Function at 0x1800919e0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x180128010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12, rcx
mov ecx, 0x104
call fcn.1800d6a34
mov rbx, rax
test rax, rax
je 0x18009200a
xor r9d, r9d
mov qword [rsp + 0x2d8], r13
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r13d, r13d
mov qword [rbp + 0x18], 0xf
xor r8d, r8d
mov qword [rbp], r13
lea rdx, [0x18010b500]
mov qword [rbp + 0x10], r13
lea rcx, [rbp]
call fcn.1800c1060
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0xf
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], r13b
jne 0x180091a80
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1800c1060
lea rdx, [0x18012ad98]
lea rcx, [rbp - 0x40]
call fcn.1800c0900
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18008aa40
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
mov r9, qword [rbp - 0x10]
mov rcx, rax
cmovae r8, qword [rbp - 0x20]
call fcn.1800c5980
mov rdx, qword [rbp - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rbp + 0x30], xmm1
cmp rdx, 0x10
jb 0x180091b38
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091b29
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009202b
call fcn.1800ce78c
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x60]
mov rdx, qword [rbp - 0x48]
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm1
cmp rdx, 0x10
jb 0x180091b7b
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091b76
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009202b
call fcn.1800ce78c
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x298], r14
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 2
jb 0x180092031
cmp qword [rbp + 0x38], 0x10
lea rax, [0x180116238]
mov qword [rsp + 0x30], 2
lea r9, [rbp - 0x20]
cmovae r9, qword [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x290], r15
call fcn.1800c3cb0
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
lea rdx, [rbp + 0x40]
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rsp + 0x78]
mov r15, rax
cmp rdx, 0x10
jb 0x180091c36
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091c31
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092037
call fcn.1800ce78c
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r13b
nop dword [rax]
test byte [rbp + 0x40], 0x10
je 0x180091f11
mov qword [rbp + 0x20], r13
lea rax, [rbp + 0x6c]
mov qword [rbp + 0x30], r13
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x38], 0xf
inc r8
cmp byte [rax + r8], r13b
jne 0x180091c85
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 0x20]
call fcn.1800c1060
cmp qword [0x18012b690], 0x10
lea rsi, [0x18012b678]
mov rdi, qword [0x18012b688]
cmovae rsi, qword [0x18012b678]
cmp rdi, 0x10
jae 0x180091cd0
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x68], 0xf
movups xmmword [rbp - 0x80], xmm0
jmp 0x180091d40
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180091d1a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180092043
mov rcx, rax
call fcn.1800ce794
mov rcx, rax
test rax, rax
je 0x180092049
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180091d29
test rcx, rcx
je 0x180091d26
call fcn.1800ce794
jmp 0x180091d29
mov rax, r13
lea r8, [rdi + 1]
mov qword [rbp - 0x80], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d1860
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rdi
lea rcx, [rbp + 0x6c]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r13b
jne 0x180091d50
mov rdx, qword [rbp - 0x10]
mov rcx, r14
sub rcx, rdx
cmp rcx, rax
jb 0x18009204f
cmp qword [rbp - 8], 0x10
lea r9, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x60]
cmovae r9, qword [rbp - 0x20]
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
call fcn.1800c3cb0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.18008aa40
mov r9, rax
lea r8, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800c3ac0
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
lea rdx, [0x180116130]
cmovae rcx, qword [rsp + 0x40]
call fcn.1800da3c8
test rax, rax
je 0x180091de2
mov rcx, rax
call fcn.1800da458
mov bl, 1
jmp 0x180091de4
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180091e21
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091e1c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092049
call fcn.1800ce78c
mov rdx, qword [rbp - 0x48]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r13b
cmp rdx, 0x10
jb 0x180091e6f
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091e6a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092049
call fcn.1800ce78c
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180091eaa
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091ea5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092049
call fcn.1800ce78c
test bl, bl
je 0x180091ed6
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180091ec0
lea rdx, [rbp + 0x6c]
lea rcx, [rbp]
call fcn.1800c1060
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180091f11
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091f0c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092025
call fcn.1800ce78c
lea rdx, [rbp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180091c60
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x10]
sub r14, rcx
cmp r14, rdx
jb 0x18009203d
cmp qword [rbp - 8], 0x10
lea r9, [rbp - 0x20]
mov qword [rsp + 0x30], rdx
lea rax, [rbp]
cmovae r9, qword [rbp - 0x20]
cmp qword [rbp + 0x18], 0x10
cmovae rax, qword [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.1800c3cb0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180091fa8
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091fa3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092025
call fcn.1800ce78c
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180091fdf
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091fda
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092025
call fcn.1800ce78c
mov rdi, qword [rsp + 0x2d0]
mov rax, r12
mov rsi, qword [rsp + 0x2c8]
mov r15, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
mov r13, qword [rsp + 0x2d8]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1800ce4d0
add rsp, 0x2a0
pop r12
pop rbx
pop rbp
ret
call fcn.1800dd818
int3
call fcn.1800dd818
int3
call fcn.180088c70
int3
call fcn.1800dd818
int3
call fcn.180088c70
int3
call fcn.180088bd0
int3
call fcn.1800dd818
int3
call fcn.180088c70
int3