Function at 0x18000a380
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x750], rbx
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x610], rax
mov rdi, rdx
mov qword [rsp + 0x38], rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x400]
call fcn.180021060
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea rbx, [0x180039a84]
lea rcx, [0x1800399e8]
cmp word [rdi + rax*2 - 2], 0x5c
cmove rbx, rcx
mov qword [rsp + 0x40], rbx
mov dword [rbp + 0x1e0], 0x730025
mov dword [rbp + 0x1e4], 0x730025
mov dword [rbp + 0x1e8], 0x2e002a
mov dword [rbp + 0x1ec], 0x2a
mov r9, rbx
mov r8, rdi
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x400]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x400]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x18000a461
xor al, al
jmp 0x18000a62d
mov dword [rbp + 0x1d0], 0x730025
mov dword [rbp + 0x1d4], 0x730025
mov dword [rbp + 0x1d8], 0x730025
xor ecx, ecx
mov word [rbp + 0x1dc], cx
nop dword [rax + rax]
cmp word [rbp - 0x54], 0x2e
je 0x18000a5ee
lea rax, [rbp - 0x54]
mov r9, rbx
mov r8, rdi
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1f0]
mov qword [rsp + 0x20], rax
test byte [rbp - 0x80], 0x10
je 0x18000a4d8
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call fcn.18000a380
jmp 0x18000a5ee
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 7
mov qword [rsp + 0x68], rdx
xor r8d, r8d
mov qword [rsp + 0x60], r8
mov word [rsp + 0x50], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1f0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
ja 0x18000a613
cmp rcx, rdx
jbe 0x18000a53b
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.18000ef70
mov rdx, qword [rsp + 0x68]
jmp 0x18000a54b
test rcx, rcx
jne 0x18000a54b
mov qword [rsp + 0x60], r8
mov word [rsp + 0x50], r8w
test rbx, rbx
setne al
test al, al
je 0x18000a593
lea rcx, [rsp + 0x50]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x50]
lea rdi, [rbx + rbx]
mov r8, rdi
lea rdx, [rbp + 0x1f0]
call fcn.18001bea0
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rax, qword [rsp + 0x50]
xor ecx, ecx
mov word [rdi + rax], cx
mov rdi, qword [rsi + 0x38]
lea r8, [rsp + 0x50]
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.18000ec00
mov rdx, qword [rsi + 0x40]
movabs rcx, 0x666666666666665
sub rcx, rdx
cmp rcx, 1
jb 0x18000a606
lea rcx, [rdx + 1]
mov qword [rsi + 0x40], rcx
mov qword [rdi + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
cmp qword [rsp + 0x68], 8
jb 0x18000a5e4
mov rcx, qword [rsp + 0x50]
call fcn.18001be54
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18000a620
jmp 0x18000a490
lea rcx, str.list_T__too_long
call fcn.18001aaa0
nop
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.18001be70
mov rbx, qword [rsp + 0x750]
add rsp, 0x720
pop rdi
pop rsi
pop rbp
ret