Function at 0x1801072d0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3f0
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x3e0], rax
mov dword [rsp + 0x290], 0
mov qword [rsp + 0x3c0], 0xffffffffffffffff
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x2a8], 0xffffffff
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x400]
mov r8, qword [rsp + 0x400]
lea rdx, [0x18003eda0]
mov ecx, 4
call fcn.18010b280
lea rdi, [rsp + 0x2b0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x400]
lea rdx, [0x180010cb0]
lea rcx, [rsp + 0x2b0]
call fcn.1800eb79c
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x3c0], rax
cmp qword [rsp + 0x3c0], 0xffffffffffffffff
jne 0x180107442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x290], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x2b0]
lea rdx, [0x18003ed20]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x18010747d
movsx eax, byte [rsp + 0x17c]
cmp eax, 0x2e
jne 0x18010747d
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x17c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 1
je 0x1801074c5
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x1801074e3
movsx eax, byte [rsp + 0x17c]
cmp eax, 0x2e
jne 0x1801074e3
movsx eax, byte [rsp + 0x17d]
cmp eax, 0x2e
jne 0x1801074e3
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x17c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jne 0x1801074e3
lea r8, [rsp + 0x17c]
lea rdx, [0x18003ecc0]
mov ecx, 3
call fcn.18010b280
jmp 0x180107c7e
lea r8, [rsp + 0x17c]
lea rdx, [0x18003ec70]
mov ecx, 3
call fcn.18010b280
lea rdi, [rsp + 0x2b0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea r9, [rsp + 0x17c]
mov r8, qword [rsp + 0x400]
lea rdx, [0x180009c88]
lea rcx, [rsp + 0x2b0]
call fcn.1800eb79c
lea rdi, [rsp + 0x90]
xor eax, eax
mov ecx, 0xac
rep stosb byte [rdi], al
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [rsp + 0x2a8], eax
cmp dword [rsp + 0x2a8], 0xffffffff
jne 0x1801075b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x290], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x290]
lea r8, [rsp + 0x90]
lea rdx, [0x18003ebe0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
lea rdi, [rsp + 0x140]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x154]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x18010763d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x290], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x154]
lea rdx, [0x18003eb40]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
movzx eax, word [rsp + 0x140]
mov word [rsp + 0x298], ax
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x29a], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x29b], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x29c], al
movzx eax, byte [rsp + 0x14a]
mov byte [rsp + 0x29d], al
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x29e], al
movzx eax, byte [rsp + 0x14e]
mov byte [rsp + 0x29f], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x1801076c4
mov eax, 0x1000
mov word [rsp + 0x2a0], ax
jmp 0x180107729
cmp dword [rsp + 0x2a8], 1
jne 0x1801076de
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x3c8], eax
jmp 0x180107711
cmp dword [rsp + 0x2a8], 2
jne 0x1801076f8
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x3cc], eax
jmp 0x180107703
mov dword [rsp + 0x3cc], 0
mov eax, dword [rsp + 0x3cc]
mov dword [rsp + 0x3c8], eax
mov eax, dword [rsp + 0x90]
neg eax
sub eax, dword [rsp + 0x3c8]
mov word [rsp + 0x2a0], ax
lea rdi, [rsp + 0x140]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x15c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x1801077b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x290], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x15c]
lea rdx, [0x18003eaa0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
movzx eax, word [rsp + 0x140]
mov word [rsp + 0x78], ax
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x7a], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x7b], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x7c], al
movzx eax, byte [rsp + 0x14a]
mov byte [rsp + 0x7d], al
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x7e], al
movzx eax, byte [rsp + 0x14e]
mov byte [rsp + 0x7f], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180107824
mov eax, 0x1000
mov word [rsp + 0x80], ax
jmp 0x180107889
cmp dword [rsp + 0x2a8], 1
jne 0x18010783e
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x3d0], eax
jmp 0x180107871
cmp dword [rsp + 0x2a8], 2
jne 0x180107858
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x3d4], eax
jmp 0x180107863
mov dword [rsp + 0x3d4], 0
mov eax, dword [rsp + 0x3d4]
mov dword [rsp + 0x3d0], eax
mov eax, dword [rsp + 0x90]
neg eax
sub eax, dword [rsp + 0x3d0]
mov word [rsp + 0x80], ax
lea rdi, [rsp + 0x140]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x164]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180107912
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x290], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x164]
lea rdx, [0x18003ea00]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
movzx eax, word [rsp + 0x140]
mov word [rsp + 0x68], ax
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x6b], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x6c], al
movzx eax, byte [rsp + 0x14a]
mov byte [rsp + 0x6d], al
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x6e], al
movzx eax, byte [rsp + 0x14e]
mov byte [rsp + 0x6f], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180107981
mov eax, 0x1000
mov word [rsp + 0x70], ax
jmp 0x1801079e3
cmp dword [rsp + 0x2a8], 1
jne 0x18010799b
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x3d8], eax
jmp 0x1801079ce
cmp dword [rsp + 0x2a8], 2
jne 0x1801079b5
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x3dc], eax
jmp 0x1801079c0
mov dword [rsp + 0x3dc], 0
mov eax, dword [rsp + 0x3dc]
mov dword [rsp + 0x3d8], eax
mov eax, dword [rsp + 0x90]
neg eax
sub eax, dword [rsp + 0x3d8]
mov word [rsp + 0x70], ax
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x180107aed
lea rax, [rsp + 0x298]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x410]
mov r8, qword [rsp + 0x408]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x17c]
call fcn.1801059f0
mov dword [rsp + 0x290], eax
cmp dword [rsp + 0x290], 0
je 0x180107ae8
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x17c]
lea rdx, [0x18003e950]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
jmp 0x180107c7e
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x408]
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x17c]
lea rcx, [rsp + 0x60]
call fcn.180102fd0
mov dword [rsp + 0x290], eax
cmp dword [rsp + 0x290], 0
je 0x180107ba2
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x17c]
lea r8, [rsp + 0x60]
lea rdx, [0x18003e8b0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
xor r8d, r8d
lea rdx, [rsp + 0x298]
mov rcx, qword [rsp + 0x60]
call fcn.180105440
mov r8d, 1
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call fcn.180105440
mov r8d, 2
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.180105440
cmp qword [rsp + 0x418], 0
je 0x180107c7e
mov r8, qword [rsp + 0x420]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x17c]
call qword [rsp + 0x418]
mov dword [rsp + 0x290], eax
cmp dword [rsp + 0x290], 0
je 0x180107c7e
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2b0]
lea r8, [rsp + 0x17c]
lea rdx, [0x18003e820]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180107d30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x290], eax
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x290], 0x12
je 0x180107d12
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
mov r8, qword [rsp + 0x3c0]
lea rdx, [0x18003e7a0]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x290]
jmp 0x180107d4d
lea rdx, [0x18003e740]
mov ecx, 3
call fcn.18010b280
mov dword [rsp + 0x290], 0
jmp 0x180107d35
jmp 0x180107442
lea rdx, [0x18003e6f0]
mov ecx, 4
call fcn.18010b280
mov eax, dword [rsp + 0x290]
mov rcx, qword [rsp + 0x3e0]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x3f0
pop rdi
ret