Function at 0x18001e740
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x18006e218]
xor rax, rsp
mov qword [rbp + 0x320], rax
mov r15, qword [rsp + 0x50]
lea r11, [0x180000000]
mov ebx, dword [rsp + 0x30]
mov esi, r8d
mov r12, qword [rsp + 0x50]
xor r10d, r10d
mov qword [rsp + 0x58], r9
mov r13, rdx
mov r8, rcx
mov qword [rsp + 0x40], rcx
lea r14d, [rsi - 0xb]
mov qword [rsp + 0x48], r15
cmp esi, r14d
jbe 0x18001e9e9
lea edx, [r10 + 0x6c]
lea r10d, [rdx - 7]
lea r11d, [rdx - 0x39]
lea edi, [rsi - 0xe4]
nop
cmp edi, 0x17
ja case.0x18001e7e1.2
lea rcx, [0x180000000]
mov ecx, dword [rcx + rdi*4 + 0x1ed58]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
xor ebx, ebx
test r8, r8
jne 0x18001e80b
lea r9, [0x180062423]
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
mov edx, 0xa8
lea rcx, str.a___NULL
call fcn.1800175c0
test r13, r13
jne 0x18001e831
lea r9, [0x180062423]
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
mov edx, 0xa8
lea rcx, str.b___NULL
call fcn.1800175c0
mov rbx, qword [rsp + 0x58]
test rbx, rbx
jne 0x18001e85c
lea r9, [0x180062423]
mov dword [rsp + 0x30], ebx
lea r8, [rsp + 0x30]
mov edx, 0xa8
lea rcx, str.c___NULL
call fcn.1800175c0
mov rax, qword [rsp + 0x40]
mov r9d, 0xcc
mov r8, r13
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rbx
call fcn.180050620
mov edx, reloc.SHLWAPI.dll_SHStripMneumonicW
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x30]
call fcn.180033a20
mov rbx, rax
mov r8, qword [rsp + 0x40]
mov edx, 0x6c
mov r9, qword [rsp + 0x58]
lea r10d, [rdx - 7]
lea r11d, [rdx - 0x39]
jmp case.0x18001e7e1.2
xor r12d, r12d
jmp case.0x18001e7e1.2
lea rdx, str._s.
lea rcx, [rbp + 0x100]
call fcn.18005b0b0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
mov qword [rsp + 0x48], rax
jmp 0x18001e88f
mov word [rbp + 0xe6], r10w
jmp case.0x18001e7e1.2
mov dword [rbp + 0xe8], 0x790061
mov word [rbp + 0xec], r11w
mov dword [rbp + 0xee], 0x2e0032
jmp case.0x18001e7e1.2
mov r15, 0xffffffffffffffff
lea rcx, [rbp + 0x210]
xor edx, edx
mov qword [rsp + 0x48], r15
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x100]
lea rax, [rbp + 0x210]
lea edx, [r15 + 3]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x18001e941
mov eax, dword [rax]
mov dword [rcx], eax
jmp 0x18001e88f
mov word [rbp + 0xf6], dx
jmp case.0x18001e7e1.2
mov dword [rbp + 0xf2], 0x6c0064
jmp case.0x18001e7e1.2
mov dword [rbp + 0xe0], 0x730073
mov word [rbp + 0xe4], dx
jmp case.0x18001e7e1.2
xor eax, eax
mov qword [r13], rax
mov qword [r9], rax
dec edi
lea eax, [rdi + 0xe4]
cmp eax, r14d
ja 0x18001e7c0
xor r10d, r10d
lea r11, [0x180000000]
lea eax, [rsi + 0xd1]
mov dword [rsp + 0x38], eax
cmp esi, eax
jae case.0x18001ea40.5
mov r14, qword [rsp + 0x60]
lea edx, [rsi - 0xf0]
mov rdi, qword [rsp + 0x60]
mov ecx, eax
mov rsi, qword [rsp + 0x50]
mov dword [rsp + 0x30], edx
nop word [rax + rax]
cmp edx, 0x85
ja case.default.0x18001ea40
movzx eax, byte [r11 + rdx + 0x1ede8]
mov ecx, dword [r11 + rax*4 + 0x1edb8]
add rcx, r11
jmp rcx
movzx eax, word [0x1800653ba]
movsd xmm0, qword [0x1800653b2]
mov word [rbp + 0xc8], ax
mov eax, dword [0x180065422]
mov dword [rbp + 0xca], eax
movzx eax, word [0x180065426]
mov word [rbp + 0xce], ax
movsd qword [rbp + 0xc0], xmm0
jmp case.0x18001ea40.11
mov dword [rbp + 0xd0], 0x64002e
jmp case.0x18001ea40.11
mov r8d, 2
lea rdx, [0x180065444]
lea rcx, [rbp + 0xd4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
xor eax, eax
mov r15d, 0x11
mov word [rbp + 0xd8], ax
mov eax, r15d
sub eax, 0xe
je 0x18001eaee
sub eax, 2
je 0x18001eb0d
cmp eax, 1
jne 0x18001eb04
xor r8d, r8d
lea rcx, [rbp + 0xe0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov edx, 0x30
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
jmp 0x18001eb04
cmp byte [0x180071521], 0
je 0x18001eb04
call qword [0x180071518]
mov byte [0x180071521], 0
dec r15d
cmp r15d, 0xe
ja 0x18001eab7
mov r15, qword [rsp + 0x48]
xor r10d, r10d
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x60], rdi
jmp 0x18001ed07
mov word [rbp + 0xd4], r10w
jmp case.0x18001ea40.11
imul r15, r12, 0x110
xor esi, esi
mov ebx, 0x30
nop
mov eax, ebx
sub eax, 0x2f
je 0x18001eb87
cmp eax, 1
jne 0x18001ebfd
mov rcx, qword [r13]
add r15, 0x110
mov rdx, r15
inc r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov qword [r13], rax
lea r14, [rax - 0x110]
add r14, r15
jmp 0x18001ebfd
lea r8, [rbp - 0x54]
mov rcx, r14
lea rdx, [0x180062670]
call fcn.18005b0b0
test byte [rbp - 0x80], 0x10
je 0x18001ebb4
mov qword [r14 + 0x108], rsi
mov dword [r14 + 0x100], 1
jmp 0x18001ebfd
mov eax, 0xb6
nop dword [rax]
cmp eax, 0xb6
je 0x18001ebd7
cmp eax, 0xe38
jne 0x18001ebf1
mov dword [r14 + 0x100], esi
jmp 0x18001ebf1
mov ecx, dword [rbp - 0x60]
mov dword [rsp + 0x68], ecx
mov ecx, dword [rbp - 0x64]
mov dword [rsp + 0x6c], ecx
mov rcx, qword [rsp + 0x68]
mov qword [r14 + 0x108], rcx
add eax, 0xd82
cmp eax, 0x1b04
jbe 0x18001ebc0
dec ebx
cmp ebx, 0x2e
ja 0x18001eb50
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne case.0x18001ea40.3
mov r15, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x58]
xor r10d, r10d
mov r8, qword [rsp + 0x40]
mov ebx, r10d
mov qword [rax], r12
jmp 0x18001ed07
mov rcx, qword [r8]
call qword [rsp + 0x70]
mov r8, qword [rsp + 0x40]
xor r10d, r10d
jmp 0x18001ed07
cmp r15, 0xffffffffffffffff
jne case.0x18001ea40.11
lea eax, [r15 + 2]
jmp 0x18001ed2e
mov r15d, 0x11
mov eax, r15d
sub eax, 0xe
je 0x18001ecae
sub eax, 2
je 0x18001eccd
cmp eax, 1
jne 0x18001ecc4
xor r8d, r8d
lea rcx, [rbp + 0xc0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x18001ecc4
cmp byte [0x180071521], 0
je 0x18001ecc4
call qword [0x180071518]
mov byte [0x180071521], 0
dec r15d
cmp r15d, 0xe
ja 0x18001ec77
mov r15, qword [rsp + 0x48]
xor r10d, r10d
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x70], rsi
jmp 0x18001ed07
mov word [rbp + 0xf8], r10w
jmp case.0x18001ea40.11
mov rcx, qword [r13]
call qword [rsp + 0x60]
mov r8, qword [rsp + 0x40]
xor r10d, r10d
mov qword [r8], r10
mov qword [r13], r10
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
add edx, 0x13
mov dword [rsp + 0x30], edx
lea eax, [rdx + 0xf0]
cmp eax, ecx
jae case.0x18001ea40.5
lea r11, [0x180000000]
jmp 0x18001ea20
mov eax, ebx
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.18005b930
mov rbx, qword [rsp + 0x480]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret