Function at 0x1800891d0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f8]
sub rsp, 0x6d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180332088]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov r14, rdx
mov r8, rcx
lea rdx, [0x1802ac140]
lea rcx, [rbp + 0x3b0]
call fcn.18005c530
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x180089497
xor r12d, r12d
nop word [rax + rax]
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180089497
cmp word [rsp + 0x7c], 0x2e
je 0x180089250
movzx eax, word [rsp + 0x7e]
test ax, ax
je 0x180089250
cmp ax, 0x2e
jne 0x180089285
cmp word [rbp - 0x80], 0
je 0x180089250
test byte [rsp + 0x50], 0x10
jne 0x180089250
xor bl, bl
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r12
mov word [rsp + 0x28], r12w
xor r8d, r8d
lea rdx, [0x1802abc2c]
lea rcx, [rsp + 0x28]
call fcn.18005c660
mov word [rsp + 0x48], 0
lea rdx, str..wnpf
lea rcx, [rsp + 0x7c]
call fcn.180232988
test rax, rax
je 0x180089328
mov byte [rsp + 0x48], bl
mov bl, 1
lea r8, [rsp + 0x7c]
lea rdx, [0x1802abd74]
lea rcx, [rbp + 0x1a0]
call fcn.18005c530
lea rcx, [rbp + 0x1a0]
or rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x180089300
lea rax, [rax*2 - 0xa]
cmp rax, 0x208
jae 0x18008948b
mov word [rbp + rax + 0x1a0], r12w
lea rdx, str..swnpf
lea rcx, [rsp + 0x7c]
call fcn.180232988
test rax, rax
je 0x18008939a
mov byte [rsp + 0x48], 1
lea r8, [rsp + 0x7c]
lea rdx, [0x1802abd74]
lea rcx, [rbp + 0x1a0]
call fcn.18005c530
lea rcx, [rbp + 0x1a0]
or rax, 0xffffffffffffffff
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x180089370
lea rax, [rax*2 - 0xc]
cmp rax, 0x208
jae 0x180089491
mov word [rbp + rax + 0x1a0], r12w
jmp 0x1800893a2
test bl, bl
je 0x180089465
cmp word [rbp + 0x1a0], 0
jne 0x1800893b1
mov r8, r12
jmp 0x1800893cb
lea rax, [rbp + 0x1a0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1800893c0
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x28]
call fcn.18005c660
lea rcx, [rbp + 0x1a0]
call fcn.180088920
cmp eax, 1
sete byte [rsp + 0x49]
mov rbx, qword [r14]
mov rdi, qword [r14 + 8]
cmp rbx, rdi
je 0x180089457
movzx esi, word [rbp + 0x1a0]
test si, si
jne 0x18008940d
mov r9, r12
jmp 0x18008942b
lea rax, [rbp + 0x1a0]
or r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp word [rax + r9*2], 0
jne 0x180089420
cmp qword [rbx + 0x18], 8
jb 0x180089437
mov rcx, qword [rbx]
jmp 0x18008943a
mov rcx, rbx
lea r8, [rbp + 0x1a0]
mov rdx, qword [rbx + 0x10]
call fcn.18005c450
test eax, eax
je 0x180089465
add rbx, 0x28
cmp rbx, rdi
jne 0x180089403
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.180089570
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180089250
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.18005cac0
jmp 0x180089250
call fcn.18020404c
int3
call fcn.18020404c
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.1802037a0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret