Function at 0x180008220
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x240]
sub rsp, 0x340
mov rbx, rdx
mov rsi, rcx
xor r15d, r15d
mov r13d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov r12d, r15d
mov qword [rsp + 0x48], r15
lea r8, [0x180101060]
lea rcx, [rbp - 0x30]
call fcn.180011dd0
cmp qword [rax + 0x18], 7
jbe 0x180008285
mov rax, qword [rax]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
mov qword [rbp + 0x290], rax
lea rcx, [rbp - 0x30]
call fcn.180010370
mov rdi, qword [rsp + 0x40]
cmp r14, 0xffffffffffffffff
je 0x1800084b1
test byte [rbp - 0x10], 0x10
jne 0x180008493
lea r8, [0x180101070]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.180011dd0
mov rbx, rax
lea rax, [rbp + 0x1c]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1800082e0
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x180008335
lea r15, [rcx + rdx]
mov qword [rbx + 0x10], r15
mov r14, rbx
cmp r8, 7
jbe 0x180008311
mov r14, qword [rbx]
lea rcx, [r14 + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x1c]
call fcn.18008bd90
xor eax, eax
mov word [r14 + r15*2], ax
mov r14, qword [rbp + 0x290]
xor r15d, r15d
jmp 0x18000834c
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1c]
xor r8d, r8d
mov rcx, rbx
call fcn.180018ad0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], r15
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
or r13d, 2
mov dword [rsp + 0x30], r13d
lea rcx, [rsp + 0x50]
call fcn.180010370
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.180007f60
nop
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180016a70
nop
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x70]
call fcn.18000e400
nop
cmp rdi, r12
je 0x180008411
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbp - 0x80]
movups xmmword [rdi + 0x30], xmm1
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
add rdi, 0x40
mov qword [rsp + 0x40], rdi
jmp 0x18000842d
lea r8, [rsp + 0x50]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.180018470
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.180010370
lea rcx, [rsp + 0x50]
call fcn.180010370
nop
lea rcx, [rbp - 0x50]
call fcn.180010370
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 7
jbe 0x18000848c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008487
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800085a5
call fcn.180067fbc
mov rbx, qword [rbp + 0x288]
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800082b4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8, rdi
mov r14, qword [rsp + 0x38]
sub r8, r14
sar r8, 6
xor r9d, r9d
mov rdx, rdi
mov rcx, r14
call fcn.180019e00
mov qword [rsi], r15
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
or r13d, 1
mov dword [rsp + 0x30], r13d
cmp r14, rdi
je 0x180008527
lea rbx, [r14 + 0x20]
nop dword [rax + rax]
mov rax, qword [rsi + 8]
cmp rax, qword [rsi + 0x10]
je 0x18000850c
mov rdx, rbx
mov rcx, rax
call fcn.180016a70
add qword [rsi + 8], 0x20
jmp 0x18000851a
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1800186a0
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, rdi
jne 0x1800084f0
test r14, r14
je 0x180008581
mov rbx, r14
cmp r14, rdi
je 0x18000854e
lea rcx, [rbx + 0x20]
call fcn.180010370
mov rcx, rbx
call fcn.180010370
add rbx, 0x40
cmp rbx, rdi
jne 0x180008534
sub r12, r14
and r12, 0xffffffffffffffc0
mov rax, r14
cmp r12, 0x1000
jb 0x180008576
add r12, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000859f
mov rdx, r12
mov rcx, r14
call fcn.180067fbc
mov rax, rsi
mov rbx, qword [rsp + 0x398]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800731e0
nop
call fcn.1800731e0
int3