Function at 0x14001b6c0
Capabilities:
Enumerate files on windows
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3f8]
sub rsp, 0x4d0
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
xor r12d, r12d
mov r13, rcx
mov esi, r12d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, 0x5000
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14001b920
lea rcx, [rbp + 0x1b0]
call fcn.14000ae40
mov edx, 0xf10b425b
mov ecx, 0xcf2f812b
mov r8d, 0xa7e81463
mov r14, rax
call fcn.140001678
mov rdx, r14
mov rcx, rax
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001b750
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14001b8be
lea rax, [rsp + 0x6c]
sub r14, rax
lea rcx, [rsp + 0x6c]
movzx eax, word [rcx]
mov word [r14 + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14001b78c
xor r9d, r9d
mov qword [rsp + 0x30], r12
lea rcx, [rbp + 0x1b0]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001b8a8
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
dec eax
cmp eax, 0xfffffffd
ja 0x14001b89f
cmp ecx, 0x5000
jbe 0x14001b80f
mov r9d, 2
xor r8d, r8d
mov edx, 0xffffb000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea r9, [rbp + 0x190]
mov r8d, 0x5000
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001b89f
mov r9d, dword [rbp + 0x190]
test r9d, r9d
je 0x14001b89f
mov rcx, qword [r13 + 0xe0]
xor eax, eax
lea rdx, [rbp + 0x198]
mov dword [rbp + 0x1a1], eax
mov word [rbp + 0x1a5], ax
mov byte [rbp + 0x1a7], al
mov al, byte [rsp + 0x6c]
mov r8, rbx
mov qword [rsp + 0x28], r12
mov word [rbp + 0x198], 0x6f6c
mov byte [rbp + reloc.COMCTL32.dll_SetWindowSubclass], 0x67
mov dword [rbp + reloc.COMCTL32.dll_RemoveWindowSubclass], 0x7478742e
mov byte [rbp + 0x19b], al
mov byte [rbp + 0x1a0], r12b
mov dword [rsp + 0x20], r12d
call fcn.14002038c
inc esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001b787
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call fcn.14001b24c
test eax, eax
je 0x14001b90c
mov rcx, qword [r13 + 0xe0]
lea rdx, [rbp + 0x190]
mov r9d, eax
mov r8, rbx
mov qword [rsp + 0x28], r12
mov dword [rbp + 0x190], 0x2e676572
mov dword [rbp + 0x194], 0x696e69
mov dword [rsp + 0x20], r12d
call fcn.14002038c
inc esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret