Function at 0x1800212dc
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12c8]
mov eax, 0x13c8
call fcn.180043900
sub rsp, rax
mov rax, qword [0x1800d4ad8]
xor rax, rsp
mov qword [rbp + 0x12b0], rax
mov rax, qword [rbp + 0x1338]
mov rbx, r9
mov r15, qword [rbp + 0x1358]
mov r13d, r8d
mov rsi, qword [rbp + 0x1360]
mov r14, rdx
mov rdi, qword [rbp + 0x1368]
mov r12d, 0x412
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x1340]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x1348]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x1350]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x1378]
mov dword [rbp - 0x80], r8d
mov r8d, r12d
mov qword [rbp - 0x68], rdx
xor edx, edx
mov qword [rbp - 0x70], rcx
lea rcx, [rbp + 0x650]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x50], r15
mov qword [rsp + 0x78], rsi
call fcn.180046390
mov r8d, r12d
lea rcx, [rbp + 0xe90]
xor edx, edx
call fcn.180046390
xor eax, eax
mov r12b, 1
test r15, r15
je 0x180021414
mov rcx, r15
call fcn.18005380c
test rax, rax
je 0x180021412
movzx ebx, word [r15 + rax*2 - 2]
lea rcx, [rbp + 0x650]
mov r8, r15
mov edx, 0x209
call fcn.1800537a4
lea rcx, [rbp + 0x650]
cmp bx, 0x5c
jne 0x1800213ea
mov edx, 0x209
jmp 0x180021406
mov ebx, 0x209
lea r8, [0x1800aedec]
mov edx, ebx
call fcn.18006bcb8
mov edx, ebx
lea rcx, [rbp + 0x650]
mov r8, rsi
call fcn.18006bcb8
mov rbx, qword [rbp - 0x78]
xor eax, eax
cmp r13d, 1
jne 0x180021427
cmp byte [rbp + 0x1330], al
jne 0x180021427
mov r9, qword [rbx]
jmp 0x18002142e
lea r9, [0x1800ad9e0]
mov r8, r14
lea rcx, [rbp + 0xa70]
mov edx, 0x412
call fcn.1800255a4
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
movsxd rsi, dword [rbp - 0x80]
mov r13, rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x58], rsi
cmp rax, 0xffffffffffffffff
je 0x180021645
xor eax, eax
cmp byte [rbp + 0x1370], al
je 0x180021484
mov edx, 0x104
lea rcx, [rbp + 0xc]
call fcn.18008008c
test byte [rbp - 0x20], 0x10
jne 0x18002161d
lea r9, [rbp + 0xc]
mov r8, r14
mov edx, 0x412
lea rcx, [rbp + 0xe90]
call fcn.1800255a4
xor ecx, ecx
mov r15b, cl
cmp qword [rsp + 0x78], rcx
je 0x1800214f5
cmp byte [rdi], cl
jne 0x1800214f5
mov r15, qword [rbp - 0x50]
mov rcx, r14
mov rdx, r15
call fcn.18003a720
xor ecx, ecx
test eax, eax
js 0x1800214ee
mov bl, 1
cmp byte [rdi + 1], cl
je 0x1800214d6
cmp byte [rdi], cl
jne 0x1800214f0
mov rdx, r15
mov rcx, r14
call fcn.18003a720
xor ecx, ecx
test eax, eax
jle 0x1800214f0
mov word [rdi], 0x101
jmp 0x1800214f0
mov bl, cl
mov r15b, bl
jmp 0x1800214f7
mov bl, 1
mov r14, rcx
test bl, bl
je 0x180021619
mov r13, qword [rbp - 0x68]
cmp r14, rsi
jge 0x180021615
mov rax, qword [rbp - 0x78]
lea rcx, [rbp + 0xc]
mov r8b, 1
mov rdx, qword [rax + r14*8]
call fcn.18003b12c
xor ecx, ecx
test al, al
je 0x18002160d
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x180021558
cmp byte [rdi + 1], cl
jne 0x180021558
test r15b, r15b
je 0x180021558
mov rdx, rax
lea rcx, [rbp + 0xc]
call fcn.18007f9bc
xor ecx, ecx
test eax, eax
js 0x180021558
mov word [rdi], 0x101
cmp byte [rdi], cl
je 0x180021605
mov rax, qword [rbp - 0x38]
test rax, rax
je 0x18002156b
inc dword [rax]
cmp qword [rbp - 0x60], rcx
je 0x180021601
mov rcx, r13
call fcn.18006bb74
xor esi, esi
mov rbx, rax
test rax, rax
je 0x1800215a4
mov rcx, r13
call fcn.18005380c
cmp word [rbx + rax*2 - 2], 0x5c
jne 0x1800215a4
mov rcx, r13
call fcn.18005380c
mov word [rbx + rax*2 - 2], si
lea rdx, [rbp + 0xc]
mov rcx, r13
call fcn.180025534
xor ecx, ecx
mov rsi, rax
test rbx, rbx
je 0x1800215d7
test rax, rax
je 0x1800215d7
mov rcx, qword [rbp - 0x70]
lea r8, [rbp + 0xc]
mov r9, rax
mov rdx, rbx
call qword [rbp - 0x60]
mov r12b, al
xor ecx, ecx
jmp 0x1800215da
mov r12b, 1
test rsi, rsi
je 0x1800215e9
mov rcx, rsi
call fcn.180053728
xor ecx, ecx
test rbx, rbx
je 0x1800215f8
mov rcx, rbx
call fcn.180053728
xor ecx, ecx
mov rsi, qword [rbp - 0x58]
test r12b, r12b
je 0x180021615
cmp byte [rdi], cl
jne 0x18002160d
cmp byte [rdi + 1], cl
je 0x18002160d
mov byte [rdi], 1
inc r14
jmp 0x180021506
mov r13, qword [rbp - 0x28]
mov r14, qword [rbp - 0x68]
lea rdx, [rbp - 0x20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180021638
cmp r12b, 1
je 0x18002146c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15, qword [rbp - 0x50]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xa70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18002186a
mov bl, byte [rbp + 0x1370]
xor r13d, r13d
test bl, bl
je 0x18002167e
mov edx, 0x104
lea rcx, [rbp + 0xc]
call fcn.18008008c
mov ecx, dword [rbp - 0x20]
and ecx, 0x410
cmp ecx, 0x10
jne 0x180021842
cmp byte [rbp + 0x1330], r13b
je 0x180021842
lea rdx, [0x1800aedf0]
lea rcx, [rbp + 0xc]
call fcn.18006bbf8
test eax, eax
je 0x180021842
lea rdx, [0x1800aedf4]
lea rcx, [rbp + 0xc]
call fcn.18006bbf8
test eax, eax
je 0x180021842
lea r9, [rbp + 0xc]
mov r8, r14
mov edx, 0x412
lea rcx, [rbp + 0x230]
call fcn.1800255a4
test bl, bl
je 0x1800216fa
mov edx, 0x209
lea rcx, [rbp + 0x230]
call fcn.18008008c
lea rcx, [rbp + 0x230]
call fcn.18005380c
test rdi, rdi
jne 0x18002170f
mov bl, 1
jmp 0x18002177c
cmp byte [rdi], r13b
jne 0x18002170b
lea r8, [rsp + 0x70]
mov rdx, r15
lea rcx, [rbp + 0x230]
call fcn.18003ad0c
test al, al
je 0x18002174b
cmp byte [rsp + 0x70], r13b
mov r13, qword [rsp + 0x78]
je 0x180021747
xor eax, eax
test r13, r13
jne 0x180021747
mov bl, al
mov byte [rdi + 1], 1
jmp 0x180021781
mov bl, 1
jmp 0x180021781
mov rdx, r15
lea rcx, [rbp + 0x230]
call fcn.18003a720
test eax, eax
js 0x180021765
mov word [rdi], 0x101
jmp 0x18002170b
xor r8d, r8d
lea rdx, [rbp + 0x230]
mov rcx, r15
call fcn.18003aa14
test al, al
setne bl
mov r13, qword [rsp + 0x78]
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x18002179f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
test eax, eax
je 0x18002185e
mov r8, qword [rbp - 0x48]
xor eax, eax
test r8, r8
je 0x1800217c2
cmp byte [rdi], al
je 0x1800217c2
mov rcx, qword [rbp - 0x70]
lea rdx, [rbp + 0x230]
call r8
mov r8, qword [rbp - 0x48]
mov bl, al
test bl, bl
mov bl, byte [rbp + 0x1370]
je 0x180021836
mov rax, qword [rbp - 0x40]
lea rdx, [rbp + 0x230]
mov r9, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x70]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp - 0x30]
mov byte [rsp + 0x60], bl
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x38], r8
mov r8d, dword [rbp - 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x28], rax
mov al, byte [rbp + 0x1330]
mov byte [rsp + 0x20], al
call fcn.1800212dc
xor r13d, r13d
mov r12b, al
test al, al
je 0x180021861
jmp 0x180021839
xor r13d, r13d
cmp byte [rdi + 1], r13b
je 0x180021842
mov byte [rdi], 1
lea rdx, [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x180021861
cmp r12b, 1
jne 0x180021861
jmp 0x18002166c
mov r12b, cl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x18002187c
mov rcx, qword [rbp - 0x70]
mov rdx, r14
call rax
mov al, r12b
mov rcx, qword [rbp + 0x12b0]
xor rcx, rsp
call fcn.180043830
add rsp, 0x13c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret