Function at 0x18005cca0
Capabilities:
Enumerate files on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1c48
call fcn.180012ac0
sub rsp, rax
mov rax, qword [0x180135070]
xor rax, rsp
mov qword [rsp + 0x1c38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x12d8], 1
mov qword [rsp + 0x13f0], 0xffffffffffffffff
mov dword [rsp + 0x12dc], 1
cmp qword [rsp + 0x1c58], 0
je 0x18005cd13
mov rax, qword [rsp + 0x1c58]
movsx eax, byte [rax]
test eax, eax
jne 0x18005cd1d
mov rax, qword [rsp + 0x30]
jmp 0x18005d372
mov edx, 0x4e20
mov rcx, qword [rsp + 0x1c50]
call fcn.180024600
mov qword [rsp + 0x1298], rax
cmp qword [rsp + 0x1298], 0
jne 0x18005cd4f
mov rax, qword [rsp + 0x1298]
jmp 0x18005d372
lea rdx, [0x18013de70]
mov rcx, qword [rsp + 0x1c58]
call fcn.18000e810
test eax, eax
jne 0x18005cd72
mov dword [rsp + 0x12d8], 0
mov rax, qword [rsp + 0x1298]
mov byte [rax], 0
mov rdx, qword [rsp + 0x1c58]
lea rcx, [rsp + 0x12e0]
call fcn.1800f9f10
lea rcx, [rsp + 0x12e0]
call fcn.18000acf0
movsx eax, byte [rsp + rax + 0x12df]
cmp eax, 0x5c
jne 0x18005cdc3
lea rcx, [rsp + 0x12e0]
call fcn.18000acf0
mov byte [rsp + rax + 0x12df], 0
jmp 0x18005cd92
lea rcx, [rsp + 0x12e0]
call fcn.18000acf0
movsx eax, byte [rsp + rax + 0x12df]
cmp eax, 0x2f
jne 0x18005cdf4
lea rcx, [rsp + 0x12e0]
call fcn.18000acf0
mov byte [rsp + rax + 0x12df], 0
jmp 0x18005cdc3
lea rcx, [rsp + 0x12e0]
call fcn.18000acf0
cmp rax, 2
jne 0x18005ce28
movsx eax, byte [rsp + 0x12e1]
cmp eax, 0x3a
jne 0x18005ce28
lea rdx, [0x18013de74]
lea rcx, [rsp + 0x12e0]
call fcn.1800f9e70
mov r8d, 0x1000
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x12e0]
call fcn.180023540
lea rdx, [rsp + 0x12a0]
lea rcx, [rsp + 0x40]
call fcn.1800fc8ac
test eax, eax
je 0x18005cf57
mov rdx, qword [rsp + 0x1c58]
mov rcx, qword [rsp + 0x1298]
call fcn.1800f9f10
cmp dword [rsp + 0x1c60], 0
je 0x18005cf52
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov r8d, 0x800
mov rdx, qword [rsp + 0x1c58]
mov rcx, rax
call fcn.180023830
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov edx, 0x5c
mov rcx, rax
call fcn.1800fae98
mov qword [rsp + 0x13f8], rax
cmp qword [rsp + 0x13f8], 0
je 0x18005cef4
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
cmp qword [rsp + 0x13f8], rax
je 0x18005cef4
mov rax, qword [rsp + 0x13f8]
mov byte [rax], 0
jmp 0x18005cf52
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov edx, 0x2f
mov rcx, rax
call fcn.1800fae98
mov qword [rsp + 0x13f8], rax
cmp qword [rsp + 0x13f8], 0
je 0x18005cf2f
mov rax, qword [rsp + 0x13f8]
mov byte [rax], 0
jmp 0x18005cf52
mov rax, qword [rsp + 0x1c50]
movsx eax, byte [rax + 0xb48]
cmp eax, 0x5c
je 0x18005cf52
mov rax, qword [rsp + 0x1c50]
mov byte [rax + 0xb48], 0
jmp 0x18005d322
lea rdx, [rsp + 0x12e0]
mov rcx, qword [rsp + 0x1c58]
call fcn.1800f9f10
movzx eax, word [rsp + 0x12a6]
and eax, 0x8000
test eax, eax
je 0x18005d052
mov rdx, qword [rsp + 0x1c58]
mov rcx, qword [rsp + 0x1298]
call fcn.1800f9f10
cmp dword [rsp + 0x1c60], 0
je 0x18005d04d
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov r8d, 0x800
mov rdx, qword [rsp + 0x1c58]
mov rcx, rax
call fcn.180023830
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov edx, 0x5c
mov rcx, rax
call fcn.1800fae98
mov qword [rsp + 0x1400], rax
cmp qword [rsp + 0x1400], 0
je 0x18005d003
mov rax, qword [rsp + 0x1400]
mov byte [rax], 0
jmp 0x18005d04d
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov edx, 0x2f
mov rcx, rax
call fcn.1800fae98
mov qword [rsp + 0x1400], rax
cmp qword [rsp + 0x1400], 0
je 0x18005d03e
mov rax, qword [rsp + 0x1400]
mov byte [rax], 0
jmp 0x18005d04d
mov rax, qword [rsp + 0x1c50]
mov byte [rax + 0xb48], 0
jmp 0x18005d322
cmp dword [rsp + 0x1c60], 0
je 0x18005d080
mov rax, qword [rsp + 0x1c50]
add rax, 0xb48
mov r8d, 0x800
mov rdx, qword [rsp + 0x1c58]
mov rcx, rax
call fcn.180023830
mov rax, qword [rsp + 0x1c50]
cmp dword [rax + 0x1350], 0
je 0x18005d0a2
lea rax, [0x18013de78]
mov qword [rsp + 0x1c10], rax
jmp 0x18005d0b1
lea rax, [0x18013de80]
mov qword [rsp + 0x1c10], rax
mov rdx, qword [rsp + 0x1c10]
lea rcx, [rsp + 0x12e0]
call fcn.1800f9e70
mov rax, qword [rsp + 0x1c50]
cmp dword [rax + 0x1350], 0
je 0x18005d0e8
lea rax, str..dat
mov qword [rsp + 0x1c18], rax
jmp 0x18005d0f7
lea rax, str..lic
mov qword [rsp + 0x1c18], rax
mov rax, qword [rsp + 0x1c18]
mov qword [rsp + 0x12d0], rax
mov r8d, 0x1000
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x12e0]
call fcn.180023540
lea rdx, [rsp + 0x1040]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x13f0], rax
cmp qword [rsp + 0x13f0], 0xffffffffffffffff
je 0x18005d322
mov r8d, 0x800
lea rdx, [rsp + 0x1410]
lea rcx, [rsp + 0x106c]
call fcn.180023590
lea rcx, [rsp + 0x1410]
call fcn.18000acf0
mov qword [rsp + 0x1c20], rax
mov rcx, qword [rsp + 0x12d0]
call fcn.18000acf0
mov rcx, qword [rsp + 0x1c20]
sub rcx, rax
mov rax, rcx
lea rax, [rsp + rax + 0x1410]
mov rdx, qword [rsp + 0x12d0]
mov rcx, rax
call fcn.180005964
test eax, eax
jne 0x18005d1ed
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x12dc]
mov r8d, dword [rsp + 0x12d8]
mov rdx, qword [rsp + 0x1c58]
mov rcx, qword [rsp + 0x1298]
call fcn.18005d390
mov dword [rsp + 0x12dc], 0
lea rdx, [rsp + 0x1040]
mov rcx, qword [rsp + 0x13f0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18005d314
mov r8d, 0x800
lea rdx, [rsp + 0x1410]
lea rcx, [rsp + 0x106c]
call fcn.180023590
lea rcx, [rsp + 0x1410]
call fcn.18000acf0
mov qword [rsp + 0x1c28], rax
mov rcx, qword [rsp + 0x12d0]
call fcn.18000acf0
mov rcx, qword [rsp + 0x1c28]
sub rcx, rax
mov rax, rcx
lea rax, [rsp + rax + 0x1410]
mov rdx, qword [rsp + 0x12d0]
mov rcx, rax
call fcn.180005964
test eax, eax
jne 0x18005d30f
lea rcx, [rsp + 0x1410]
call fcn.18000acf0
mov qword [rsp + 0x1c30], rax
mov rcx, qword [rsp + 0x1298]
call fcn.18000acf0
mov rcx, qword [rsp + 0x1c30]
lea rax, [rcx + rax + 1]
cmp rax, 0x4e20
jae 0x18005d2ec
lea rax, [rsp + 0x1410]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x12dc]
mov r8d, dword [rsp + 0x12d8]
mov rdx, qword [rsp + 0x1c58]
mov rcx, qword [rsp + 0x1298]
call fcn.18005d390
mov dword [rsp + 0x12dc], 0
jmp 0x18005d30f
mov rcx, qword [rsp + 0x1298]
call fcn.180024680
mov rax, qword [rsp + 0x1c50]
mov dword [rax + 0x184], 0xffffff9a
xor eax, eax
jmp 0x18005d372
jmp 0x18005d1ed
mov rcx, qword [rsp + 0x13f0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x1298]
call fcn.18000acf0
inc rax
mov edx, eax
mov rcx, qword [rsp + 0x1c50]
call fcn.180024600
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18005d360
mov rdx, qword [rsp + 0x1298]
mov rcx, qword [rsp + 0x30]
call fcn.1800f9f10
mov rcx, qword [rsp + 0x1298]
call fcn.180024680
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x1c38]
xor rcx, rsp
call fcn.180005860
add rsp, 0x1c48
ret