Function at 0x1801059f0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x400
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov dword [rsp + 0x2a0], 0
mov qword [rsp + 0x3d0], 0xffffffffffffffff
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x2b8], 0xffffffff
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x410]
mov r8, qword [rsp + 0x410]
lea rdx, [0x18003dce0]
mov ecx, 4
call fcn.18010b280
mov r9, qword [rsp + 0x428]
mov r8, qword [rsp + 0x420]
mov rdx, qword [rsp + 0x410]
lea rcx, [rsp + 0x60]
call fcn.180102940
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0
je 0x180105b5b
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x410]
lea r8, [rsp + 0x60]
lea rdx, [0x18003dc40]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
mov rdx, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x60]
call fcn.180105360
cmp qword [rsp + 0x430], 0
je 0x180105bed
mov r8, qword [rsp + 0x438]
xor edx, edx
mov rcx, qword [rsp + 0x410]
call qword [rsp + 0x430]
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0
je 0x180105bed
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, qword [rsp + 0x410]
lea rdx, [0x18003dbb0]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
lea rdi, [rsp + 0x2c0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x418]
lea rdx, [0x180010cb0]
lea rcx, [rsp + 0x2c0]
call fcn.1800eb79c
lea rdi, [rsp + 0x160]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0xffffffffffffffff
jne 0x180105ca4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x160]
lea r8, [rsp + 0x2c0]
lea rdx, [0x18003db30]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
mov eax, dword [rsp + 0x160]
and eax, 0x10
test eax, eax
je 0x180105cdf
movsx eax, byte [rsp + 0x18c]
cmp eax, 0x2e
jne 0x180105cdf
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x18c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 1
je 0x180105d27
mov eax, dword [rsp + 0x160]
and eax, 0x10
test eax, eax
je 0x180105d45
movsx eax, byte [rsp + 0x18c]
cmp eax, 0x2e
jne 0x180105d45
movsx eax, byte [rsp + 0x18d]
cmp eax, 0x2e
jne 0x180105d45
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x18c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jne 0x180105d45
lea r8, [rsp + 0x18c]
lea rdx, [0x18003dad0]
mov ecx, 3
call fcn.18010b280
jmp 0x1801064ec
lea r8, [rsp + 0x18c]
lea rdx, [0x18003da80]
mov ecx, 3
call fcn.18010b280
lea rdi, [rsp + 0x2c0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea r9, [rsp + 0x18c]
mov r8, qword [rsp + 0x418]
lea rdx, [0x180009c88]
lea rcx, [rsp + 0x2c0]
call fcn.1800eb79c
lea rdi, [rsp + 0xa0]
xor eax, eax
mov ecx, 0xac
rep stosb byte [rdi], al
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [rsp + 0x2b8], eax
cmp dword [rsp + 0x2b8], 0xffffffff
jne 0x180105e16
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x2a0]
lea r8, [rsp + 0xa0]
lea rdx, [0x18003da00]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x164]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180105e9f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x164]
lea rdx, [0x18003d960]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x2a8], ax
movzx eax, byte [rsp + 0x152]
mov byte [rsp + 0x2aa], al
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x2ab], al
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x2ac], al
movzx eax, byte [rsp + 0x15a]
mov byte [rsp + 0x2ad], al
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x2ae], al
movzx eax, byte [rsp + 0x15e]
mov byte [rsp + 0x2af], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180105f26
mov eax, 0x1000
mov word [rsp + 0x2b0], ax
jmp 0x180105f8b
cmp dword [rsp + 0x2b8], 1
jne 0x180105f40
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x3d8], eax
jmp 0x180105f73
cmp dword [rsp + 0x2b8], 2
jne 0x180105f5a
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x3dc], eax
jmp 0x180105f65
mov dword [rsp + 0x3dc], 0
mov eax, dword [rsp + 0x3dc]
mov dword [rsp + 0x3d8], eax
mov eax, dword [rsp + 0xa0]
neg eax
sub eax, dword [rsp + 0x3d8]
mov word [rsp + 0x2b0], ax
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x16c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180106014
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x16c]
lea rdx, [0x18003d8c0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x80], ax
