Function at 0x180008070
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x268], rbx
mov rax, qword [0x18005d0e0]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r13, r8
mov qword [rsp + 0x70], r8
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rbp - 0x78], rcx
mov dword [r8], 0
mov rcx, qword [rcx]
mov edx, dword [rcx - 0x10]
lea eax, [rdx - 1]
test eax, eax
js 0x180008744
cmp eax, edx
jg 0x180008744
cdqe
cmp byte [rax + rcx], 0x5c
je 0x180008100
mov r8d, 1
lea rdx, [0x18004e2a0]
mov rcx, rbx
call fcn.180003ff0
mov rdx, qword [rbx]
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], 0
mov byte [rbp - 0x68], 0
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp - 0x68]
call fcn.180001660
nop
lea r8d, [r14 + 4]
lea rdx, [0x18004e32c]
lea rcx, [rbp - 0x68]
call fcn.1800071f0
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rcx, qword [rbp - 0x68]
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov qword [rbp - 0x80], rax
cmp rax, r14
je 0x1800086f8
cmp byte [rbp - 0x14], 0x2e
jne 0x18000818f
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1800086bb
jmp 0x180008172
mov rdi, qword [rbx]
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
test byte [rbp - 0x40], 0x10
je 0x1800083f6
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1800081bf
cmp rax, qword [rdi - 0x18]
jne 0x1800081bf
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x1800081f6
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x1800086b5
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
mov r8, rdi
lea rcx, [rax + 0x18]
mov r9, rdx
call fcn.18002feb4
add rbx, 0x18
mov qword [rsp + 0x40], rbx
xor eax, eax
mov rcx, r14
lea rdi, [rbp - 0x14]
repne scasb al, byte [rdi]
not rcx
dec rcx
lea rax, [rbp - 0x14]
mov qword [rsp + 0x30], rax
lea r12, [rbp - 0x14]
sub r12, rbx
mov r13d, dword [rbx - 0x10]
xor eax, eax
test ecx, ecx
setns al
test eax, eax
je 0x1800086aa
movsxd rdx, ecx
lea rcx, [rbp - 0x14]
call fcn.180030828
mov r15, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, r13d
setge dl
test edx, edx
je 0x18000869f
lea edi, [r13 + rax]
test edi, edi
js 0x180008694
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x180008288
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180001ef0
mov rbx, qword [rsp + 0x40]
cmp r12, r13
lea r8, [r12 + rbx]
jbe 0x180008296
mov r8, qword [rsp + 0x30]
movsxd rdx, r15d
lea rcx, [r13 + rbx]
mov r9, rdx
call fcn.18002feb4
cmp edi, dword [rbx - 0xc]
jg 0x180008689
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.180022680
nop
lea rcx, [0x18005d078]
mov rax, qword [0x18005d078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x14]
lea rdx, str._s_t0_t_u_t_s_t1_n
lea rcx, [rsp + 0x30]
call fcn.180002980
mov rdi, qword [rsp + 0x30]
mov eax, dword [rdi - 0x10]
add eax, 0x20
mov r13, qword [rsp + 0x70]
add dword [r13], eax
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x30]
cmp rax, rcx
jae 0x180008379
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
cmp rax, rdx
ja 0x180008379
lea rbx, [rsp + 0x30]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [rsi + 0x10]
jne 0x18000834c
mov rcx, rsi
call fcn.180009040
mov rcx, qword [rsi]
mov r12, qword [rsi + 8]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x48], r12
test r12, r12
je 0x180008377
mov rcx, qword [rcx + rbx*8]
sub rcx, 0x18
call fcn.180001790
add rax, 0x18
mov qword [r12], rax
jmp 0x1800083aa
cmp rcx, qword [rsi + 0x10]
jne 0x180008387
mov rcx, rsi
call fcn.180009040
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x1800083aa
lea rcx, [rdi - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [rbx], rax
add qword [rsi + 8], 8
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800083cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1800083ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x40]
jmp 0x18000864f
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x180008412
cmp rax, qword [rdi - 0x18]
jne 0x180008412
lea rbx, [rdi - 0x18]
lock inc dword [rdi - 8]
jmp 0x180008449
mov rax, qword [rax]
mov r8d, 1
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x1800086f2
mov ecx, dword [rdi - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rdi - 0x10]
inc ecx
movsxd rdx, ecx
mov r8, rdi
lea rcx, [rax + 0x18]
mov r9, rdx
call fcn.18002feb4
add rbx, 0x18
mov qword [rsp + 0x50], rbx
xor eax, eax
mov rcx, r14
lea rdi, [rbp - 0x14]
repne scasb al, byte [rdi]
not rcx
dec rcx
lea rax, [rbp - 0x14]
mov qword [rsp + 0x38], rax
lea r12, [rbp - 0x14]
sub r12, rbx
mov r13d, dword [rbx - 0x10]
xor eax, eax
test ecx, ecx
setns al
test eax, eax
je 0x1800086e7
movsxd rdx, ecx
lea rcx, [rbp - 0x14]
call fcn.180030828
mov r15, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, r13d
setge dl
test edx, edx
je 0x1800086dc
lea edi, [r13 + rax]
test edi, edi
js 0x1800086d1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1800084db
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.180001ef0
mov rbx, qword [rsp + 0x50]
cmp r12, r13
lea r8, [r12 + rbx]
jbe 0x1800084e9
mov r8, qword [rsp + 0x38]
movsxd rdx, r15d
lea rcx, [r13 + rbx]
mov r9, rdx
call fcn.18002feb4
cmp edi, dword [rbx - 0xc]
jg 0x1800086c6
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], 0
mov rcx, rbx
call fcn.180021ff0
mov rdi, rax
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.180022680
nop
lea rcx, [0x18005d078]
mov rdx, qword [0x18005d078]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9, rdi
lea r8, [rbp - 0x14]
lea rdx, str._s_t1_t_llu_t_s_t1_n
lea rcx, [rsp + 0x38]
call fcn.180002980
mov rdi, qword [rsp + 0x38]
mov eax, dword [rdi - 0x10]
add eax, 0x20
mov r13, qword [rsp + 0x70]
add dword [r13], eax
mov rcx, qword [rsi + 8]
lea rax, [rsp + 0x38]
cmp rax, rcx
jae 0x1800085d7
mov rax, qword [rsi]
lea rdx, [rsp + 0x38]
cmp rax, rdx
ja 0x1800085d7
lea rbx, [rsp + 0x38]
sub rbx, rax
sar rbx, 3
cmp rcx, qword [rsi + 0x10]
jne 0x1800085aa
mov rcx, rsi
call fcn.180009040
mov rcx, qword [rsi]
mov r12, qword [rsi + 8]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r12
test r12, r12
je 0x1800085d5
mov rcx, qword [rcx + rbx*8]
sub rcx, 0x18
call fcn.180001790
add rax, 0x18
mov qword [r12], rax
jmp 0x180008608
cmp rcx, qword [rsi + 0x10]
jne 0x1800085e5
mov rcx, rsi
call fcn.180009040
mov rbx, qword [rsi + 8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rbx
test rbx, rbx
je 0x180008608
lea rcx, [rdi - 0x18]
call fcn.180001790
add rax, 0x18
mov qword [rbx], rax
add qword [rsi + 8], 8
lea rdx, [rdi - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180008629
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000864a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x18000866a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rbp - 0x40]
mov rdi, qword [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x1800086bb
jmp 0x180008172
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
nop
call fcn.180001c20
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1800086f8
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
int3
mov ecx, 0x80070057
call fcn.180001050
nop
call fcn.180001c20
int3
add dword [r13], 0x400
cmp qword [rbp - 0x50], 0x10
jb 0x180008710
mov rcx, qword [rbp - 0x68]
call fcn.18002f934
mov qword [rbp - 0x50], sendto
mov qword [rbp - 0x58], 0
mov byte [rbp - 0x68], 0
mov rdx, qword [rbx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
dec r14d
test r14d, r14d
jg 0x18000874f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x18000874f
mov ecx, 0x80070057
call fcn.180001050
nop
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.18002f950
mov rbx, qword [rsp + 0x268]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret