Function at 0x180002d40
Capabilities:
Enumerate files on windows
Enumerate files recursively
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x18001e010]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor esi, esi
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp]
call fcn.1800057f0
lea r8, [0x18001ae3c]
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.180003630
nop
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
mov qword [rbp - 8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x180002f31
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea edx, [rsi + 8]
mov r8d, 0x100000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180002f31
lea r14, [0x18001ae5c]
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
lea rax, [rbp + 0x2c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180002e20
lea rdx, [rbp + 0x2c]
lea rcx, [rsp + 0x78]
call fcn.1800029f0
nop
lea r8, [rsp + 0x78]
mov r15, qword [rbp - 0x70]
cmp r15, 8
setae sil
mov r13, qword [rsp + 0x78]
cmovae r8, r13
mov r12, qword [rbp - 0x78]
cmp r12, 1
jne 0x180002e86
mov rdx, r12
mov rcx, r14
test r12, r12
je 0x180002ec9
sub r8, r14
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x180002e86
add rcx, 2
sub rdx, 1
jne 0x180002e70
jmp 0x180002ec9
lea r8, [rsp + 0x78]
test sil, sil
cmovne r8, r13
cmp r12, 2
jne 0x180002fb5
mov rdx, r12
lea rax, [0x18001ae60]
mov rcx, rax
test r12, r12
je 0x180002ec9
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x180002fb5
add rcx, 2
sub rdx, 1
jne 0x180002eb1
test sil, sil
je 0x180002f03
lea rdx, [r15*2 + 2]
cmp rdx, 0x1000
mov rax, r13
jb 0x180002efb
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003382
mov rcx, r13
call fcn.180004278
xor esi, esi
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180002e00
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180002f45
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x180002f85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002f80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003388
call fcn.180004278
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.180003b30
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rbx
call fcn.1800033c0
test al, al
jne 0x180002ec9
lea r8, [0x18001ae44]
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.180003630
mov rbx, rax
lea r9, [rsp + 0x78]
test sil, sil
cmovne r9, r13
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp r12, rax
ja 0x180003029
lea r14, [r12 + rcx]
mov qword [rbx + 0x10], r14
mov rsi, rbx
cmp rdx, 8
jb 0x18000300f
mov rsi, qword [rbx]
lea rcx, [rsi + rcx*2]
lea r8, [r12 + r12]
mov rdx, r9
call fcn.180008140
xor r8d, r8d
mov word [rsi + r14*2], r8w
jmp 0x18000304c
mov qword [rsp + 0x20], r12
mov rdx, r12
mov rcx, rbx
call fcn.1800037c0
mov rbx, rax
mov r12, qword [rbp - 0x78]
mov r13, qword [rsp + 0x78]
mov r15, qword [rbp - 0x70]
xor r8d, r8d
mov qword [rbp - 0x68], r8
mov qword [rbp - 0x58], r8
mov qword [rbp - 0x50], r8
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], 7
mov word [rbx], r8w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1800030bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800030b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000338e
call fcn.180004278
xor r8d, r8d
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], r8w
mov eax, dword [rbp]
shr eax, 4
and al, 1
mov dword [rsp + 0x44], eax
mov byte [rsp + 0x40], 0
lea rsi, [0x18001ffe0]
lea rax, [0x180020800]
nop
mov r11, qword [rsi + 0x10]
mov rbx, rsi
cmp qword [rsi + 0x18], 8
jb 0x180003101
mov rbx, qword [rsi]
lea r14, [rsp + 0x78]
cmp r15, 8
cmovae r14, r13
cmp r11, r12
ja 0x1800031c6
mov rax, r12
sub rax, r11
test r11, r11
je 0x1800032d7
lea r15, [rax + 1]
lea r15, [r14 + r15*2]
mov rcx, r14
movzx r10d, word [rbx]
nop word [rax + rax]
mov rax, r15
sub rax, rcx
sar rax, 1
mov rdx, r8
je 0x18000316a
cmp word [rcx], r10w
je 0x180003167
cmp rax, 1
je 0x18000316a
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x180003154
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x1800031bb
mov r8, r11
mov rdx, rbx
test r11, r11
je 0x1800031a8
mov r9, rcx
sub r9, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x1800032cb
add rdx, 2
sub r8, 1
jne 0x180003190
sub rcx, r14
sar rcx, 1
xor r8d, r8d
cmp rcx, 0xffffffffffffffff
jne 0x1800032d7
lea rax, [0x180020800]
mov r15, qword [rbp - 0x70]
add rsi, 0x20
cmp rsi, rax
jne 0x1800030f0
movzx eax, byte [rsp + 0x40]
cmp byte [rsp + 0x44], 0
jne 0x1800032de
test al, al
je 0x1800032e8
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800032e8
mov r15d, 0xa00000
cmp dword [rbp + 0x20], r15d
cmovb r15d, dword [rbp + 0x20]
xor esi, esi
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm0
mov r12, qword [rsp + 0x48]
cmp r15, 0x100000
jb 0x18000329d
mov r14d, r15d
shr r14, 0x14
imul rax, r14, 0xfffffffffff00000
add r15, rax
nop word [rax + rax]
mov dword [rbp - 0x38], esi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0x100000
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
add esi, 0x100000
sub r14, 1
jne 0x180003270
test r15, r15
je 0x1800032c0
mov dword [rbp - 0x38], esi
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800032e8
add rcx, 2
xor r8d, r8d
jmp 0x180003140
mov al, 1
jmp 0x1800031d8
lea rcx, [rbp - 0x68]
call fcn.180002d40
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x180003324
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000331f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003394
call fcn.180004278
xor esi, esi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], si
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x180003371
lea rdx, [rdx*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x180003369
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180003382
mov rcx, r13
call fcn.180004278
mov rbx, qword [rsp + 0x50]
lea r14, [0x18001ae5c]
jmp 0x180002f05
call fcn.1800089ec
nop
call fcn.1800089ec
nop
call fcn.1800089ec
nop
call fcn.1800089ec
int3