Function at 0x18005ad50
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x18015f040]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rax, qword [0x18015f488]
cmp rax, qword [0x18015f490]
je 0x18005ad8f
mov qword [0x18015f490], rax
movabs rax, 0x52df98b3aa56497
movabs r12, 0x544f9e93a8b64bd
mov qword [rsp + 0x20], rax
movabs r14, 0x9fe74ab83cc32036
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x9fe74ab83cc32058
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x40]
movzx ecx, word [0x18015fb90]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x1a0]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
test cx, cx
je 0x18005ae40
lea rdx, [0x18015fb90]
lea r8, [rbp + 0x1a0]
sub rdx, r8
nop dword [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x18005ae30
xor esi, esi
movq rcx, xmm0
mov word [rax], si
test cx, cx
je 0x18005ae70
lea rdx, [rsp + 0x40]
sub rdx, rax
nop word [rax + rax]
mov word [rax], cx
add rax, 2
movzx ecx, word [rax + rdx]
test cx, cx
jne 0x18005ae60
lea rdx, [rsp + 0x50]
mov word [rax], si
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18005b061
mov qword [rsp + 0x4f0], rbx
mov qword [rsp + 0x4f8], r13
movabs r13, 0x6a27d98d54fe0bdb
mov qword [rsp + 0x500], r15
mov r15, 0xffffffffffffffff
nop dword [rax + rax]
lea rbx, [rsp + 0x7c]
cmp word [rsp + 0x7c], si
je 0x18005aed9
nop dword [rax]
add rbx, 2
cmp word [rbx], si
jne 0x18005aed0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rax, [rsp + 0x7c]
sub rbx, rax
mov eax, 2
sar rbx, 1
inc rbx
mul rbx
cmovb rax, r15
xor edx, edx
mov r8, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, qword [0x18015f490]
cmp rdx, qword [0x18015f498]
mov qword [rsp + 0x20], rax
je 0x18005af33
mov qword [rdx], rax
mov rcx, qword [0x18015f490]
add rcx, 8
mov qword [0x18015f490], rcx
jmp 0x18005af44
lea r8, [rsp + 0x20]
call fcn.18005cf90
mov rcx, qword [0x18015f490]
movzx eax, word [rsp + 0x7c]
lea rdx, [rsp + 0x7c]
mov rcx, qword [rcx - 8]
test ax, ax
je 0x18005af73
nop word [rax + rax]
mov word [rcx], ax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
add rcx, 2
test ax, ax
jne 0x18005af60
mov word [rcx], si
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], r13
mov rcx, rdi
mov rax, qword [rsp + 0x20]
movabs rax, 0xeb8638cd5baa4658
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x877089b96218f0fe
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x23df19e6072c6022
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
movabs rax, 0xe21ce0df42769f97
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x23df19e6070e4018
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x544f9e93a8b649f
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], r14
mov rax, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18005aec0
mov r15, qword [rsp + 0x500]
mov rcx, rdi
mov r13, qword [rsp + 0x4f8]
mov rbx, qword [rsp + 0x4f0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1800e1360
add rsp, 0x4c0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret