Function at 0x18012eb40
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x1d0
mov rax, qword [0x180222e50]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x210]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x218]
mov rbp, r8
mov qword [rsp + 0x48], rax
mov eax, 0x1f3
mov rbx, rcx
sub eax, edx
mov rdx, r8
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x18012ebb0
lea eax, [rcx + 2]
jmp 0x18012ed87
movsxd r10, dword [rsp + 0x34]
mov qword [rsp + 0x1c8], rdi
mov esi, 1
mov rdi, r10
mov qword [rsp + 0x58], r10
nop word [rax + rax]
mov r8d, dword [rbp]
mov dword [rsp + 0x50], r8d
test r8b, 0x10
je 0x18012ed29
cmp byte [rbp + 0x2c], 0x2e
jne 0x18012ec03
movzx eax, byte [rbp + 0x2d]
test al, al
je 0x18012ed53
cmp al, 0x2e
jne 0x18012ec03
cmp byte [rbp + 0x2e], 0
je 0x18012ed53
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x2c]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov r9, rcx
mov qword [rsp + 0x68], rcx
lea eax, [rcx + 1]
cmp dword [rsp + 0x60], eax
jb 0x18012ed49
mov rax, qword [rsp + 0x58]
or rcx, 0xffffffffffffffff
mov rdi, rbx
mov byte [rax + rbx - 1], 0
xor eax, eax
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x2c]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18012ec50
mov eax, dword [rsp + 0x30]
test al, 0x10
je 0x18012ec86
mov r9, qword [rsp + 0x48]
xor edx, edx
mov rcx, rbx
call qword [rsp + 0x40]
mov r9, qword [rsp + 0x68]
mov r10d, dword [rsp + 0x34]
mov esi, eax
mov eax, dword [rsp + 0x30]
test esi, esi
je 0x18012ecea
test al, 0x40
jne 0x18012ecea
lea edx, [r10 + r9]
lea edi, [r10 + r9 + 1]
lea rcx, [rsp + 0x74]
lea eax, [rdx - 1]
mov byte [rdx + rbx], 0x2a
mov r8d, 0x13c
xor edx, edx
mov byte [rdi + rbx], 0
mov dword [rsp + 0x70], 0
mov byte [rax + rbx], 0x5c
call fcn.1800fb1e0
mov rax, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
lea r8, [rsp + 0x70]
mov edx, edi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.18012eb40
mov esi, eax
test byte [rsp + 0x30], 0x20
je 0x18012ed1b
test esi, esi
je 0x18012ed1b
mov rax, qword [rsp + 0x68]
mov edx, dword [rsp + 0x34]
mov r9, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x50]
lea eax, [rdx + rax - 1]
mov rcx, rbx
xor edx, edx
mov byte [rax + rbx], 0
call qword [rsp + 0x40]
mov esi, eax
mov rdi, qword [rsp + 0x58]
mov word [rdi + rbx - 1], 0x2a
jmp 0x18012ed4e
mov r9, qword [rsp + 0x48]
lea rdx, [rbp + 0x2c]
mov rcx, rbx
mov byte [rdi + rbx - 2], 0
call qword [rsp + 0x40]
mov word [rdi + rbx - 2], 0x2a5c
mov esi, eax
jmp 0x18012ed4e
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
test esi, esi
je 0x18012ed72
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, qword [rsp + 0x38]
mov r10d, dword [rsp + 0x34]
test eax, eax
jne 0x18012ebd0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x1c8]
mov eax, esi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800fbf40
add rsp, 0x1d0
pop rsi
pop rbp
pop rbx
ret