Function at 0x180005644
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor edi, edi
mov rbx, rcx
test rdx, rdx
jne 0x180004fdc
call fcn.180004bb0
lea ebx, [rdi + 0x16]
mov dword [rax], ebx
call fcn.180004a90
mov eax, ebx
jmp 0x18000517c
xorps xmm0, xmm0
mov qword [rdx], rdi
mov rax, qword [rcx]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
test rax, rax
je 0x180005049
lea rdx, [rbp + 0x50]
mov word [rbp + 0x50], 0x3f2a
mov rcx, rax
mov byte [rbp + 0x52], dil
call fcn.1800083c0
mov rcx, qword [rbx]
test rax, rax
jne 0x180005021
lea r9, [rbp - 0x20]
xor r8d, r8d
xor edx, edx
call 0x1800051ac
jmp 0x18000502d
lea r8, [rbp - 0x20]
mov rdx, rax
call 0x180005334
mov esi, eax
test eax, eax
jne 0x18000503c
add rbx, 8
mov rax, qword [rbx]
jmp 0x180004fee
mov r12, qword [rbp - 0x18]
mov r15, qword [rbp - 0x20]
jmp 0x180005141
mov r15, qword [rbp - 0x20]
mov r9, rdi
mov r12, qword [rbp - 0x18]
mov rdx, r15
mov rax, r12
mov qword [rbp + 0x50], rdi
sub rax, r15
mov r8, rdi
mov r14, rax
sar r14, 3
inc r14
lea rcx, [rax + 7]
shr rcx, 3
cmp r15, r12
cmova rcx, rdi
or rsi, 0xffffffffffffffff
test rcx, rcx
je 0x1800050ab
mov r10, qword [rdx]
mov rax, rsi
inc rax
cmp byte [r10 + rax], dil
jne 0x18000508c
inc r9
add rdx, 8
add r9, rax
inc r8
cmp r8, rcx
jne 0x180005086
mov qword [rbp + 0x50], r9
mov r8d, 1
mov rdx, r9
mov rcx, r14
call fcn.18000374c
mov rbx, rax
test rax, rax
je 0x18000513a
lea rdx, [rax + r14*8]
mov r14, r15
mov qword [rbp - 0x28], rdx
mov rax, rdx
mov qword [rbp + 0x58], rdx
cmp r15, r12
je 0x180005131
mov rcx, rbx
sub rcx, r15
mov qword [rbp - 0x30], rcx
mov r8, qword [r14]
mov r13, rsi
inc r13
cmp byte [r8 + r13], dil
jne 0x1800050eb
sub rdx, rax
inc r13
add rdx, qword [rbp + 0x50]
mov r9, r13
mov rcx, rax
call fcn.180008240
test eax, eax
jne 0x180005194
mov rax, qword [rbp + 0x58]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rcx + r14], rax
add rax, r13
add r14, 8
mov qword [rbp + 0x58], rax
cmp r14, r12
jne 0x1800050e5
mov rax, qword [rbp + 0x48]
mov esi, edi
mov qword [rax], rbx
xor ecx, ecx
call fcn.180004c48
mov rbx, r12
mov r14, r15
sub rbx, r15
add rbx, 7
shr rbx, 3
cmp r15, r12
cmova rbx, rdi
test rbx, rbx
je 0x180005172
mov rcx, qword [r14]
call fcn.180004c48
inc rdi
lea r14, [r14 + 8]
cmp rdi, rbx
jne 0x18000515e
mov rcx, r15
call fcn.180004c48
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180004ab0
int1
int1
int1
int1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
or rbp, 0xffffffffffffffff
mov rdi, r9
xor esi, esi
mov r14, r8
mov r13, rdx
mov r12, rcx
inc rbp
cmp byte [rcx + rbp], sil
jne 0x1800051da
mov edx, 1
mov rax, r14
add rbp, rdx
not rax
cmp rbp, rax
jbe 0x180005216
lea eax, [rdx + 0xb]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r15, [r8 + 1]
add r15, rbp
mov rcx, r15
call fcn.180004bd0
mov rbx, rax
test r14, r14
je 0x180005246
mov r9, r14
mov r8, r13
mov rdx, r15
mov rcx, rax
call fcn.180008240
test eax, eax
jne 0x18000531e
sub r15, r14
lea rcx, [rbx + r14]
mov rdx, r15
mov r9, rbp
mov r8, r12
call fcn.180008240
test eax, eax
jne 0x18000531e
mov rcx, qword [rdi + 8]
lea r15d, [rax + 8]
mov r14, qword [rdi + 0x10]
cmp rcx, r14
jne 0x180005315
cmp qword [rdi], rsi
jne 0x1800052a8
mov edx, r15d
lea ecx, [rax + 4]
call fcn.180004bd0
xor ecx, ecx
mov qword [rdi], rax
call fcn.180004c48
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800052dc
lea rax, [rcx + 0x20]
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rax
jmp 0x180005315
sub r14, qword [rdi]
movabs rax, 0x7fffffffffffffff
sar r14, 3
cmp r14, rax
ja 0x1800052dc
mov rcx, qword [rdi]
lea rbp, [r14 + r14]
mov rdx, rbp
mov r8, r15
call fcn.1800065a4
test rax, rax
jne 0x1800052f7
xor ecx, ecx
call fcn.180004c48
mov rcx, rbx
call fcn.180004c48
mov esi, 0xc
xor ecx, ecx
call fcn.180004c48
mov eax, esi
jmp 0x1800051f9
lea rcx, [rax + r14*8]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
lea rcx, [rax + rbp*8]
mov qword [rdi + 0x10], rcx
xor ecx, ecx
call fcn.180004c48
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
add qword [rdi + 8], r15
jmp 0x1800052e9
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180004ab0
int1
int1
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x180016008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r12, r8
mov rsi, rcx
movabs rbx, 0x200000000801
cmp rdx, rcx
je 0x18000539b
mov al, byte [rdx]
sub al, 0x2f
cmp al, 0x2d
ja 0x18000538b
movsx rax, al
bt rbx, rax
jb 0x18000539b
mov rcx, rsi
call fcn.180008788
mov rdx, rax
cmp rax, rsi
jne 0x180005379
mov r8b, byte [rdx]
cmp r8b, 0x3a
jne 0x1800053c2
lea rax, [rsi + 1]
cmp rdx, rax
je 0x1800053c2
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call 0x1800051ac
jmp 0x180005618
sub r8b, 0x2f
xor edi, edi
cmp r8b, 0x2d
ja 0x1800053da
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x1800053dd
mov al, dil
sub rdx, rsi
mov qword [rbp - 0x60], rdi
inc rdx
mov qword [rbp - 0x58], rdi
neg al
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x48], rdi
sbb r13, r13
mov qword [rbp - 0x40], rdi
and r13, rdx
mov byte [rbp - 0x38], dil
xor edx, edx
call fcn.180003fb8
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jne 0x180005438
cmp byte [rsp + 0x48], dil
je 0x180005433
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x180005472
call fcn.180006864
test eax, eax
jne 0x18000545c
cmp byte [rsp + 0x48], dil
je 0x180005454
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x180005472
cmp byte [rsp + 0x48], dil
je 0x18000546f
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.180004c9c
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
test eax, eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800054c0
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call 0x1800051ac
mov edi, eax
jmp 0x180005607
mov r14, qword [r12 + 8]
sub r14, qword [r12]
sar r14, 3
xor edx, edx
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
call fcn.180003fb8
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0xc], r15d
jne 0x180005516
cmp byte [rsp + 0x68], dil
je 0x180005511
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x180005550
call fcn.180006864
test eax, eax
jne 0x18000553a
cmp byte [rsp + 0x68], dil
je 0x180005532
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x180005550
cmp byte [rsp + 0x68], dil
je 0x18000554d
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 4]
call fcn.180004e14
mov r15, qword [rbp - 0x80]
test eax, eax
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jne 0x180005581
mov al, byte [rcx + 1]
test al, al
je 0x180005597
cmp al, 0x2e
jne 0x180005581
cmp byte [rcx + 2], dil
je 0x180005597
mov r9, r12
mov r8, r13
mov rdx, rsi
call 0x1800051ac
mov edi, eax
test eax, eax
jne 0x1800055f0
xor edi, edi
cmp byte [rbp - 0x68], dil
je 0x1800055a5
mov rcx, r15
call fcn.180004c48
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jne 0x1800054cd
mov rax, qword [r12]
mov rdx, qword [r12 + 8]
sub rdx, rax
sar rdx, 3
cmp r14, rdx
je 0x1800055fe
sub rdx, r14
lea rcx, [rax + r14*8]
lea r9, [0x180004c88]
mov r8d, 8
call fcn.180007ea0
jmp 0x1800055fe
cmp byte [rbp - 0x68], 0
je 0x1800055fe
mov rcx, r15
call fcn.180004c48
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x180005616
mov rcx, qword [rbp - 0x50]
call fcn.180004c48
mov eax, edi
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.1800010c0
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
jmp 0x180004fa0