Function at 0x18008e630
Capabilities:
Enumerate files on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x460
mov qword [rsp + 0x438], 0xfffffffffffffffe
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x458], rax
mov qword [rsp + 0x170], 0
mov qword [rsp + 0x3d8], 0
mov qword [rsp + 0x3d0], 0xffffffffffffffff
mov dword [rsp + 0x48], 0x1f
mov rdx, qword [rsp + 0x470]
add rdx, 0x28
lea rcx, [rsp + 0x30]
call fcn.18008d200
nop
mov rax, qword [rsp + 0x470]
mov byte [rax + 0x10], 0
cmp qword [rsp + 0x478], 0
jne 0x18008e776
cmp qword [rsp + 0x480], 0
jne 0x18008e776
lea rcx, [0x180010d20]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x3e8], rax
cmp qword [rsp + 0x3e8], 0
je 0x18008e726
lea r9, [0x180010cc0]
xor r8d, r8d
mov edx, 2
mov rcx, qword [rsp + 0x3e8]
call fcn.18008d120
mov qword [rsp + 0x440], rax
jmp 0x18008e732
mov qword [rsp + 0x440], 0
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x3f0], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x3f0]
call fcn.1800ec370
cmp qword [rsp + 0x478], 0
jne 0x18008e834
mov rax, qword [rsp + 0x498]
cmp qword [rax], 0
je 0x18008e7cf
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x490]
mov r8d, dword [rsp + 0x488]
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
call fcn.18008f530
mov qword [rsp + 0x170], rax
jmp 0x18008e80d
mov rax, qword [rsp + 0x470]
add rax, 0x58
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x490]
mov r8d, dword [rsp + 0x488]
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
call fcn.18008f530
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x3f8], rax
lea rcx, [rsp + 0x30]
call fcn.18008d2a0
mov rax, qword [rsp + 0x3f8]
jmp 0x18008ec89
lea rdi, [rsp + 0x180]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x478]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0xffffffffffffffff
je 0x18008e90d
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x498]
cmp qword [rax], 0
je 0x18008e8ca
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x488]
mov r8, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x470]
call fcn.18008ecb0
mov qword [rsp + 0x170], rax
jmp 0x18008e908
mov rax, qword [rsp + 0x470]
add rax, 0x58
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x488]
mov r8, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rsp + 0x470]
call fcn.18008ecb0
mov qword [rsp + 0x170], rax
jmp 0x18008ec67
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x478]
lea rdx, [0x180010cb0]
lea rcx, [rsp + 0x60]
call fcn.1800eb79c
lea rdi, [rsp + 0x180]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x3d0], rax
cmp qword [rsp + 0x3d0], 0xffffffffffffffff
jne 0x18008ea36
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x60]
lea rcx, [0x180010c60]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x408], rax
cmp qword [rsp + 0x408], 0
je 0x18008e9e6
mov r8d, dword [rsp + 0x48]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x180010c00]
mov edx, 5
mov rcx, qword [rsp + 0x408]
call fcn.18008d120
mov qword [rsp + 0x448], rax
jmp 0x18008e9f2
mov qword [rsp + 0x448], 0
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x400], rax
mov rax, qword [rsp + 0x400]
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x410], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x410]
call fcn.1800ec370
mov eax, dword [rsp + 0x180]
and eax, 0x10
test eax, eax
je 0x18008ea71
movsx eax, byte [rsp + 0x1ac]
cmp eax, 0x2e
jne 0x18008ea71
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1ac]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 1
je 0x18008eab9
mov eax, dword [rsp + 0x180]
and eax, 0x10
test eax, eax
je 0x18008eabe
movsx eax, byte [rsp + 0x1ac]
cmp eax, 0x2e
jne 0x18008eabe
movsx eax, byte [rsp + 0x1ad]
cmp eax, 0x2e
jne 0x18008eabe
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1ac]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jne 0x18008eabe
jmp 0x18008eb61
lea rdi, [rsp + 0x2c0]
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea r9, [rsp + 0x1ac]
mov r8, qword [rsp + 0x478]
lea rdx, [0x180009c88]
lea rcx, [rsp + 0x2c0]
call fcn.1800eb79c
mov rax, qword [rsp + 0x498]
cmp qword [rax], 0
je 0x18008eb30
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x488]
xor r8d, r8d
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x470]
call fcn.18008ecb0
jmp 0x18008eb61
mov rax, qword [rsp + 0x470]
add rax, 0x58
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x488]
xor r8d, r8d
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x470]
call fcn.18008ecb0
lea rdi, [rsp + 0x180]
xor eax, eax
mov ecx, 0x140
rep stosb byte [rdi], al
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x18008ec62
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x3d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x48], 0x12
je 0x18008ec60
mov edx, dword [rsp + 0x48]
lea rcx, [0x180010bb0]
call fcn.1800892c0
mov ecx, 0x1020
call fcn.1800eb9ac
mov qword [rsp + 0x420], rax
cmp qword [rsp + 0x420], 0
je 0x18008ec10
mov r8d, dword [rsp + 0x48]
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
lea r9, [0x180010b60]
mov edx, 5
mov rcx, qword [rsp + 0x420]
call fcn.18008d120
mov qword [rsp + 0x450], rax
jmp 0x18008ec1c
mov qword [rsp + 0x450], 0
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x3d8], rax
mov rax, qword [rsp + 0x3d8]
mov qword [rsp + 0x428], rax
lea rdx, [0x18015a158]
lea rcx, [rsp + 0x428]
call fcn.1800ec370
jmp 0x18008ec67
jmp 0x18008ea36
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x430], rax
lea rcx, [rsp + 0x30]
call fcn.18008d2a0
mov rax, qword [rsp + 0x430]
mov rcx, qword [rsp + 0x458]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x460
pop rdi
ret