Function at 0x14002ea20
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd70
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1400e71f0]
xor rax, rsp
mov qword [rsp + 0xd60], rax
xor r14d, r14d
mov word [r11 - 0x878], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0x876]
call fcn.140080d50
mov word [rsp + 0x730], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x732]
call fcn.140080d50
call fcn.140069504
mov r12, qword [rax + 8]
mov qword [rsp + 0x50], r12
mov edx, 0x104
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x14002f23f
lea rdx, str.DriverStoreFileRepository_
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea r8, [rsp + 0x520]
mov edx, 0x104
lea rcx, [rsp + 0x730]
call fcn.140081cd0
lea rdx, [0x1400a88f8]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x520]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x14002f23c
movsxd rbp, dword [r12 + 0x748]
mov qword [rsp + 0x60], rbp
lea rsi, [0x1400a4510]
mov rdi, rax
cmp dword [rsp + 0x80], 0x10
jne 0x14002f1a2
call fcn.1400696cc
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x14002f220
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0xac]
lea rax, [rsp + 0xac]
test rax, 0xffffffffffff0000
jne 0x14002ebbb
movzx edi, cx
mov ecx, edi
call fcn.1400696b8
test rax, rax
je 0x14002ecc9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140003a40
mov rbx, qword [rsp + 0x48]
jmp 0x14002ecc9
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xac]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x14002ec33
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14002ecc9
cmp dword [rdx + 0x10], eax
jge 0x14002ec04
cmp dword [rbx - 0xc], eax
jl 0x14002f1bc
mov dword [rbx - 0x10], r14d
mov word [rbx], ax
jmp 0x14002ecc9
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002ec1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
jmp 0x14002ecc9
mov esi, dword [rbx - 0x10]
lea rbp, [rsp + 0xac]
sub rbp, rbx
sar rbp, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14002ec66
mov edx, edi
lea rcx, [rsp + 0x48]
call fcn.140003180
mov rbx, qword [rsp + 0x48]
cmp rbp, rsi
ja 0x14002ec86
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + rbp*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140081c40
jmp 0x14002eca3
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
lea r8, [rsp + 0xac]
mov rdx, rsi
mov rcx, rbx
call fcn.140080540
test edi, edi
js 0x14002f215
cmp edi, dword [rbx - 0xc]
jg 0x14002f215
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
mov rbp, qword [rsp + 0x60]
lea rsi, [0x1400a4510]
call fcn.1400696cc
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x14002f20a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
test rsi, 0xffffffffffff0000
jne 0x14002ed20
movzx esi, si
mov ecx, esi
call fcn.1400696b8
test rax, rax
je 0x14002ed45
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003a40
mov rdi, qword [rsp + 0x40]
jmp 0x14002ed45
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140003c40
mov rdi, qword [rsp + 0x40]
movsxd rsi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14002ed6b
mov edx, esi
lea rcx, [rsp + 0x48]
call fcn.140003180
mov rbx, qword [rsp + 0x48]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140084240
test esi, esi
js 0x14002f1ff
cmp esi, dword [rbx - 0xc]
jg 0x14002f1ff
lea r13, [rbx - 0x10]
mov qword [rsp + 0x68], r13
mov dword [r13], esi
mov word [rbx + rsi*2], 0
mov r15, r14
test rbp, rbp
jle 0x14002f01c
nop
nop
test r15, r15
js 0x14002f1f9
cmp r15, qword [r12 + 0x748]
jge 0x14002f1f9
mov rax, qword [r12 + 0x740]
mov r12, qword [rax + r15*8]
lea rbp, [r12 - 0x18]
lea rsi, [rdi - 0x18]
cmp rbp, rsi
je 0x14002ef80
cmp dword [rsi + 0x10], 0
jl 0x14002ee86
mov rcx, qword [rbp]
cmp rcx, qword [rsi]
jne 0x14002ee86
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbp + 0x10], 0
jl 0x14002ee1b
cmp rax, qword [rbp]
jne 0x14002ee1b
mov rdi, rbp
lock add dword [rbp + 0x10], 1
jmp 0x14002ee58
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbp + 8]
call qword [rax]
mov rdi, rax
test rax, rax
je 0x14002f1c7
mov ecx, dword [rbp + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbp + 8]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rbp + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140080540
or eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002ee73
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x40], rdi
mov rbx, qword [rsp + 0x48]
jmp 0x14002ef80
movsxd rbp, dword [r12 - 0x10]
test ebp, ebp
jne 0x14002eef2
mov rbp, qword [rsi]
cmp dword [rsi + 8], 0
je 0x14002ef80
cmp dword [rsi + 0x10], 0
jge 0x14002eeba
cmp dword [rdi - 0xc], 0
jl 0x14002f1cd
mov dword [rdi - 0x10], r14d
mov word [rdi], 0
jmp 0x14002ef80
or eax, 0xffffffff
lock xadd dword [rsi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002eed5
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov rbx, qword [rsp + 0x48]
jmp 0x14002ef80
test r12, r12
je 0x14002f1e3
mov r14d, dword [rdi - 0x10]
mov r13, r12
sub r13, rdi
sar r13, 1
mov ecx, 1
sub ecx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
sub eax, ebp
or eax, ecx
jge 0x14002ef2a
mov edx, ebp
lea rcx, [rsp + 0x40]
call fcn.140003180
mov rdi, qword [rsp + 0x40]
cmp r13, r14
ja 0x14002ef48
lea rsi, [rbp + rbp]
lea r8, [rdi + r13*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rdi
call fcn.140081c40
jmp 0x14002ef5e
lea rsi, [rbp + rbp]
mov r9, rsi
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140080540
test ebp, ebp
js 0x14002f1d8
cmp ebp, dword [rdi - 0xc]
jg 0x14002f1d8
mov dword [rdi - 0x10], ebp
mov word [rsi + rdi], 0
mov r13, qword [rsp + 0x68]
xor r14d, r14d
movsxd rsi, dword [rdi - 0x10]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x14002efa6
mov edx, esi
lea rcx, [rsp + 0x40]
call fcn.140003180
mov rdi, qword [rsp + 0x40]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140084240
test esi, esi
js 0x14002f1ee
cmp esi, dword [rdi - 0xc]
jg 0x14002f1ee
mov dword [rdi - 0x10], esi
mov word [rdi + rsi*2], 0
cmp dword [r13], 0
jl 0x14002eff0
mov rdx, rdi
mov rcx, rbx
call fcn.1400804d0
test rax, rax
je 0x14002eff0
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
jg 0x14002f012
add r15, 1
mov rbp, qword [rsp + 0x60]
cmp r15, rbp
mov r12, qword [rsp + 0x50]
jl 0x14002edb0
test rbp, rbp
jne 0x14002f140
jmp 0x14002f01c
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov word [rsp + 0x940], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x942]
call fcn.140080d50
mov word [rsp + 0xb50], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xb52]
call fcn.140080d50
lea r11, [rsp + 0xac]
mov qword [rsp + 0x28], r11
lea rax, [rsp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, str._s_s.inf
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0x940]
call fcn.140083fd0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x940]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002f140
nop
nop
nop
lea rax, [rsp + 0x2fc]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x730]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a45d0]
or r8, 0xffffffffffffffff
mov edx, 0x104
lea rcx, [rsp + 0xb50]
call fcn.140083fd0
lea r8, [rsp + 0xb50]
mov rdx, qword [r12 + 0x720]
lea rcx, [r12 + 0x710]
call fcn.140068584
lea rdx, [rsp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002f0c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002f15d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002f191
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
lea rsi, [0x1400a4510]
jmp 0x14002f1a2
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
lea rsi, [0x1400a4510]
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002f22b
jmp 0x14002eb40
mov ecx, 0x80070057
call fcn.140001000
nop
call fcn.1400019f0
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
call fcn.14006766c
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80004005
call fcn.140001000
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14d, dword [r12 + 0x720]
mov eax, r14d
mov rcx, qword [rsp + 0xd60]
xor rcx, rsp
call fcn.140081050
lea r11, [rsp + 0xd70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret