Function at 0x18000a9b0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
xor edi, edi
xor ebp, ebp
mov r14, rcx
mov dword [rsp + 0x78], edi
mov qword [rsp + 0x80], rbp
cmp qword [rcx + 8], rdi
jbe 0x18000ac60
mov rax, qword [r14]
mov rbx, qword [rax + rbp*8]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test eax, eax
jle 0x18000ac4b
movsxd rcx, eax
cmp byte [rcx + rbx - 1], 0x2a
jne 0x18000ac4b
cmp eax, 1
je 0x18000aa1c
mov al, byte [rcx + rbx - 2]
cmp al, 0x5c
je 0x18000aa1c
cmp al, 0x2f
jne 0x18000ac4b
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
je 0x18000ac4b
mov rax, qword [r14]
mov ecx, 0x10
mov rbx, qword [rax + rbp*8]
call sym.jli.dll_JLI_List_new
mov ecx, 0x10
mov r15, rax
call sym.jli.dll_JLI_MemAlloc
lea rdx, [0x1800151d0]
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
jne 0x18000aa7e
mov rcx, r12
call sym.jli.dll_JLI_MemFree
mov rcx, r15
call fcn.180008f74
xor r15d, r15d
jmp 0x18000ac43
lea rbp, [0x1800151fc]
mov qword [r12], rax
mov qword [r12 + 8], rbp
mov r14, rbx
mov r13, qword [r12 + 8]
test r13, r13
je 0x18000aaa3
and qword [r12 + 8], 0
jmp 0x18000aac2
mov rcx, qword [r12]
lea rdx, [0x1800151d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
neg eax
sbb r13, r13
and r13, rbp
je 0x18000ab77
mov rcx, r13
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp eax, 4
jl 0x18000aa91
movsxd rcx, eax
cmp byte [rcx + r13 - 4], 0x2e
jne 0x18000aa91
lea rbx, [rcx + r13]
lea rcx, [rbx - 3]
lea rdx, [0x18000ff84]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x18000ab06
lea rdx, [0x18000ff88]
lea rcx, [rbx - 3]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x18000aa91
mov edx, 0x3b
mov rcx, r13
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x18000aa91
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, r13
mov rsi, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
add eax, esi
movsxd rcx, eax
call sym.jli.dll_JLI_MemAlloc
mov rdi, rax
mov rdx, r14
lea eax, [rsi - 1]
mov rcx, rdi
movsxd r8, eax
call sub.VCRUNTIME140.dll_memcpy
lea eax, [rbx + 1]
movsxd rcx, esi
dec rcx
movsxd r8, eax
add rcx, rdi
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov rdx, rdi
mov rcx, r15
call sym.jli.dll_JLI_List_add
jmp 0x18000aa91
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [r12 + 8]
call sym.jli.dll_JLI_MemFree
mov rcx, r12
call sym.jli.dll_JLI_MemFree
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
mov edi, dword [rsp + 0x78]
test r15, r15
je 0x18000ac43
cmp qword [r15 + 8], 0
jbe 0x18000ac43
mov rcx, qword [r14]
inc edi
mov dword [rsp + 0x78], edi
mov rcx, qword [rcx + rbp*8]
call sym.jli.dll_JLI_MemFree
mov rdx, qword [r14 + 8]
mov rcx, r14
add rdx, qword [r15 + 8]
call fcn.180008f3c
mov r8, qword [r14 + 8]
lea r9, [rbp + 1]
jmp 0x18000abf7
mov rdx, qword [r14]
mov rcx, qword [r15 + 8]
add rcx, r8
mov rax, qword [rdx + r8*8]
mov qword [rdx + rcx*8 - 8], rax
dec r8
cmp r8, r9
jae 0x18000abe4
mov rdx, qword [r15 + 8]
xor r9d, r9d
test rdx, rdx
je 0x18000ac31
mov rax, qword [r15]
lea r8, [r9*8]
mov rcx, qword [r14]
lea rdx, [r8 + rbp*8]
inc r9
mov rax, qword [r8 + rax]
mov qword [rdx + rcx], rax
mov rdx, qword [r15 + 8]
cmp r9, rdx
jb 0x18000ac0b
dec rbp
add rbp, rdx
dec rdx
add qword [r14 + 8], rdx
and qword [r15 + 8], 0
mov rcx, r15
call fcn.180008f74
inc rbp
mov qword [rsp + 0x80], rbp
cmp rbp, qword [r14 + 8]
jb 0x18000a9e2
mov eax, edi
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret