Function at 0x180001400
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x138]
sub rsp, 0x238
mov rax, qword [0x18000a040]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov qword [rbp - 0x40], r9
mov r13, r8
mov qword [rbp - 0x38], rdx
mov r15, rcx
mov qword [rbp - 0x30], rcx
mov rsi, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 2
jb 0x180001c6a
mov r12, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x18000146a
mov r12, qword [r15]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea r14, [rsi + 2]
mov ebx, 0xf
lea rdi, [rbp - 0x68]
movabs rax, 0x8000000000000000
lea edx, [rbx + 7]
cmp r14, rbx
jbe 0x180001502
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1800014ca
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1800052a4
test rax, rax
je 0x180001574
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800014fe
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800014ed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001c5e
jmp 0x1800014ab
test rcx, rcx
je 0x1800014fc
call fcn.1800052a4
mov rdi, rax
jmp 0x1800014fe
xor edi, edi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], rbx
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x2a5c
mov byte [rdi + r14], 0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rcx, qword [rbp - 0x68]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x180001580
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000157b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000157b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180005270
movdqa xmm0, xmmword [0x180007630]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
cmp rbx, 0xffffffffffffffff
jne 0x180001610
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x1800015d1
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1800015cc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180001c51
mov rcx, r8
call fcn.180005270
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180005250
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, [rbp + 0xc]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180001620
xorps xmm0, xmm0
xor esi, esi
movabs r12, 0x7fffffffffffffff
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
test byte [rbp - 0x20], 0x10
je 0x180001926
cmp rbx, r12
ja 0x180001c82
cmp rbx, 0xf
ja 0x180001689
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov r8, rbx
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], sil
jmp 0x18000171f
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x1800016a8
mov rdi, r12
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800016cf
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800016ee
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001c70
mov rcx, rax
call fcn.1800052a4
test rax, rax
je 0x180001c35
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800016fb
test rcx, rcx
je 0x1800016fb
call fcn.1800052a4
mov rsi, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov r8, rbx
lea rdx, [rbp + 0xc]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
lea rcx, [rsp + 0x50]
call qword [rbp - 0x40]
test al, al
je 0x180001bde
mov r14, qword [r15 + 0x10]
mov rax, r12
sub rax, r14
cmp rax, 1
jb 0x180001c7c
mov r12, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x180001750
mov r12, qword [r15]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x1800017fe
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1800017a2
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800017c9
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800017e8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001c76
mov rcx, rax
call fcn.1800052a4
test rax, rax
je 0x180001c3c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800017f9
test rcx, rcx
je 0x1800017f7
call fcn.1800052a4
mov rdi, rax
jmp 0x1800017f9
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x5c
mov byte [rdi + rsi], 0
lea rax, [rbp + 0xc]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x180001830
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180001883
lea rax, [rdi + rcx]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0xc]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x30]
jmp 0x180001899
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xc]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180004ae0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor esi, esi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov r9, qword [rbp - 0x40]
mov r8, r13
mov rdx, qword [rbp - 0x38]
lea rcx, [rsp + 0x78]
call fcn.180001400
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180001be0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000191c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c3c
call fcn.180005270
jmp 0x180001be0
cmp rbx, r12
ja 0x180001c64
cmp rbx, 0xf
ja 0x18000195e
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 0xf
mov r8, rbx
lea rdx, [rbp + 0xc]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], sil
jmp 0x1800019f4
mov rdi, rbx
or rdi, 0xf
cmp rdi, r12
jbe 0x18000197d
mov rdi, r12
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800019a4
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800019c3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001c88
mov rcx, rax
call fcn.1800052a4
test rax, rax
je 0x180001c43
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800019d0
test rcx, rcx
je 0x1800019d0
call fcn.1800052a4
mov rsi, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov r8, rbx
lea rdx, [rbp + 0xc]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
lea rcx, [rsp + 0x50]
call r13
test al, al
je 0x180001be0
mov r14, qword [r15 + 0x10]
mov rax, r12
sub rax, r14
cmp rax, 1
jb 0x180001c58
mov r12, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x180001a25
mov r12, qword [r15]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp rsi, rbx
jbe 0x180001ad3
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x180001a77
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x180001a9e
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180001abd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180001c8e
mov rcx, rax
call fcn.1800052a4
test rax, rax
je 0x180001c4a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180001ace
test rcx, rcx
je 0x180001acc
call fcn.1800052a4
mov rdi, rax
jmp 0x180001ace
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x5c
mov byte [rdi + rsi], 0
lea rax, [rbp + 0xc]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x180001b00
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x180001b53
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0xc]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x30]
jmp 0x180001b69
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xc]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180004ae0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor esi, esi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea rcx, [rsp + 0x78]
call qword [rbp - 0x38]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180001be0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001bd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001c4a
call fcn.180005270
jmp 0x180001be0
xor esi, esi
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180001610
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x180001c2c
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x180001c27
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180001c51
mov rcx, r8
call fcn.180005270
mov qword [r15 + 0x10], rsi
jmp 0x1800015d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1800011b0
int3
call fcn.180001110
int3
call fcn.1800011b0
int3
call fcn.1800011b0
int3
call fcn.180001110
int3
call fcn.180001110
int3
call fcn.1800011b0
int3
call fcn.1800011b0
int3
call fcn.180001110
int3
call fcn.180001110
int3