Function at 0x1800b5a70
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rdi
push r12
push r14
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x18012a010]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rax, qword [rdx + 0x10]
xor r12d, r12d
mov rdi, rcx
mov dword [rsp + 0x60], r12d
mov rbx, rdx
mov qword [rbp - 0x68], r12
mov r14d, r12d
mov qword [rbp - 0x60], 0xf
lea rcx, [rax - 1]
mov byte [rbp - 0x78], r12b
cmp rax, rcx
jb 0x1800b60de
cmp qword [rdx + 0x18], 0x10
mov rax, rdx
jb 0x1800b5ad7
mov rax, qword [rdx]
lea rdx, [rax + rcx]
mov qword [rsp + 0x240], rsi
lea rcx, [rbp - 0x78]
mov r8d, 1
call fcn.1800c2ee0
mov rdx, qword [rbp - 0x60]
lea rax, [rbp - 0x78]
mov rcx, qword [rbp - 0x78]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rbp - 0x68], 1
jne 0x1800b5b17
cmp byte [rax], 0x5c
jne 0x1800b5b17
xor sil, sil
jmp 0x1800b5b1a
mov sil, 1
mov qword [rsp + 0x248], r15
cmp rdx, 0x10
jb 0x1800b5b55
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5b50
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60d8
call fcn.1800cfd40
mov r8, qword [rbx + 0x10]
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], r12b
test sil, sil
je 0x1800b5c08
lea rdx, [r8 + 2]
cmp rdx, 0xf
jbe 0x1800b5b8d
lea rcx, [rbp - 0x78]
call fcn.1800c9320
mov r8, qword [rbx + 0x10]
mov qword [rbp - 0x68], r12
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800b5b9a
mov rdx, qword [rbx]
lea rcx, [rbp - 0x78]
call fcn.1800c2650
mov r8d, 2
lea rdx, [0x180118d54]
lea rcx, [rbp - 0x78]
call fcn.1800c2650
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.1800c2790
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1800b5c96
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5c91
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60d2
jmp 0x1800b5c91
lea rdx, [r8 + 1]
cmp rdx, 0xf
jbe 0x1800b5c23
lea rcx, [rbp - 0x78]
call fcn.1800c9320
mov r8, qword [rbx + 0x10]
mov qword [rbp - 0x68], r12
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800b5c30
mov rdx, qword [rbx]
lea rcx, [rbp - 0x78]
call fcn.1800c2650
mov r8d, 1
lea rdx, [0x180112318]
lea rcx, [rbp - 0x78]
call fcn.1800c2650
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.1800c2790
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1800b5c96
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5c91
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60e4
call fcn.1800cfd40
xor r8d, r8d
mov qword [rdi + 0x10], r12
lea rdx, [0x18010e0d0]
mov qword [rdi + 0x18], 0xf
mov rcx, rdi
mov byte [rdi], r12b
call fcn.1800c2ee0
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x1800b5cc4
mov rcx, qword [rbx]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
nop dword [rax]
nop word [rax + rax]
mov qword [rbp - 0x68], r12
lea rax, [rbp - 0x24]
mov qword [rbp - 0x60], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbp - 0x78], r12b
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1800b5d00
lea rdx, [rbp - 0x24]
lea rcx, [rbp - 0x78]
call fcn.1800c2ee0
test byte [rbp - 0x50], 0x10
jne 0x1800b5ffd
mov rax, qword [rbx + 0x10]
mov rdx, rbx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r12b
lea r8, [rax - 2]
cmp rax, r8
cmovb r8, rax
cmp qword [rbx + 0x18], 0x10
jb 0x1800b5d4f
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
call fcn.1800c2ee0
mov r8d, 1
lea rdx, [0x180118bb8]
lea rcx, [rsp + 0x40]
call fcn.1800c2650
cmp qword [rbp - 0x60], 0x10
lea rdx, [rbp - 0x78]
mov r8, qword [rbp - 0x68]
lea rcx, [rsp + 0x20]
cmovae rdx, qword [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.1800c2650
lea rcx, [rsp + 0x68]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.1800b5740
mov rdx, qword [rsp + 0x38]
test al, al
sete sil
cmp rdx, 0x10
jb 0x1800b5e19
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5e14
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60ea
call fcn.1800cfd40
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r12b
cmp rdx, 0x10
jb 0x1800b5e69
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5e64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60ea
call fcn.1800cfd40
test sil, sil
je 0x1800b5e83
mov r8d, 1
lea rdx, [0x1801195fc]
mov rcx, rdi
call fcn.1800c2ee0
mov rax, qword [rbx + 0x10]
or r14d, 1
mov qword [rsp + 0x50], r12
mov rdx, rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r12b
lea r8, [rax - 2]
cmp rax, r8
cmovb r8, rax
cmp qword [rbx + 0x18], 0x10
jb 0x1800b5eb6
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
call fcn.1800c2ee0
mov r8d, 1
lea rdx, [0x180118bb8]
lea rcx, [rsp + 0x40]
call fcn.1800c2650
cmp qword [rbp - 0x60], 0x10
lea rdx, [rbp - 0x78]
mov r8, qword [rbp - 0x68]
lea rcx, [rsp + 0x20]
cmovae rdx, qword [rbp - 0x78]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.1800c2650
lea rcx, [rsp + 0x68]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.18008b9c0
cmp eax, 0x2800
jge 0x1800b5f4f
cmp qword [rdi + 0x10], r12
jne 0x1800b5f4f
mov sil, 1
jmp 0x1800b5f52
xor sil, sil
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800b5f8f
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5f8a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60cc
call fcn.1800cfd40
mov rdx, qword [rsp + 0x58]
and r14d, 0xfffffffc
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r12b
cmp rdx, 0x10
jb 0x1800b5fe3
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b5fde
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60cc
call fcn.1800cfd40
test sil, sil
je 0x1800b5ffd
mov r8d, 1
lea rdx, [0x18010f580]
mov rcx, rdi
call fcn.1800c2ee0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1800b6038
mov rcx, qword [rbp - 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b6033
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b60d8
call fcn.1800cfd40
lea rdx, [rbp - 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800b5ce0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b608c
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b6087
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b60d8
mov rcx, r8
call fcn.1800cfd40
mov r15, qword [rsp + 0x248]
mov rax, rdi
mov rsi, qword [rsp + 0x240]
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r12b
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1800cfa80
add rsp, 0x200
pop r14
pop r12
pop rdi
pop rbx
pop rbp
ret
call fcn.1800defa0
int3
call fcn.1800defa0
int3
call fcn.1800defa0
int3
call fcn.1800c3190
int3
call fcn.1800defa0
int3
call fcn.1800defa0
int3