Function at 0x180107d70
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x600
mov rax, qword [0x180161180]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
mov dword [rsp + 0x3a0], 0
mov qword [rsp + 0x5d0], 0xffffffffffffffff
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x3b8], 0xffffffff
mov rax, qword [rsp + 0x638]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x628]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x620]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x618]
mov r8, qword [rsp + 0x610]
lea rdx, [0x18003f590]
mov ecx, 4
call fcn.18010b280
mov r8, qword [rsp + 0x610]
lea rdx, [0x18003f540]
mov ecx, 4
call fcn.18010b280
lea rdi, [rsp + 0x3c0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x610]
lea rdx, [0x18003e478]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x5d0], rax
cmp qword [rsp + 0x5d0], 0xffffffffffffffff
jne 0x180107eef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
lea r8, [rsp + 0x3c0]
lea rdx, [0x18003f4b0]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x180107f2b
movzx eax, word [rsp + 0x17c]
cmp eax, 0x2e
jne 0x180107f2b
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x17c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 1
je 0x180107f74
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x180107f92
movzx eax, word [rsp + 0x17c]
cmp eax, 0x2e
jne 0x180107f92
movzx eax, word [rsp + 0x17e]
cmp eax, 0x2e
jne 0x180107f92
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x17c]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
cmp rcx, 2
jne 0x180107f92
lea r8, [rsp + 0x17c]
lea rdx, [0x18003f440]
mov ecx, 3
call fcn.18010b280
jmp 0x18010872e
lea r8, [rsp + 0x17c]
lea rdx, [0x18003f3e0]
mov ecx, 3
call fcn.18010b280
lea rdi, [rsp + 0x3c0]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea r9, [rsp + 0x17c]
mov r8, qword [rsp + 0x610]
lea rdx, [0x18003e308]
lea rcx, [rsp + 0x3c0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdi, [rsp + 0x90]
xor eax, eax
mov ecx, 0xac
rep stosb byte [rdi], al
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [rsp + 0x3b8], eax
cmp dword [rsp + 0x3b8], 0xffffffff
jne 0x180108064
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x3a0]
lea r8, [rsp + 0x90]
lea rdx, [0x18003f350]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
lea rdi, [rsp + 0x140]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x154]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x1801080ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x154]
lea rdx, [0x18003f2b0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
movzx eax, word [rsp + 0x140]
mov word [rsp + 0x3a8], ax
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x3aa], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x3ab], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x3ac], al
movzx eax, byte [rsp + 0x14a]
mov byte [rsp + 0x3ad], al
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x3ae], al
movzx eax, byte [rsp + 0x14e]
mov byte [rsp + 0x3af], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180108174
mov eax, 0x1000
mov word [rsp + 0x3b0], ax
jmp 0x1801081d9
cmp dword [rsp + 0x3b8], 1
jne 0x18010818e
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x5d8], eax
jmp 0x1801081c1
cmp dword [rsp + 0x3b8], 2
jne 0x1801081a8
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x5dc], eax
jmp 0x1801081b3
mov dword [rsp + 0x5dc], 0
mov eax, dword [rsp + 0x5dc]
mov dword [rsp + 0x5d8], eax
mov eax, dword [rsp + 0x90]
neg eax
sub eax, dword [rsp + 0x5d8]
mov word [rsp + 0x3b0], ax
lea rdi, [rsp + 0x140]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x15c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x180108262
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x15c]
lea rdx, [0x18003f200]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
movzx eax, word [rsp + 0x140]
mov word [rsp + 0x78], ax
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x7a], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x7b], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x7c], al
movzx eax, byte [rsp + 0x14a]
mov byte [rsp + 0x7d], al
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x7e], al
movzx eax, byte [rsp + 0x14e]
mov byte [rsp + 0x7f], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x1801082d4
mov eax, 0x1000
mov word [rsp + 0x80], ax
jmp 0x180108339
cmp dword [rsp + 0x3b8], 1
jne 0x1801082ee
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x5e0], eax
