Function at 0x18000f580
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x18005c188]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov byte [rsp + 0x24], r9b
mov r12, r8
mov r15, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x50], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov edi, 1
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000f600
lea rcx, [rsp + 0x58]
call fcn.180001800
nop
movabs r8, 0x7ffffffffffffffe
mov r13, qword [rsp + 0x68]
mov qword [rsp + 0x40], r13
test r13, r13
je 0x18000f691
lea rcx, [r13 - 1]
cmp r13, rcx
jbe 0x18000fecb
lea rax, [rsp + 0x58]
mov r14, qword [rsp + 0x58]
mov qword [rsp + 0x30], r14
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rbx
cmp rbx, 8
cmovae rax, r14
cmp word [rax + rcx*2], 0x5c
je 0x18000f6a5
cmp r13, rbx
jae 0x18000f6de
lea rax, [r13 + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rbx, 8
cmovae rax, r14
mov dword [rax + r13*2], 0x5c
mov r13, qword [rsp + 0x68]
mov qword [rsp + 0x40], r13
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
lea rsi, [rsp + 0x58]
cmp rbx, 8
cmovae rsi, r14
cmp r13, 8
jae 0x18000f7de
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x70], 7
jmp 0x18000f81b
mov r14, r13
mov rax, r8
sub rax, r13
cmp rax, 1
jb 0x18000fed1
inc r13
mov qword [rsp + 0x40], r13
mov rdx, r13
or rdx, 7
cmp rdx, r8
jbe 0x18000f70a
mov rdx, r8
jmp 0x18000f72b
mov rcx, rbx
shr rcx, 1
mov rax, r8
sub rax, rcx
cmp rbx, rax
jbe 0x18000f720
mov rdx, r8
jmp 0x18000f72b
lea rax, [rbx + rcx]
cmp rdx, rax
cmovb rdx, rax
mov qword [rsp + 0x28], rdx
inc rdx
lea rcx, [rsp + 0x58]
call fcn.180001790
mov rsi, rax
mov qword [rsp + 0x68], r13
mov rdx, qword [rsp + 0x28]
mov qword [rsp + 0x70], rdx
add r14, r14
mov r8, r14
mov rcx, rax
cmp rbx, 8
jb 0x18000f7ca
mov rdx, qword [rsp + 0x30]
call fcn.18001aca0
mov dword [r14 + rsi], 0x5c
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f7a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fefb
call fcn.180018b7c
mov r14, rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x58], rsi
mov rbx, qword [rsp + 0x28]
xor esi, esi
movabs r8, 0x7ffffffffffffffe
jmp 0x18000f6a5
lea rdx, [rsp + 0x58]
call fcn.18001aca0
mov dword [r14 + rsi], 0x5c
jmp 0x18000f7a7
mov rbx, r13
or rbx, 7
cmp rbx, r8
cmova rbx, r8
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x78]
call fcn.180001790
mov qword [rsp + 0x78], rax
lea r8, [r13*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.18001aca0
mov qword [rbp - 0x70], rbx
mov rbx, qword [rsp + 0x28]
mov qword [rbp - 0x78], r13
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x18000f830
mov rdx, r12
lea rcx, [rsp + 0x78]
call fcn.180001d40
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x18000fe08
movzx eax, byte [rbp + 0x2e0]
movzx ecx, byte [rbp + 0x2e8]
mov edx, 0xa
cmp word [rbp + 0x4c], 0x2e
jne 0x18000f8b0
movzx eax, word [rbp + 0x4e]
test ax, ax
je 0x18000fdde
cmp ax, 0x2e
jne 0x18000f8a9
cmp word [rbp + 0x50], 0
je 0x18000fdde
movzx eax, byte [rbp + 0x2e0]
test byte [rbp + 0x20], 0x10
je 0x18000fb30
cmp byte [rsp + 0x24], 0
je 0x18000fdde
lea rcx, [rbp + 0x4c]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x18000f8d0
test al, al
je 0x18000f994
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, rsi
jb 0x18000fee3
lea r12, [rsp + 0x58]
cmp rbx, 8
cmovae r12, r14
xor eax, eax
mov qword [rbp - 0x68], rax
lea r15, [rsi + r13]
mov ebx, 7
lea r14, [rbp - 0x68]
cmp r15, rbx
jbe 0x18000f94d
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x18000f931
mov rbx, rcx
jmp 0x18000f939
cmp rbx, 0xa
cmovb rbx, rdx
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.180001790
mov r14, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], rbx
lea rbx, [r13*2]
mov r8, rbx
mov rdx, r12
mov rcx, r14
call fcn.18001aca0
lea rcx, [r14 + rbx]
lea r8, [rsi + rsi]
lea rdx, [rbp + 0x4c]
call fcn.18001aca0
xor ebx, ebx
mov word [r14 + r15*2], bx
or edi, 0x20
lea rax, [rbp - 0x68]
or edi, 2
mov r15, qword [rsp + 0x38]
jmp 0x18000f9bd
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov r8, rsi
lea rdx, [rbp + 0x4c]
lea rcx, [rbp - 0x48]
call fcn.180001800
lea rax, [rbp - 0x48]
or edi, 4
mov dword [rsp + 0x20], edi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
test dil, 4
je 0x18000fa2d
and edi, 0xfffffffb
mov dword [rsp + 0x20], edi
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x18000fa2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fa27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fed7
call fcn.180018b7c
nop
test dil, 2
je 0x18000fa7a
and edi, 0xfffffffd
mov dword [rsp + 0x20], edi
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x18000fa7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fa75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fedd
call fcn.180018b7c
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x18000fb17
mov rsi, rdx
mov qword [rdx], rbx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], rbx
lea r12, [rbp - 0x28]
mov rbx, qword [rbp - 0x28]
mov r14, qword [rbp - 0x10]
cmp r14, 8
cmovae r12, rbx
mov r13, qword [rbp - 0x18]
cmp r13, 8
jae 0x18000fac4
movups xmm0, xmmword [r12]
movups xmmword [rdx], xmm0
mov r15d, 7
jmp 0x18000fafe
mov r15, r13
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
mov rcx, rsi
call fcn.180001790
mov qword [rsi], rax
lea r8, [r13*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.18001aca0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r15
mov r15, qword [rsp + 0x38]
add qword [r15 + 8], 0x20
mov r13, qword [rsp + 0x40]
jmp 0x18000fb2b
lea r8, [rbp - 0x28]
mov rcx, r15
call fcn.18000e660
mov r14, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x28]
jmp 0x18000fd9e
test cl, cl
je 0x18000fdde
lea rcx, [rbp + 0x4c]
mov rsi, 0xffffffffffffffff
inc rsi
cmp word [rcx + rsi*2], 0
jne 0x18000fb43
test al, al
je 0x18000fc07
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, rsi
jb 0x18000fee3
lea r12, [rsp + 0x58]
cmp rbx, 8
cmovae r12, r14
xor eax, eax
mov qword [rbp - 0x68], rax
lea r15, [rsi + r13]
mov ebx, 7
lea r14, [rbp - 0x68]
cmp r15, rbx
jbe 0x18000fbc0
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x18000fba4
mov rbx, rcx
jmp 0x18000fbac
cmp rbx, 0xa
cmovb rbx, rdx
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.180001790
mov r14, rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], rbx
lea rbx, [r13*2]
mov r8, rbx
mov rdx, r12
mov rcx, r14
call fcn.18001aca0
lea rcx, [r14 + rbx]
lea r8, [rsi + rsi]
lea rdx, [rbp + 0x4c]
call fcn.18001aca0
xor ebx, ebx
mov word [r14 + r15*2], bx
or edi, 0x40
lea rax, [rbp - 0x68]
or edi, 8
mov r15, qword [rsp + 0x38]
jmp 0x18000fc30
xor ebx, ebx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov r8, rsi
lea rdx, [rbp + 0x4c]
lea rcx, [rbp - 0x48]
call fcn.180001800
lea rax, [rbp - 0x48]
or edi, 0x10
mov dword [rsp + 0x20], edi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
test dil, 0x10
je 0x18000fca0
and edi, 0xffffffef
mov dword [rsp + 0x20], edi
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x18000fca0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fc9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fee9
call fcn.180018b7c
nop
test dil, 8
je 0x18000fced
and edi, 0xfffffff7
mov dword [rsp + 0x20], edi
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x18000fced
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000feef
call fcn.180018b7c
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x18000fd8a
mov rsi, rdx
mov qword [rdx], rbx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], rbx
lea r12, [rbp - 8]
mov rbx, qword [rbp - 8]
mov r14, qword [rbp + 0x10]
cmp r14, 8
cmovae r12, rbx
mov r13, qword [rbp + 8]
cmp r13, 8
jae 0x18000fd37
movups xmm0, xmmword [r12]
movups xmmword [rdx], xmm0
mov r15d, 7
jmp 0x18000fd71
mov r15, r13
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
mov rcx, rsi
call fcn.180001790
mov qword [rsi], rax
lea r8, [r13*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.18001aca0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r15
mov r15, qword [rsp + 0x38]
add qword [r15 + 8], 0x20
mov r13, qword [rsp + 0x40]
jmp 0x18000fd9e
lea r8, [rbp - 8]
mov rcx, r15
call fcn.18000e660
mov r14, qword [rbp + 0x10]
mov rbx, qword [rbp - 8]
cmp r14, 8
jb 0x18000fdd9
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
mov rax, rbx
jb 0x18000fdd1
mov rbx, qword [rbx - 8]
sub rax, rbx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fef5
mov rcx, rbx
call fcn.180018b7c
mov r14, qword [rsp + 0x30]
lea rdx, [rbp + 0x20]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18000fdfe
mov rbx, qword [rsp + 0x28]
jmp 0x18000f871
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x18000fe49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fe44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fefb
call fcn.180018b7c
xor eax, eax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], ax
mov rdx, qword [rsp + 0x28]
cmp rdx, 8
jb 0x18000fe98
lea rdx, [rdx*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x18000fe90
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fec5
mov rcx, r14
call fcn.180018b7c
mov rax, r15
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.180018fa0
mov rbx, qword [rsp + 0x3d8]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18001f648
nop
call fcn.18000ae50
int3
call fcn.180001770
nop
call fcn.18001f648
nop
call fcn.18001f648
nop
call fcn.180001770
nop
call fcn.18001f648
nop
call fcn.18001f648
nop
call fcn.18001f648
nop
call fcn.18001f648
int3