Function at 0x18003efa0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x430]
sub rsp, 0x530
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x588], rbx
mov rax, qword [0x180106010]
xor rax, rsp
mov qword [rbp + 0x420], rax
mov r15, r8
mov rdi, rdx
mov rbx, rcx
lea rcx, [rbp]
call fcn.180005bfc
nop
add rbx, 0x40
cmp byte [rbx], 0
jne 0x18003f001
mov rcx, rbx
call fcn.18004d480
lea rdx, [rbx + 0x28]
lea rcx, [rbp + 0x40]
call fcn.180006d90
nop
lea rcx, [rbp + 0x40]
call fcn.180005e24
test al, al
je 0x18003f023
xor bl, bl
jmp 0x18003f470
mov dword [rbp + 0xb0], 0x11c
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0xb4]
call fcn.18008a090
lea rcx, [rbp + 0xb0]
call fcn.180054360
mov bl, 1
mov byte [rsp + 0x20], bl
lea rcx, [rbp - 0x48]
cmp dword [rbp + 0xb4], 6
jb 0x18003f0c5
xor bl, bl
mov byte [rsp + 0x20], bl
lea rdx, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
call fcn.180005ef8
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.180056c70
nop
mov rdx, rax
lea rcx, [rbp]
call fcn.180005e60
nop
lea rcx, [rbp - 0x20]
call fcn.180005bf4
nop
lea rcx, [rbp - 0x48]
call fcn.180005bf4
mov r8, rdi
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.180056c70
nop
mov rdx, rax
lea rcx, [rbp]
call fcn.180005e60
nop
jmp 0x18003f122
lea rdx, str.MicrosoftInternet_ExplorerQuick_Launch_
call fcn.180005ef8
nop
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.180056c70
nop
mov rdx, rax
lea rcx, [rbp]
call fcn.180005e60
nop
lea rcx, [rbp - 0x20]
call fcn.180005bf4
nop
lea rcx, [rbp - 0x48]
call fcn.180005bf4
mov r8, rdi
lea rdx, [rbp]
lea rcx, [rbp - 0x48]
call fcn.180056c70
nop
mov rdx, rax
lea rcx, [rbp]
call fcn.180005e60
nop
lea rcx, [rbp - 0x48]
call fcn.180005bf4
mov qword [rbp - 0x28], 0
mov ecx, 8
call fcn.180086a58
mov r13, rax
mov qword [rsp + 0x30], rax
mov qword [rax], 0xffffffffffffffff
mov qword [rbp - 0x28], rax
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
lea rcx, [rbp + 0x88]
call fcn.180005bfc
nop
mov rcx, qword [r13]
cmp rcx, 0xffffffffffffffff
je 0x18003f1a8
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x18003f430
mov qword [r13], 0xffffffffffffffff
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x1d0]
call fcn.18008a090
lea rcx, [rbp]
call fcn.180005be4
mov rcx, rax
lea rdx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [r13], rax
cmp rax, 0xffffffffffffffff
jne 0x18003f220
lea rcx, [rbp - 0x48]
call fcn.180005bfc
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp]
call fcn.18006a450
test al, al
je 0x18003f217
lea rcx, [rbp - 0x48]
call fcn.180005be4
mov rcx, rax
lea rdx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [r13], rax
lea rcx, [rbp - 0x48]
call fcn.180005bf4
cmp qword [r13], 0xffffffffffffffff
je 0x18003f430
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x1d0]
call fcn.18005d990
nop dword [rax + rax]
lea rcx, [rbp - 0x20]
call fcn.180005bfc
nop
lea rdx, [rbp + 0x40]
test bl, bl
je 0x18003f298
lea r8, str.MicrosoftInternet_ExplorerQuick_Launch_
lea rcx, [rsp + 0x58]
call fcn.18000b7c0
nop
lea r8, [rbp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.180006348
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.180005e60
nop
lea rcx, [rsp + 0x38]
call fcn.180005bf4
nop
lea rcx, [rsp + 0x58]
jmp 0x18003f2da
lea r8, str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar_
lea rcx, [rbp - 0x68]
call fcn.18000b7c0
nop
lea r8, [rbp + 0x88]
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.180006348
nop
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.180005e60
nop
lea rcx, [rsp + 0x78]
call fcn.180005bf4
nop
lea rcx, [rbp - 0x68]
call fcn.180005bf4
lea rcx, [rbp + 0x20]
call fcn.180005bfc
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x20]
call fcn.18003f4b0
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x48]
call fcn.180055dd0
nop
lea rcx, [rbp + 0x20]
call fcn.180005e24
test al, al
jne 0x18003f384
xor esi, esi
mov rcx, r15
call fcn.180006c48
test rax, rax
je 0x18003f384
call fcn.180005c20
mov r12, rax
xor r14d, r14d
nop dword [rax + rax]
mov rbx, qword [r12]
add rbx, r14
lea rcx, [rbp - 0x48]
call fcn.180005be4
mov rdi, rax
mov rcx, rbx
call fcn.180005be4
test rax, rax
jne 0x18003f358
test rdi, rdi
sete al
jmp 0x18003f368
test rdi, rdi
je 0x18003f370
mov rdx, rdi
mov rcx, rax
call fcn.180054c90
test al, al
jne 0x18003f3f2
inc rsi
add r14, 0x20
mov rcx, r15
call fcn.180006c48
cmp rsi, rax
jb 0x18003f330
mov rbx, qword [r13]
cmp rbx, 0xffffffffffffffff
je 0x18003f413
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x1d0]
call fcn.18008a090
lea rdx, [rbp + 0x1d0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18003f413
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x1d0]
call fcn.18005d990
nop
lea rcx, [rbp - 0x48]
call fcn.180005bf4
nop
lea rcx, [rbp + 0x20]
call fcn.180005bf4
nop
lea rcx, [rbp - 0x20]
call fcn.180005bf4
movzx ebx, byte [rsp + 0x20]
jmp 0x18003f240
mov bl, 1
lea rcx, [rbp - 0x48]
call fcn.180005bf4
nop
lea rcx, [rbp + 0x20]
call fcn.180005bf4
nop
lea rcx, [rbp - 0x20]
call fcn.180005bf4
jmp 0x18003f432
lea rcx, [rbp - 0x48]
call fcn.180005bf4
nop
lea rcx, [rbp + 0x20]
call fcn.180005bf4
nop
lea rcx, [rbp - 0x20]
call fcn.180005bf4
xor bl, bl
lea rcx, [rbp + 0x88]
call fcn.180005bf4
nop
mov rcx, qword [r13]
cmp rcx, 0xffffffffffffffff
je 0x18003f45b
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x18003f45b
mov qword [r13], 0xffffffffffffffff
mov edx, 8
mov rcx, r13
call fcn.1800862a4
mov qword [rbp - 0x28], 0
lea rcx, [rbp + 0x40]
call fcn.180005bf4
nop
lea rcx, [rbp]
call fcn.180005bf4
movzx eax, bl
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.180086280
mov rbx, qword [rsp + 0x588]
add rsp, 0x530
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret