Function at 0x1000c5d2c
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6f8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov r14, qword [rsp + 0x760]
mov rsi, qword [rsp + 0x768]
or rbx, 0xffffffffffffffff
mov r13, rbx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x44], r9d
mov r15b, r8b
mov byte [rsp + 0x40], dl
mov r12, rcx
mov rax, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rax, rdi
je 0x1000c5def
test byte [rax + 0x1c], 4
je 0x1000c5db6
cmp byte [rax + 0x19], 4
jb 0x1000c5db6
mov rcx, qword [rax + 0x10]
lea edx, [rbx + 0x6b]
lea r8, [0x100003198]
call fcn.10001c7b8
mov rax, qword [0x1001653b8]
cmp rax, rdi
je 0x1000c5def
test byte [rax + 0x1c], 4
je 0x1000c5def
cmp byte [rax + 0x19], 4
jb 0x1000c5def
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlNumberOfSetBits]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003198]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x6b
call fcn.10001c7dc
xor eax, eax
mov rcx, rbx
mov rdi, r14
repne scasw ax, word [rdi]
mov edx, 0x104
not rcx
dec rcx
lea ebp, [rcx + 0x42]
lea eax, [rbp + 1]
cmp eax, edx
ja 0x1000c60a9
lea ebx, [rcx + 0x1b]
lea eax, [rbx + 1]
cmp eax, edx
ja 0x1000c60a9
mov eax, ecx
lea rcx, [rsp + 0x4d0]
mov rdx, r14
lea rdi, [rax + rax]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + rdi + 0x4d0]
lea rdx, [0x10000d2d0]
mov r8d, 0x84
call sub.msvcrt.dll_memcpy
mov ecx, ebp
xor ebp, ebp
mov word [rsp + rcx*2 + 0x4d0], bp
lea rcx, [rsp + 0x2c0]
mov r8, rdi
mov rdx, r14
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + rdi + 0x2c0]
lea r8d, [rbp + 0x36]
lea rdx, [0x10000d358]
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x4d0]
mov word [rsp + rbx*2 + 0x2c0], bp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1000c5eb6
xor eax, eax
jmp 0x1000c60b4
mov bpl, byte [rsp + 0x40]
mov r14d, dword [rsp + 0x44]
test r15b, r15b
jne 0x1000c5fb5
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x9c]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x4a
jbe 0x1000c5f79
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x9c]
mov r8, rsi
call fcn.1000c5764
test eax, eax
je 0x1000c5f4b
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000c5ffb
test byte [rcx + 0x1c], 4
je 0x1000c5ffb
cmp byte [rcx + 0x19], 4
jb 0x1000c5ffb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x6c
mov r9d, eax
call fcn.10001c7dc
jmp 0x1000c5ffb
movaps xmm0, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov r8, rsi
movdqa xmmword [rsp + 0x50], xmm0
call fcn.1000c593c
mov edi, eax
test eax, eax
jne 0x1000c609c
mov r13, qword [rsp + 0x48]
jmp 0x1000c5fb5
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000c5fb5
test byte [rcx + 0x1c], 4
je 0x1000c5fb5
cmp byte [rcx + 0x19], 4
jb 0x1000c5fb5
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x9c]
lea r8, [0x100003198]
mov edx, 0x6d
call fcn.10001da24
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2c0]
mov r9d, r14d
mov r8b, r15b
mov dl, bpl
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.1000c54e8
mov edi, eax
test eax, eax
jne 0x1000c609c
lea rdi, [0x1001653b8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000c5ec0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000c5eaf
test byte [rcx + 0x1c], 4
je 0x1000c6065
cmp byte [rcx + 0x19], 4
jb 0x1000c6065
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlNumberOfSetBits]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003198]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x6e
call fcn.10001c7dc
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000c5eaf
test byte [rcx + 0x1c], 4
je 0x1000c5eaf
cmp byte [rcx + 0x19], 4
jb 0x1000c5eaf
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003198]
mov edx, 0x6f
call fcn.10001c7b8
jmp 0x1000c5eaf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
jmp 0x1000c60b4
mov dword [rsi], 0x57
mov eax, 2
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.10014e480
add rsp, 0x6f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret