Function at 0x18004e4c0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x18012d040]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rax, qword [0x18012e040]
cmp rax, qword [0x18012e048]
je 0x18004e4ff
mov qword [0x18012e048], rax
movabs rax, 0x18eee73b675ae57f
movabs r12, 0x1887e7596774e555
mov qword [rsp + 0x20], rax
movabs r14, 0x920f5d30473f0e32
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x920f5d30473f0e5c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x40]
movzx ecx, word [0x18012f480]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1a0]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
test cx, cx
je 0x18004e5b0
lea rdx, [0x18012f480]
lea r8, [rbp + 0x1a0]
sub rdx, r8
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18004e5a0
xor esi, esi
movq rcx, xmm0
mov word [rax], si
test cx, cx
je 0x18004e5e0
lea rdx, [rsp + 0x40]
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x18004e5d0
lea rdx, [rsp + 0x50]
mov word [rax], si
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18004e7d1
mov qword [rsp + 0x4f0], rbx
mov qword [rsp + 0x4f8], r13
movabs r13, 0x77e4c73d09018a33
mov qword [rsp + 0x500], r15
mov r15, 0xffffffffffffffff
nop dword [rax + rax]
lea rbx, [rsp + 0x7c]
cmp word [rsp + 0x7c], si
je 0x18004e649
nop dword [rax]
add rbx, 2
cmp word [rbx], si
jne 0x18004e640
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rax, [rsp + 0x7c]
sub rbx, rax
mov eax, 2
sar rbx, 1
inc rbx
mul rbx
cmovo rax, r15
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, qword [0x18012e048]
cmp rdx, qword [0x18012e050]
mov qword [rsp + 0x20], rax
je 0x18004e6a3
mov qword [rdx], rax
mov rcx, qword [0x18012e048]
add rcx, 8
mov qword [0x18012e048], rcx
jmp 0x18004e6b4
lea r8, [rsp + 0x20]
call fcn.180050310
mov rcx, qword [0x18012e048]
movzx eax, word [rsp + 0x7c]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rcx - 8]
test ax, ax
je 0x18004e6e3
nop word [rax + rax]
mov word [rcx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rcx, 2
test ax, ax
jne 0x18004e6d0
mov word [rcx], si
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov rax, qword [rsp + 0x20]
movabs rax, 0xe66e2f452056685c
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0xec985c45987638ee
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0xa58959da21244b96
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
movabs rax, 0x89f43523b8185787
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0xa58959da21066bac
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x1887e7596774e577
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18004e630
mov r15, qword [rsp + 0x500]
mov rcx, rdi
mov r13, qword [rsp + 0x4f8]
mov rbx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1800c4b70
add rsp, 0x4c0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret