Function at 0x180045ec0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa48]
sub rsp, 0xb48
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0xa30], rax
mov dword [rsp + 0x40], r9d
mov qword [rbp - 0x68], r8
mov rdi, rdx
mov r15, rcx
mov qword [rbp - 0x80], rcx
mov rax, qword [rbp + 0xab0]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0xab8]
mov qword [rbp - 0x70], rax
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x34], 1
call fcn.1800f3548
mov rcx, rax
test rax, rax
je 0x180046780
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
call fcn.1800f3548
mov rcx, rax
test rax, rax
je 0x18004678b
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x58], rbx
lea r13, [r14 - 1]
test rdi, rdi
je 0x180046716
mov rax, r13
nop dword [rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x180045f80
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.180007b10
mov rdi, qword [rbp - 0x50]
movsxd rbx, dword [rdi - 0x10]
lea r12, [rdi - 0x18]
cmp ebx, 1
jg 0x180045fbd
mov rcx, r12
call fcn.18000f360
add rax, 0x18
mov qword [rsp + 0x70], rax
jmp 0x180045fff
mov rcx, qword [r12]
test rcx, rcx
je 0x180045fd1
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x180045fdf
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
lea rcx, [rdi - 2]
lea rdx, [rcx + rbx*2]
mov r9, rax
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.18001cbf0
mov rax, qword [rsp + 0x70]
mov dword [rsp + 0x30], 1
cmp dword [rax - 0x10], 1
jne 0x180046017
cmp word [rax], 0x5c
jne 0x180046017
mov bl, 1
jmp 0x180046019
xor bl, bl
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180046033
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
je 0x18004612d
mov qword [rsp + 0x48], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x180046057
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x180046068
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x180046796
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x30], 3
lea r9, [0x180156698]
mov rax, r13
inc rax
cmp word [r9 + rax*2], 0
jne 0x180046092
mov dword [rsp + 0x20], eax
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.18000f130
mov rdx, qword [rsp + 0x48]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp - 0x58]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x180046117
cmp dword [rsi + 0x10], 0
jl 0x180046109
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x180046109
mov rcx, rbx
call fcn.18000f360
mov r14, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1800460fc
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [r14 + 0x18]
mov qword [rbp - 0x58], rax
xor r14d, r14d
jmp 0x180046117
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.180007b10
nop
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x18004622a
jmp 0x18004621e
mov qword [rsp + 0x50], r14
mov rcx, qword [r12]
test rcx, rcx
je 0x180046149
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x18004615a
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rcx, rcx
je 0x1800467a1
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 5
lea r9, [0x180155a80]
mov rax, r13
inc rax
cmp word [r9 + rax*2], 0
jne 0x180046184
mov dword [rsp + 0x20], eax
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000f130
mov rdx, qword [rsp + 0x50]
lea rbx, [rdx - 0x18]
mov rsi, qword [rbp - 0x58]
add rsi, 0xffffffffffffffe8
cmp rbx, rsi
je 0x180046209
cmp dword [rsi + 0x10], 0
jl 0x1800461fb
mov rax, qword [rsi]
cmp qword [rbx], rax
jne 0x1800461fb
mov rcx, rbx
call fcn.18000f360
mov r14, rax
mov ecx, r13d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1800461ee
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
lea rax, [r14 + 0x18]
mov qword [rbp - 0x58], rax
xor r14d, r14d
jmp 0x180046209
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.180007b10
nop
mov dword [rsp + 0x30], 1
mov eax, r13d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x180046232
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 8]
mov dword [rsp + 0x30], 1
lea rdx, [rbp - 0x40]
mov rbx, qword [rbp - 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x180046716
mov rsi, rax
nop word [rax + rax]
mov r14d, dword [rsp + 0x30]
cmp dword [r15 + 0x220], 0
jne 0x180046706
movzx ecx, word [rbp - 0x14]
movzx eax, word [rbp - 0x12]
cmp cx, word [0x180155a8c]
jne 0x180046291
cmp ax, word [0x180155a8e]
je 0x1800466eb
cmp cx, word [0x180155a90]
jne 0x1800462b4
cmp ax, word [0x180155a92]
jne 0x1800462b4
movzx eax, word [rbp - 0x10]
cmp ax, word [0x180155a94]
je 0x1800466eb
movsxd rbx, dword [rdi - 0x10]
cmp ebx, 1
jg 0x1800462d0
mov rcx, r12
call fcn.18000f360
add rax, 0x18
mov qword [rsp + 0x78], rax
jmp 0x180046316
mov rcx, qword [r12]
test rcx, rcx
je 0x1800462e4
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1800462f2
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, qword [rbp - 0x50]
sub rcx, 2
lea rdx, [rcx + rbx*2]
mov r9, rax
mov r8d, 1
lea rcx, [rsp + 0x78]
call fcn.18001cbf0
mov rax, qword [rsp + 0x78]
or dword [rsp + 0x30], 8
cmp dword [rax - 0x10], 1
jne 0x18004632b
cmp word [rax], 0x5c
jne 0x18004632b
mov bl, 1
jmp 0x18004632d
xor bl, bl
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180046347
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
je 0x180046458
mov qword [rsp + 0x58], 0
mov rcx, qword [r12]
test rcx, rcx
je 0x18004636c
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x180046383
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x1800467ac
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
or r14d, 0x18
mov dword [rsp + 0x30], r14d
lea rcx, [rbp - 0x14]
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800463a5
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x14]
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x50]
lea rcx, [rsp + 0x58]
call fcn.18000f130
mov rdx, qword [rsp + 0x58]
lea rsi, [rdx - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x18004642d
cmp dword [rbx + 0x10], 0
jl 0x180046420
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x180046420
mov rcx, rsi
call fcn.18000f360
mov r15, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x180046412
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x58], rax
mov r15, qword [rbp - 0x80]
jmp 0x18004642d
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.180007b10
and r14d, 0xffffffef
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1800465f4
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
jmp 0x1800465f4
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov rcx, qword [r12]
test rcx, rcx
je 0x180046473
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x18004648a
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x180046775
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
or r14d, 0x28
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x20], 1
lea r9, [0x180155ad4]
mov r8d, dword [rdi - 0x10]
mov rdx, qword [rbp - 0x50]
lea rcx, [rsp + 0x60]
call fcn.18000f130
nop
mov qword [rsp + 0x68], rbx
mov rbx, qword [rsp + 0x60]
lea r12, [rbx - 0x18]
mov rcx, qword [r12]
test rcx, rcx
je 0x1800464e9
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x180046500
call fcn.1800f3548
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
test rax, rax
je 0x1800467b7
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
or r14d, 0x40
mov dword [rsp + 0x30], r14d
lea rcx, [rbp - 0x14]
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x180046522
mov dword [rsp + 0x20], eax
lea r9, [rbp - 0x14]
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.18000f130
mov rdx, qword [rsp + 0x68]
lea rsi, [rdx - 0x18]
mov rbx, qword [rbp - 0x58]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x1800465a9
cmp dword [rbx + 0x10], 0
jl 0x18004659c
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x18004659c
mov rcx, rsi
call fcn.18000f360
mov r15, rax
mov ecx, r13d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x18004658e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [r15 + 0x18]
mov qword [rbp - 0x58], rax
mov r15, qword [rbp - 0x80]
jmp 0x1800465a9
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x58]
call fcn.180007b10
and r14d, 0xffffffbf
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1800465cb
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 8]
and r14d, 0xffffffdf
mov dword [rsp + 0x30], r14d
mov eax, r13d
lock xadd dword [r12 + 0x10], eax
sub eax, 1
jg 0x1800465f0
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 8]
lea r12, [rdi - 0x18]
mov rbx, qword [rbp - 0x58]
test byte [rbp - 0x40], 0x10
je 0x18004663f
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x1800466e6
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, ecx
mov r8, qword [rbp - 0x68]
mov rdx, rbx
mov rcx, r15
call sym.SafeBase64.dll_public:_int___cdecl_CSearchFile::FindFolder_wchar_t_const____ptr64__wchar_t_const____ptr64__int__int____cdecl___struct__scanFileInfo____ptr64__void____ptr64___void____ptr64____ptr64
mov r14d, eax
mov dword [rsp + 0x34], eax
mov rsi, qword [rsp + 0x38]
jmp 0x1800466f0
inc dword [r15 + 0x224]
mov esi, dword [rbp - 0x24]
shl rsi, 0x20
mov eax, dword [rbp - 0x20]
or rsi, rax
add qword [r15 + 0x230], rsi
mov rdx, rbx
mov rcx, r15
call sym.SafeBase64.dll_public:_int___cdecl_CPattern::MatchPattern_wchar_t_const____ptr64____ptr64
test eax, eax
je 0x1800466e6
inc dword [r15 + 0x228]
add qword [r15 + 0x238], rsi
mov rsi, qword [rbp - 0x78]
test rsi, rsi
je 0x1800466e6
mov r8, rbx
mov edx, 0x3ff
lea rcx, [rbp + 0x210]
call fcn.1801259f0
mov rax, qword [rbp - 0x2c]
mov qword [rbp + 0xa10], rax
mov ecx, dword [rbp - 0x24]
shl rcx, 0x20
mov eax, dword [rbp - 0x20]
or rcx, rax
mov qword [rbp + 0xa18], rcx
mov eax, dword [rbp - 0x40]
mov dword [rbp + 0xa20], eax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x210]
call rsi
mov r14d, eax
mov dword [rsp + 0x34], eax
mov rsi, qword [rsp + 0x38]
test eax, eax
jne 0x1800466f0
mov dword [r15 + 0x220], 1
jmp 0x1800466f0
mov rsi, qword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18004670c
jmp 0x180046260
mov r14d, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180046731
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x18004674f
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, r14d
mov rcx, qword [rbp + 0xa30]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0xb48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
nop
mov ecx, 0x80004005
call fcn.180007f70
int3