Function at 0x180011160
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov qword [rcx + 0x20], rdx
mov rcx, rdx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rbx + 0x20]
lea rcx, [rdx + rax*2 + 2]
mov qword [rbx + 0x28], rcx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rbx + 0x28]
lea rax, [rdx + rax*2 + 2]
mov rcx, rbx
mov qword [rbx + 0x30], rax
add rsp, 0x20
pop rbx
jmp 0x1800114d8
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
xor edi, edi
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov r15d, 0x800
lea edx, [rdi + 8]
mov qword [rbp + 0x1c0], rdi
mov r8d, r15d
mov qword [rbp + 0x1c8], rdi
mov r13d, edi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
test rax, rax
je 0x1800117e3
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r12
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rsi + 0x18]
lea rcx, [r12 + rax*4]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r12
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rsi + 0x18]
lea rcx, [r12 + rax*4]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, str..lnk
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r12
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
lea rdx, str..lnk
lea rcx, [r12 + rax*4]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
lea rdx, [0x18003a400]
mov r8, r12
mov ecx, 0x186
call fcn.180030818
lea rdx, [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1800117d1
mov r8, r15
xor edx, edx
mov rcx, r12
call qword [sym.imp.msvcrt.dll_memset]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r12
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, qword [rsi + 0x18]
lea rcx, [r12 + rax*4]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, [0x18003adf8]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r12
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
lea rdx, [0x18003adf8]
lea rcx, [r12 + rax*4]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, r12
lea rbx, [rax + rax + 2]
call qword [sym.imp.msvcrt.dll_wcslen]
lea rdx, [rsp + 0x5c]
lea rcx, [r12 + rax*4]
mov r8, rbx
call qword [sym.imp.msvcrt.dll_memcpy]
lea rdx, [0x18003a400]
mov r8, r12
mov ecx, 0x19b
call fcn.180030818
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rcx, qword [rsi + 0x10]
lea r8, [rbp + 0x1c0]
test eax, eax
mov eax, 1
lea rdx, [0x1800398d8]
cmove r13d, eax
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x1800117d1
mov rcx, qword [rbp + 0x1c0]
xor r8d, r8d
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rcx, qword [rbp + 0x1c0]
test eax, eax
js 0x1800117cb
mov rax, qword [rcx]
lea r8, [rbp + 0x1c8]
lea rdx, [0x1800386c8]
call qword [rax]
test eax, eax
js 0x1800117bc
mov rcx, qword [rsi + 8]
mov r8, r15
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x1800117af
mov rcx, qword [rsi + 0x10]
xor r9d, r9d
mov r8d, r15d
mov rax, qword [rcx]
mov rdx, rbx
mov dword [rsp + 0x20], edi
call qword [rax + 0x18]
mov r8, rbx
test eax, eax
js 0x1800117a3
mov rdx, qword [rsi + 0x20]
mov rcx, rsi
call fcn.180011800
mov rcx, qword [rsi + 8]
xor edx, edx
mov r8, rbx
test al, al
jne 0x180011779
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x1c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r13d, r13d
je 0x1800115df
jmp 0x1800117d1
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x1c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 1
mov dil, al
jmp 0x1800117d1
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x1c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x1800117d1
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsi + 8]
mov r8, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov al, dil
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret