a
mov word [rbx + rdi*2 - 2], ax
jmp 0x18003ba35
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
test esi, esi
je 0x18003ba5f
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, qword [rsp + 0x38]
mov r10d, dword [rsp + 0x34]
mov r11d, 0
test eax, eax
jne 0x18003b890
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x2d8]
mov eax, esi
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.180043ec0
add rsp, 0x2e0
pop rsi
pop rbp
pop rbx
ret