Function at 0x180002b00
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x180007010]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor r14d, r14d
mov r8d, r14d
lea rsi, [0x1800072d0]
mov rcx, rsi
lea r12, [0x1800053f0]
movzx edx, word [rcx]
test dx, dx
jne 0x180002b5f
cmp word [rcx + 2], r14w
je 0x180002b83
mov eax, r8d
and eax, 0x80000007
jge 0x180002b70
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor dx, word [r12 + rax*2]
mov word [rcx], dx
inc r8d
add rcx, 2
jmp 0x180002b50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r14w
movaps xmm0, xmmword [0x1800072d0]
movaps xmmword [rbp + 0x1d0], xmm0
movaps xmm1, xmmword [0x1800072e0]
movaps xmmword [rbp + 0x1e0], xmm1
movaps xmm0, xmmword [0x1800072f0]
movaps xmmword [rbp + 0x1f0], xmm0
movaps xmm1, xmmword [0x180007300]
movaps xmmword [rbp + 0x200], xmm1
movaps xmm0, xmmword [0x180007310]
movaps xmmword [rbp + 0x210], xmm0
movaps xmm1, xmmword [0x180007320]
movaps xmmword [rbp + 0x220], xmm1
movsd xmm0, qword [0x180007330]
movsd qword [rbp + 0x230], xmm0
mov eax, dword [0x180007338]
mov dword [rbp + 0x238], eax
movzx eax, word [0x18000733c]
mov word [rbp + 0x23c], ax
lea r8, [0x180005380]
mov edx, 0x105
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rsi + rdx*2], 0
jne 0x180002c43
mov rax, qword [0x1800077e0]
lea r15, [0x1800077c8]
cmp rdx, rax
ja 0x180002c8f
mov rdi, r15
cmp rax, 8
cmovae rdi, qword [0x1800077c8]
mov qword [0x1800077d8], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], r14w
jmp 0x180002c9d
lfence
mov r9, rsi
mov rcx, r15
call fcn.1800035a0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002e49
movabs rdi, 0x7ffffffffffffffe
lea rdx, str..lnk
lea rcx, [rbp - 0x54]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x180002df7
lea rdx, str.Word
lea rcx, [rbp - 0x54]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x180002df7
mov rdx, qword [0x1800077d8]
lea rax, [rbp - 0x54]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002d10
mov rax, rdi
sub rax, rdx
cmp rax, rcx
jb 0x180002e79
lfence
mov r9, r15
cmp qword [0x1800077e0], 8
cmovae r9, qword [0x1800077c8]
mov qword [rsp + 0x30], rcx
lea rax, [rbp - 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x40]
call fcn.180003710
mov rdx, qword [0x1800077e0]
cmp rdx, 8
jb 0x180002da2
lea rdx, [rdx*2 + 2]
mov rcx, qword [0x1800077c8]
cmp rdx, 0x1000
jb 0x180002d9d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180002e42
mov rcx, r8
call fcn.180003c54
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [0x1800077c8], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [0x1800077d8], xmm1
mov r9d, r14d
mov rdx, rsi
movzx r8d, word [rdx]
test r8w, r8w
jne 0x180002dd1
cmp word [rdx + 2], r8w
je 0x180002df7
mov eax, r9d
and eax, 0x80000007
jge 0x180002de2
dec eax
or eax, 0xfffffff8
inc eax
movsxd rcx, eax
xor r8w, word [r12 + rcx*2]
mov word [rdx], r8w
inc r9d
add rdx, 2
jmp 0x180002dc0
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180002cc5
nop dword [rax]
movzx ecx, word [rsi]
test cx, cx
jne 0x180002e1e
cmp word [rsi + 2], cx
je 0x180002e49
mov eax, r14d
and eax, 0x80000007
jge 0x180002e2f
dec eax
or eax, 0xfffffff8
inc eax
cdqe
xor cx, word [r12 + rax*2]
mov word [rsi], cx
inc r14d
add rsi, 2
jmp 0x180002e10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.180003870
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800011b0
nop
int3