Function at 0x14001fb90
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3f0
mov rax, qword [0x140025100]
xor rax, rsp
mov qword [rsp + 0x3e8], rax
mov dword [rsp + 0x2a0], 0
mov dword [rsp + 0x184], 0
mov eax, dword [rsp + 0x410]
and eax, 4
test eax, eax
je 0x14001fbfd
mov eax, dword [rsp + 0x410]
and eax, 2
test eax, eax
jne 0x14001fbfd
mov dword [rsp + 0x3e4], 1
jmp 0x14001fc08
mov dword [rsp + 0x3e4], 0
mov eax, dword [rsp + 0x3e4]
mov dword [rsp + 0x3d4], eax
mov qword [rsp + 0x188], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x3c8], 0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [rsp + 0x180], eax
cmp dword [rsp + 0x3d4], 0
je 0x14001fc5e
mov dword [rsp + 0x2a0], 1
mov ecx, 0x110
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x3c8], rax
cmp qword [rsp + 0x3c8], 0
jne 0x14001fc8c
mov dword [rsp + 0x184], 8
jmp 0x1400203b5
mov rax, qword [rsp + 0x3c8]
mov qword [rax], 0
mov rax, qword [rsp + 0x3c8]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x188], rax
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x400]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
cmp rax, 1
jae 0x14001fd25
mov rax, qword [rsp + 0x188]
add rax, 8
lea r8, [0x140002ec8]
mov edx, 0x105
mov rcx, rax
call fcn.1400053e0
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
je 0x14001fd20
mov eax, dword [rsp + 0x3dc]
and eax, 0xffff
mov dword [rsp + 0x184], eax
jmp 0x1400203b5
jmp 0x14001fde6
mov rax, qword [rsp + 0x188]
add rax, 8
mov r8, qword [rsp + 0x400]
mov edx, 0x105
mov rcx, rax
call fcn.1400053e0
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
je 0x14001fd6f
mov eax, dword [rsp + 0x3dc]
and eax, 0xffff
mov dword [rsp + 0x184], eax
jmp 0x1400203b5
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, qword [rsp + 0x400]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rax, rcx
mov rcx, qword [rsp + 0x400]
movsx eax, byte [rcx + rax - 1]
cmp eax, 0x5c
je 0x14001fde6
mov rax, qword [rsp + 0x188]
add rax, 8
lea r8, [0x140002a30]
mov edx, 0x105
mov rcx, rax
call fcn.14001f5e0
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
je 0x14001fde6
mov eax, dword [rsp + 0x3dc]
and eax, 0xffff
mov dword [rsp + 0x184], eax
jmp 0x1400203b5
cmp qword [rsp + 0x188], 0
je 0x1400203b5
mov rax, qword [rsp + 0x188]
add rax, 8
mov rcx, qword [rsp + 0x408]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x140002c8c]
mov edx, 0x105
lea rcx, [rsp + 0x190]
call fcn.14001f670
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
je 0x14001fe53
mov eax, dword [rsp + 0x3dc]
and eax, 0xffff
mov dword [rsp + 0x184], eax
jmp 0x1400203b5
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x2a0]
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExA]
mov qword [rsp + 0x3c0], rax
cmp qword [rsp + 0x3c0], 0xffffffffffffffff
je 0x1400200a9
mov dword [rsp + 0x3d8], 0
cmp dword [rsp + 0x3d4], 0
je 0x14001febc
mov eax, dword [rsp + 0x40]
and eax, 0x10
test eax, eax
je 0x14001fffe
lea rax, [rsp + 0x6c]
lea rcx, [0x140005264]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14001fede
inc rax
test dl, dl
jne 0x14001fecb
xor eax, eax
jmp 0x14001fee3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x14001ff12
lea rax, [rsp + 0x6c]
lea rcx, [0x140005268]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14001ff09
inc rax
test dl, dl
jne 0x14001fef6
xor eax, eax
jmp 0x14001ff0e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x14001ff17
jmp 0x14001fffe
mov eax, dword [rsp + 0x410]
and eax, 4
test eax, eax
jne 0x14001ff35
mov eax, dword [rsp + 0x40]
and eax, 0x10
test eax, eax
je 0x14001ff35
jmp 0x14001fffe
mov rax, qword [rsp + 0x188]
add rax, 8
lea rcx, [rsp + 0x6c]
mov qword [rsp + 0x20], rcx
mov r9, rax
lea r8, [0x140002c8c]
mov edx, 0x105
lea rcx, [rsp + 0x2b0]
call fcn.14001f670
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
je 0x14001ffd3
cmp dword [rsp + 0x3dc], 0x8007007a
jne 0x14001ffbb
cmp qword [rsp + 0x418], 0
je 0x14001ffb7
mov rax, qword [rsp + 0x188]
add rax, 8
lea r9, [rsp + 0x6c]
mov r8, rax
lea rdx, [0x140005270]
mov ecx, 3
call qword [rsp + 0x418]
jmp 0x14001fffe
mov eax, dword [rsp + 0x3dc]
and eax, 0xffff
mov dword [rsp + 0x184], eax
jmp 0x1400203b5
mov rdx, qword [rsp + 0x428]
lea rcx, [rsp + 0x2b0]
call qword [rsp + 0x420]
test eax, eax
jne 0x14001fffe
mov dword [rsp + 0x184], 0x4c7
jmp 0x1400203b5
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001fea3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3d0], eax
cmp dword [rsp + 0x3d0], 2
jne 0x14002009b
cmp dword [rsp + 0x3d8], 0xa
jae 0x14002009b
cmp qword [rsp + 0x418], 0
je 0x140020062
cmp dword [rsp + 0x3d8], 0
jne 0x140020062
lea rdx, [0x1400052a0]
mov ecx, 1
call qword [rsp + 0x418]
mov eax, dword [rsp + 0x3d8]
inc eax
mov dword [rsp + 0x3d8], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140020099
jmp 0x14001fe98
jmp 0x140020030
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [rsp + 0x410]
and eax, 1
test eax, eax
je 0x14002037f
mov rax, qword [rsp + 0x188]
add rax, 8
mov r9, rax
lea r8, [0x1400052d0]
mov edx, 0x105
lea rcx, [rsp + 0x190]
call fcn.14001f670
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
je 0x14002010c
mov eax, dword [rsp + 0x3dc]
and eax, 0xffff
mov dword [rsp + 0x184], eax
jmp 0x1400203b5
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 1
lea r8, [rsp + 0x40]
xor edx, edx
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExA]
mov qword [rsp + 0x3c0], rax
cmp qword [rsp + 0x3c0], 0xffffffffffffffff
je 0x14002037f
mov dword [rsp + 0x3d8], 0
mov eax, dword [rsp + 0x40]
and eax, 0x10
test eax, eax
je 0x1400202d4
lea rax, [rsp + 0x6c]
lea rcx, [0x140005264]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x14002018b
inc rax
test dl, dl
jne 0x140020178
xor eax, eax
jmp 0x140020190
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1400202d4
lea rax, [rsp + 0x6c]
lea rcx, [0x140005268]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x1400201ba
inc rax
test dl, dl
jne 0x1400201a7
xor eax, eax
jmp 0x1400201bf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1400202d4
mov ecx, 0x110
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rsp + 0x3c8], rax
cmp qword [rsp + 0x3c8], 0
je 0x1400202a2
mov rax, qword [rsp + 0x188]
add rax, 8
mov rcx, qword [rsp + 0x3c8]
add rcx, 8
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [0x1400052d4]
mov edx, 0x105
call fcn.14001f670
mov dword [rsp + 0x3dc], eax
cmp dword [rsp + 0x3dc], 0
jne 0x14002025e
mov rax, qword [rsp + 0x3c8]
mov qword [rax], 0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x3c8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
jmp 0x1400202a0
cmp qword [rsp + 0x418], 0
je 0x140020290
mov rax, qword [rsp + 0x188]
add rax, 8
lea r9, [rsp + 0x6c]
mov r8, rax
lea rdx, [0x1400052e0]
mov ecx, 3
call qword [rsp + 0x418]
mov rcx, qword [rsp + 0x3c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1400202d4
jmp 0x1400202d4
cmp qword [rsp + 0x418], 0
je 0x1400202d4
mov rax, qword [rsp + 0x188]
add rax, 8
lea r9, [rsp + 0x6c]
mov r8, rax
lea rdx, [0x140005320]
mov ecx, 3
call qword [rsp + 0x418]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14002015a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3d0], eax
cmp dword [rsp + 0x3d0], 2
jne 0x140020371
cmp dword [rsp + 0x3d8], 0xa
jae 0x140020371
cmp qword [rsp + 0x418], 0
je 0x140020338
cmp dword [rsp + 0x3d8], 0
jne 0x140020338
lea rdx, [0x1400052a0]
mov ecx, 1
call qword [rsp + 0x418]
mov eax, dword [rsp + 0x3d8]
inc eax
mov dword [rsp + 0x3d8], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14002036f
jmp 0x14002014f
jmp 0x140020306
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x3c8], rax
mov rax, qword [rsp + 0x188]
mov rax, qword [rax]
mov qword [rsp + 0x188], rax
mov rcx, qword [rsp + 0x3c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x14001fde6
cmp qword [rsp + 0x188], 0
je 0x1400203f3
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x3c8], rax
mov rax, qword [rsp + 0x188]
mov rax, qword [rax]
mov qword [rsp + 0x188], rax
mov rcx, qword [rsp + 0x3c8]
call qword [sym.imp.msvcrt.dll_free]
jmp 0x1400203b5
mov ecx, dword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ecx, dword [rsp + 0x184]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x184]
mov rcx, qword [rsp + 0x3e8]
xor rcx, rsp
call fcn.140021740
add rsp, 0x3f0
pop rdi
ret