Function at 0x180061c10
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov r13, rdx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.1800801b0
nop
mov rcx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
mov rax, r8
sub rax, rcx
cmp rax, 2
jb 0x180061c83
lea rax, [rcx + 2]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x70]
mov edx, 0x2a5c
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], 0
jmp 0x180061ca2
mov qword [rsp + 0x20], 2
lea r9, [0x1800a0f04]
mov edx, 2
lea rcx, [rsp + 0x70]
call fcn.180058fc0
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x180061f99
xor esi, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], sil
lea rax, [rbp + 0xbc]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180061cf4
lea rdx, [rbp + 0xbc]
lea rcx, [rsp + 0x30]
call fcn.180056af0
nop
lea rbx, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x48]
cmp r15, 0x10
cmovae rbx, r14
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x180061d7c
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp - 0x42], 1
lea rcx, [rdi - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
add rax, rbx
movzx ecx, byte [rax]
cmp byte [rbp + rcx - 0x70], 0
jne 0x180061d77
cmp rax, rbx
je 0x180061d7c
dec rax
movzx ecx, byte [rax]
cmp byte [rbp + rcx - 0x70], 0
je 0x180061d65
sub rax, rbx
jmp 0x180061d83
mov rax, 0xffffffffffffffff
lea rcx, [rax + 1]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], 0xf
cmp rdi, rcx
jb 0x180062007
sub rdi, rcx
mov rsi, 0xffffffffffffffff
cmp rdi, rsi
cmovb rsi, rdi
lea rax, [rsp + 0x30]
cmp r15, 0x10
cmovae rax, r14
lea r14, [rax + rcx]
cmp rsi, 0xf
ja 0x180061df4
mov qword [rsp + 0x60], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x50], 0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
jmp 0x180061e9a
movabs r15, 0x7fffffffffffffff
cmp rsi, r15
ja 0x180062013
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
jbe 0x180061e22
mov rbx, r15
movabs rax, 0x8000000000000027
jmp 0x180061e49
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180061e68
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18006200d
mov rcx, rax
call fcn.18008939c
test rax, rax
je 0x180061fd3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180061e79
test rcx, rcx
je 0x180061e77
call fcn.18008939c
mov rdi, rax
jmp 0x180061e79
xor edi, edi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
cmp rbx, 0x10
cmovae rax, rdi
cmp rsi, 3
jne 0x180061ed0
cmp byte [rax], 0x63
jne 0x180061ec2
cmp byte [rax + 1], 0x66
jne 0x180061ec2
cmp byte [rax + 2], 0x67
jne 0x180061ec2
xor eax, eax
jmp 0x180061ec7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180061ed0
mov sil, 1
jmp 0x180061ed3
xor sil, sil
cmp rbx, 0x10
jb 0x180061f0a
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180061f02
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061fd3
mov rcx, rdi
call fcn.18008976c
test sil, sil
je 0x180061f3e
mov rax, qword [r13 + 8]
cmp rax, qword [r13 + 0x10]
je 0x180061f2d
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1800801b0
add qword [r13 + 8], 0x20
jmp 0x180061f3e
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, r13
call fcn.180081c80
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180061f77
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061f72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061fda
call fcn.18008976c
lea rdx, [rbp + 0x90]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180061ccc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180061fe6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061fe1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180061fe1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.18008976c
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800592d0
nop
call fcn.180011b40
int3
call fcn.180044ef0
int3