Function at 0x140001c10
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rbx, rcx
mov esi, edx
mov ecx, 0x4000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
mov rdi, rax
call fcn.140021acb
xor r15d, r15d
cmp esi, 4
jae 0x140001c63
mov r14d, r15d
jmp 0x140001cac
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r14d, eax
lea eax, [rsi - 4]
cmp eax, 4
jb 0x140001cac
mov ecx, dword [rbx + 4]
add esi, 0xfffffff8
call qword [sym.imp.WS2_32.dll_ntohl]
lea rdx, [rbx + 8]
test eax, eax
je 0x140001cac
cmp eax, 0x4000
jge 0x140001cac
cmp esi, eax
jl 0x140001cac
test rdx, rdx
je 0x140001cac
movsxd rbx, eax
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r15b
mov ecx, 0x200000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor edx, edx
mov dword [rsp + 0x74], 0x200000
mov rcx, rax
mov qword [rsp + 0x60], rax
mov r8d, 0x200000
mov rbx, rax
call fcn.140021acb
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_htonl]
mov r8d, 0x4000
mov dword [rsp + 0x70], 4
mov dword [rbx], eax
lea rdx, [0x1400290e0]
lea rax, [rbx + 4]
mov rcx, rdi
mov qword [rsp + 0x68], rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
jne 0x140001d36
mov rdx, rdi
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r9d, 2
lea r8, [0x1400290e4]
mov edx, 0x4000
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
mov r8, rdi
lea rdx, [0x1400290e8]
lea rcx, [rsp + 0x60]
call fcn.14000cf50
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001dfb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rdi
lea ecx, [rsi + 0x35]
mov edx, eax
xor r8d, r8d
call fcn.14000a500
cmp dword [0x140036d14], 1
jne 0x140001dd4
mov rax, qword [0x140036d20]
cmp word [rax + 0x1c0], 2
jne 0x140001dd4
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x140001dd4
movsxd r9, dword [rsp + 0x70]
lea r8d, [rsi + 0x17]
mov rbx, qword [rsp + 0x60]
mov rdx, r9
cmp r9, rcx
ja 0x140001dbb
lea r9d, [rsi + 2]
jmp 0x140001de5
mov rdx, rbx
mov ecx, r9d
call fcn.14000a2f0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400020f7
movsxd rdx, dword [rsp + 0x70]
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
lea r8d, [r9 + 0x16]
mov rcx, rbx
call fcn.14000a200
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400020f7
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movabs rdi, 0xf7ff7beade7941ab
movabs r14, 0xad5aef9a246042c
nop dword [rax + rax]
lea rdx, [rbp]
lea rcx, [rbp + 0x24]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor eax, eax
xorps xmm0, xmm0
test byte [rbp + 0x10], 0x10
je 0x140001f52
mov word [rbp - 0xa], ax
mov dword [rbp - 0x40], 0x18701a5a
mov dword [rbp - 0x3c], 0xa36e6d7d
mov dword [rbp - 0x38], 0x6968666f
mov dword [rbp - 0x34], 0x676b64a6
mov dword [rbp - 0x30], 0x6c70ad64
mov dword [rbp - 0x2c], 0x25d01f62
mov dword [rbp - 0x28], 0xd71a1911
mov dword [rbp - 0x24], 0x15141a20
mov dword [rbp - 0x20], 0xee1f7ada
mov word [rbp - 0x1c], 0x7d78
movups xmmword [rbp - 0x1a], xmm0
mov qword [rbp + 0x170], r15
mov rax, qword [rbp + 0x170]
nop dword [rax]
mov rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x170]
add rcx, rdi
movzx edx, byte [rbp + rax - 0x40]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x170]
add r8, rcx
add r8, rdx
add r8b, 0x53
mov byte [rbp + rax - 0x40], r8b
mov rax, qword [rbp + 0x170]
inc rax
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
cmp rax, 0x38
jb 0x140001eb0
movzx ecx, word [rsp + 0x5a]
lea r11, [rbp + 0x3c]
movzx edx, word [rsp + 0x58]
movzx eax, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x50]
movzx r9d, word [rsp + 0x56]
movzx r8d, word [rsp + 0x52]
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x20], r10d
call fcn.14000cf50
jmp 0x140002070
mov dword [rbp - 0x46], eax
mov dword [rbp - 0x80], 0x52771056
mov dword [rbp - 0x7c], 0xeaa595a
mov dword [rbp - 0x78], 0xaf50516d
mov dword [rbp - 0x74], 0x5d5e605b
mov dword [rbp - 0x70], 0x5b675ea4
mov dword [rbp - 0x6c], 0x1a16d926
mov dword [rbp - 0x68], 0x29de2320
mov dword [rbp - 0x64], 0xd32c2d11
mov dword [rbp - 0x60], 0x292a1422
mov dword [rbp - 0x5c], 0xf40b6cc8
mov word [rbp - 0x58], 0x616a
movups xmmword [rbp - 0x56], xmm0
mov qword [rbp + 0x170], r15
mov rax, qword [rbp + 0x170]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x170]
add rcx, r14
movzx edx, byte [rbp + rax - 0x80]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x170]
add r8, rcx
add r8, rdx
sub r8b, 0x34
mov byte [rbp + rax - 0x80], r8b
mov rax, qword [rbp + 0x170]
inc rax
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
cmp rax, 0x3e
jb 0x140001fc0
mov eax, dword [rbp + 0x30]
movzx ecx, word [rsp + 0x5c]
movzx edx, word [rsp + 0x5a]
mov r8d, dword [rbp + 0x2c]
movzx r10d, word [rsp + 0x58]
movzx r11d, word [rsp + 0x50]
movzx ebx, word [rsp + 0x56]
movzx r9d, word [rsp + 0x52]
shl r8, 0x20
or r8, rax
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], edx
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.14000cf50
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001e20
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x140036d14], 1
jne 0x1400020de
mov rax, qword [0x140036d20]
cmp word [rax + 0x1c0], 2
jne 0x1400020de
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x1400020de
movsxd r9, dword [rsp + 0x70]
mov r8d, reloc.WS2_32.dll_shutdown
mov rbx, qword [rsp + 0x60]
mov rdx, r9
cmp r9, rcx
ja 0x1400020d1
lea r9d, [r8 - 0x15]
jmp 0x1400020ef
mov rdx, rbx
mov ecx, r9d
call fcn.14000a2f0
jmp 0x1400020f7
movsxd rdx, dword [rsp + 0x70]
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
lea r8d, [r9 + 0x16]
mov rcx, rbx
call fcn.14000a200
movsxd r8, dword [rsp + 0x74]
xor edx, edx
mov rcx, rbx
call fcn.140021acb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret