Function at 0x14001be90
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get common file path
Get file attributes
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r15
lea rbp, [rsp - 0x818]
sub rsp, 0x918
mov esi, r9d
mov rdi, r8
mov r15, rcx
cmp r9d, 2
jg 0x14001c6d8
test r8, r8
jne 0x14001bf07
lea rax, [rbp + 0x600]
xor r9d, r9d
lea edx, [r8 + 0x1a]
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14001c6d8
lea r9, [rdi - 1]
mov edx, 0x104
lea r8, [0x1401bad40]
lea rcx, [rbp + 0x600]
call fcn.14003e54c
lea rdi, [rbp + 0x600]
mov qword [rsp + 0x940], rbx
lea rcx, [rbp + 0x1a0]
mov qword [rsp + 0x950], r12
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x910], r14
mov r8, rdi
mov edx, 0x104
xor r14b, r14b
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, str.origin.txt
mov edx, 0x104
lea rcx, [rbp + 0x1a0]
call fcn.14003e54c
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001c5a5
xor r12d, r12d
mov dword [rbp - 0x6c], 0x104
lea rax, [rbp - 0x68]
mov dword [rbp - 0x70], r12d
mov qword [rbp - 0x78], rax
lea rdx, [0x1401ae572]
lea rax, [0x1401b7690]
mov word [rbp - 0x68], r12w
mov ecx, 0x10000
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], 0x10000
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov byte [rsp + 0x74], r12b
mov qword [rsp + 0x60], r12
call fcn.14002ec60
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14001c534
mov qword [rsp + 0x30], r12
lea r8d, [r12 + 3]
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x1a0]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
mov qword [rsp + 0x40], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14001c52f
lea rdx, [rbp + 0x848]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x60]
lea r8d, [r12 + 2]
mov dword [rsp + 0x48], eax
lea rdx, [rbp + 0x858]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x60]
test eax, eax
je 0x14001c081
cmp r8d, 2
jne 0x14001c081
cmp byte [rbp + 0x858], 0xff
jne 0x14001c081
cmp byte [rbp + 0x859], 0xfe
jne 0x14001c081
mov byte [rsp + 0x74], 1
jmp 0x14001c0a8
mov rcx, qword [rsp + 0x40]
mov edx, r12d
mov dword [rsp + 0x5c], edx
mov dword [rsp + 0x64], r12d
test rcx, rcx
je 0x14001c0ac
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
mov rdi, qword [rbp - 0x78]
mov esi, dword [rbp - 0x6c]
mov dword [rbp - 0x70], r12d
test rdi, rdi
je 0x14001c0c9
mov word [rdi], r12w
mov r8d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
cmp byte [rsp + 0x74], r12b
je 0x14001c283
cmp qword [rsp + 0x40], r12
je 0x14001c1a9
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x14001c1a9
mov rbx, qword [rbp - 0x78]
lea rax, [rsi - 1]
lea rdi, [rbx + rax*2]
mov eax, edx
lea r9, [r9 + rax*2]
nop
cmp dword [rsp + 0x64], r12d
je 0x14001c114
mov ecx, edx
add rcx, rcx
mov eax, r8d
cmp rcx, rax
jne 0x14001c154
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x5c], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001c1a9
mov r8d, dword [rsp + 0x60]
cmp r8d, 1
jb 0x14001c22b
mov r9, qword [rsp + 0x50]
mov edx, dword [rsp + 0x5c]
mov ecx, edx
add rcx, rcx
mov eax, r8d
cmp rcx, rax
jae 0x14001c198
cmp rbx, rdi
jae 0x14001c200
movzx eax, word [r9]
cmp ax, 0xa
je 0x14001c1e4
mov word [rbx], ax
add r9, 2
mov edx, dword [rsp + 0x5c]
add rbx, 2
mov r8d, dword [rsp + 0x60]
inc edx
mov ecx, edx
add rcx, rcx
mov dword [rsp + 0x5c], edx
cmp rcx, r8
jb 0x14001c161
mov ecx, edx
add rcx, rcx
mov eax, r8d
cmp rcx, rax
jbe 0x14001c100
mov eax, r12d
test eax, eax
je 0x14001c1c0
mov r8, qword [rbp - 0x78]
mov rcx, r15
call fcn.14001bbd0
movzx r14d, al
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001c1d5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x5c], r12
mov dword [rsp + 0x64], r12d
jmp 0x14001c534
cmp rbx, qword [rbp - 0x78]
jbe 0x14001c1f7
cmp word [rbx - 2], 0xd
lea rax, [rbx - 2]
cmove rbx, rax
mov word [rbx], r12w
jmp 0x14001c3eb
mov word [rbx], r12w
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c221
mov edx, dword [rbp - 0x6c]
mov rcx, rdi
call fcn.14003c814
mov dword [rbp - 0x70], eax
mov eax, dword [rsp + 0x64]
jmp 0x14001c1ac
mov dword [rbp - 0x70], r12d
mov eax, dword [rsp + 0x64]
jmp 0x14001c1ac
mov word [rbx], r12w
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c26e
mov edx, dword [rbp - 0x6c]
mov rcx, rdi
call fcn.14003c814
mov dword [rbp - 0x70], eax
cmp eax, 1
jb 0x14001c272
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c272
cmp word [rdi], r12w
je 0x14001c272
inc dword [rsp + 0x64]
mov eax, r12d
cmp rbx, rdi
cmovne eax, dword [rsp + 0x64]
jmp 0x14001c1ac
mov dword [rbp - 0x70], r12d
cmp rbx, qword [rbp - 0x78]
mov eax, r12d
cmovne eax, dword [rsp + 0x64]
jmp 0x14001c1ac
mov eax, dword [rsp + 0x70]
cmp eax, esi
jae 0x14001c2c0
mov rcx, qword [rsp + 0x68]
add eax, esi
mov dword [rsp + 0x70], eax
test rcx, rcx
je 0x14001c2a4
call fcn.14002ec58
mov eax, dword [rsp + 0x70]
mov ecx, eax
lea rdx, [0x1401ae572]
call fcn.14002ec60
mov r8d, dword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14001c1c0
cmp qword [rsp + 0x40], r12
je 0x14001c1a9
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x14001c1a9
lea edi, [rsi - 1]
mov ecx, edx
add rdi, rbx
add rcx, r9
cmp dword [rsp + 0x64], r12d
je 0x14001c2fe
cmp edx, r8d
jne 0x14001c345
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x5c], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001c1a9
mov r8d, dword [rsp + 0x60]
cmp r8d, 1
jb 0x14001c497
mov edx, dword [rsp + 0x5c]
cmp edx, r8d
mov rcx, qword [rsp + 0x50]
jae 0x14001c373
cmp rbx, rdi
jae 0x14001c42c
movzx eax, byte [rcx]
cmp al, 0xa
je 0x14001c381
mov byte [rbx], al
inc rcx
mov edx, dword [rsp + 0x5c]
inc rbx
mov r8d, dword [rsp + 0x60]
inc edx
mov dword [rsp + 0x5c], edx
cmp edx, r8d
jb 0x14001c347
cmp edx, r8d
jbe 0x14001c2f2
jmp 0x14001c1a9
cmp rbx, qword [rsp + 0x68]
jbe 0x14001c394
cmp byte [rbx - 1], 0xd
lea rax, [rbx - 1]
cmove rbx, rax
mov byte [rbx], r12b
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c419
cmp qword [rsp + 0x68], r12
je 0x14001c3e7
mov ebx, dword [rbp - 0x6c]
test ebx, ebx
je 0x14001c3eb
mov r8, qword [rsp + 0x68]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x14001c3eb
jne 0x14001c3e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001c3e7
lea eax, [rbx - 1]
mov word [rdi + rax*2], r12w
jmp 0x14001c3eb
mov word [rdi], r12w
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c415
mov edx, dword [rbp - 0x6c]
mov rcx, rdi
call fcn.14003c814
inc dword [rsp + 0x5c]
mov dword [rbp - 0x70], eax
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
jmp 0x14001c1ac
mov dword [rbp - 0x70], r12d
mov eax, dword [rsp + 0x64]
inc dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x64], eax
jmp 0x14001c1ac
mov byte [rbx], r12b
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c225
cmp qword [rsp + 0x68], r12
je 0x14001c48e
mov ebx, dword [rbp - 0x6c]
test ebx, ebx
je 0x14001c204
mov r8, qword [rsp + 0x68]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x14001c204
jne 0x14001c48e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001c48e
lea eax, [rbx - 1]
mov word [rdi + rax*2], r12w
jmp 0x14001c204
mov word [rdi], r12w
jmp 0x14001c204
mov byte [rbx], r12b
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c50b
cmp qword [rsp + 0x68], r12
je 0x14001c4ea
mov esi, dword [rbp - 0x6c]
test esi, esi
je 0x14001c4ee
mov r8, qword [rsp + 0x68]
mov r9d, 0xffffffff
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jg 0x14001c4ee
jne 0x14001c4ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001c4ea
lea eax, [rsi - 1]
mov word [rdi + rax*2], r12w
jmp 0x14001c4ee
mov word [rdi], r12w
mov rdi, qword [rbp - 0x78]
test rdi, rdi
je 0x14001c507
mov edx, dword [rbp - 0x6c]
mov rcx, rdi
call fcn.14003c814
mov dword [rbp - 0x70], eax
jmp 0x14001c50b
mov dword [rbp - 0x70], r12d
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
cmp byte [rax], r12b
je 0x14001c51f
inc ecx
mov dword [rsp + 0x64], ecx
cmp rbx, qword [rsp + 0x68]
mov eax, r12d
cmovne eax, ecx
jmp 0x14001c1ac
mov qword [rsp + 0x40], r12
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001c549
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], r12
mov r9, qword [rsp + 0x50]
mov qword [rsp + 0x5c], r12
mov dword [rsp + 0x64], r12d
test r9, r9
je 0x14001c56a
mov rcx, r9
call fcn.14002ec58
mov qword [rsp + 0x50], r12
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14001c57c
mov rcx, rbx
call fcn.14002ec58
mov r12, qword [rsp + 0x950]
movzx eax, r14b
mov r14, qword [rsp + 0x910]
mov rbx, qword [rsp + 0x940]
add rsp, 0x918
pop r15
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
lea rcx, [rbp + 0x3b0]
mov r8d, 0x250
call fcn.14014e180
mov r9, 0xffffffffffffffff
lea rcx, [rbp + 0x1a0]
mov r8, rdi
mov edx, 0x104
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, [0x1401c6710]
mov edx, 0x104
lea rcx, [rbp + 0x1a0]
call fcn.14003e54c
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14001c57c
mov r12d, 1
nop word [rax + rax]
cmp word [rbp + 0x3dc], 0x2e
je 0x14001c6b2
test byte [rbp + 0x3b0], 0x10
je 0x14001c6b2
mov r9, 0xffffffffffffffff
lea rcx, [rbp + 0x1a0]
mov r8, rdi
mov edx, 0x104
call fcn.14003c5c8
mov r9, 0xffffffffffffffff
lea r8, [0x1401b7674]
mov edx, 0x104
lea rcx, [rbp + 0x1a0]
call fcn.14003e54c
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x3dc]
mov edx, 0x104
lea rcx, [rbp + 0x1a0]
call fcn.14003e54c
lea r9d, [rsi + 1]
mov edx, 0x80
lea r8, [rbp + 0x1a0]
mov rcx, r15
call fcn.14001be90
test al, al
movzx r14d, r14b
cmovne r14d, r12d
lea rdx, [rbp + 0x3b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001c620
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x14001c57c
xor al, al
add rsp, 0x918
pop r15
pop rdi
pop rsi
pop rbp
ret