Function at 0x18001d710
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1801ae098]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov ebx, r8d
mov rdi, rcx
mov r8d, 0x140
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.1801248c0
test ebx, ebx
je 0x18001d988
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x18001da2f
mov r8, qword [rsp + 0x30]
lea rdx, [rbp + 0x2a0]
mov rcx, r8
sub rdx, r8
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x18001d790
mov al, 0x39
mov byte [rsp + 0x20], 0x13
mov cl, 0x3d
movzx edx, al
xor cl, 0x13
xor al, 0x13
xor r9d, r9d
mov byte [rsp + 0x22], cl
xor dl, 0x13
mov byte [rsp + 0x21], al
mov byte [rsp + 0x23], dl
lea rcx, [rsp + 0x21]
mov byte [rsp + 0x24], r9b
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
jne 0x18001d7d0
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001d97f
nop dword [rax]
xor eax, eax
mov byte [rsp + 0x28], 0x32
mov cl, 0x1c
mov byte [rsp + 0x2a], al
xor cl, 0x32
lea rdx, [rsp + 0x29]
mov byte [rsp + 0x29], cl
lea rcx, [rsp + 0x6c]
lea r8d, [rax + 1]
call fcn.180134680
test eax, eax
je 0x18001d969
xor edx, edx
mov byte [rsp + 0x20], 0x2a
mov al, 4
mov byte [rsp + 0x23], dl
movzx ecx, al
xor al, 0x2a
xor cl, 0x2a
mov byte [rsp + 0x21], al
mov byte [rsp + 0x22], cl
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x6c]
lea rdx, [rsp + 0x21]
call fcn.180134680
test eax, eax
je 0x18001d969
test byte [rsp + 0x40], 0x10
je 0x18001d969
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x18001da2f
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x6c]
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18001d8b0
xor ecx, ecx
mov byte [rsp + 0x2c], 0x5f
mov byte [rsp + 0x2e], cl
mov al, 3
xor al, 0x5f
lea rcx, [rbp + 0x80]
dec rcx
mov byte [rsp + 0x2d], al
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001d8e0
lea r8, [rsp + 0x2d]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18001d900
lea rax, [rbp + 0x80]
dec rax
nop word [rax + rax]
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x18001d920
lea r8, [rbp + 0x2a0]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x18001d940
mov r8d, 1
lea rdx, [fcn.18001da40]
lea rcx, [rbp + 0x80]
call fcn.18001d710
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18001d810
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001da06
nop
test byte [rsp + 0x40], 0x10
jne 0x18001d9eb
lea r9, [rsp + 0x30]
mov edx, 0x104
lea r8, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
je 0x18001da2f
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x6c]
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18001d9d0
lea rcx, [rsp + 0x6c]
call fcn.18001da40
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18001d9a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1800b7df0
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
xor eax, eax
jmp 0x18001da0b