Function at 0x18016f5c0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push r15
sub rsp, 0x840
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x830], rax
xor edi, edi
mov dword [rsp + 0x34], edi
lea rdx, [0x180037a50]
lea rcx, [rsp + 0x40]
call fcn.1800aaba0
nop
lea rcx, [rsp + 0x40]
call fcn.180123260
movzx ebx, al
lea rcx, [rsp + 0x40]
call fcn.1800ad110
test bl, bl
je 0x18016fa03
mov rcx, qword [0x180412640]
add rcx, 8
mov rax, qword [rcx]
lea r8, [0x180037a78]
lea edx, [rdi + 4]
call qword [rax + reloc.WSOCK32.dll_recv]
lea rcx, [0x180037a98]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x18016fa03
lea rdx, [0x180037ac8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x18016f9f9
mov r14d, edi
mov esi, edi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x500]
call fcn.1802c7550
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x610]
call fcn.1802c7550
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x2e0]
call fcn.1802c7550
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 0x1c]
xor ecx, ecx
call rbx
test eax, eax
js 0x18016f727
lea r8, [rsp + 0x500]
lea rdx, [0x180037b30]
lea rcx, [rsp + 0x610]
call fcn.1800fe670
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x610]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x18016f71e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
lea rax, [rsp + 0x500]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call rbx
test eax, eax
js 0x18016f7c1
lea r8, [rsp + 0x500]
lea rdx, [0x180037b50]
lea rcx, [rsp + 0x2e0]
call fcn.1800fe670
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
jne 0x18016f7b0
lea r8, [rsp + 0x500]
lea rdx, [0x180037b70]
lea rcx, [rsp + 0x2e0]
call fcn.1800fe670
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x18016f7b9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov rcx, qword [0x180412640]
add rcx, 8
mov rax, qword [rcx]
lea rdx, [rsp + 0x610]
mov qword [rsp + 0x20], rdx
mov r9d, r14d
lea r8, [0x180037bb0]
mov edx, 4
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [0x180412640]
add rcx, 8
mov rax, qword [rcx]
lea rdx, [rsp + 0x2e0]
mov qword [rsp + 0x20], rdx
mov r9d, esi
lea r8, [0x180035350]
mov edx, 4
call qword [rax + reloc.WSOCK32.dll_recv]
mov ebx, edi
mov dword [rsp + 0x30], ebx
inc ebx
mov dword [rsp + 0x30], ebx
cmp ebx, 2
ja 0x18016f9f9
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x720]
call fcn.1802c7550
lea r8, [rsp + 0x610]
lea rax, [rsp + 0x2e0]
cmp ebx, 1
cmovne r8, rax
lea rdx, [0x18003538c]
lea rcx, [rsp + 0x720]
call fcn.1800fe670
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x720]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18016f9f4
test byte [rsp + 0x60], 0x10
je 0x18016f9d5
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x3f0]
call fcn.1802c7550
lea r8, [rsp + 0x610]
lea rax, [rsp + 0x2e0]
cmp ebx, 1
cmovne r8, rax
lea r9, [rsp + 0x8c]
lea rdx, [0x180035398]
lea rcx, [rsp + 0x3f0]
call fcn.1800fe670
lea rdx, [0x180035374]
lea rcx, [rsp + 0x8c]
call fcn.1802d57c0
test eax, eax
je 0x18016f9d5
lea rdx, [0x180035394]
lea rcx, [rsp + 0x8c]
call fcn.1802d57c0
test eax, eax
je 0x18016f9d5
mov rcx, qword [0x180412640]
add rcx, 8
mov rax, qword [rcx]
lea r9, [rsp + 0x3f0]
lea r8, [0x180035430]
mov edx, 4
call qword [rax + reloc.WSOCK32.dll_recv]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
je 0x18016f9d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, [rsp + 0x3f0]
dec rax
lea rax, [rax + 1]
cmp byte [rax], 0
jne 0x18016f970
mov ecx, dword [0x180035470]
mov dword [rax], ecx
movzx ecx, byte [0x180035474]
mov byte [rax + 4], cl
lea rcx, [rsp + 0x3f0]
call fcn.1802b3b00
mov edi, eax
mov dword [rsp + 0x34], eax
mov rcx, qword [0x180412640]
add rcx, 8
mov r10, qword [rcx]
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x20], rax
mov r9d, edi
lea r8, [0x180035498]
mov edx, 4
call qword [r10 + reloc.WSOCK32.dll_recv]
mov ebx, 2
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18016f890
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x18016f821
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov eax, edi
jmp 0x18016fa0b
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret