Function at 0x180131c64
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x10858
call fcn.1801907a0
sub rsp, rax
mov qword [rsp + 0x218], 0xfffffffffffffffe
mov rdx, qword [rsp + 0x10868]
lea rcx, [rsp + 0x1d8]
call fcn.1800aac40
nop
lea r8, [0x1803a93f8]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x2d8]
call fcn.1800f2520
nop
lea rdx, [0x1803a9320]
lea rcx, [rsp + 0x2f8]
call fcn.1800730e0
nop
mov rax, qword [rsp + 0x10860]
add rax, 0xd0
lea r8, [rsp + 0x2f8]
mov rdx, rax
lea rcx, [rsp + 0x1f8]
call fcn.180133400
nop
lea rcx, [rsp + 0x2f8]
call fcn.180073360
lea rcx, [rsp + 0x1f8]
call fcn.1800738f0
movzx eax, al
test eax, eax
je 0x180131d8a
lea rdx, [0x1803a92f8]
lea rcx, [rsp + 0x2b8]
call fcn.1800730e0
nop
mov rax, qword [rsp + 0x10860]
add rax, 0xd0
lea r8, [rsp + 0x2b8]
mov rdx, rax
lea rcx, [rsp + 0x370]
call fcn.180133400
mov qword [rsp + 0x120], rax
mov rdx, qword [rsp + 0x120]
lea rcx, [rsp + 0x1f8]
call fcn.180073df0
lea rcx, [rsp + 0x370]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x2b8]
call fcn.180073360
lea rcx, [rsp + 0x2d8]
call fcn.180074060
lea rdx, [rsp + 0x570]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
je 0x180132672
mov eax, dword [rsp + 0x570]
and eax, 0x10
test eax, eax
je 0x180131dcc
jmp 0x18013264b
lea rcx, [rsp + 0x7c0]
call fcn.180133c88
mov qword [rsp + 0x220], rax
lea rdx, [rsp + 0x59c]
lea rcx, [rsp + 0x350]
call fcn.1800aac40
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x180], rax
mov r8, qword [rsp + 0x180]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x390]
call fcn.1800fe0e0
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x190], rax
mov rdx, qword [rsp + 0x190]
lea rcx, [rsp + 0x298]
call fcn.18012daa8
mov qword [rsp + 0x228], rax
lea rcx, [rsp + 0x390]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x350]
call fcn.180073fc0
lea rcx, [rsp + 0x298]
call fcn.180073860
mov rdx, rax
lea rcx, [rsp + 0x7c0]
call fcn.180134fb8
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9408]
lea rcx, [rsp + 0x7c0]
call fcn.180133cf8
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x180131efe
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9418]
lea rcx, [rsp + 0x7c0]
call fcn.180133cf8
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18013262a
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9430]
mov rcx, qword [rsp + 0x38]
call fcn.180133cf8
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x180131f6a
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9440]
mov rcx, qword [rsp + 0x38]
call fcn.180133cf8
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x180131f95
lea rcx, [rsp + 0x298]
call fcn.180073360
nop
lea rax, [rsp + 0x820]
mov rcx, rax
call fcn.1801346ac
jmp 0x18013264b
mov dword [rsp + 0x34], 0
mov rax, qword [rsp + 0x48]
cmp qword [rax + 8], 0
je 0x180131fb9
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 8]
mov qword [rsp + 0x68], rax
jmp 0x180131fc5
lea rax, [0x1803dc780]
mov qword [rsp + 0x68], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1801e94e0
mov qword [rsp + 0x238], rax
lea rcx, [rsp + 0x1f8]
call fcn.180074060
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0x80]
call fcn.180074060
mov rcx, qword [rsp + 0xe8]
mov rdx, rcx
mov rcx, rax
call fcn.18017dc80
test eax, eax
jne 0x18013202a
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x10860]
add rax, 0x128
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x290]
mov rcx, rax
call fcn.180133b8c
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x10860]
add rax, 0x128
lea rdx, [rsp + 0x230]
mov rcx, rax
call fcn.180108e38
mov rdx, rax
mov rcx, qword [rsp + 0x1c0]
call fcn.18010a5bc
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
test eax, eax
je 0x1801321be
lea rcx, [rsp + 0x318]
call fcn.1800740e0
mov qword [rsp + 0x1d0], rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x10860]
add rax, 0x128
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1801339c4
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x108]
call fcn.180133860
nop
lea rcx, [rsp + 0x318]
call fcn.180074b60
lea rdx, [rsp + 0x59c]
lea rcx, [rsp + 0x3b0]
call fcn.1800aac40
mov qword [rsp + 0x1b8], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x118], rax
mov r8, qword [rsp + 0x118]
lea rdx, [rsp + 0x1d8]
lea rcx, [rsp + 0x330]
call fcn.1800fe0e0
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0x10860]
add rax, 0x138
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1800ed500
mov qword [rsp + 0x1a8], rax
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x1a8]
call fcn.180073df0
nop
lea rcx, [rsp + 0x330]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x3b0]
call fcn.180073fc0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9450]
mov rcx, qword [rsp + 0x38]
call fcn.180133cf8
mov qword [rsp + 0x138], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x50], rax
jmp 0x180132218
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9450]
mov rcx, qword [rsp + 0x50]
call fcn.180133e20
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1801323ed
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9458]
mov rcx, qword [rsp + 0x50]
call fcn.180133f40
mov qword [rsp + 0x148], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1801323e8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
je 0x180132278
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x78], rax
jmp 0x180132284
lea rax, [0x1803dc780]
mov qword [rsp + 0x78], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x248]
call fcn.1801e94e0
mov qword [rsp + 0x268], rax
lea rcx, [rsp + 0x248]
call fcn.180074060
mov qword [rsp + 0x1c8], rax
lea rcx, [rsp + 0x80]
call fcn.180074060
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, qword [rsp + 0x1c8]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x3d0]
call fcn.1800aa8f0
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x10860]
add rax, 0x128
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1801339c4
mov qword [rsp + 0xf8], rax
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0xf8]
call fcn.1800b1c00
nop
lea rcx, [rsp + 0x3d0]
call fcn.180058330
lea rcx, [rsp + 0x248]
call fcn.180074060
mov qword [rsp + 0xf0], rax
lea rcx, [rsp + 0x80]
call fcn.180074060
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, qword [rsp + 0xf0]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x4a0]
call fcn.1800aa8f0
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x10860]
add rax, 0xb0
mov rdx, qword [rsp + 0xa0]
mov rcx, rax
call fcn.1800b1c00
nop
lea rcx, [rsp + 0x4a0]
call fcn.180058330
nop
lea rcx, [rsp + 0x248]
call fcn.180073fc0
jmp 0x1801321ec
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9464]
mov rcx, qword [rsp + 0x38]
call fcn.180133cf8
mov qword [rsp + 0x130], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x58], rax
jmp 0x180132447
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9464]
mov rcx, qword [rsp + 0x58]
call fcn.180133e20
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x18013261c
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1803a9458]
mov rcx, qword [rsp + 0x58]
call fcn.180133f40
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x180132617
mov rax, qword [rsp + 0x40]
cmp qword [rax + 8], 0
je 0x1801324a7
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 8]
mov qword [rsp + 0x70], rax
jmp 0x1801324b3
lea rax, [0x1803dc780]
mov qword [rsp + 0x70], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x270]
call fcn.1801e94e0
mov qword [rsp + 0x240], rax
lea rcx, [rsp + 0x270]
call fcn.180074060
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x80]
call fcn.180074060
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, qword [rsp + 0x160]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x508]
call fcn.1800aa8f0
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x10860]
add rax, 0x128
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1801339c4
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
call fcn.1800b1c00
nop
lea rcx, [rsp + 0x508]
call fcn.180058330
lea rcx, [rsp + 0x270]
call fcn.180074060
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x80]
call fcn.180074060
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x20], ecx
xor r9d, r9d
mov rcx, qword [rsp + 0xc0]
mov r8, rcx
mov rdx, rax
lea rcx, [rsp + 0x438]
call fcn.1800aa8f0
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x10860]
add rax, 0xb0
mov rdx, qword [rsp + 0xe0]
mov rcx, rax
call fcn.1800b1c00
nop
lea rcx, [rsp + 0x438]
call fcn.180058330
nop
lea rcx, [rsp + 0x270]
call fcn.180073fc0
jmp 0x18013241b
lea rcx, [rsp + 0x80]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x298]
call fcn.180073360
nop
lea rax, [rsp + 0x820]
mov rcx, rax
call fcn.1801346ac
nop
jmp 0x18013264b
lea rdx, [rsp + 0x570]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180131db9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x1f8]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x2d8]
call fcn.180073fc0
nop
lea rcx, [rsp + 0x1d8]
call fcn.180073fc0
add rsp, 0x10858
ret