Function at 0x1800919d0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rbx
push r12
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x180126010]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov r12, rcx
mov ecx, 0x104
call fcn.1800d5574
mov rbx, rax
test rax, rax
je 0x180091ffa
xor r9d, r9d
mov qword [rsp + 0x2d8], r13
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor r13d, r13d
mov qword [rbp + 0x18], 0xf
xor r8d, r8d
mov qword [rbp], r13
lea rdx, [0x18010a500]
mov qword [rbp + 0x10], r13
lea rcx, [rbp]
call fcn.1800bfba0
mov r8, 0xffffffffffffffff
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], 0xf
nop word [rax + rax]
inc r8
cmp byte [rbx + r8], r13b
jne 0x180091a70
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1800bfba0
lea rdx, [0x180128d78]
lea rcx, [rbp - 0x40]
call fcn.1800bf440
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.18008aa30
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
mov r9, qword [rbp - 0x10]
mov rcx, rax
cmovae r8, qword [rbp - 0x20]
call fcn.1800c44c0
mov rdx, qword [rbp - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rsp + 0x60], xmm1
movups xmmword [rbp + 0x30], xmm1
cmp rdx, 0x10
jb 0x180091b28
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091b19
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009201b
call fcn.1800cd2cc
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x60]
mov rdx, qword [rbp - 0x48]
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm1
cmp rdx, 0x10
jb 0x180091b6b
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091b66
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009201b
call fcn.1800cd2cc
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x298], r14
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, 2
jb 0x180092021
cmp qword [rbp + 0x38], 0x10
lea rax, [0x180115238]
mov qword [rsp + 0x30], 2
lea r9, [rbp - 0x20]
cmovae r9, qword [rbp + 0x20]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x290], r15
call fcn.1800c27f0
cmp qword [rsp + 0x78], 0x10
lea rcx, [rsp + 0x60]
lea rdx, [rbp + 0x40]
cmovae rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdx, qword [rsp + 0x78]
mov r15, rax
cmp rdx, 0x10
jb 0x180091c26
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091c21
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092027
call fcn.1800cd2cc
mov qword [rsp + 0x2c8], rsi
mov qword [rsp + 0x2d0], rdi
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], r13b
nop dword [rax]
test byte [rbp + 0x40], 0x10
je 0x180091f01
mov qword [rbp + 0x20], r13
lea rax, [rbp + 0x6c]
mov qword [rbp + 0x30], r13
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x38], 0xf
inc r8
cmp byte [rax + r8], r13b
jne 0x180091c75
lea rdx, [rbp + 0x6c]
lea rcx, [rbp + 0x20]
call fcn.1800bfba0
cmp qword [0x180129670], 0x10
lea rsi, [0x180129658]
mov rdi, qword [0x180129668]
cmovae rsi, qword [0x180129658]
cmp rdi, 0x10
jae 0x180091cc0
movups xmm0, xmmword [rsi]
mov qword [rbp - 0x68], 0xf
movups xmmword [rbp - 0x80], xmm0
jmp 0x180091d30
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180091d0a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180092033
mov rcx, rax
call fcn.1800cd2d4
mov rcx, rax
test rax, rax
je 0x180092039
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180091d19
test rcx, rcx
je 0x180091d16
call fcn.1800cd2d4
jmp 0x180091d19
mov rax, r13
lea r8, [rdi + 1]
mov qword [rbp - 0x80], rax
mov rdx, rsi
mov rcx, rax
call fcn.1800d03a0
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rdi
lea rcx, [rbp + 0x6c]
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], r13b
jne 0x180091d40
mov rdx, qword [rbp - 0x10]
mov rcx, r14
sub rcx, rdx
cmp rcx, rax
jb 0x18009203f
cmp qword [rbp - 8], 0x10
lea r9, [rbp - 0x20]
mov qword [rsp + 0x30], rax
lea rcx, [rbp - 0x60]
cmovae r9, qword [rbp - 0x20]
lea rax, [rbp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
call fcn.1800c27f0
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x40]
call fcn.18008aa30
mov r9, rax
lea r8, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800c2600
cmp qword [rsp + 0x58], 0x10
lea rcx, [rsp + 0x40]
lea rdx, [0x180115130]
cmovae rcx, qword [rsp + 0x40]
call fcn.1800d8f08
test rax, rax
je 0x180091dd2
mov rcx, rax
call fcn.1800d8f98
mov bl, 1
jmp 0x180091dd4
xor bl, bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x180091e11
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091e0c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092039
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x48]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], r13b
cmp rdx, 0x10
jb 0x180091e5f
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091e5a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092039
call fcn.1800cd2cc
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180091e9a
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091e95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092039
call fcn.1800cd2cc
test bl, bl
je 0x180091ec6
lea rax, [rbp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x180091eb0
lea rdx, [rbp + 0x6c]
lea rcx, [rbp]
call fcn.1800bfba0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x180091f01
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091efc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092015
call fcn.1800cd2cc
lea rdx, [rbp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180091c50
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp + 0x10]
sub r14, rcx
cmp r14, rdx
jb 0x18009202d
cmp qword [rbp - 8], 0x10
lea r9, [rbp - 0x20]
mov qword [rsp + 0x30], rdx
lea rax, [rbp]
cmovae r9, qword [rbp - 0x20]
cmp qword [rbp + 0x18], 0x10
cmovae rax, qword [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, r12
call fcn.1800c27f0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x180091f98
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091f93
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092015
call fcn.1800cd2cc
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180091fcf
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180091fca
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180092015
call fcn.1800cd2cc
mov rdi, qword [rsp + 0x2d0]
mov rax, r12
mov rsi, qword [rsp + 0x2c8]
mov r15, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
mov r13, qword [rsp + 0x2d8]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1800cd010
add rsp, 0x2a0
pop r12
pop rbx
pop rbp
ret
call fcn.1800dc358
int3
call fcn.1800dc358
int3
call fcn.180088c60
int3
call fcn.1800dc358
int3
call fcn.180088c60
int3
call fcn.180088bc0
int3
call fcn.1800dc358
int3
call fcn.180088c60
int3