Function at 0x140006878
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x10348]
mov eax, 0x10430
call fcn.1400079a0
sub rsp, rax
mov rax, qword [0x140026100]
xor rax, rsp
mov qword [rbp + 0x10320], rax
xor r15d, r15d
xor edx, edx
mov r8d, 0x10000
lea rcx, [rbp + 0x320]
call fcn.140017b80
mov r8d, 0x8000
lea rdx, [rbp + 0x320]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x7ffe
ja 0x140006c6c
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x320]
or r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp word [rax + r8*2], r15w
jne 0x14000690e
lea rdx, [rbp + 0x320]
lea rcx, [rsp + 0x28]
call fcn.1400012cc
nop
lea rdx, [rsp + 0x28]
mov r10, qword [rsp + 0x28]
mov r11, qword [rsp + 0x40]
cmp r11, 7
cmova rdx, r10
mov r9, qword [rsp + 0x38]
test r9, r9
je 0x140006976
lea rcx, [r9 - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea rbx, [rdx + rax*2]
jmp 0x140006968
cmp rbx, rdx
je 0x140006976
sub rbx, 2
cmp word [rbx], 0x5c
jne 0x14000695f
sub rbx, rdx
sar rbx, 1
jmp 0x140006979
mov rbx, r14
lea rdx, [rsp + 0x28]
cmp r11, 7
cmova rdx, r10
test r9, r9
je 0x1400069b6
lea rcx, [r9 - 1]
mov rax, r14
cmp rcx, r14
cmovb rax, rcx
lea rcx, [rdx + rax*2]
jmp 0x1400069a8
cmp rcx, rdx
je 0x1400069b6
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x14000699f
sub rcx, rdx
sar rcx, 1
jmp 0x1400069b9
mov rcx, r14
cmp rcx, r14
cmove ecx, r14d
cmp rbx, r14
cmove ebx, r14d
cmp ebx, ecx
cmovl ebx, ecx
test ebx, ebx
js 0x140006c8b
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea eax, [rbx + 1]
movsxd rsi, eax
mov r8, rsi
cmp r9, rsi
cmovb r8, r9
lea rdx, [rsp + 0x28]
cmp r11, 7
cmova rdx, r10
lea rcx, [rsp + 0x48]
call fcn.1400012cc
nop
lea r8, str..dll
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.1400010c8
nop
mov r12d, 0x1000
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140006a67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, r12
jb 0x140006a62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006caa
call fcn.1400073a8
movdqa xmm0, xmmword [0x14001a950]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r15w
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0xd0]
call fcn.140017b80
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rcx, qword [rbp - 0x78]
lea rdx, [rbp + 0xd0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, r14
jne 0x140006afa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 2
jne 0x140006c47
jmp 0x140006b17
call fcn.1400073a8
mov rcx, qword [rbp + 0x10320]
xor rcx, rsp
call fcn.140007a00
lea r11, [rsp + 0x10430]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
test byte [rbp + 0xd0], 0x10
je 0x140006b5f
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140006afa
lea rcx, [rbp - 0x78]
call fcn.140002064
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140006aca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
cmp rdx, r12
mov rax, rcx
jb 0x140006ac5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c66
jmp 0x140006ac5
mov r9, r14
mov r8, rsi
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.140006e5c
nop
movsxd r9, ebx
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x28]
call fcn.140006e5c
mov rbx, rax
lea rdx, [rbp + 0xfc]
lea rcx, [rbp - 0x58]
call fcn.140006654
nop
mov r8, rax
lea rdx, str.Unknown_DLL_library__
lea rcx, [rbp - 0x38]
call fcn.140006478
nop
lea r8, str.__found_in_the_directory_with
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1400010c8
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140001050
nop
lea r8, str.._n_nThis_may_be_a_virus_or_a_malicious_program.__n_nPlease_remove_all_DLL_libraries_from_this_directory:_n_n
mov rdx, rax
lea rcx, [rbp + 0x28]
call fcn.1400010c8
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140006450
nop
lea r8, str._n_nAlternatively__you_can_move
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.1400010c8
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rbp + 0x88]
call fcn.140001050
nop
lea r8, str._to_a_new_directory.
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1400010c8
nop
xor edx, edx
mov rcx, rax
call fcn.140006cb0
nop
lea rdx, str.Could_not_enumerate_executable_path_
lea rcx, [rsp + 0x68]
call fcn.140006654
nop
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.140006cb0
nop
call fcn.14000e1ec
int3
lea rdx, str.Could_not_get_executable_path_
lea rcx, [rsp + 0x68]
call fcn.140006654
nop
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140006cb0
nop
lea rdx, str.Could_not_get_executable_directory_
lea rcx, [rsp + 0x68]
call fcn.140006654
nop
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140006cb0
nop
call fcn.14000e1ec
int3