Function at 0x180002d40
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x3c0
mov rax, qword [0x180061008]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov ebx, 0x104
lea rcx, [rsp + 0x2a0]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, ebx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, ebx
lea rax, [rsp + 0x2a0]
cmp byte [rax], 0
je 0x180002db0
inc rax
sub rcx, 1
jne 0x180002da2
xor r12d, r12d
mov r15d, 0x80070057
test rcx, rcx
mov edx, r15d
cmovne edx, r12d
je 0x180002dcd
mov rax, rbx
sub rax, rcx
jmp 0x180002dd0
mov rax, r12
test edx, edx
js 0x180002e2c
mov rdx, rbx
lea rcx, [rsp + 0x2a0]
lea rcx, [rcx + rax]
sub rdx, rax
je 0x180002e1e
add rax, 0x7ffffefa
lea r9, [0x1800553f0]
add rax, rdx
sub r9, rcx
nop dword [rax + rax]
test rax, rax
je 0x180002e1e
movzx r8d, byte [r9 + rcx]
test r8b, r8b
je 0x180002e1e
mov byte [rcx], r8b
dec rax
inc rcx
sub rdx, 1
jne 0x180002e00
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r12b
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, 0x9c40
mov rsi, r12
mov rbp, rax
call fcn.180017504
mov r14, rax
mov rdi, r12
mov rcx, rbx
call fcn.180017504
mov qword [r14 + rdi*8], rax
inc rdi
cmp rdi, 0x1388
jb 0x180002e55
nop dword [rax]
test byte [rsp + 0x50], 0x10
jne 0x180002ec1
cmp dword [rsp + 0x70], 0x249f0
jbe 0x180002ec1
mov rax, qword [r14 + rsi*8]
lea r8, [rsp + 0x7c]
sub r8, rax
mov rdx, rbx
lea rcx, [rdx + 0x7ffffefa]
test rcx, rcx
je 0x180002eb0
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x180002eb0
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x180002e90
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
inc rsi
mov byte [rcx], r12b
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x180002edc
cmp rsi, 0x1388
jb 0x180002e70
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
mov eax, 8
div rsi
mov rcx, rbx
lea rax, [rsp + 0x190]
mov r10, rdx
nop dword [rax]
cmp byte [rax], r12b
je 0x180002f0e
inc rax
sub rcx, 1
jne 0x180002f00
test rcx, rcx
mov r8d, r15d
cmovne r8d, r12d
je 0x180002f22
mov rax, rbx
sub rax, rcx
jmp 0x180002f25
mov rax, r12
test r8d, r8d
js 0x180002f7d
mov rdx, rbx
lea rcx, [rsp + 0x190]
lea rcx, [rcx + rax]
sub rdx, rax
je 0x180002f6f
add rax, 0x7ffffefa
lea r9, [0x1800553f4]
add rax, rdx
sub r9, rcx
test rax, rax
je 0x180002f6f
movzx r8d, byte [r9 + rcx]
test r8b, r8b
je 0x180002f6f
mov byte [rcx], r8b
dec rax
inc rcx
sub rdx, 1
jne 0x180002f51
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r12b
mov r8, qword [r14 + r10*8]
lea rax, [rsp + 0x190]
mov rcx, rbx
nop dword [rax]
cmp byte [rax], r12b
je 0x180002f9e
inc rax
sub rcx, 1
jne 0x180002f90
test rcx, rcx
cmovne r15d, r12d
je 0x180002faf
mov rax, rbx
sub rax, rcx
jmp 0x180002fb2
mov rax, r12
test r15d, r15d
js 0x180002ffe
lea rcx, [rsp + 0x190]
lea rcx, [rcx + rax]
sub rbx, rax
je 0x180002ff0
add rax, 0x7ffffefa
add rax, rbx
sub r8, rcx
test rax, rax
je 0x180002ff0
movzx edx, byte [rcx + r8]
test dl, dl
je 0x180002ff0
mov byte [rcx], dl
dec rax
inc rcx
sub rbx, 1
jne 0x180002fd4
test rbx, rbx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r12b
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x190]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
xor edx, edx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebx, eax
call fcn.180017504
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r12
mov r8d, ebx
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, r12d
movabs r10, 0x8080808080808081
nop dword [rax]
mov r9d, edx
cmp byte [r9 + rdi], r12b
jne 0x1800030b1
imul r8d, edx, 0x7c
mov ecx, 0x17
shl edx, 5
mov eax, edx
sub r8d, 0x2c
imul r8, rax
mov rax, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xff
mov edx, r12d
sub r8, rax
movzx eax, r8b
cmovne ecx, eax
mov byte [r9 + rdi], cl
inc edx
cmp edx, 0x249f0
jb 0x180003070
mov rcx, rsi
mov byte [rdi + 0x249ef], r12b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.180017470
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret