Function at 0x180009890
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x730
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x720], rax
mov sil, 1
mov byte [rsp + 0x20], sil
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x300]
call fcn.18004c900
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x510]
call fcn.18004c900
lea rdx, [0x180082ea0]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.pluginsx64_
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [0x18006cf10]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov qword [rsp + 0x28], rax
movabs r14, 0xeeeeeeeeeeeeeeef
mov r15d, 1
test sil, sil
je 0x180009bf6
lea rdx, [0x180082ea0]
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, str.pluginsx64_
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], rax
lea rcx, [rsp + 0x510]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x180009bd0
lea rdx, str.TitanResetPlugin
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x98], rax
lea rdx, str.TitanReleasePlugin
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x90], rax
lea rdx, str.TitanRegisterPlugin
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x88], rax
lea rdx, str.TitanDebuggingCallBack
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x180009bd0
lea r8, [rsp + 0x74]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call rax
test al, al
je 0x180009b9e
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x40
jg 0x180009b9e
xor dil, dil
mov byte [rsp + 0x21], dil
xor ebx, ebx
mov dword [rsp + 0x24], ebx
mov ecx, ebx
mov rdx, qword [0x180090a30]
mov rax, rdx
mov r8, qword [0x180090a28]
sub rax, r8
sar rax, 3
imul rax, r14
cmp rcx, rax
jae 0x180009b28
imul rcx, rcx, 0x78
add rcx, r8
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
movzx edi, dil
test eax, eax
cmove edi, r15d
mov byte [rsp + 0x21], dil
inc ebx
jmp 0x180009adc
test dil, dil
jne 0x180009b9e
cmp rdx, qword [0x180090a38]
je 0x180009b92
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rdx + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rdx + 0x30], xmm1
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rdx + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x80]
movups xmmword [rdx + 0x50], xmm1
movaps xmm0, xmmword [rsp + 0x90]
movups xmmword [rdx + 0x60], xmm0
movsd xmm1, qword [rsp + 0xa0]
movsd qword [rdx + 0x70], xmm1
add qword [0x180090a30], 0x78
jmp 0x180009ba9
lea r8, [rsp + 0x30]
call fcn.18000a3b0
jmp 0x180009ba9
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180009bd0
lea rdx, [rsp + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180009993
xor sil, sil
mov byte [rsp + 0x20], sil
jmp 0x180009993
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.180049ad0
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret