Function at 0x1800b1fd0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [rcx + 0x10]
xor r12d, r12d
mov rbx, rcx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r12b
lea rcx, [rax - 1]
cmp rax, rcx
jb 0x1800b2881
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x1800b201b
mov rax, qword [rbx]
lea rdx, [rax + rcx]
mov qword [rsp + 0x280], rdi
lea rcx, [rsp + 0x40]
mov r8d, 1
call fcn.1800b8fb0
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rsp + 0x50], 1
jne 0x1800b2060
cmp byte [rax], 0x5c
jne 0x1800b2060
xor dil, dil
jmp 0x1800b2063
mov dil, 1
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x240], r15
cmp rdx, 0x10
jb 0x1800b20b6
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b20b1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b287b
call fcn.1800c1180
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r12b
test dil, dil
je 0x1800b21b9
add rdx, 2
call fcn.1800ba640
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800b20f1
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1800b8790
mov r8d, 2
lea rdx, [0x18010441c]
lea rcx, [rsp + 0x20]
call fcn.1800b8790
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1800b2174
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b2237
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b2159
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b2875
mov rcx, r8
call fcn.1800c1180
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x1800b2287
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800b2287
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b2282
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b2875
jmp 0x1800b2282
inc rdx
call fcn.1800ba640
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800b21ce
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1800b8790
mov r8d, 1
lea rdx, [0x1800fdc18]
lea rcx, [rsp + 0x20]
call fcn.1800b8790
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1800b224a
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b2237
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b2232
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b2887
mov rcx, r8
call fcn.1800c1180
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x1800b2287
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800b2287
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b2282
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b2887
call fcn.1800c1180
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x1800b2294
mov rcx, qword [rbx]
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0x170], rax
mov qword [rsp + 0x30], r12
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x38], 0xf
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 0
inc r8
cmp byte [rax + r8], 0
jne 0x1800b22c3
lea rdx, [rbp + 0x2c]
lea rcx, [rsp + 0x20]
call fcn.1800b8fb0
test byte [rbp], 0x10
jne 0x1800b2788
mov r13, qword [rsp + 0x38]
lea r15, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
cmp r13, 0x10
mov rdi, qword [rsp + 0x30]
cmovae r15, rsi
cmp rdi, 0x10
jae 0x1800b231b
movups xmm0, xmmword [r15]
mov qword [rsp + 0x58], 0xf
movups xmmword [rsp + 0x40], xmm0
jmp 0x1800b2397
movabs rax, 0x7fffffffffffffff
mov r14, rdi
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b236f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b2893
mov rcx, rax
call fcn.1800c1188
mov rcx, rax
test rax, rax
je 0x1800b288d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b237e
test rcx, rcx
je 0x1800b237b
call fcn.1800c1188
jmp 0x1800b237e
mov rax, r12
lea r8, [rdi + 1]
mov qword [rsp + 0x40], rax
mov rdx, r15
mov rcx, rax
call fcn.1800c41f0
mov qword [rsp + 0x58], r14
cmp qword [0x180117330], 0x10
lea r12, [0x180117318]
mov r15, qword [0x180117328]
cmovae r12, qword [0x180117318]
mov qword [rsp + 0x50], rdi
cmp r15, 0x10
jae 0x1800b23d5
movups xmm0, xmmword [r12]
mov qword [rsp + 0x78], 0xf
movups xmmword [rsp + 0x60], xmm0
jmp 0x1800b2450
movabs rax, 0x7fffffffffffffff
mov r14, r15
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b2429
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b2893
mov rcx, rax
call fcn.1800c1188
mov rcx, rax
test rax, rax
je 0x1800b288d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b2437
test rcx, rcx
je 0x1800b2435
call fcn.1800c1188
jmp 0x1800b2437
xor eax, eax
lea r8, [r15 + 1]
mov qword [rsp + 0x60], rax
mov rdx, r12
mov rcx, rax
call fcn.1800c41f0
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], r15
lea rcx, [rbp - 0x80]
call fcn.18008a760
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18008c300
test eax, eax
jne 0x1800b2792
cmp r13, 0x10
lea r15, [rsp + 0x20]
cmovae r15, rsi
cmp rdi, 0x10
jae 0x1800b249d
movups xmm0, xmmword [r15]
mov qword [rbp - 0x28], 0xf
movups xmmword [rbp - 0x40], xmm0
jmp 0x1800b2516
movabs rax, 0x7fffffffffffffff
mov r14, rdi
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b24f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b289f
mov rcx, rax
call fcn.1800c1188
mov rcx, rax
test rax, rax
je 0x1800b2899
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b24ff
test rcx, rcx
je 0x1800b24fd
call fcn.1800c1188
jmp 0x1800b24ff
xor eax, eax
lea r8, [rdi + 1]
mov qword [rbp - 0x40], rax
mov rdx, r15
mov rcx, rax
call fcn.1800c41f0
mov qword [rbp - 0x28], r14
cmp qword [0x1801173f0], 0x10
lea r12, [0x1801173d8]
mov r15, qword [0x1801173e8]
cmovae r12, qword [0x1801173d8]
mov qword [rbp - 0x30], rdi
cmp r15, 0x10
jae 0x1800b2551
movups xmm0, xmmword [r12]
mov qword [rbp - 0x48], 0xf
movups xmmword [rbp - 0x60], xmm0
jmp 0x1800b25ca
movabs rax, 0x7fffffffffffffff
mov r14, r15
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b25a5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b289f
mov rcx, rax
call fcn.1800c1188
mov rcx, rax
test rax, rax
je 0x1800b2899
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b25b3
test rcx, rcx
je 0x1800b25b1
call fcn.1800c1188
jmp 0x1800b25b3
xor eax, eax
lea r8, [r15 + 1]
mov qword [rbp - 0x60], rax
mov rdx, r12
mov rcx, rax
call fcn.1800c41f0
mov qword [rbp - 0x48], r14
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], r15
lea rcx, [rbp - 0x20]
call fcn.18008a760
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.18008c300
test eax, eax
jne 0x1800b2792
mov rax, qword [rbx + 0x10]
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov rdx, rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
lea r8, [rax - 2]
cmp rax, r8
cmovb r8, rax
cmp qword [rbx + 0x18], 0x10
jb 0x1800b261e
mov rdx, qword [rbx]
lea rcx, [rbp - 0x80]
call fcn.1800b8fb0
mov r8d, 1
lea rdx, [0x180103e98]
lea rcx, [rbp - 0x80]
call fcn.1800b8790
cmp r13, 0x10
lea rdx, [rsp + 0x20]
mov r8, rdi
lea rcx, [rsp + 0x60]
cmovae rdx, rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.1800b8790
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.1800c9574
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800b26ea
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b26e5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b286f
call fcn.1800c1180
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r12b
cmp rdx, 0x10
jb 0x1800b273a
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b2735
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b286f
call fcn.1800c1180
mov rdx, qword [rbp - 0x68]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r12b
cmp rdx, 0x10
jb 0x1800b2788
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b2783
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b286f
call fcn.1800c1180
mov rsi, qword [rsp + 0x20]
mov r13, qword [rsp + 0x38]
cmp r13, 0x10
jb 0x1800b27c9
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800b27c1
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b287b
mov rcx, rsi
call fcn.1800c1180
mov rdi, qword [rbp + 0x170]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1800b27e9
xor r12d, r12d
jmp 0x1800b22a5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b2828
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b2823
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b287b
mov rcx, r8
call fcn.1800c1180
mov r14, qword [rsp + 0x248]
mov r13, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x278]
mov r15, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x280]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret
call fcn.1800cc350
int3
call fcn.1800cc350
int3
call fcn.1800cc350
int3
call fcn.1800b91a0
int3
call fcn.1800cc350
int3
call fcn.1800cc350
int3
call fcn.180089550
int3
call fcn.1800cc350
int3
call fcn.180089550
int3