Function at 0x180001770
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x390
mov rax, qword [0x1800190f0]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov esi, r9d
mov rbp, r8
mov rbx, rdx
xor ecx, ecx
lea r15, str.C:WindowsSysWOW64
nop dword [rax]
movzx eax, byte [rcx + r15]
lea rcx, [rcx + 1]
mov byte [rsp + rcx + 0x26f], al
test al, al
jne 0x1800017b0
lea rcx, [rsp + 0x270]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1800017d0
mov eax, dword [str..exe]
lea rdx, [rsp + 0x20]
mov dword [rcx], eax
movzx eax, word [0x180016970]
mov word [rcx + 4], ax
movzx eax, byte [0x180016972]
mov byte [rcx + 6], al
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800019f2
xor ecx, ecx
call fcn.180004b18
mov rcx, rax
call fcn.180004a68
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1800019f2
mov qword [rsp + 0x3b0], r14
lea r14, str.cmd.exe
nop dword [rax + rax]
movzx ecx, byte [rsp + 0x4c]
movzx eax, byte [rsp + 0x4d]
cmp cl, byte [0x180016974]
jne 0x18000186e
cmp al, byte [0x180016975]
je 0x1800019d4
cmp cl, byte [0x180016978]
jne 0x18000188f
cmp al, byte [0x180016979]
jne 0x18000188f
movzx eax, byte [rsp + 0x4e]
cmp al, byte [0x18001697a]
je 0x1800019d4
lea rcx, [rsp + 0x161]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x160], 0
call fcn.180007d50
lea r9, [rsp + 0x4c]
lea rdx, str._s_s
lea rcx, [rsp + 0x160]
mov r8, r15
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rsp + 0x160]
mov r8d, esi
mov rdx, rbp
call fcn.180001650
test eax, eax
je 0x1800019d4
xor edx, edx
mov r8d, 0x104
mov rcx, rbx
call fcn.180007d50
lea rdx, [rsp + 0x160]
lea r9, [rsp + 0x160]
mov rax, rdx
mov rcx, rbx
or rax, rbx
and eax, 0xf
jne 0x180001978
mov eax, 2
nop word [rax + rax]
movaps xmm0, xmmword [rdx]
movaps xmm1, xmmword [rdx + 0x10]
lea rcx, [rcx + 0x80]
lea rdx, [rdx + 0x80]
movaps xmmword [rcx - 0x80], xmm0
movaps xmm0, xmmword [rdx - 0x60]
movaps xmmword [rcx - 0x70], xmm1
movaps xmm1, xmmword [rdx - 0x50]
movaps xmmword [rcx - 0x60], xmm0
movaps xmm0, xmmword [rdx - 0x40]
movaps xmmword [rcx - 0x50], xmm1
movaps xmm1, xmmword [rdx - 0x30]
movaps xmmword [rcx - 0x40], xmm0
movaps xmm0, xmmword [rdx - 0x20]
movaps xmmword [rcx - 0x30], xmm1
movaps xmm1, xmmword [rdx - 0x10]
movaps xmmword [rcx - 0x20], xmm0
movaps xmmword [rcx - 0x10], xmm1
dec rax
jne 0x180001920
mov eax, dword [rdx]
mov dword [rcx], eax
jmp 0x180001986
mov r8d, 0x104
mov rdx, r9
call fcn.1800043f0
call fcn.180004a3c
mov r8d, eax
mov eax, 0x1b4e81b5
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x12c
sub r8d, edx
cmp r8d, 0xa
jge 0x1800019d4
xor eax, eax
lea rdx, [rsp + 0x4c]
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r14 + rax - 1]
jne 0x1800019ea
cmp rax, 8
jne 0x1800019c0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x180001850
mov r14, qword [rsp + 0x3b0]
xor eax, eax
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.1800043c0
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rsi
ret