Function at 0x1800bb290
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x18012a010]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov rax, qword [rcx + 0x10]
xor r15d, r15d
mov rbx, rcx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r15b
lea rcx, [rax - 1]
cmp rax, rcx
jb 0x1800bbaba
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x1800bb2ff
mov rax, qword [rbx]
lea rdx, [rax + rcx]
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.1800c2b50
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rsp + 0x30], 1
jne 0x1800bb33c
cmp byte [rax], 0x5c
jne 0x1800bb33c
xor dil, dil
jmp 0x1800bb33f
mov dil, 1
cmp rdx, 0x10
jb 0x1800bb372
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb36d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbab4
call fcn.1800cf9b0
test dil, dil
je 0x1800bb427
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r15b
lea rdx, [r8 + 1]
cmp rdx, 0xf
jbe 0x1800bb3af
lea rcx, [rsp + 0x60]
call fcn.1800c8f90
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x70], r15
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800bb3bc
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
call fcn.1800c22c0
mov r8d, 1
lea rdx, [0x180118c68]
lea rcx, [rsp + 0x60]
call fcn.1800c22c0
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1800c2400
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800bb427
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb422
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbac0
call fcn.1800cf9b0
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r15b
lea rdx, [r8 + 3]
cmp rdx, 0xf
jbe 0x1800bb45b
lea rcx, [rsp + 0x40]
call fcn.1800c8f90
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x50], r15
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800bb468
mov rdx, qword [rbx]
lea rcx, [rsp + 0x40]
call fcn.1800c22c0
mov r8d, 3
lea rdx, [0x180118ce8]
lea rcx, [rsp + 0x40]
call fcn.1800c22c0
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
lea rdx, [rbp - 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rsp + 0x58]
mov r12, rax
cmp rdx, 0x10
jb 0x1800bb4e4
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb4df
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbac6
call fcn.1800cf9b0
mov qword [rsp + 0x50], r15
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r15b
nop dword [rax]
nop word [rax + rax]
mov qword [rbp - 0x70], r15
lea rax, [rbp - 0x14]
mov qword [rbp - 0x68], 0xf
mov r8, 0xffffffffffffffff
mov byte [rbp - 0x80], 0
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800bb530
lea rdx, [rbp - 0x14]
lea rcx, [rbp - 0x80]
call fcn.1800c2b50
test byte [rbp - 0x40], 0x10
mov r8, qword [rbx + 0x10]
lea rdx, [r8 + 1]
je 0x1800bb8bd
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp rdx, 0xf
jbe 0x1800bb585
lea rcx, [rsp + 0x60]
call fcn.1800c8f90
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x70], r15
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800bb592
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
call fcn.1800c22c0
mov r8d, 1
lea rdx, [0x180118c68]
lea rcx, [rsp + 0x60]
call fcn.1800c22c0
cmp qword [rbp - 0x68], 0x10
lea rdx, [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rsp + 0x60]
cmovae rdx, qword [rbp - 0x80]
call fcn.1800c22c0
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x78]
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm1
cmp rdx, 0x10
jb 0x1800bb62a
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb625
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbacc
call fcn.1800cf9b0
mov rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
lea rcx, [rax - 1]
cmp rax, rcx
jb 0x1800bbaba
sub rax, rcx
lea rdx, [rbp - 0x60]
mov r8d, 1
cmp rax, r8
cmovb r8, rax
cmp qword [rbp - 0x48], 0x10
cmovae rdx, qword [rbp - 0x60]
add rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1800c2b50
mov rdx, qword [rsp + 0x38]
lea rax, [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
cmp rdx, 0x10
cmovae rax, rcx
cmp qword [rsp + 0x30], 1
jne 0x1800bb6a2
cmp byte [rax], 0x2e
jne 0x1800bb6a2
xor sil, sil
jmp 0x1800bb6a5
mov sil, 1
cmp rdx, 0x10
jb 0x1800bb6d8
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb6d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbab4
call fcn.1800cf9b0
mov r13, qword [rbp - 0x48]
mov rdi, qword [rbp - 0x60]
test sil, sil
je 0x1800bb7aa
mov r14, qword [rbp - 0x50]
cmp r13, 0x10
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
lea r15, [rbp - 0x60]
cmovae r15, rdi
cmp r14, 0x10
jae 0x1800bb71d
movups xmm0, xmmword [r15]
mov qword [rsp + 0x38], 0xf
movups xmmword [rsp + 0x20], xmm0
jmp 0x1800bb798
movabs rax, 0x7fffffffffffffff
mov rsi, r14
or rsi, 0xf
cmp rsi, rax
cmova rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1800bb771
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800bbad8
mov rcx, rax
call fcn.1800cf9b8
mov rcx, rax
test rax, rax
je 0x1800bbad2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800bb77f
test rcx, rcx
je 0x1800bb77d
call fcn.1800cf9b8
jmp 0x1800bb77f
xor eax, eax
lea r8, [r14 + 1]
mov qword [rsp + 0x20], rax
mov rdx, r15
mov rcx, rax
call fcn.1800d3040
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], r14
call fcn.1800bb290
xor r15d, r15d
cmp r13, 0x10
jb 0x1800bb7e1
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800bb7d9
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbab4
mov rcx, rdi
call fcn.1800cf9b0
movabs r13, 0x7fffffffffffffff
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1800bb826
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb821
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbab4
call fcn.1800cf9b0
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800bb510
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800bb87e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800bb879
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800bbab4
mov rcx, r8
call fcn.1800cf9b0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1800cf6f0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
cmp rdx, 0xf
jbe 0x1800bb8e9
lea rcx, [rsp + 0x20]
call fcn.1800c8f90
mov r8, qword [rbx + 0x10]
mov qword [rsp + 0x30], r15
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1800bb8f6
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
call fcn.1800c22c0
mov r8d, 1
lea rdx, [0x180118c68]
lea rcx, [rsp + 0x20]
call fcn.1800c22c0
cmp qword [rbp - 0x68], 0x10
lea rdx, [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rsp + 0x20]
cmovae rdx, qword [rbp - 0x80]
call fcn.1800c22c0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800bb99a
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bb995
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbade
call fcn.1800cf9b0
cmp qword [rsp + 0x78], 0x10
lea r14, [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
cmovae r14, qword [rsp + 0x60]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
cmp rsi, 0x10
jae 0x1800bb9d4
movups xmm0, xmmword [r14]
mov qword [rsp + 0x38], 0xf
movups xmmword [rsp + 0x20], xmm0
jmp 0x1800bba46
mov rdi, rsi
or rdi, 0xf
cmp rdi, r13
cmova rdi, r13
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1800bba1e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800bbaea
mov rcx, rax
call fcn.1800cf9b8
mov rcx, rax
test rax, rax
je 0x1800bbae4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800bba2d
test rcx, rcx
je 0x1800bba2a
call fcn.1800cf9b8
jmp 0x1800bba2d
mov rax, r15
lea r8, [rsi + 1]
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rax
call fcn.1800d3040
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rsi
call fcn.18008bab0
cmp eax, 0x19000
jle 0x1800bba72
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
cmovae rcx, qword [rsp + 0x60]
call fcn.1800dbb34
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800bb7eb
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800bbaaa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800bbaf0
call fcn.1800cf9b0
jmp 0x1800bb7eb
call fcn.1800dec10
int3
call fcn.1800c2e00
int3
call fcn.1800dec10
int3
call fcn.1800dec10
int3
call fcn.1800dec10
int3
call fcn.1800dec10
int3
call fcn.1800892e0
int3
call fcn.1800dec10
int3
call fcn.1800dec10
int3
call fcn.1800892e0
int3
call fcn.1800dec10
int3