movzx eax, byte [rsp + 0x152]
mov byte [rsp + 0x82], al
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x83], al
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x84], al
movzx eax, byte [rsp + 0x15a]
mov byte [rsp + 0x85], al
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x86], al
movzx eax, byte [rsp + 0x15e]
mov byte [rsp + 0x87], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x18010609b
mov eax, 0x1000
mov word [rsp + 0x88], ax
jmp 0x180106100
cmp dword [rsp + 0x2b8], 1
jne 0x1801060b5
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x3e0], eax
jmp 0x1801060e8
cmp dword [rsp + 0x2b8], 2
jne 0x1801060cf
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x3e4], eax
jmp 0x1801060da
mov dword [rsp + 0x3e4], 0
mov eax, dword [rsp + 0x3e4]
mov dword [rsp + 0x3e0], eax
mov eax, dword [rsp + 0xa0]
neg eax
sub eax, dword [rsp + 0x3e0]
mov word [rsp + 0x88], ax
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x174]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180106189
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x174]
lea rdx, [0x18003d820]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
movzx eax, word [rsp + 0x150]
mov word [rsp + 0x70], ax
movzx eax, byte [rsp + 0x152]
mov byte [rsp + 0x72], al
movzx eax, byte [rsp + 0x156]
mov byte [rsp + 0x73], al
movzx eax, byte [rsp + 0x158]
mov byte [rsp + 0x74], al
movzx eax, byte [rsp + 0x15a]
mov byte [rsp + 0x75], al
movzx eax, byte [rsp + 0x15c]
mov byte [rsp + 0x76], al
movzx eax, byte [rsp + 0x15e]
mov byte [rsp + 0x77], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x1801061f8
mov eax, 0x1000
mov word [rsp + 0x78], ax
jmp 0x18010625a
cmp dword [rsp + 0x2b8], 1
jne 0x180106212
mov eax, dword [rsp + 0xf4]
mov dword [rsp + 0x3e8], eax
jmp 0x180106245
cmp dword [rsp + 0x2b8], 2
jne 0x18010622c
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x3ec], eax
jmp 0x180106237
mov dword [rsp + 0x3ec], 0
mov eax, dword [rsp + 0x3ec]
mov dword [rsp + 0x3e8], eax
mov eax, dword [rsp + 0xa0]
neg eax
sub eax, dword [rsp + 0x3e8]
mov word [rsp + 0x78], ax
mov eax, dword [rsp + 0x160]
and eax, 0x10
test eax, eax
je 0x18010635e
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x420]
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x18c]
call fcn.1801059f0
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0
je 0x180106359
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c0]
lea r8, [rsp + 0x18c]
lea rdx, [0x18003d770]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
jmp 0x1801064ec
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x420]
lea r8, [rsp + 0x2c0]
lea rdx, [rsp + 0x18c]
lea rcx, [rsp + 0x68]
call fcn.180102fd0
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0
je 0x18010640d
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x18c]
lea r8, [rsp + 0x68]
lea rdx, [0x18003d6d0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
xor r8d, r8d
lea rdx, [rsp + 0x2a8]
mov rcx, qword [rsp + 0x68]
call fcn.180105440
mov r8d, 1
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call fcn.180105440
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call fcn.180105440
cmp qword [rsp + 0x430], 0
je 0x1801064ec
mov r8, qword [rsp + 0x438]
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x18c]
call qword [rsp + 0x430]
mov dword [rsp + 0x2a0], eax
cmp dword [rsp + 0x2a0], 0
je 0x1801064ec
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c0]
lea r8, [rsp + 0x18c]
lea rdx, [0x18003d640]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
lea rdi, [rsp + 0x160]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18010659e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2a0], eax
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x2a0], 0x12
je 0x180106580
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x160]
mov r8, qword [rsp + 0x3d0]
lea rdx, [0x18003d5c0]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x2a0]
jmp 0x1801065bb
lea rdx, [0x18003d570]
mov ecx, 3
call fcn.18010b280
mov dword [rsp + 0x2a0], 0
jmp 0x1801065a3
jmp 0x180105ca4
lea rdx, [0x18003d520]
mov ecx, 4
call fcn.18010b280
mov eax, dword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x3f0]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x400
pop rdi
ret