Function at 0x18000c0e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x5e8]
sub rsp, 0x6e8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1800438e8]
xor rax, rsp
mov qword [rbp + 0x5d0], rax
mov dword [rsp + 0x38], r9d
mov qword [rsp + 0x48], r8
mov rsi, rdx
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp - 0x80]
call fcn.180021060
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x3d0]
call fcn.180021060
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x1d0]
call fcn.180021060
mov rdx, rsi
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x3ce], 0x5c
je 0x18000c1a0
lea rdx, [0x180039a84]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x180039ab0]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x28], rax
mov rbx, rax
nop dword [rax]
mov rdx, rsi
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp word [rbp + rcx*2 + 0x1ce], 0x5c
je 0x18000c20f
lea rdx, [0x180039a84]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
test byte [rbp - 0x80], 0x10
je 0x18000c46f
lea rdx, [0x180039a94]
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000c46f
lea rdx, [0x180039a98]
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000c46f
mov ecx, 0x410
call fcn.18001ab88
mov qword [rsp + 0x40], rax
mov esi, 7
mov qword [rsp + 0x70], rsi
xor r8d, r8d
mov edx, r8d
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x58], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1d0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
ja 0x18000c6d2
cmp rcx, rsi
jbe 0x18000c2d0
mov rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.18000ef70
mov rsi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
jmp 0x18000c2e0
test rcx, rcx
jne 0x18000c2e0
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x58], r8w
test rbx, rbx
setne al
test al, al
je 0x18000c332
lea rcx, [rsp + 0x58]
cmp rsi, 8
cmovae rcx, qword [rsp + 0x58]
lea rdi, [rbx + rbx]
mov r8, rdi
lea rdx, [rbp + 0x1d0]
call fcn.18001bea0
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
xor ecx, ecx
mov word [rdi + rax], cx
mov rsi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
je 0x18000c46a
cmp rdx, 0xffffffffffffffff
jbe 0x18000c34c
or rdx, 0xffffffffffffffff
jmp 0x18000c34f
dec rdx
lea rax, [rsp + 0x58]
cmp rsi, 8
cmovae rax, rbx
lea rdi, [rax + rdx*2]
mov ecx, 1
lea rax, [0x180039a84]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x18000c397
add rax, 2
dec rcx
jne 0x18000c370
lea rcx, [rsp + 0x58]
call fcn.18000e7f0
cmp rdi, rax
je 0x18000c46a
sub rdi, 2
jmp 0x18000c360
lea rax, [rsp + 0x58]
cmp rsi, 8
cmovae rax, rbx
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x18000c46a
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov esi, dword [rsp + 0x38]
sub eax, esi
movsxd r8, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
lea rdx, [rbp + rcx*2 + 0x1d0]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.18001bea0
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x18000c403
mov dword [0x180046e54], 0x10000
jmp 0x18000c42f
cmp dword [rbx], 2
je 0x18000c414
mov dword [0x180046e54], 0x80000
jmp 0x18000c42f
mov r9d, 4
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rbx + 8]
call fcn.180013980
mov dword [0x180046e54], eax
mov r9d, esi
mov r8, rbx
lea rdx, [rbp + 0x1d0]
mov rcx, qword [rsp + 0x20]
call fcn.18000c0e0
test rdi, rdi
je 0x18000c454
mov rcx, rdi
call fcn.18001c9dc
nop
cmp qword [rsp + 0x70], 8
jb 0x18000c6a4
mov rcx, qword [rsp + 0x58]
jmp 0x18000c69f
jmp 0x18000c696
lea rdx, [0x180039a94]
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000c6b3
lea rdx, [0x180039a98]
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x18000c6b3
mov ecx, 0x410
call fcn.18001ab88
mov qword [rsp + 0x40], rax
mov esi, 7
mov qword [rsp + 0x70], rsi
xor r8d, r8d
mov edx, r8d
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x58], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1d0]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
ja 0x18000c6df
cmp rcx, rsi
jbe 0x18000c515
mov rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.18000ef70
mov rsi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
jmp 0x18000c525
test rcx, rcx
jne 0x18000c525
mov qword [rsp + 0x68], rdx
mov word [rsp + 0x58], r8w
test rbx, rbx
setne al
test al, al
je 0x18000c577
lea rcx, [rsp + 0x58]
cmp rsi, 8
cmovae rcx, qword [rsp + 0x58]
lea rdi, [rbx + rbx]
mov r8, rdi
lea rdx, [rbp + 0x1d0]
call fcn.18001bea0
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rax, qword [rsp + 0x58]
xor ecx, ecx
mov word [rdi + rax], cx
mov rsi, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
test rdx, rdx
je 0x18000c696
cmp rdx, 0xffffffffffffffff
jbe 0x18000c591
or rdx, 0xffffffffffffffff
jmp 0x18000c594
dec rdx
lea rax, [rsp + 0x58]
cmp rsi, 8
cmovae rax, rbx
lea rdi, [rax + rdx*2]
nop word [rax + rax]
mov ecx, 1
lea rax, [0x180039a84]
movzx edx, word [rdi]
nop
cmp word [rax], dx
je 0x18000c5e7
add rax, 2
dec rcx
jne 0x18000c5c0
lea rcx, [rsp + 0x58]
call fcn.18000e7f0
cmp rdi, rax
je 0x18000c696
sub rdi, 2
jmp 0x18000c5b0
lea rax, [rsp + 0x58]
cmp rsi, 8
cmovae rax, rbx
sub rdi, rax
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x18000c696
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax + rax + 2]
mov esi, dword [rsp + 0x38]
sub eax, esi
movsxd r8, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
lea rdx, [rbp + rcx*2 + 0x1d0]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call fcn.18001bea0
mov rbx, qword [rsp + 0x48]
test rbx, rbx
jne 0x18000c653
mov dword [0x180046e54], 0x10000
jmp 0x18000c683
cmp dword [rbx], 2
je 0x18000c664
mov dword [0x180046e54], 0x80000
jmp 0x18000c683
mov r9d, 2
lea r8, [rbp + 0x1d0]
mov rdx, rdi
mov rcx, qword [rbx + 8]
call fcn.180013980
mov dword [0x180046e54], eax
test rdi, rdi
je 0x18000c691
mov rcx, rdi
call fcn.18001c9dc
nop
jmp 0x18000c454
cmp rsi, 8
jb 0x18000c6a4
mov rcx, rbx
call fcn.18001be54
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18000c6ec
cmp dword [rdi + 0x8c8], 0
jne 0x18000c6ec
jmp 0x18000c1d0
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
lea rcx, str.string_too_long
call fcn.18001aaa0
int3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x5d0]
xor rcx, rsp
call fcn.18001be70
add rsp, 0x6e8
pop rdi
pop rsi
pop rbx
pop rbp
ret