Function at 0x180106650
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x610
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x600], rax
mov dword [rsp + 0x3b0], 0
mov qword [rsp + 0x5e0], 0xffffffffffffffff
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x3c8], 0xffffffff
mov rax, qword [rsp + 0x650]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x640]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x638]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x628]
mov r8, qword [rsp + 0x620]
lea rdx, [0x18003e680]
mov ecx, 4
call fcn.18010b280
mov r8, qword [rsp + 0x620]
lea rdx, [0x18003e630]
mov ecx, 4
call fcn.18010b280
mov r8, qword [rsp + 0x628]
lea rdx, [0x18003e5e0]
mov ecx, 4
call fcn.18010b280
mov r9, qword [rsp + 0x638]
mov r8, qword [rsp + 0x630]
mov rdx, qword [rsp + 0x620]
lea rcx, [rsp + 0x60]
call fcn.180102b30
mov dword [rsp + 0x3b0], eax
cmp dword [rsp + 0x3b0], 0
je 0x1801067d3
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x638]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x620]
lea r8, [rsp + 0x60]
lea rdx, [0x18003e530]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rsp + 0x60]
call fcn.180105360
cmp qword [rsp + 0x640], 0
je 0x180106865
mov r8, qword [rsp + 0x648]
xor edx, edx
mov rcx, qword [rsp + 0x620]
call qword [rsp + 0x640]
mov dword [rsp + 0x3b0], eax
cmp dword [rsp + 0x3b0], 0
je 0x180106865
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x620]
lea rdx, [0x18003e490]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
lea rdi, [rsp + 0x3d0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x628]
lea rdx, [0x18003e478]
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdi, [rsp + 0x160]
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x5e0], rax
cmp qword [rsp + 0x5e0], 0xffffffffffffffff
jne 0x18010691d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3b0], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x160]
lea r8, [rsp + 0x3d0]
lea rdx, [0x18003e3f0]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
mov eax, dword [rsp + 0x160]
and eax, 0x10
test eax, eax
je 0x180106959
movzx eax, word [rsp + 0x18c]
cmp eax, 0x2e
jne 0x180106959
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x18c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 1
je 0x1801069a2
mov eax, dword [rsp + 0x160]
and eax, 0x10
test eax, eax
je 0x1801069c0
movzx eax, word [rsp + 0x18c]
cmp eax, 0x2e
jne 0x1801069c0
movzx eax, word [rsp + 0x18e]
cmp eax, 0x2e
jne 0x1801069c0
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x18c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jne 0x1801069c0
lea r8, [rsp + 0x18c]
lea rdx, [0x18003e380]
mov ecx, 3
call fcn.18010b280
jmp 0x180107168
lea r8, [rsp + 0x18c]
lea rdx, [0x18003e320]
mov ecx, 3
call fcn.18010b280
lea rdi, [rsp + 0x3d0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r9, [rsp + 0x18c]
mov r8, qword [rsp + 0x628]
lea rdx, [0x18003e308]
lea rcx, [rsp + 0x3d0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdi, [rsp + 0xa0]
xor eax, eax
mov ecx, 0xac
rep stosb byte [rdi], al
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [rsp + 0x3c8], eax
cmp dword [rsp + 0x3c8], 0xffffffff
jne 0x180106a92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3b0], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x3b0]
lea r8, [rsp + 0xa0]
lea rdx, [0x18003e280]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x164]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180106b1b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3b0], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x164]
lea rdx, [0x18003e1e0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x3b8], ax
movzx eax, byte [rsp + 0x152]
mov byte [rsp + 0x3ba], al
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x3bb], al
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x3bc], al
movzx eax, byte [rsp + 0x15a]
mov byte [rsp + 0x3bd], al
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x3be], al
movzx eax, byte [rsp + 0x15e]
mov byte [rsp + 0x3bf], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180106ba2
mov eax, 0x1000
mov word [rsp + 0x3c0], ax
jmp 0x180106c07
cmp dword [rsp + 0x3c8], 1
jne 0x180106bbc
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x5e8], eax
jmp 0x180106bef
cmp dword [rsp + 0x3c8], 2
jne 0x180106bd6
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x5ec], eax
jmp 0x180106be1
mov dword [rsp + 0x5ec], 0
mov eax, dword [rsp + 0x5ec]
mov dword [rsp + 0x5e8], eax
mov eax, dword [rsp + 0xa0]
neg eax
sub eax, dword [rsp + 0x5e8]
mov word [rsp + 0x3c0], ax
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x16c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180106c90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3b0], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x16c]
lea rdx, [0x18003e140]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x80], ax
movzx eax, byte [rsp + 0x152]
mov byte [rsp + 0x82], al
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x83], al
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x84], al
movzx eax, byte [rsp + 0x15a]
mov byte [rsp + 0x85], al
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x86], al
movzx eax, byte [rsp + 0x15e]
mov byte [rsp + 0x87], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180106d17
mov eax, 0x1000
mov word [rsp + 0x88], ax
jmp 0x180106d7c
cmp dword [rsp + 0x3c8], 1
jne 0x180106d31
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x5f0], eax
jmp 0x180106d64
cmp dword [rsp + 0x3c8], 2
jne 0x180106d4b
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x5f4], eax
jmp 0x180106d56
mov dword [rsp + 0x5f4], 0
mov eax, dword [rsp + 0x5f4]
mov dword [rsp + 0x5f0], eax
mov eax, dword [rsp + 0xa0]
neg eax
sub eax, dword [rsp + 0x5f0]
mov word [rsp + 0x88], ax
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180106e05
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3b0], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x174]
lea rdx, [0x18003e0a0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x70], ax
movzx eax, byte [rsp + 0x152]
mov byte [rsp + 0x72], al
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x73], al
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x74], al
movzx eax, byte [rsp + 0x15a]
mov byte [rsp + 0x75], al
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x76], al
movzx eax, byte [rsp + 0x15e]
mov byte [rsp + 0x77], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180106e74
mov eax, 0x1000
mov word [rsp + 0x78], ax
jmp 0x180106ed6
cmp dword [rsp + 0x3c8], 1
jne 0x180106e8e
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x5f8], eax
jmp 0x180106ec1
cmp dword [rsp + 0x3c8], 2
jne 0x180106ea8
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x5fc], eax
jmp 0x180106eb3
mov dword [rsp + 0x5fc], 0
mov eax, dword [rsp + 0x5fc]
mov dword [rsp + 0x5f8], eax
mov eax, dword [rsp + 0xa0]
neg eax
sub eax, dword [rsp + 0x5f8]
mov word [rsp + 0x78], ax
mov eax, dword [rsp + 0x160]
and eax, 0x10
test eax, eax
je 0x180106fda
lea rax, [rsp + 0x3b8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x640]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x630]
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x18c]
call fcn.180106650
mov dword [rsp + 0x3b0], eax
cmp dword [rsp + 0x3b0], 0
je 0x180106fd5
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x3b8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x640]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3d0]
lea r8, [rsp + 0x18c]
lea rdx, [0x18003dfe0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
jmp 0x180107168
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x630]
lea r8, [rsp + 0x3d0]
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0x68]
call fcn.180103220
mov dword [rsp + 0x3b0], eax
cmp dword [rsp + 0x3b0], 0
je 0x180107089
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18c]
lea r8, [rsp + 0x68]
lea rdx, [0x18003df30]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
xor r8d, r8d
lea rdx, [rsp + 0x3b8]
mov rcx, qword [rsp + 0x68]
call fcn.180105440
mov r8d, 1
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call fcn.180105440
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.180105440
cmp qword [rsp + 0x640], 0
je 0x180107168
mov r8, qword [rsp + 0x648]
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x18c]
call qword [rsp + 0x640]
mov dword [rsp + 0x3b0], eax
cmp dword [rsp + 0x3b0], 0
je 0x180107168
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x648]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3d0]
lea r8, [rsp + 0x18c]
lea rdx, [0x18003dea0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
lea rdi, [rsp + 0x160]
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18010721a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3b0], eax
mov rcx, qword [rsp + 0x5e0]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x3b0], 0x12
je 0x1801071fc
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3b0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x160]
mov r8, qword [rsp + 0x5e0]
lea rdx, [0x18003de10]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x3b0]
jmp 0x180107237
lea rdx, [0x18003ddb0]
mov ecx, 3
call fcn.18010b280
mov dword [rsp + 0x3b0], 0
jmp 0x18010721f
jmp 0x18010691d
lea rdx, [0x18003dd60]
mov ecx, 4
call fcn.18010b280
mov eax, dword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x600]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x610
pop rdi
ret