Function at 0x1800b7e90
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [rcx + 0x10]
xor r12d, r12d
mov rbx, rcx
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r12b
lea rcx, [rax - 1]
cmp rax, rcx
jb 0x1800b8741
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x1800b7edb
mov rax, qword [rbx]
lea rdx, [rax + rcx]
mov qword [rsp + 0x280], rdi
lea rcx, [rsp + 0x40]
mov r8d, 1
call fcn.1800bef90
mov rdx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rsp + 0x50], 1
jne 0x1800b7f20
cmp byte [rax], 0x5c
jne 0x1800b7f20
xor dil, dil
jmp 0x1800b7f23
mov dil, 1
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x248], r14
mov qword [rsp + 0x240], r15
cmp rdx, 0x10
jb 0x1800b7f76
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b7f71
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b873b
call fcn.1800cb8d0
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r12b
test dil, dil
je 0x1800b8079
add rdx, 2
call fcn.1800c17c0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800b7fb1
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1800be770
mov r8d, 2
lea rdx, [0x180113d24]
lea rcx, [rsp + 0x20]
call fcn.1800be770
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1800b8034
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b80f7
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b8019
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b8735
mov rcx, r8
call fcn.1800cb8d0
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x1800b8147
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800b8147
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b8142
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b8735
jmp 0x1800b8142
inc rdx
call fcn.1800c17c0
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800b808e
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1800be770
mov r8d, 1
lea rdx, [0x18010d2f8]
lea rcx, [rsp + 0x20]
call fcn.1800be770
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1800b810a
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b80f7
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b80f2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b8747
mov rcx, r8
call fcn.1800cb8d0
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
jmp 0x1800b8147
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800b8147
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b8142
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b8747
call fcn.1800cb8d0
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x1800b8154
mov rcx, qword [rbx]
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0x170], rax
mov qword [rsp + 0x30], r12
lea rax, [rbp + 0x2c]
mov qword [rsp + 0x38], 0xf
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 0
inc r8
cmp byte [rax + r8], 0
jne 0x1800b8183
lea rdx, [rbp + 0x2c]
lea rcx, [rsp + 0x20]
call fcn.1800bef90
test byte [rbp], 0x10
jne 0x1800b8648
mov r13, qword [rsp + 0x38]
lea r15, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
cmp r13, 0x10
mov rdi, qword [rsp + 0x30]
cmovae r15, rsi
cmp rdi, 0x10
jae 0x1800b81db
movups xmm0, xmmword [r15]
mov qword [rsp + 0x58], 0xf
movups xmmword [rsp + 0x40], xmm0
jmp 0x1800b8257
movabs rax, 0x7fffffffffffffff
mov r14, rdi
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b822f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b8753
mov rcx, rax
call fcn.1800cb8d8
mov rcx, rax
test rax, rax
je 0x1800b874d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b823e
test rcx, rcx
je 0x1800b823b
call fcn.1800cb8d8
jmp 0x1800b823e
mov rax, r12
lea r8, [rdi + 1]
mov qword [rsp + 0x40], rax
mov rdx, r15
mov rcx, rax
call fcn.1800cef60
mov qword [rsp + 0x58], r14
cmp qword [0x180127790], 0x10
lea r12, [0x180127778]
mov r15, qword [0x180127788]
cmovae r12, qword [0x180127778]
mov qword [rsp + 0x50], rdi
cmp r15, 0x10
jae 0x1800b8295
movups xmm0, xmmword [r12]
mov qword [rsp + 0x78], 0xf
movups xmmword [rsp + 0x60], xmm0
jmp 0x1800b8310
movabs rax, 0x7fffffffffffffff
mov r14, r15
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b82e9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b8753
mov rcx, rax
call fcn.1800cb8d8
mov rcx, rax
test rax, rax
je 0x1800b874d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b82f7
test rcx, rcx
je 0x1800b82f5
call fcn.1800cb8d8
jmp 0x1800b82f7
xor eax, eax
lea r8, [r15 + 1]
mov qword [rsp + 0x60], rax
mov rdx, r12
mov rcx, rax
call fcn.1800cef60
mov qword [rsp + 0x78], r14
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x70], r15
lea rcx, [rbp - 0x80]
call fcn.18008ae30
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.18008c9d0
test eax, eax
jne 0x1800b8652
cmp r13, 0x10
lea r15, [rsp + 0x20]
cmovae r15, rsi
cmp rdi, 0x10
jae 0x1800b835d
movups xmm0, xmmword [r15]
mov qword [rbp - 0x28], 0xf
movups xmmword [rbp - 0x40], xmm0
jmp 0x1800b83d6
movabs rax, 0x7fffffffffffffff
mov r14, rdi
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b83b1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b875f
mov rcx, rax
call fcn.1800cb8d8
mov rcx, rax
test rax, rax
je 0x1800b8759
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b83bf
test rcx, rcx
je 0x1800b83bd
call fcn.1800cb8d8
jmp 0x1800b83bf
xor eax, eax
lea r8, [rdi + 1]
mov qword [rbp - 0x40], rax
mov rdx, r15
mov rcx, rax
call fcn.1800cef60
mov qword [rbp - 0x28], r14
cmp qword [0x180127870], 0x10
lea r12, [0x180127858]
mov r15, qword [0x180127868]
cmovae r12, qword [0x180127858]
mov qword [rbp - 0x30], rdi
cmp r15, 0x10
jae 0x1800b8411
movups xmm0, xmmword [r12]
mov qword [rbp - 0x48], 0xf
movups xmmword [rbp - 0x60], xmm0
jmp 0x1800b848a
movabs rax, 0x7fffffffffffffff
mov r14, r15
or r14, 0xf
cmp r14, rax
cmova r14, rax
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x1800b8465
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800b875f
mov rcx, rax
call fcn.1800cb8d8
mov rcx, rax
test rax, rax
je 0x1800b8759
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800b8473
test rcx, rcx
je 0x1800b8471
call fcn.1800cb8d8
jmp 0x1800b8473
xor eax, eax
lea r8, [r15 + 1]
mov qword [rbp - 0x60], rax
mov rdx, r12
mov rcx, rax
call fcn.1800cef60
mov qword [rbp - 0x48], r14
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x50], r15
lea rcx, [rbp - 0x20]
call fcn.18008ae30
mov rcx, rax
lea rdx, [rbp - 0x40]
call fcn.18008c9d0
test eax, eax
jne 0x1800b8652
mov rax, qword [rbx + 0x10]
xor r12d, r12d
mov qword [rbp - 0x70], r12
mov rdx, rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], r12b
lea r8, [rax - 2]
cmp rax, r8
cmovb r8, rax
cmp qword [rbx + 0x18], 0x10
jb 0x1800b84de
mov rdx, qword [rbx]
lea rcx, [rbp - 0x80]
call fcn.1800bef90
mov r8d, 1
lea rdx, [0x180113be8]
lea rcx, [rbp - 0x80]
call fcn.1800be770
cmp r13, 0x10
lea rdx, [rsp + 0x20]
mov r8, rdi
lea rcx, [rsp + 0x60]
cmovae rdx, rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
call fcn.1800be770
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
cmp qword [rsp + 0x58], 0x10
cmovae rcx, qword [rsp + 0x40]
call fcn.1800d7a54
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800b85aa
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b85a5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b872f
call fcn.1800cb8d0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r12b
cmp rdx, 0x10
jb 0x1800b85fa
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b85f5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b872f
call fcn.1800cb8d0
mov rdx, qword [rbp - 0x68]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r12b
cmp rdx, 0x10
jb 0x1800b8648
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b8643
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b872f
call fcn.1800cb8d0
mov rsi, qword [rsp + 0x20]
mov r13, qword [rsp + 0x38]
cmp r13, 0x10
jb 0x1800b8689
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1800b8681
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800b873b
mov rcx, rsi
call fcn.1800cb8d0
mov rdi, qword [rbp + 0x170]
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1800b86a9
xor r12d, r12d
jmp 0x1800b8165
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800b86e8
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800b86e3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800b873b
mov rcx, r8
call fcn.1800cb8d0
mov r14, qword [rsp + 0x248]
mov r13, qword [rsp + 0x288]
mov rsi, qword [rsp + 0x278]
mov r15, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x280]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rsp, 0x250
pop r12
pop rbx
pop rbp
ret
call fcn.1800dab30
int3
call fcn.1800dab30
int3
call fcn.1800dab30
int3
call fcn.1800bf180
int3
call fcn.1800dab30
int3
call fcn.1800dab30
int3
call fcn.180089c20
int3
call fcn.1800dab30
int3
call fcn.180089c20
int3