Function at 0x1400011e0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rax, [rbp + 0xc0]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140001244
movsxd rax, ecx
mov byte [rbp + rax + 0xc0], 0x5c
movsxd rax, ecx
mov byte [rbp + rax + 0xc1], 0x2a
movsxd rax, ecx
add rax, 2
cmp rax, 0x104
jae 0x1400015e9
mov byte [rbp + rax + 0xc0], 0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0xf5cffdb3
mov byte [rsp + 0x34], 0
xor ebx, ebx
mov edi, ebx
inc ebx
cmp byte [rsp + rbx + 0x30], 0
jne 0x1400012a3
lea ecx, [rbx + 1]
call fcn.140001ea0
xor edx, edx
test ebx, ebx
je 0x1400012ef
mov r8, rax
lea r10, [rsp + 0x30]
sub r10, rax
nop word [rax + rax]
movzx ecx, byte [r10 + r8]
xor cl, 0xf
mov byte [r8], cl
lea ecx, [rdx + 1]
cmp edx, edi
mov edx, ecx
jne 0x1400012e8
mov byte [rcx + rax], 0
inc r8
cmp edx, ebx
jb 0x1400012d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001960
nop
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
mov r8d, 0x16
movabs rdx, 0x8000000000000000
movabs rcx, 0x7fffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
lea rax, [rbp - 0x54]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001334
cmp rbx, rcx
ja 0x1400015e3
cmp rbx, 0xf
ja 0x140001384
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov r8, rbx
lea rdx, [rbp - 0x54]
lea rcx, [rsp + 0x60]
call fcn.140011270
mov byte [rsp + rbx + 0x60], 0
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
jmp 0x14000140d
mov rsi, rbx
or rsi, 0xf
cmp rsi, rcx
jbe 0x140001399
mov rsi, rcx
lea rax, [rdx + 0x27]
jmp 0x1400013bb
cmp rsi, 0x16
cmovb rsi, r8
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400013da
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400015f5
mov rcx, rax
call fcn.140001e5c
test rax, rax
je 0x1400015fb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013eb
test rcx, rcx
je 0x1400013e9
call fcn.140001e5c
mov rdi, rax
jmp 0x1400013eb
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov r8, rbx
lea rdx, [rbp - 0x54]
mov rcx, rdi
call fcn.140011270
mov byte [rdi + rbx], 0
lea r14, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova r14, r13
lea r15, [rsp + 0x60]
cmp rsi, 0xf
cmova r15, rdi
cmp r12, rbx
ja 0x1400014ab
test r12, r12
je 0x140001541
mov rax, r15
sub rax, r12
lea r12, [rax + rbx]
movsx r13d, byte [r14]
lea r8, [r12 + 1]
sub r8, r15
mov edx, r13d
mov rcx, r15
call fcn.1400119d0
mov rbx, rax
test rax, rax
je 0x1400014a1
mov r8, qword [rsp + 0x50]
mov rdx, r14
mov rcx, rbx
call fcn.1400118f0
test eax, eax
je 0x140001494
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call fcn.1400119d0
mov rbx, rax
test rax, rax
jne 0x140001460
jmp 0x1400014a1
sub rbx, r15
cmp rbx, 0xffffffffffffffff
jne 0x14000153c
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
cmp rsi, 0xf
jbe 0x1400014e2
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400014da
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015fb
mov rcx, rdi
call fcn.140001e98
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001307
mov rax, qword [rsp + 0x58]
cmp rax, 0xf
jbe 0x140001535
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000152d
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015ef
mov rcx, r13
call fcn.140001e98
mov eax, 1
jmp 0x1400015b3
mov r13, qword [rsp + 0x40]
cmp rsi, 0xf
jbe 0x140001579
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140001570
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015fb
mov rcx, rdi
call fcn.140001e98
nop
mov rax, qword [rsp + 0x58]
cmp rax, 0xf
jbe 0x1400015b1
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400015a9
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400015ef
mov rcx, r13
call fcn.140001e98
xor eax, eax
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140001ba0
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001cc8
int3
call fcn.140008a30
nop
call fcn.140001100
int3
call fcn.140008a30
int3