Function at 0x10000cb60
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f8
mov rax, qword [0x100014100]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rbp, rcx
mov r15, r8
mov qword [rsp + 0x40], rdx
xor edi, edi
lea rcx, [rsp + 0x94]
xor edx, edx
mov r8d, 0x24c
mov qword [rsp + 0x38], r9
mov rsi, rdi
mov dword [rsp + 0x90], edi
call sub.msvcrt.dll_memset
mov ebx, edi
mov r14d, edi
mov dword [rsp + 0x30], edi
cmp rbp, rdi
je 0x10000cee0
cmp di, word [rbp]
je 0x10000cee0
mov rcx, rbp
call fcn.10000de10
cmp eax, edi
je 0x10000cc54
mov ecx, dword [rsp + 0x360]
and ecx, 1
cmp cl, dil
je 0x10000cc00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
jmp 0x10000ceed
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.10000dea0
cmp eax, edi
je 0x10000cc1d
cmp dword [rsp + 0x30], 0x80000008
je 0x10000cc54
jmp 0x10000cbee
call sub.KERNEL32.dll_GetLastError
mov rcx, rbp
mov edi, eax
call fcn.10000de10
test eax, eax
je 0x10000cc52
lea r8, [0x1000044b0]
lea rcx, [0x1000152b8]
mov r9d, edi
mov edx, 0x2000000
call fcn.10000c95c
mov ecx, edi
jmp 0x10000cee5
xor edi, edi
lea rdx, [0x1000033b0]
mov rcx, rbp
call fcn.10000c7f4
mov r12, rax
cmp rax, rdi
je 0x10000ceb5
xor edx, edx
mov rcx, rax
call fcn.10000d400
mov rsi, rax
cmp rax, rdi
je 0x10000ceb5
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x10000ce4e
xor edx, edx
lea rcx, [rsp + 0x54]
mov dword [rsp + 0x50], edi
lea r8d, [rdx + 0x3c]
call sub.msvcrt.dll_memset
jmp 0x10000ccbb
xor edi, edi
lea rax, [rsp + 0x90]
cmp rax, rdi
je 0x10000cce1
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x90]
mov rdx, rbp
call fcn.10000c9d8
mov edi, eax
jmp 0x10000ccec
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 1
jne 0x10000cd8c
test byte [rsp + 0x50], 0x10
je 0x10000cd78
cmp qword [rsp + 0x40], rbx
je 0x10000cd8c
mov rax, qword [rsp + 0x80]
or dword [rsp + 0x28], 0xffffffff
lea r8, [0x100004558]
or r9d, 0xffffffff
mov edx, edi
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000cd8c
mov rax, qword [rsp + 0x80]
or dword [rsp + 0x28], 0xffffffff
lea r8, [0x10000455c]
or r9d, 0xffffffff
mov edx, edi
mov ecx, 0x409
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
je 0x10000cd8c
mov r8, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
mov rdx, r15
call qword [rsp + 0x40]
jmp 0x10000cd8a
test r15, r15
je 0x10000cd8c
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x50]
call r15
mov edi, eax
lea rcx, [rsp + 0x50]
call fcn.10000cadc
cmp eax, 1
jne 0x10000cdb9
cmp edi, eax
jne 0x10000cddb
lea rdx, [rsp + 0x90]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x10000ccb9
cmp edi, 1
jne 0x10000cddb
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x12
jne 0x10000cdcd
mov r14d, edi
jmp 0x10000ce01
call sub.KERNEL32.dll_GetLastError
lea r8, [0x100004570]
jmp 0x10000cde7
call sub.KERNEL32.dll_GetLastError
lea r8, [0x1000045e0]
lea rcx, [0x1000152b8]
mov r9, rsi
mov edx, 0x2000000
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.10000c95c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
cmp r12, rdi
je 0x10000ce25
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rsi, rdi
je 0x10000ce3e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r14d
jmp 0x10000ceed
call sub.KERNEL32.dll_GetLastError
lea r8, [0x100004760]
lea rcx, [0x1000152b8]
mov r9, rsi
mov edx, 0x2000000
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.10000c95c
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x104
jb 0x10000ce0a
lea r8, [0x1000047e0]
lea rcx, [0x1000152b8]
mov edx, 0x3000000
call fcn.10000c95c
mov ebx, 0xce
jmp 0x10000ce0a
call sub.KERNEL32.dll_GetLastError
lea r8, [0x1000046d0]
lea rcx, [0x1000152b8]
mov r9, rbp
mov edx, 0x2000000
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.10000c95c
jmp 0x10000ce0c
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10000f390
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret