Function at 0x18002b4d8
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x598]
sub rsp, 0x680
mov rbx, rcx
lea rcx, [rbp + 0x170]
xor esi, esi
xor edx, edx
mov r8d, 0x410
mov r15d, esi
call fcn.18002ec70
lea rdx, [rbx + 0xc]
lea rcx, [rbp + 0x170]
mov r8d, 0x1a4
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
lea rdx, [0x18003e5a8]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [0x18003e5b0]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [0x180050ad0]
xor edx, edx
mov r8d, 0x800c
call fcn.18002ec70
mov rdi, qword [0x180050ad0]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x250
lea r14, [rdi + 0xc]
call fcn.18002ec70
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x18002b5c0
mov dl, 2
mov cl, 3
call fcn.18002c99c
jmp 0x18002b728
lea rdx, [0x18003e5b8]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18002b6d1
lea rdx, [0x18003e5bc]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18002b6d1
mov eax, dword [rsp + 0x40]
lea rdx, [rsp + 0x4c]
lea rcx, [r14 + 0x18]
mov dword [r14 + 4], eax
mov eax, dword [rsp + 0x3c]
mov dword [r14 + 8], eax
mov rax, qword [rsp + 0x34]
mov qword [r14 + 0x10], rax
mov eax, dword [rsp + 0x20]
mov dword [r14 + 0xc], eax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [r14 + 0x18]
mov dword [r14], 0x18
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 0x800c
lea eax, [rax*2 + 2]
add dword [r14], eax
mov eax, dword [r14]
add r15d, eax
add r14, rax
mov eax, r15d
add rax, 0x22c
cmp rax, rbx
jb 0x18002b6d1
xor eax, eax
mov rcx, rdi
mov qword [rdi], rax
lea edx, [rax + 0xc]
mov qword [rdi + 4], 0x203
mov dword [rdi], r15d
call fcn.18002c2a8
lea edx, [r15 + 0xc]
mov word [rdi + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
test eax, eax
jle 0x18002b749
mov rcx, qword [0x180050ad8]
xor eax, eax
mov qword [rcx], rax
lea edx, [rax + 0xc]
mov dword [rcx + 8], eax
call fcn.18002e420
cmp eax, 0xffffffff
je 0x18002b749
mov rcx, qword [0x180050ad0]
mov r8d, ebx
xor edx, edx
mov r15d, esi
call fcn.18002ec70
mov rdi, qword [0x180050ad0]
lea r14, [rdi + 0xc]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18002b5c0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov rcx, rdi
mov qword [rdi], rax
lea edx, [rax + 0xc]
mov qword [rdi + 4], 0x40203
mov dword [rdi], r15d
call fcn.18002c2a8
lea edx, [r15 + 0xc]
mov word [rdi + 0xa], ax
mov rcx, qword [0x180050ad0]
call fcn.18002e4dc
test eax, eax
setg sil
lea eax, [rsi - 1]
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
or eax, 0xffffffff
jmp 0x18002b728