Function at 0x18009e000
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x4b0
mov rax, qword [0x1801dc960]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rsi, rcx
mov rbp, r8
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x391]
xor edx, edx
mov r8d, 0x103
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x390], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x281]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x280], 0
call fcn.1800f4fb0
lea rcx, [rsp + 0x280]
sub rcx, rsi
mov rdx, rsi
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [rcx + rdx - 1], al
test al, al
jne 0x18009e080
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp byte [rcx + rsi - 2], 0x5c
je 0x18009e0bc
lea rdi, [rsp + 0x280]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x180151570]
mov word [rdi - 1], ax
xor esi, esi
mov rcx, rsi
movzx eax, byte [rsp + rcx + 0x280]
inc rcx
mov byte [rsp + rcx + 0x38f], al
test al, al
jne 0x18009e0c1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
mov eax, dword [0x18015d30c]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x390]
mov dword [rdi - 1], eax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18009e125
mov rcx, qword [0x1801e1b60]
test rcx, rcx
je 0x18009e11e
mov rax, qword [rcx]
call qword [rax + 8]
xor eax, eax
jmp 0x18009e2a4
test byte [rsp + 0x30], 0x10
je 0x18009e1df
lea rsi, [rsp + 0x5c]
lea rdi, [0x180151958]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x18009e27d
lea rsi, [rsp + 0x5c]
lea rdi, [0x18015d308]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x18009e27d
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x170], 0
call fcn.1800f4fb0
xor esi, esi
mov rdx, rsi
movzx eax, byte [rsp + rdx + 0x280]
inc rdx
mov byte [rsp + rdx + 0x16f], al
test al, al
jne 0x18009e184
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x5c]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18009e1b1
mov r9, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x170]
mov r8, rbp
call fcn.18009e000
jmp 0x18009e27f
lea rcx, [rsp + 0x171]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x170], 0
call fcn.1800f4fb0
mov rdx, rsi
nop
movzx eax, byte [rsp + rdx + 0x280]
inc rdx
mov byte [rsp + rdx + 0x16f], al
test al, al
jne 0x18009e200
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x5c]
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x18009e230
mov rdx, qword [rsp + 0x28]
mov edi, 1
lea rcx, [rsp + 0x170]
cmp dword [rbp], edi
mov r8d, edi
cmove r8d, esi
call fcn.18009d740
mov rcx, qword [rsp + 0x20]
mov dword [rcx], eax
mov ecx, dword [0x18028f15c]
test eax, eax
cmove ecx, edi
dec dword [rbp]
mov dword [0x18028f15c], ecx
jmp 0x18009e27f
xor esi, esi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18009e125
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0x18028f15c]
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1800f4f80
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4b0
pop rdi
pop rsi
pop rbp
ret