Function at 0x140101cc0
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov r10, r8
mov rcx, rdx
xor r8d, r8d
mov rdx, r10
jmp 0x140101cc0
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2d8
mov rax, qword [0x1401b3658]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rdi, qword [rsp + 0x340]
xor eax, eax
movsxd r14, dword [rsp + 0x348]
mov rbx, rcx
mov qword [rsp + 0x68], r9
mov r13d, eax
mov qword [rsp + 0x48], r8
mov r15d, eax
mov qword [rsp + 0x50], rdx
mov ebp, eax
mov byte [rsp + 0x40], 0
test rdi, rdi
je 0x140101d23
test r14d, r14d
jle 0x140101d23
mov byte [rdi], al
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp byte [rcx + rsi], al
jne 0x140101d30
movsxd rcx, esi
add rcx, 0xa
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x60], rax
mov r12, rax
test rax, rax
jne 0x140101d84
test rdi, rdi
je 0x140101d7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdx, r14
lea r8, [0x14016f62c]
mov r9, rax
mov rcx, rdi
call fcn.1400df210
mov eax, 0xffffffff
jmp 0x140102129
mov rcx, r12
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140101d90
movzx eax, byte [r12]
mov rbx, r12
test al, al
je 0x140101dc2
nop word [rax + rax]
cmp al, 0x2f
jne 0x140101db7
mov byte [rbx], 0x5c
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x140101db0
test esi, esi
jne 0x140101dd0
mov dword [r12], 0x2a5c2e
jmp 0x140101e43
cmp esi, 2
jne 0x140101df7
cmp byte [r12 + 1], 0x3a
jne 0x140101e15
movsx ecx, byte [r12]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140101e15
mov byte [rbx], 0x5c
inc rbx
mov byte [rbx], bpl
jmp 0x140101e15
cmp esi, 1
jne 0x140101e11
cmp byte [rbx - 1], 0x2e
jne 0x140101e15
mov dword [r12], 0x2a5c2e
mov byte [rsp + 0x40], sil
jmp 0x140101e15
test esi, esi
jle 0x140101e29
cmp byte [rbx - 1], 0x5c
jne 0x140101e29
mov byte [rbx], 0x2a
inc rbx
mov byte [rsp + 0x40], 1
mov byte [rbx], bpl
cmp esi, 1
jle 0x140101e43
cmp byte [rbx - 1], 0x2e
jne 0x140101e43
cmp byte [rbx - 2], 0x5c
jne 0x140101e43
mov byte [rbx - 1], 0x2a
mov byte [rsp + 0x40], 1
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp byte [r12 + rdx], bpl
jne 0x140101e50
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
call fcn.1400dd1a0
mov esi, eax
lea ecx, [rax + 3]
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [r12 + rdx], bpl
jne 0x140101e80
lea r9d, [rsi + 1]
mov r8, rbx
mov rcx, r12
call fcn.1400dd1a0
mov esi, eax
xor eax, eax
lea r14, [rbx + rsi*2]
mov word [r14], ax
cmp byte [rsp + 0x40], al
jne 0x140101ed8
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140101ed8
test al, 0x10
je 0x140101ed8
lea eax, [rsi + 1]
mov word [r14], 0x5c
mov word [rbx + rax*2], 0x2a
xor r14d, r14d
lea eax, [rsi + 2]
mov word [rbx + rax*2], r14w
jmp 0x140101edb
xor r14d, r14d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FindFirstFileW]
mov rcx, rbx
mov qword [rsp + 0x58], rax
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp rsi, 0xffffffffffffffff
jne 0x140101fdf
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x12
je 0x140101fd2
mov r13d, esi
call qword [sym.imp.kernel32.dll_GetLastError]
mov qword [rsp + 0x48], r14
mov ebx, eax
test rdi, rdi
je 0x140101fd2
movsxd rsi, dword [rsp + 0x348]
test esi, esi
jle 0x140101fd2
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x48]
mov dword [rsp + 0x28], r14d
mov r9d, 0x400
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.kernel32.dll_FormatMessageW]
mov rcx, rdi
test eax, eax
jne 0x140101f95
mov rdx, rsi
lea r8, str.Error__lu
mov r9d, ebx
call fcn.1400df210
mov rcx, qword [rsp + 0x50]
mov qword [rcx], r14
jmp 0x140102126
mov r8, qword [rsp + 0x48]
mov r9d, eax
mov edx, esi
call fcn.1400dd0b0
movzx eax, byte [rdi]
mov rcx, rdi
test al, al
je 0x140101fc4
nop
cmp al, 0xd
je 0x140101fb9
mov byte [rdi], al
inc rdi
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x140101fb0
mov rcx, qword [rsp + 0x48]
mov byte [rdi], bpl
call qword [sym.imp.kernel32.dll_LocalFree]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], r14
jmp 0x140102126
mov r12, qword [rsp + 0x48]
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0x9c]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140102000
lea ebx, [rdi + rdi*4]
movsxd rcx, ebx
add rcx, 2
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea edx, [rbx + 1]
mov r9d, edi
mov rcx, rax
lea r8, [rsp + 0x9c]
mov rsi, rax
call fcn.1400dd0b0
movsxd rcx, eax
mov byte [rcx + rsi], 0
test byte [rsp + 0x70], 0x10
je 0x140102059
lea rcx, [rsi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140102045
movzx eax, word [0x1401733fc]
mov word [rcx], ax
test r12, r12
je 0x140102073
mov rcx, rsi
call r12
test eax, eax
jne 0x140102073
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401020ca
cmp r13d, r15d
jne 0x1401020b9
lea eax, [r15 + 0x21]
mov ecx, 8
movsxd rdx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test r15d, r15d
je 0x1401020a4
movsxd r8, r15d
mov rdx, rbp
shl r8, 3
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
test rbp, rbp
je 0x1401020b2
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, rbx
add r15d, 0x20
mov qword [r14 + rbp], rsi
inc r13d
add r14, 8
xor eax, eax
mov qword [r14 + rbp], rax
mov rsi, qword [rsp + 0x58]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x140101ff0
call qword [sym.imp.kernel32.dll_GetLastError]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_FindClose]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14010211e
movsxd rdx, r13d
mov r9, rax
mov r8d, 8
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_qsort]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rbp
mov eax, r13d
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14012cd90
add rsp, 0x2d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret