Function at 0x100018900
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x560
mov qword [rsp + 0x540], 0xfffffffffffffffe
mov rax, qword [0x10002c580]
xor rax, rsp
mov qword [rsp + 0x558], rax
mov dword [rsp + 0x29c], 0
mov qword [rsp + 0x290], 0xffffffffffffffff
mov dword [rsp + 0x40], 0
lea rax, [rsp + 0x44]
mov rdi, rax
xor eax, eax
mov ecx, 0x24c
rep stosb byte [rdi], al
mov word [rsp + 0x2a0], 0
lea rax, [rsp + 0x2a2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x298], 0
call fcn.100010250
test rax, rax
je 0x1000189bc
call fcn.100010250
mov rcx, qword [rsp + 0x570]
mov qword [rsp + 0x20], rcx
lea r9, [0x10000f930]
mov r8d, 0x144
lea rdx, [0x10000eff0]
mov rcx, rax
call fcn.100010300
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x100018c02
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4e0]
call fcn.1000138f0
nop
lea rdx, [0x10000f990]
lea rcx, [rsp + 0x4e0]
call fcn.100013980
mov rdx, qword [rsp + 0x570]
lea rcx, [rsp + 0x4e0]
call fcn.100013980
lea rdx, [0x10000f9dc]
lea rcx, [rsp + 0x4e0]
call fcn.100013980
call fcn.100010250
test rax, rax
je 0x100018a77
lea rcx, [rsp + 0x4e0]
call fcn.100013a50
mov qword [rsp + 0x548], rax
call fcn.100010250
mov rcx, qword [rsp + 0x548]
mov qword [rsp + 0x20], rcx
lea r9, [0x10000f9e0]
mov r8d, 0x14d
lea rdx, [0x10000eff0]
mov rcx, rax
call fcn.100010300
lea rcx, [rsp + 0x4e0]
call fcn.100013a50
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x290], rax
cmp qword [rsp + 0x290], 0xffffffffffffffff
jne 0x100018b31
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x298], eax
mov ecx, dword [rsp + 0x298]
call fcn.100015760
mov dword [rsp + 0x29c], eax
call fcn.100010250
test rax, rax
je 0x100018b0a
call fcn.100010250
mov ecx, dword [rsp + 0x29c]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x298]
mov dword [rsp + 0x20], ecx
lea r9, [0x10000fa40]
mov r8d, 0x154
lea rdx, [0x10000eff0]
mov rcx, rax
call fcn.100010300
mov eax, dword [rsp + 0x29c]
mov dword [rsp + 0x508], eax
lea rcx, [rsp + 0x4e0]
call fcn.100013950
mov eax, dword [rsp + 0x508]
jmp 0x100018c73
lea rcx, [rsp + 0x4b8]
call fcn.100018ce0
nop
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x4b8]
call fcn.100018d60
lea rdx, [0x10000f990]
lea rcx, [rsp + 0x4b8]
call fcn.100013980
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x4b8]
call fcn.100013980
lea rax, [rsp + 0x510]
mov qword [rsp + 0x538], rax
lea rdx, [rsp + 0x4b8]
mov rcx, qword [rsp + 0x538]
call fcn.100013880
mov qword [rsp + 0x550], rax
mov rcx, qword [rsp + 0x550]
call fcn.100018390
mov dword [rsp + 0x4b0], eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100018b3f
mov rcx, qword [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x4b8]
call fcn.100013950
nop
lea rcx, [rsp + 0x4e0]
call fcn.100013950
jmp 0x100018c6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x298], eax
mov ecx, dword [rsp + 0x298]
call fcn.100015760
mov dword [rsp + 0x29c], eax
call fcn.100010250
test rax, rax
je 0x100018c63
call fcn.100010250
mov ecx, dword [rsp + 0x29c]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0x298]
mov dword [rsp + 0x20], ecx
lea r9, [0x10000fac0]
mov r8d, 0x166
lea rdx, [0x10000eff0]
mov rcx, rax
call fcn.100010300
mov eax, dword [rsp + 0x29c]
jmp 0x100018c73
mov eax, dword [rsp + 0x29c]
mov rcx, qword [rsp + 0x558]
xor rcx, rsp
call fcn.100019c20
add rsp, 0x560
pop rdi
ret