Function at 0x1401b35a0
Capabilities:
Enumerate files on windows
Get file attributes
Get file size

Disassembly:
push rbp
push rbx
push r13
push r14
lea rbp, [rsp - 0x828]
sub rsp, 0x928
mov rax, qword [0x1406836b8]
xor rax, rsp
mov qword [rbp + 0x800], rax
mov rax, rdx
mov qword [rsp + 0x68], rcx
mov rbx, r8
lea rdx, [rbp + 0x5f0]
mov rcx, rax
mov qword [rsp + 0x48], rbx
mov r8d, 0x104
call sym.ErrorReportClient.exe_SfGetRootPathFromFilePath
mov edx, 0x400
lea rcx, [rbp + 0x5f0]
call sym.ErrorReportClient.exe_SfGetDiskFreeSpace
xor r14d, r14d
mov dword [rsp + 0x40], eax
movsxd rax, dword [rbx]
mov r13d, r14d
mov qword [rsp + 0x70], rax
test rax, rax
jle 0x1401b38c1
mov qword [rsp + 0x968], rsi
mov qword [rsp + 0x920], rdi
mov qword [rsp + 0x918], r12
mov r12d, r14d
mov qword [rsp + 0x910], r15
mov qword [rsp + 0x60], r14
mov rax, qword [rbx + 0x10]
mov rsi, qword [rax + r12*8]
test rsi, rsi
je 0x1401b388e
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1401b3825
mov r9, 0xffffffffffffffff
lea rcx, [rbp + 0x3e0]
mov r8, rsi
mov edx, 0x104
mov ebx, 1
mov rdi, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov edx, 0x104
lea rcx, [rbp + 0x3e0]
call sym.ErrorReportClient.exe_SfAddSlashToPathName
mov r9, 0xffffffffffffffff
lea r8, [0x140450db0]
mov edx, 0x104
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1401b3805
mov r12, qword [rsp + 0x68]
nop word [rax + rax]
test ebx, ebx
je 0x1401b3800
lea rdx, [0x140450b08]
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1401b37ec
lea rdx, [0x140450db8]
lea rcx, [rbp - 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1401b37ec
mov r9, 0xffffffffffffffff
lea rcx, [rbp + 0x1d0]
mov r8, rsi
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov edx, 0x104
lea rcx, [rbp + 0x1d0]
call sym.ErrorReportClient.exe_SfAddSlashToPathName
mov r9, 0xffffffffffffffff
lea r8, [rbp - 0x54]
mov edx, 0x104
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
test byte [rbp - 0x80], 0x10
je 0x1401b3796
mov r8d, 1
lea rdx, [rbp + 0x1d0]
mov rcx, r12
call fcn.1401b44c0
add rdi, rax
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
jmp 0x1401b36e0
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x1d0]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401b37ec
lea rdx, [rsp + 0x54]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x50], eax
mov rcx, rbx
add rdi, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x80]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
jmp 0x1401b36e0
mov r12, qword [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, rdi
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
add r13, rax
jmp 0x1401b3889
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401b3889
lea rdx, [rsp + 0x5c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x58], eax
mov rcx, rbx
mov rax, qword [rsp + 0x58]
cqo
and edx, 0x3ff
add rax, rdx
sar rax, 0xa
add r13, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
inc r12
mov qword [rsp + 0x60], r12
cmp r12, qword [rsp + 0x70]
jl 0x1401b3640
mov r15, qword [rsp + 0x910]
mov r12, qword [rsp + 0x918]
mov rdi, qword [rsp + 0x920]
mov rsi, qword [rsp + 0x968]
mov ecx, dword [rsp + 0x40]
cmp r13, rcx
setl r14b
mov eax, r14d
mov rcx, qword [rbp + 0x800]
xor rcx, rsp
call fcn.14039bbb0
add rsp, 0x928
pop r14
pop r13
pop rbx
pop rbp
ret