Function at 0x180008c20
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x18009a918]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, r9
mov qword [rsp + 0x70], r8
mov dword [rsp + 0x60], edx
mov rbx, rcx
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x68], rax
test rcx, rcx
jne 0x180008c9b
mov eax, 0xc00000ef
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18005e1d0
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
test r8, r8
jne 0x180008ca7
mov eax, 0xc00000f0
jmp 0x180008c78
mov qword [rsp + 0x58], 0xffffffffffffffff
mov dword [rsp + 0x50], 0xc0000001
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
xor r15d, r15d
xor edx, edx
mov r8d, 0x250
mov rcx, rsi
call fcn.18005f850
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
jne 0x180008d0f
mov edi, 0xc0000008
mov dword [rsp + 0x50], edi
lea r12, str.E:_buildsARK23181_2_trufos_dll_fileTable.c
jmp 0x180009032
lea rax, str.WinApiFileList
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], 0
lea rax, [0x180008b30]
mov qword [rsp + 0x38], rax
lea rax, [0x180008a90]
mov qword [rsp + 0x30], rax
lea rax, [0x180008a50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x10
xor edx, edx
mov r9d, 0x800
mov r8d, 0x100
lea rcx, [rsp + 0x88]
call fcn.18004d790
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x180008dc0
lea r13, [0x18009b358]
mov rcx, qword [0x18009b358]
cmp rcx, r13
je 0x180008db4
test byte [rcx + 0x1c], 1
je 0x180008db4
cmp byte [rcx + 0x19], 2
jb 0x180008db4
mov edx, 0x10
mov dword [rsp + 0x20], eax
lea r9, str.HatAllocAndInit2
lea r8, [0x180090b38]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
lea r12, str.E:_buildsARK23181_2_trufos_dll_fileTable.c
jmp 0x18000902d
lea r13, [0x18009b358]
mov ecx, 0x18c
lea r12, str.E:_buildsARK23181_2_trufos_dll_fileTable.c
movzx eax, word [rsi + 0x2c]
cmp ax, 0x2e
jne 0x180008dfe
cmp word [rsi + 0x2e], 0
je 0x180008f88
cmp ax, ax
jne 0x180008dfe
cmp word [rsi + 0x2e], ax
jne 0x180008dfe
cmp word [rsi + 0x30], 0
je 0x180008f88
test dword [rsi], 0x440000
je 0x180008e12
mov eax, dword [rsp + 0x60]
test al, 1
je 0x180008f88
cmp byte [0x18009b380], 0
je 0x180008e40
mov qword [rsp + 0x28], r12
mov word [rsp + 0x20], cx
xor r9d, r9d
lea edx, [r9 + 0x28]
mov r8d, 0x4849463a
lea rcx, [0x18009cc40]
call fcn.18004b960
jmp 0x180008e5a
xor edx, edx
lea r8d, [rdx + 0x28]
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b430]
call qword [0x18007d538]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x180009024
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rsi + rbx*2 + 0x2c], 0
jne 0x180008e72
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
mov r8d, 0x194
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x80]
add rcx, 0x10
mov r9, r12
call fcn.180049d00
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
js 0x180008ffe
movzx edi, bx
lea r8d, [rdi + 1]
add r8, r8
lea rdx, [rsi + 0x2c]
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x18]
call fcn.18005f360
inc di
add di, di
mov rax, qword [rsp + 0x80]
mov word [rax + 0x12], di
add bx, bx
mov rax, qword [rsp + 0x80]
mov word [rax + 0x10], bx
mov ecx, dword [rsi]
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x24], ecx
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x20], 0
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.18004dbf0
mov edi, eax
mov dword [rsp + 0x50], eax
test eax, eax
js 0x180008fc4
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
call fcn.18001bb50
mov dword [rsp + 0x50], eax
test eax, eax
jns 0x180008f80
mov rcx, qword [0x18009b358]
cmp rcx, r13
je 0x180008f80
test byte [rcx + 0x1c], 1
je 0x180008f80
cmp byte [rcx + 0x19], 2
jb 0x180008f80
mov edx, 0x13
mov dword [rsp + 0x20], eax
lea r9, str.Callback_function
lea r8, [0x180090b38]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
inc r15d
mov dword [rsp + 0x64], r15d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov ecx, 0x18c
jne 0x180008dd3
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x180008fc0
mov dword [rax], r15d
xor edi, edi
jmp 0x180009029
mov rcx, qword [0x18009b358]
cmp rcx, r13
je 0x18000902d
test byte [rcx + 0x1c], 1
je 0x18000902d
cmp byte [rcx + 0x19], 2
jb 0x18000902d
mov edx, 0x12
lea r9, str.HatInsert
mov dword [rsp + 0x20], eax
lea r8, [0x180090b38]
mov rcx, qword [rcx + 0x10]
call fcn.1800012d0
jmp 0x18000902d
mov rcx, qword [0x18009b358]
cmp rcx, r13
je 0x18000902d
test byte [rcx + 0x1c], 1
je 0x18000902d
cmp byte [rcx + 0x19], 2
jb 0x18000902d
mov edx, 0x11
lea r9, str.UstrAllocBuffer
jmp 0x180008fe8
mov edi, 0xc000009a
mov dword [rsp + 0x50], edi
mov rax, qword [rsp + 0x58]
cmp rax, 0xffffffffffffffff
je 0x180009041
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
jns 0x1800090ef
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1800090d7
cmp qword [rcx + 0x18], 0
je 0x180009072
mov edx, 0x1c4
add rcx, 0x10
mov r8, r12
call fcn.18004a4f0
cmp qword [rsp + 0x80], 0
je 0x1800090d7
cmp byte [0x18009b380], 0
je 0x1800090ad
mov r9d, 0x1c6
mov qword [rsp + 0x20], r12
mov r8d, 0x4849463a
lea rdx, [rsp + 0x80]
lea rcx, [0x18009cc40]
call fcn.18004be40
jmp 0x1800090cb
mov r8, qword [rsp + 0x80]
xor edx, edx
mov rcx, qword [0x18009ccf0]
mov rax, qword [0x18009b440]
call qword [0x18007d538]
mov qword [rsp + 0x80], 0
cmp qword [rsp + 0x88], 0
je 0x1800090ef
lea rcx, [rsp + 0x88]
call fcn.18004b3f0
mov eax, edi
jmp 0x180008c78