Function at 0x180002710
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub rsp, 0x38
add edx, 0xfffffff6
mov r10, r9
mov r11, r8
cmp edx, 0x40
ja case.0x1800024b2.12
movsxd rax, edx
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x2568]
mov ecx, dword [rdx + rax*4 + 0x2548]
add rcx, rdx
jmp rcx
lea r9, [0x18000c1d8]
mov r8, r10
mov rdx, r11
add rsp, 0x38
jmp 0x180002610
lea r9, [0x18000c1dc]
mov r8, r10
mov rdx, r11
add rsp, 0x38
jmp 0x180002610
mov r8, r10
mov rdx, r11
add rsp, 0x38
jmp 0x180002710
mov r8, r10
mov rdx, r11
add rsp, 0x38
jmp 0x1800025b0
mov rdx, r11
add rsp, 0x38
jmp 0x180002b10
lea rax, str.download_command_not_implemented...
jmp 0x180002526
mov rdx, r11
add rsp, 0x38
jmp 0x180002a70
lea rax, str.unknown_file_system_command..
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
mov rcx, r10
call fcn.180003230
mov eax, 0x1f
add rsp, 0x38
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, rdx
mov rdi, r8
call fcn.180002ce0
mov edx, 0x80
mov rcx, rdi
mov ebx, eax
call fcn.180003090
mov edx, ebx
mov rcx, rdi
call fcn.180003190
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
lea rdx, [0x18000c228]
mov rcx, rdi
mov r8d, eax
call fcn.1800031c0
mov rbx, qword [rsp + 0x30]
mov eax, 0x16
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov dword [rsp + 0x50], 0
mov rcx, r14
lea rdx, [rsp + 0x50]
mov rsi, r9
mov r15, r8
call fcn.180002d20
movsxd rdi, dword [rsp + 0x50]
mov rbx, rax
lea rcx, [rdi + 1]
call qword [sym.imp.msvcrt.dll_malloc]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call sub.msvcrt.dll_memcpy
mov rdx, rsi
mov byte [rdi + rbp], 0
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fopen]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1800026c4
mov rcx, r14
call fcn.180002d90
movsxd r8, eax
call fcn.180002d80
mov rcx, rax
mov r9, rbx
mov edx, 1
call fcn.180006400
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, 0x21
jmp 0x1800026f3
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rcx, r15
lea edx, [r9 + 8]
call fcn.180003230
mov eax, 0x1f
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x118], rax
mov rcx, rdx
mov qword [rsp + 0x58], r8
mov r15, r8
mov rbx, rdx
call fcn.180002ce0
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0
mov rcx, rbx
mov esi, eax
call fcn.180002d20
mov ecx, 0x4000
mov rdi, rax
call qword [sym.imp.msvcrt.dll_malloc]
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
mov r14, rax
call sub.msvcrt.dll_memset
movsxd rbx, dword [rsp + 0x50]
mov rdx, rdi
mov r8, rbx
mov rcx, r14
call sub.msvcrt.dll_memcpy
mov edx, 0x200000
mov byte [rbx + r14], 0
mov rcx, r15
call fcn.180003090
mov edx, esi
mov rcx, r15
call fcn.180003190
mov r8d, 0x4000
lea rdx, [0x18000c22c]
mov rcx, r14
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
jne 0x1800027f7
mov rdx, r14
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r9d, 2
lea r8, [0x18000c230]
mov edx, 0x4000
mov rcx, r14
call fcn.180006260
mov r8, r14
lea rdx, [0x18000c138]
mov rcx, r15
call fcn.1800031c0
lea rdx, [rbp - 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov rcx, r14
cmp rax, 0xffffffffffffffff
jne 0x18000282d
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1800029aa
call qword [sym.imp.msvcrt.dll_free]
mov qword [rsp + 0x260], r12
nop dword [rax + rax]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x6c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rsp + 0x60]
xor ecx, ecx
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test byte [rbp - 0x80], 0x10
movzx ebx, word [rsp + 0x6c]
movzx edi, word [rsp + 0x6a]
movzx esi, word [rsp + 0x68]
movzx r14d, word [rsp + 0x60]
movzx r15d, word [rsp + 0x66]
movzx r12d, word [rsp + 0x62]
je 0x1800028fc
mov eax, dword [0x18000c258]
lea rcx, [rbp + 0xc0]
movups xmm0, xmmword [str._ns__td20_:d20_:d20__d20__d20__d20__t0_tD]
mov dword [rbp + 0xe0], eax
movups xmm1, xmmword [0x18000c248]
movzx eax, word [0x18000c25c]
movups xmmword [rbp + 0xc0], xmm0
mov word [rbp + 0xe4], ax
movups xmmword [rbp + 0xd0], xmm1
call sub.msvcrt.dll__strrev
mov rcx, qword [rsp + 0x58]
mov rdx, rax
lea rax, [rbp - 0x54]
mov r9d, r15d
mov qword [rsp + 0x40], rax
mov r8d, r12d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
call fcn.1800031c0
jmp 0x180002984
movups xmm0, xmmword [str._ns__td20_:d20_:d20__d20__d20__d20__td46I__tF]
mov eax, dword [rbp - 0x60]
lea rcx, [rbp + 0xe8]
movups xmm1, xmmword [0x18000c270]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x64]
movups xmmword [rbp + 0xe8], xmm0
mov dword [rsp + 0x54], eax
movsd xmm0, qword [0x18000c280]
movzx eax, word [0x18000c288]
movsd qword [rbp + 0x108], xmm0
movups xmmword [rbp + 0xf8], xmm1
mov word [rbp + 0x110], ax
call sub.msvcrt.dll__strrev
mov r8, qword [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x54]
mov qword [rsp + 0x48], rax
mov r9d, r12d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
call fcn.1800031c0
lea rdx, [rbp - 0x80]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180002840
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r12, qword [rsp + 0x260]
mov eax, 0x16
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.18000a290
add rsp, 0x220
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rcx, rdx
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
call fcn.180002d20
movsxd rdi, dword [rsp + 0x40]
mov rbx, rax
lea rcx, [rdi + 1]
call qword [sym.imp.msvcrt.dll_malloc]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_memcpy
mov rcx, rsi
mov byte [rdi + rsi], 0
call fcn.1800029d0
mov rcx, rsi
test eax, eax
je 0x180002adf
call fcn.180003ab0
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__rmdir]
jmp 0x180002ae5
call qword [sym.imp.msvcrt.dll_remove]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x30]
mov eax, 0x21
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rcx, rdx
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
call fcn.180002d20
movsxd rdi, dword [rsp + 0x40]
mov rbx, rax
lea rcx, [rdi + 1]
call qword [sym.imp.msvcrt.dll_malloc]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_memcpy
mov rcx, rsi
mov byte [rdi + rsi], 0
call qword [sym.imp.msvcrt.dll__mkdir]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rbx, qword [rsp + 0x30]
mov eax, 0x21
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret