Function at 0x1401206dc
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1e0]
sub rsp, 0x2e0
mov rax, qword [0x14017d140]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rdi, rdx
mov qword [rsp + 0x60], rdx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14012074b
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x14012074b
cmp byte [rcx + 0x19], 4
jb 0x14012074b
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, EventWrite
call fcn.14001dd24
xor esi, esi
test rbx, rbx
jne 0x14012076a
lea r8, [0x140009698]
lea rcx, [0x140012540]
mov edx, 0x630
call fcn.1400a8be8
test rdi, rdi
jne 0x140120787
lea r8, [0x1400126c8]
lea rcx, [0x140012540]
mov edx, 0x631
call fcn.1400a8be8
xor eax, eax
lea rcx, [rbp - 0x80]
xor edx, edx
mov r8d, 0x250
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rsi
mov qword [rdi], rax
call sub.msvcrt.dll_memset
xor edx, edx
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x50], rdx
inc rdi
cmp word [rbx + rdi*2], dx
jne 0x1401207bc
test rbx, rbx
jne 0x1401207e4
lea r8, [0x140009698]
lea rcx, [0x140009638]
mov edx, 0x101
call fcn.1400a8be8
xor edx, edx
movsxd rax, edi
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rdx
lea rcx, [rbx + rax*2]
test edi, edi
je 0x140120805
sub rcx, 2
dec edi
cmp word [rcx], 0x5c
je 0x1401207f5
mov ecx, edx
mov eax, edi
lea rdx, [rsp + 0x40]
cmp word [rbx + rax*2], 0x5c
setne cl
lea r8d, [rcx + rdi]
mov rcx, rbx
call fcn.1400a99e4
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0x140120838
mov rdi, qword [rsp + 0x40]
mov ecx, eax
mov qword [rsp + 0x48], rdi
jmp 0x140120842
mov rcx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test rcx, rcx
je 0x14012084d
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
js 0x140120aeb
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x14012088f
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x14012088f
cmp byte [rcx + 0x19], 4
jb 0x14012088f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, EventWrite
mov r9, rdi
call fcn.14001ec40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, reloc.ADVAPI32.dll_TraceEvent
je 0x140120aeb
lea r8, [rsp + 0x38]
lea rdx, [0x140009d7c]
mov rcx, rdi
call fcn.1400a9ab8
mov ebx, eax
test eax, eax
js 0x140120ab7
lea r8, [rsp + 0x58]
lea rdx, [0x140001800]
mov rcx, rdi
call fcn.1400a9ab8
mov ebx, eax
test eax, eax
js 0x140120ab7
mov rcx, qword [rsp + 0x38]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x14012095e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140120946
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140120946
cmp byte [rcx + 0x19], 2
jb 0x140120946
mov r9, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, EventWrite
mov dword [rsp + 0x20], edi
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
mov rdi, qword [rsp + 0x48]
jmp 0x140120abe
test rsi, rsi
je 0x140120973
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov qword [rsp + 0x30], rax
lea rsi, [rbp - 0x54]
lea rdi, [0x140009d84]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x140120a20
lea rsi, [rbp - 0x54]
lea rdi, [0x140009d88]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x140120a20
lea rdx, [0x140008d50]
lea rcx, [rbp - 0x54]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x140120a20
mov rcx, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x54]
call fcn.1400a9ab8
mov ebx, eax
test eax, eax
js 0x140120a97
test byte [rbp - 0x80], 0x10
mov rsi, qword [rsp + 0x30]
je 0x140120a03
lea rdx, [rsp + 0x68]
mov rcx, rsi
call fcn.1401206dc
mov ebx, eax
test eax, eax
js 0x140120a97
mov rdi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
add qword [rdi], rax
jmp 0x140120a25
mov eax, dword [rbp - 0x60]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x64]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x50]
add qword [rcx], rax
jmp 0x140120a25
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14012095e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x140120a97
mov rcx, qword [0x14017d3a8]
lea rax, [0x14017d3a8]
cmp rcx, rax
je 0x140120a89
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140120a89
cmp byte [rcx + 0x19], 2
jb 0x140120a89
mov r9, qword [rsp + 0x38]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, reloc.ADVAPI32.dll_EventWrite
mov dword [rsp + 0x20], edi
call fcn.14001ecbc
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140120aa7
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x48]
mov rcx, qword [0x14017d3a8]
cmp qword [rsp + 0x38], 0
je 0x140120ad8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x140120af2
mov rcx, rax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test rdi, rdi
je 0x140120b07
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x14017d3a8]
test ebx, ebx
jns 0x140120b4d
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x140120b7d
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140120b54
cmp byte [rcx + 0x19], 2
jb 0x140120b54
mov r9, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x53
mov dword [rsp + 0x20], ebx
call fcn.14001ecbc
mov rcx, qword [0x14017d3a8]
jmp 0x140120b54
lea rdi, [0x14017d3a8]
cmp rcx, rdi
je 0x140120b7d
test dword [rcx + 0x1c], reloc.ADVAPI32.dll_TraceEvent
je 0x140120b7d
cmp byte [rcx + 0x19], 4
jb 0x140120b7d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400127c8]
mov edx, 0x54
call fcn.14001dd24
mov eax, ebx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140168920
mov rbx, qword [rsp + 0x310]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret