Function at 0x100123a50
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
mov r15, rcx
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100123ab5
test byte [rcx + 0x1c], 1
je 0x100123ab5
cmp byte [rcx + 0x19], 4
jb 0x100123ab5
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f00]
mov edx, 0x46
call fcn.10001c854
and qword [rsp + 0x30], 0
xor ebp, ebp
or r14, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
test rsi, rsi
jne 0x100123ae3
lea r8, [0x100013a30]
lea rcx, [0x100013830]
mov edx, 0x93a
call fcn.10009a050
cmp qword [rsi + 8], rbp
je 0x100123b01
lea r8, [0x100013a48]
lea rcx, [0x100013830]
mov edx, 0x93b
call fcn.10009a050
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r15
call fcn.100123848
mov ebx, eax
test eax, eax
js 0x100123d4f
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x250
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x100123b96
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123b83
bt dword [rcx + 0x1c], 9
jae 0x100123b83
cmp byte [rcx + 0x19], 3
jb 0x100123b83
mov r9, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x48]
lea r8, [0x100002f00]
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
cmp edi, 5
jne 0x100123d4f
mov ebx, 0x80070005
jmp 0x100123d4f
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123bc8
test byte [rcx + 0x1c], 1
je 0x100123bc8
cmp byte [rcx + 0x19], 4
jb 0x100123bc8
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x6c]
lea r8, [0x100002f00]
mov edx, 0x48
call fcn.10001db08
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x6c]
repne scasw ax, word [rdi]
lea rdi, [0x10000a05c]
not rcx
lea r12, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp r12, rcx
jb 0x100123c0f
lea rdx, [0x10000a05c]
lea rcx, [rsp + 0x6c]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x100123c97
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x10000a060]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp r12, rcx
jb 0x100123c3f
lea rdx, [0x10000a060]
lea rcx, [rsp + 0x6c]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x100123c97
test byte [rsp + 0x40], 0x10
je 0x100123c97
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x6c]
xor r8d, r8d
call fcn.10009bac4
mov ebx, eax
test eax, eax
js 0x100123cd2
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jb 0x100123c78
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.10006a9e0
test al, al
je 0x100123cc7
mov rax, qword [rsi]
lea rcx, [rax + rdi*8]
test rcx, rcx
je 0x100123c8c
mov rax, qword [rsp + 0x38]
mov qword [rcx], rax
inc qword [rsi + 8]
xor ebp, ebp
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x250
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100123ce0
lea r12, [0x1001653b8]
jmp 0x100123b96
mov ecx, 0x8007000e
call fcn.1000196c8
int3
mov rbp, qword [rsp + 0x38]
lea r12, [0x1001653b8]
jmp 0x100123d38
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x100123d48
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100123d2a
test byte [rcx + 0x1c], 1
je 0x100123d2a
cmp byte [rcx + 0x19], 2
jb 0x100123d2a
mov r9, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f00]
mov edx, 0x49
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
test rbp, rbp
je 0x100123d4f
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100123d4f
lea r12, [0x1001653b8]
cmp qword [rsp + 0x30], 0
je 0x100123d62
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jns 0x100123da3
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123dd0
test byte [rcx + 0x1c], 1
je 0x100123daa
cmp byte [rcx + 0x19], 3
jb 0x100123daa
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f00]
mov edx, 0x4a
mov r9, r15
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123dd0
test byte [rcx + 0x1c], 1
je 0x100123dd0
cmp byte [rcx + 0x19], 4
jb 0x100123dd0
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f00]
mov edx, 0x4b
call fcn.10001c854
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10014e600
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret