Function at 0x1800597f0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov r13, rdx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call fcn.180077790
nop
mov rcx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x78]
mov rax, r8
sub rax, rcx
cmp rax, 2
jb 0x180059863
lea rax, [rcx + 2]
mov qword [rbp - 0x80], rax
lea rax, [rsp + 0x70]
cmp r8, 0x10
cmovae rax, qword [rsp + 0x70]
mov edx, 0x2a5c
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], 0
jmp 0x180059882
mov qword [rsp + 0x20], 2
lea r9, [0x180096214]
mov edx, 2
lea rcx, [rsp + 0x70]
call fcn.18004f590
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rcx, qword [rsp + 0x70]
lea rdx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x180059b79
xor esi, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], sil
lea rax, [rbp + 0xbc]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800598d4
lea rdx, [rbp + 0xbc]
lea rcx, [rsp + 0x30]
call fcn.18004d0c0
nop
lea rbx, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x48]
cmp r15, 0x10
cmovae rbx, r14
mov rdi, qword [rsp + 0x40]
test rdi, rdi
je 0x18005995c
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp - 0x42], 1
lea rcx, [rdi - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
add rax, rbx
movzx ecx, byte [rax]
cmp byte [rbp + rcx - 0x70], 0
jne 0x180059957
cmp rax, rbx
je 0x18005995c
dec rax
movzx ecx, byte [rax]
cmp byte [rbp + rcx - 0x70], 0
je 0x180059945
sub rax, rbx
jmp 0x180059963
mov rax, 0xffffffffffffffff
lea rcx, [rax + 1]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], 0xf
cmp rdi, rcx
jb 0x180059be7
sub rdi, rcx
mov rsi, 0xffffffffffffffff
cmp rdi, rsi
cmovb rsi, rdi
lea rax, [rsp + 0x30]
cmp r15, 0x10
cmovae rax, r14
lea r14, [rax + rcx]
cmp rsi, 0xf
ja 0x1800599d4
mov qword [rsp + 0x60], rsi
mov r8, rsi
mov rdx, r14
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memmove
mov byte [rsp + rsi + 0x50], 0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x50]
jmp 0x180059a7a
movabs r15, 0x7fffffffffffffff
cmp rsi, r15
ja 0x180059bf3
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
jbe 0x180059a02
mov rbx, r15
movabs rax, 0x8000000000000027
jmp 0x180059a29
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180059a48
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180059bed
mov rcx, rax
call fcn.180081320
test rax, rax
je 0x180059bb3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180059a59
test rcx, rcx
je 0x180059a57
call fcn.180081320
mov rdi, rax
jmp 0x180059a59
xor edi, edi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
cmp rbx, 0x10
cmovae rax, rdi
cmp rsi, 3
jne 0x180059ab0
cmp byte [rax], 0x63
jne 0x180059aa2
cmp byte [rax + 1], 0x66
jne 0x180059aa2
cmp byte [rax + 2], 0x67
jne 0x180059aa2
xor eax, eax
jmp 0x180059aa7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180059ab0
mov sil, 1
jmp 0x180059ab3
xor sil, sil
cmp rbx, 0x10
jb 0x180059aea
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x180059ae2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180059bb3
mov rcx, rdi
call fcn.1800816dc
test sil, sil
je 0x180059b1e
mov rax, qword [r13 + 8]
cmp rax, qword [r13 + 0x10]
je 0x180059b0d
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180077790
add qword [r13 + 8], 0x20
jmp 0x180059b1e
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, r13
call fcn.1800792d0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180059b57
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180059b52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180059bba
call fcn.1800816dc
lea rdx, [rbp + 0x90]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800598ac
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x180059bc6
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180059bc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180059bc1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1800816dc
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18004f8a0
nop
call fcn.180008030
int3
call fcn.18003b4c0
int3