Function at 0x1800b53f0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x6f8], rbx
mov rax, qword [0x1801903f8]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov r12, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1800b50a0
mov r14, rax
test rax, rax
je 0x1800b5712
xor r15d, r15d
mov word [rbp + 0x180], r15w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x182]
call fcn.18007ead0
lea r8, [rbp + 0x180]
mov rdx, rbx
mov rcx, rdi
call fcn.1800b5200
mov word [rbp + 0x380], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x382]
call fcn.18007ead0
lea r9, [rbp + 0x180]
mov r8, r14
lea rdx, [0x18014aee0]
lea rcx, [rbp + 0x380]
call fcn.180002970
mov dword [rsp + 0x30], r15d
xor edx, edx
mov r8d, 0x24c
lea rcx, [rsp + 0x34]
call fcn.18007ead0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x1800b570a
nop word [rax + rax]
lea rdx, [0x18012eeb4]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800b56be
lea rdx, [0x18012eeb0]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1800b56be
test byte [rsp + 0x30], 0x10
jne 0x1800b56be
call fcn.180032e40
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
je 0x1800b56f6
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea r10, [rax + 0x18]
mov qword [rsp + 0x20], r10
lea rcx, [rsp + 0x5c]
lea rax, [rsp + 0x5c]
test rax, 0xffffffffffff0000
jne 0x1800b5591
movzx edi, cx
mov ecx, edi
call fcn.180035ed8
test rax, rax
je 0x1800b568b
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800155c0
jmp 0x1800b568b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x5c]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x1800b560b
lea rdx, [r10 - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x1800b568b
cmp dword [rdx + 0x10], eax
jge 0x1800b55dd
cmp dword [r10 - 0xc], eax
jl 0x1800b56d5
mov dword [r10 - 0x10], r15d
mov rax, qword [rsp + 0x20]
mov word [rax], r15w
jmp 0x1800b568b
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800b55f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x20], rax
jmp 0x1800b568b
mov esi, dword [r10 - 0x10]
lea rbx, [rsp + 0x5c]
sub rbx, r10
sar rbx, 1
test ecx, ecx
js 0x1800b56eb
mov ecx, 1
sub ecx, dword [r10 - 8]
mov eax, dword [r10 - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800b5646
mov edx, edi
lea rcx, [rsp + 0x20]
call fcn.180004860
mov r10, qword [rsp + 0x20]
movsxd rax, edi
movsxd rdx, dword [r10 - 0xc]
mov rcx, r10
add rdx, rdx
cmp rbx, rsi
lea rsi, [rax + rax]
mov r9, rsi
ja 0x1800b566a
lea r8, [r10 + rbx*2]
call fcn.18007f2bc
jmp 0x1800b5674
lea r8, [rsp + 0x5c]
call fcn.18007f224
mov rax, qword [rsp + 0x20]
cmp edi, dword [rax - 0xc]
jg 0x1800b56e0
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x20]
mov word [rsi + rax], r15w
lea r8, [rsp + 0x20]
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.180111b44
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800b56be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1800b5701
jmp 0x1800b54f0
mov ecx, 0x80070057
call fcn.180004010
int3
mov ecx, 0x80070057
call fcn.180004010
int3
mov ecx, 0x80070057
call fcn.180004010
nop
mov ecx, 0x80004005
call fcn.180004010
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r14
call fcn.18003081c
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.18007e1e0
mov rbx, qword [rsp + 0x6f8]
add rsp, 0x6a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret