Function at 0x18000a920
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x1b8]
sub rsp, 0x2b8
mov rcx, r8
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, edi
lea eax, [rdi + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor esi, esi
mov rbx, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], esi
test rax, rax
je 0x18000a9a4
mov rdx, qword [rbp + 0x1f0]
movsxd r8, edi
mov rcx, rax
mov esi, edi
mov dword [rsp + 0x38], edi
mov word [r8 + rax], 0
call fcn.18001ca04
mov eax, esi
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
cmp word [rbx + rcx*2 - 2], 0x5c
je 0x18000a9cd
lea rdx, [0x180023a00]
lea rcx, [rsp + 0x38]
mov r8d, 2
call fcn.1800046d0
lea rcx, [0x180023d18]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x180023d18]
lea rcx, [rsp + 0x38]
lea r8d, [rax + rax]
call fcn.1800046d0
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
jne 0x18000aa28
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18000aa1a
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor eax, eax
add rsp, 0x2b8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rdi, qword [rsp + 0x40]
nop dword [rax]
cmp word [rbp - 0x74], 0x2e
jne 0x18000aa55
movzx eax, word [rbp - 0x72]
test ax, ax
je 0x18000adfe
cmp ax, 0x2e
jne 0x18000aa55
cmp word [rbp - 0x70], 0
je 0x18000adfe
mov rcx, qword [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
test rdi, rdi
je 0x18000aa74
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea eax, [rsi + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x18000aaa5
mov rdx, qword [rbp + 0x1f0]
movsxd r8, esi
mov rcx, rax
mov ebx, esi
mov word [r8 + rax], 0
call fcn.18001ca04
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
cmp word [rdi + rcx*2 - 2], 0x5c
jne 0x18000ab5d
cmp word [rbp - 0x74], 0x5c
jne 0x18000ac13
lea rcx, [rbp - 0x72]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x24], eax
lea eax, [rbx + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov dword [rsp + 0x20], 0
mov rsi, rax
test rax, rax
je 0x18000aaff
movsxd rax, ebx
mov dword [rsp + 0x20], ebx
mov word [rax + rsi], 0
movsxd r8, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.18001ca04
add ebx, dword [rsp + 0x24]
test rdi, rdi
je 0x18000ab1f
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea eax, [rbx + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x18000acae
movsxd rax, ebx
movsxd rbx, dword [rsp + 0x20]
mov rdx, rsi
mov r8, rbx
mov rcx, rdi
mov word [rax + rdi], 0
call fcn.18001ca04
movsxd r8, dword [rsp + 0x24]
jmp 0x18000aca1
cmp word [rbp - 0x74], 0x5c
je 0x18000ac13
lea eax, [rbx + 2]
movsxd rcx, eax
mov dword [rsp + 0x20], eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov dword [rsp + 0x24], 0
mov rsi, rax
test rax, rax
je 0x18000ab95
movsxd rax, ebx
mov dword [rsp + 0x24], ebx
mov word [rax + rsi], 0
movsxd r8, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.18001ca04
test rdi, rdi
je 0x18000abb1
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea eax, [rbx + 4]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x18000acf7
movsxd rax, dword [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
mov word [rax + rdi], bx
movsxd rbx, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov r8, rbx
call fcn.18001ca04
lea rcx, [rbx + rdi]
lea rdx, [0x180023a00]
mov r8d, 2
call fcn.18001ca04
test rsi, rsi
je 0x18000ac0f
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov ebx, dword [rsp + 0x20]
lea rcx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x20], eax
lea eax, [rbx + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov dword [rsp + 0x24], 0
mov rsi, rax
test rax, rax
je 0x18000ac4c
movsxd rax, ebx
mov dword [rsp + 0x24], ebx
mov word [rax + rsi], 0
movsxd r8, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.18001ca04
add ebx, dword [rsp + 0x20]
test rdi, rdi
je 0x18000ac6c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea eax, [rbx + 2]
movsxd rcx, eax
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x18000acae
movsxd rax, ebx
movsxd rbx, dword [rsp + 0x24]
mov rdx, rsi
mov r8, rbx
mov rcx, rdi
mov word [rax + rdi], 0
call fcn.18001ca04
movsxd r8, dword [rsp + 0x20]
lea rdx, [rbp - 0x74]
lea rcx, [rbx + rdi]
call fcn.18001ca04
test rsi, rsi
je 0x18000acbc
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov r8d, dword [rsp + 0x60]
test r8b, 0x10
je 0x18000ad0e
mov r9, qword [rbp + 0x1f8]
mov rdx, qword [rbp + 0x1e8]
mov rcx, qword [rbp + 0x1e0]
mov r8, rdi
call fcn.18000a920
mov ebx, eax
mov dword [rsp + 0x28], eax
test eax, eax
jne 0x18000ae1a
jmp 0x18000ae02
test rsi, rsi
je 0x18000ac13
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
jmp 0x18000ac13
mov rcx, qword [rbp + 0x1f8]
lea rdx, [rbp - 0x74]
call fcn.18000ae50
test eax, eax
jne 0x18000adfe
mov rsi, qword [rbp + 0x1e8]
mov eax, dword [rsp + 0x7c]
lea rdx, [0x180023bfc]
mov dword [rsi + 0x14], eax
mov eax, dword [rbp - 0x80]
mov dword [rsi + 0x10], r8d
mov r8, qword [rbp + 0x1f0]
mov dword [rsi + 0x18], eax
mov rax, qword [rsp + 0x64]
mov qword [rsi + 0x1c], rax
mov rax, qword [rsp + 0x6c]
lea rcx, [rsi + 0x3a]
mov qword [rsi + 0x24], rax
mov rax, qword [rsp + 0x74]
mov qword [rsi + 0x2c], rax
mov eax, SQLGetData
mov word [rsi + 0x34], ax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp - 0x74]
lea ebx, [rax + rax + 0x2c]
lea rdx, [0x180023bfc]
movsxd rax, ebx
mov word [rsi + 0x36], bx
lea rcx, [rax + rsi + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x194]
lea rdx, [0x180023bfc]
lea ebx, [rbx + rax*2 + 2]
movsxd rax, ebx
mov word [rsi + 0x38], bx
lea rcx, [rax + rsi + 0x10]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsi], 0x2d2f2757
mov dword [rsi + 4], 0x3002
lea ecx, [rbx + rax*2 + 2]
mov dword [rsi + 0xc], 0
mov dword [rsi + 8], ecx
call fcn.180009910
mov rcx, qword [rbp + 0x1e0]
mov r8d, 0x7530
mov rdx, rsi
call qword [rax + 0x70]
mov ebx, eax
mov dword [rsp + 0x28], eax
test eax, eax
jne 0x18000ae1a
jmp 0x18000ae02
mov ebx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18000aa30
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
test rdi, rdi
je 0x18000ae33
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
add rsp, 0x2b8
pop rdi
pop rsi
pop rbx
pop rbp
ret