jmp 0x180108321
cmp dword [rsp + 0x3b8], 2
jne 0x180108308
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x5e4], eax
jmp 0x180108313
mov dword [rsp + 0x5e4], 0
mov eax, dword [rsp + 0x5e4]
mov dword [rsp + 0x5e0], eax
mov eax, dword [rsp + 0x90]
neg eax
sub eax, dword [rsp + 0x5e0]
mov word [rsp + 0x80], ax
lea rdi, [rsp + 0x140]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rdx, [rsp + 0x140]
lea rcx, [rsp + 0x164]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
jne 0x1801083c2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3a0], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x164]
lea rdx, [0x18003f150]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
movzx eax, word [rsp + 0x140]
mov word [rsp + 0x68], ax
movzx eax, byte [rsp + 0x142]
mov byte [rsp + 0x6a], al
movzx eax, byte [rsp + 0x146]
mov byte [rsp + 0x6b], al
movzx eax, byte [rsp + 0x148]
mov byte [rsp + 0x6c], al
movzx eax, byte [rsp + 0x14a]
mov byte [rsp + 0x6d], al
movzx eax, byte [rsp + 0x14c]
mov byte [rsp + 0x6e], al
movzx eax, byte [rsp + 0x14e]
mov byte [rsp + 0x6f], al
movzx eax, word [0x180162c00]
cmp eax, 0x1000
jne 0x180108431
mov eax, 0x1000
mov word [rsp + 0x70], ax
jmp 0x180108493
cmp dword [rsp + 0x3b8], 1
jne 0x18010844b
mov eax, dword [rsp + 0xe4]
mov dword [rsp + 0x5e8], eax
jmp 0x18010847e
cmp dword [rsp + 0x3b8], 2
jne 0x180108465
mov eax, dword [rsp + 0x138]
mov dword [rsp + 0x5ec], eax
jmp 0x180108470
mov dword [rsp + 0x5ec], 0
mov eax, dword [rsp + 0x5ec]
mov dword [rsp + 0x5e8], eax
mov eax, dword [rsp + 0x90]
neg eax
sub eax, dword [rsp + 0x5e8]
mov word [rsp + 0x70], ax
mov eax, dword [rsp + 0x150]
and eax, 0x10
test eax, eax
je 0x18010859d
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x628]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x620]
mov r8, qword [rsp + 0x618]
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x17c]
call fcn.180106650
mov dword [rsp + 0x3a0], eax
cmp dword [rsp + 0x3a0], 0
je 0x180108598
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x48], eax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x628]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x620]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x618]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c0]
lea r8, [rsp + 0x17c]
lea rdx, [0x18003f090]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
jmp 0x18010872e
mov rax, qword [rsp + 0x620]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x618]
lea r8, [rsp + 0x3c0]
lea rdx, [rsp + 0x17c]
lea rcx, [rsp + 0x60]
call fcn.180103220
mov dword [rsp + 0x3a0], eax
cmp dword [rsp + 0x3a0], 0
je 0x180108652
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x620]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x618]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x17c]
lea r8, [rsp + 0x60]
lea rdx, [0x18003efe0]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
xor r8d, r8d
lea rdx, [rsp + 0x3a8]
mov rcx, qword [rsp + 0x60]
call fcn.180105440
mov r8d, 1
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
call fcn.180105440
mov r8d, 2
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.180105440
cmp qword [rsp + 0x628], 0
je 0x18010872e
mov r8, qword [rsp + 0x630]
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0x17c]
call qword [rsp + 0x628]
mov dword [rsp + 0x3a0], eax
cmp dword [rsp + 0x3a0], 0
je 0x18010872e
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x630]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c0]
lea r8, [rsp + 0x17c]
lea rdx, [0x18003ef50]
mov ecx, 1
call fcn.18010b280
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
lea rdi, [rsp + 0x150]
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rdx, [rsp + 0x150]
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1801087e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3a0], eax
mov rcx, qword [rsp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x3a0], 0x12
je 0x1801087c2
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x150]
mov r8, qword [rsp + 0x5d0]
lea rdx, [0x18003eec0]
mov ecx, 1
call fcn.18010b280
mov eax, dword [rsp + 0x3a0]
jmp 0x1801087fd
lea rdx, [0x18003ee60]
mov ecx, 3
call fcn.18010b280
mov dword [rsp + 0x3a0], 0
jmp 0x1801087e5
jmp 0x180107eef
lea rdx, [0x18003ee10]
mov ecx, 4
call fcn.18010b280
mov eax, dword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x5f0]
xor rcx, rsp
call fcn.1800eb430
add rsp, 0x600
pop rdi
ret