Function at 0x18010e6f0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe30]
sub rsp, 0xf30
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xf88], rbx
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0xe20], rax
mov rdi, r8
mov qword [rsp + 0x20], r8
mov r12, rdx
mov r13, rcx
xor r15d, r15d
cmp word [rdx], r15w
jne 0x18010e749
mov r8d, r15d
jmp 0x18010e75a
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rdx + r8*2], r15w
jne 0x18010e750
call fcn.180005450
mov r14, r15
mov qword [rsp + 0x28], r15
mov rsi, r15
mov qword [rsp + 0x30], r15
mov rbx, r15
mov qword [rsp + 0x38], rbx
mov word [rbp + 0xa00], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0xa02]
call fcn.1800be330
mov word [rbp + 0x3d0], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x3d2]
call fcn.1800be330
mov r8, rdi
lea rdx, [0x1801ec2c4]
lea rcx, [rbp + 0xa00]
call fcn.1800b5a54
xor edi, edi
mov word [rbp + 0x7f0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x7f2]
call fcn.1800be330
mov word [rbp + 0x5e0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x5e2]
call fcn.1800be330
mov word [rbp + 0xc10], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0xc12]
call fcn.1800be330
lea r8, [rbp + 0xa00]
lea rdx, [0x1801ec548]
lea rcx, [rbp + 0xc10]
call fcn.1800b5a54
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0xc10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x18010eb85
lea rdx, [rsp + 0x70]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18010eb85
cmp word [rbp - 0x64], 0x2e
je 0x18010e851
movzx eax, word [rbp - 0x62]
test ax, ax
je 0x18010e851
cmp ax, 0x2e
jne 0x18010e884
cmp word [rbp - 0x60], 0
je 0x18010e851
test byte [rsp + 0x70], 0x10
jne 0x18010e851
lea r8, [rbp - 0x64]
lea rdx, [0x1801ec2c4]
lea rcx, [rbp + 0x7f0]
call fcn.1800b5a54
lea rcx, [rbp + 0x7f0]
call fcn.1800b5db4
lea rdx, str..wncl
lea rcx, [rbp + 0x7f0]
call fcn.1800bae90
test rax, rax
je 0x18010e851
mov word [rbp + 0x1c0], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x1c2]
call fcn.1800be330
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x7f0]
call fcn.18000f970
mov rcx, rdi
lea rdx, [rbp + 0x1c0]
lea r8, str..wncl
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x18010e851
cmp rcx, 6
jne 0x18010e910
lea r8, [rbp - 0x64]
lea rdx, [0x1801ec2c4]
lea rcx, [rbp + 0x5e0]
call fcn.1800b5a54
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
cmp word [rbp + 0x5e0], 0
jne 0x18010e962
mov r8, rdi
jmp 0x18010e97b
lea rax, [rbp + 0x5e0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18010e970
lea rdx, [rbp + 0x5e0]
lea rcx, [rsp + 0x50]
call fcn.180005450
nop
lea rax, [rsp + 0x50]
cmp rax, rsi
jae 0x18010ea61
lea rax, [rsp + 0x50]
cmp r14, rax
ja 0x18010ea61
lea rdi, [rsp + 0x50]
sub rdi, r14
cmp rsi, rbx
jne 0x18010ea2e
mov rax, rbx
sub rax, rsi
sar rax, 5
cmp rax, 1
jae 0x18010ea2e
sub rsi, r14
sar rsi, 5
movabs rdx, 0x7ffffffffffffff
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18010eb6b
inc rsi
sub rbx, r14
sar rbx, 5
mov rcx, rbx
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rax, rbx
jae 0x18010ea08
xor eax, eax
mov ebx, eax
jmp 0x18010ea0b
add rbx, rcx
cmp rbx, rsi
cmovb rbx, rsi
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180012cf0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
and rdi, 0xffffffffffffffe0
add rdi, r14
test rsi, rsi
je 0x18010ea56
mov qword [rsi + 0x18], 7
xor eax, eax
mov qword [rsi + 0x10], rax
mov word [rsi], ax
mov rdx, rdi
mov rcx, rsi
call fcn.1800146e0
add rsi, 0x20
xor edi, edi
jmp 0x18010eb4b
cmp rsi, rbx
jne 0x18010eadd
mov rax, rbx
sub rax, rsi
sar rax, 5
cmp rax, 1
jae 0x18010eadd
sub rsi, r14
sar rsi, 5
movabs rdx, 0x7ffffffffffffff
mov rax, rdx
sub rax, rsi
cmp rax, 1
jb 0x18010eb78
inc rsi
sub rbx, r14
sar rbx, 5
mov rcx, rbx
shr rcx, 1
mov rax, rdx
sub rax, rcx
cmp rax, rbx
jae 0x18010eab7
mov rbx, rdi
jmp 0x18010eaba
add rbx, rcx
cmp rbx, rsi
cmovb rbx, rsi
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180012cf0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
test rsi, rsi
je 0x18010eb47
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
mov word [rsi], di
cmp qword [rsp + 0x68], 8
jae 0x18010eb15
mov r8, qword [rsp + 0x60]
inc r8
je 0x18010eb22
add r8, r8
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1800b54c0
jmp 0x18010eb22
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0x68]
mov qword [rsi + 0x18], rax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x50], di
add rsi, 0x20
mov qword [rsp + 0x30], rsi
cmp qword [rsp + 0x68], 8
jb 0x18010e851
mov rcx, qword [rsp + 0x50]
call fcn.1800b5354
jmp 0x18010e851
lea rcx, str.vector_T__too_long
call fcn.1800b2c70
int3
lea rcx, str.vector_T__too_long
call fcn.1800b2c70
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15b, 1
mov rbx, r14
cmp r14, rsi
je 0x18010ee07
mov r14, qword [rsp + 0x20]
cmp qword [rbx + 0x18], 8
jb 0x18010ebae
mov rdi, qword [rbx]
jmp 0x18010ebb1
mov rdi, rbx
mov r9, rdi
mov r8, r14
lea rdx, [0x1801eb788]
lea rcx, [rbp + 0x3d0]
call fcn.1800b5a54
mov ecx, 0xc0
call fcn.1800b543c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18010ebe7
mov rcx, rax
call fcn.1801512d0
nop
mov qword [rsp + 0x20], rax
mov rdx, r14
mov rcx, rax
call fcn.180152f20
lea r9, [rbp + 0x3d0]
mov r8, rdi
mov rdx, r12
mov rcx, qword [rsp + 0x20]
call fcn.180151800
test eax, eax
jne 0x18010ed92
cmp r15b, 1
jne 0x18010ec21
xor r15b, r15b
jmp 0x18010ec37
lea rcx, [r13 + 0x20]
mov r8d, 1
lea rdx, [0x1801f3b30]
call fcn.180004d10
mov qword [rsp + 0x68], 7
xor eax, eax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x50], ax
cmp word [rdi], ax
jne 0x18010ec56
mov r8d, eax
jmp 0x18010ec6a
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], ax
jne 0x18010ec60
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180005450
nop
mov edx, 0x2e
xor r8d, r8d
lea rcx, [rsp + 0x50]
call fcn.1800215a0
mov rdi, rax
xor eax, eax
mov word [rbp + 0x1c0], ax
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x1c2]
call fcn.1800be330
movsxd r8, edi
cmp qword [rsp + 0x60], r8
cmovb r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
test r8, r8
je 0x18010ecdd
add r8, r8
lea rcx, [rbp + 0x1c0]
call fcn.1800b54c0
cmp word [rbp + 0x1c0], 0
jne 0x18010ecee
xor edi, edi
mov r8d, edi
jmp 0x18010ed0d
lea rax, [rbp + 0x1c0]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18010ed00
xor edi, edi
lea rcx, [r13 + 0x20]
lea rdx, [rbp + 0x1c0]
call fcn.180004d10
lea rcx, [rbp + 0x1c0]
call fcn.1800baa0c
mov dword [rsp + 0x40], eax
lea rcx, [r13 + 0x48]
lea rdx, [rsp + 0x40]
call fcn.18010e2f0
cmp word [rbp + 0x3d0], 0
jne 0x18010ed4a
mov r8, rdi
jmp 0x18010ed60
lea rcx, [rbp + 0x3d0]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x18010ed55
lea rdx, [rbp + 0x3d0]
mov rcx, rax
call fcn.180005450
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x18010ed90
mov rcx, rdi
call fcn.1801513c0
mov rcx, rdi
call fcn.1800b5354
xor eax, eax
mov qword [rsp + 0x20], rax
jmp 0x18010ede1
mov qword [rsp + 0x68], 7
xor eax, eax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x50], ax
cmp word [rdi], ax
jne 0x18010edb1
mov r8d, eax
jmp 0x18010edbf
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], ax
jne 0x18010edb5
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.180005450
nop
mov rcx, qword [r13 + 0x40]
mov rax, qword [rcx]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
call qword [rax]
nop
cmp qword [rsp + 0x68], 8
jb 0x18010edf3
mov rcx, qword [rsp + 0x50]
call fcn.1800b5354
add rbx, 0x20
cmp rbx, rsi
jne 0x18010eba2
mov r14, qword [rsp + 0x28]
xor edi, edi
test r14, r14
je 0x18010ee43
mov rbx, r14
cmp r14, rsi
je 0x18010ee3b
cmp qword [rbx + 0x18], 8
jb 0x18010ee23
mov rcx, qword [rbx]
call fcn.1800b5354
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
add rbx, 0x20
cmp rbx, rsi
jne 0x18010ee14
mov rcx, r14
call fcn.1800b5354
mov eax, 1
mov rcx, qword [rbp + 0xe20]
xor rcx, rsp
call fcn.1800b5370
mov rbx, qword [rsp + 0xf88]
add rsp, 0xf30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret