Function at 0x140001d10
Capabilities:
Enumerate files on windows
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor ebx, ebx
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x50], rbx
xor edx, edx
lea rcx, [0x1400042f0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor edx, edx
mov word [rbp + 0x1c0], bx
mov r8d, 0x208
lea rcx, [rbp + 0x1c2]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x82
lea rax, [rbp + 0x1c0]
mov ecx, edx
nop dword [rax]
cmp word [rax], bx
je 0x140001d9f
add rax, 2
sub rcx, 1
jne 0x140001d90
mov r9d, 0x7ffffffe
test rcx, rcx
je 0x140001e04
mov rax, rdx
mov r8, rdx
sub rax, rcx
test rcx, rcx
lea rcx, [rbp + 0x1c0]
cmove rax, rbx
lea rcx, [rcx + rax*2]
sub r8, rax
je 0x140001df6
mov r11, qword [rsp + 0x50]
mov eax, r9d
sub r11, rcx
test rax, rax
je 0x140001df6
movzx r10d, word [r11 + rcx]
test r10w, r10w
je 0x140001df6
mov word [rcx], r10w
dec rax
add rcx, 2
sub r8, 1
jne 0x140001dd5
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
mov rcx, rdx
lea rax, [rbp + 0x1c0]
nop
cmp word [rax], bx
je 0x140001e1f
add rax, 2
sub rcx, 1
jne 0x140001e10
test rcx, rcx
je 0x140001e7d
mov rax, rdx
sub rax, rcx
test rcx, rcx
lea rcx, [rbp + 0x1c0]
cmove rax, rbx
lea rcx, [rcx + rax*2]
sub rdx, rax
je 0x140001e6f
lea r8, [0x1400043d0]
sub r8, rcx
nop dword [rax + rax]
test r9, r9
je 0x140001e6f
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140001e6f
mov word [rcx], ax
dec r9
add rcx, 2
sub rdx, 1
jne 0x140001e50
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001fbc
nop dword [rax]
lea rdx, [rsp + 0x70]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140001ea0
cmp ebx, 2
lea eax, [rbx - 2]
cmovl eax, ebx
cmp eax, 0x14
jl 0x140001fbc
movzx eax, byte [0x1400043e0]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [rsp + 0x40], 9
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], 0xf
movsd xmm0, qword [str.ntdll.dll]
movsd qword [rsp + 0x30], xmm0
mov byte [rsp + 0x38], al
mov byte [rsp + 0x39], 0
call fcn.140001350
mov edx, 0x59a4ea4a
mov rcx, rax
mov rbx, rax
call fcn.140001aa0
mov edx, 0x7507132
mov rcx, rbx
mov r14, rax
call fcn.140001aa0
mov edx, 0x24da3863
mov rcx, rbx
mov rsi, rax
call fcn.140001aa0
mov rdi, rax
nop dword [rax + rax]
call fcn.140001b70
call rdi
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], 0xffffffffff676980
xor ecx, ecx
mov ebx, eax
call rsi
call rdi
sub eax, ebx
cmp eax, 0x3e8
jae 0x140001f71
mov dword [0], 0x2794
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x58]
mov rcx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1b]
call r14
test eax, eax
js 0x140001f40
cmp dword [rsp + 0x58], 0
jne 0x140001f40
xor r9d, r9d
lea r8, [0x140004408]
lea rdx, str.Found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140001f40
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3