Function at 0x1000cd0f4
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8e0
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x8d0], rax
or dword [r9], 0xffffffff
mov rdi, qword [rsp + 0x948]
xor ebx, ebx
mov dword [rsp + 0x38], edx
mov rdx, qword [rsp + 0x940]
mov r12, r8
mov r8, qword [rsp + 0x950]
mov dword [rdx], ebx
mov qword [rsp + 0x48], rdx
mov dword [rdi], ebx
lea edx, [rbx + 0x5c]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r8
or r15, 0xffffffffffffffff
mov r14d, ebx
mov r13d, ebx
mov dword [rsp + 0x20], ebx
mov rbp, rbx
mov qword [rsp + 0x30], rbx
mov rsi, rbx
mov qword [rsp + 0x28], rbx
mov dword [r8], ebx
mov word [rsp + 0x4c0], bx
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x1000cd200
lea rcx, [rax + 2]
lea rdx, [rsp + 0x30]
call fcn.1000b0d88
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x1000cd1c3
xor r9d, r9d
mov r8d, ebx
mov edx, 0x5000197
xor ecx, ecx
call fcn.1000b51b8
mov rbp, qword [rsp + 0x30]
jmp 0x1000cd5d7
mov rbp, qword [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.1000b0bd4
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x1000cd1f9
xor r9d, r9d
mov r8d, ebx
mov edx, 0x5030197
xor ecx, ecx
call fcn.1000b51b8
mov rsi, qword [rsp + 0x28]
jmp 0x1000cd5d7
mov rsi, qword [rsp + 0x28]
xor ebx, ebx
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasw ax, word [rdi]
mov r9d, 0x208
not rcx
add rcx, 3
cmp rcx, r9
jb 0x1000cd234
mov edx, 0x5090197
mov r8d, 0x8007006f
mov rcx, r12
mov ebx, r8d
jmp 0x1000cd5cf
lea rax, [rsp + 0x4c0]
mov rdi, r12
mov rdx, r9
sub rdi, rax
lea rcx, [rsp + 0x4c0]
lea rax, [rdx + 0x7ffffdf6]
cmp rax, rbx
je 0x1000cd26f
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x1000cd26f
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000cd24d
cmp rdx, rbx
jne 0x1000cd278
sub rcx, 2
mov word [rcx], bx
lea r8, [0x10002ac28]
lea rcx, [rsp + 0x4c0]
mov rdx, r9
call fcn.100038a50
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1000cd2bf
mov ebx, 0x80070002
mov edx, 0x5120197
xor ecx, ecx
jmp 0x1000cd5cc
mov ebx, 0x8007010b
test byte [rsp + 0x60], 0x10
jne 0x1000cd4f5
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x8c]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, reloc.certcli.dll_Ordinal_260
jae 0x1000cd575
lea rdi, [rsp + 0x8c]
lea rax, [rsp + 0x2b0]
mov edx, reloc.certcli.dll_Ordinal_260
sub rdi, rax
xor r8d, r8d
lea rcx, [rsp + 0x2b0]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r8
je 0x1000cd339
movzx eax, word [rdi + rcx]
cmp ax, r8w
je 0x1000cd339
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1000cd316
cmp rdx, r8
jne 0x1000cd342
sub rcx, 2
mov word [rcx], r8w
lea rcx, [rsp + 0x2b0]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_wcsrchr]
xor ecx, ecx
cmp rax, rcx
je 0x1000cd56e
lea rdi, [rax + 2]
mov word [rax], cx
lea rdx, [0x10002ac72]
mov rcx, rdi
call fcn.1000b5684
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd43f
lea r8d, [rcx + 3]
lea rdx, [0x10002ac80]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd531
lea rdi, [rsp + 0x2b6]
cmp cx, word [rsp + 0x2b6]
je 0x1000cd3d5
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_iswxdigit]
xor ecx, ecx
cmp eax, ecx
je 0x1000cd51f
add rdi, 2
cmp cx, word [rdi]
jne 0x1000cd3b9
xor edx, edx
lea rcx, [rsp + 0x2b6]
lea r8d, [rdx + 0x10]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx]
jbe 0x1000cd3f4
mov dword [rcx], eax
mov rcx, qword [rsp + 0x40]
cmp eax, dword [rcx]
jae 0x1000cd3ff
mov dword [rcx], eax
mov eax, dword [rsp + 0x7c]
mov edi, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x28]
add rax, 0xffff
cqo
movzx edx, dx
add rax, rdx
sar rax, 0x10
add dword [rcx], eax
inc edi
mov dword [rsp + 0x20], edi
jmp 0x1000cd4f9
lea rdx, [0x10001f912]
mov rcx, rdi
call fcn.1000b5684
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd4b5
cmp r14d, ecx
jne 0x1000cd552
cmp rsi, rcx
je 0x1000cd47c
lea rcx, [rsp + 0x2b0]
mov rdx, rsi
call fcn.1000b5684
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd538
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x50]
mov r14d, 1
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x30]
add rax, 0xffff
cqo
movzx edx, dx
add rax, rdx
sar rax, 0x10
add dword [rcx], eax
jmp 0x1000cd4f5
lea rdx, [0x10002ac8a]
mov rcx, rdi
call fcn.1000b5684
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd567
cmp r13d, ecx
jne 0x1000cd560
lea rdx, [0x10002ac50]
lea rcx, [rsp + 0x8c]
call fcn.1000b5684
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd559
lea r13d, [rcx + 1]
mov edi, dword [rsp + 0x20]
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
cmp eax, ecx
jne 0x1000cd2c4
cmp edi, ecx
jne 0x1000cd57f
mov edx, 0x5710197
jmp 0x1000cd5cc
mov edx, 0x5390197
lea rcx, [rsp + 0x8c]
jmp 0x1000cd5cc
mov edx, 0x5330197
jmp 0x1000cd524
xor r9d, r9d
mov r8d, ebx
mov edx, 0x5540197
mov rcx, rsi
call fcn.1000b51b8
mov edx, 0x5550197
jmp 0x1000cd524
mov edx, 0x54f0197
jmp 0x1000cd5cc
mov edx, 0x5630197
jmp 0x1000cd524
mov edx, 0x55f0197
jmp 0x1000cd5cc
mov edx, 0x5690197
jmp 0x1000cd524
mov edx, 0x52a0197
jmp 0x1000cd5cc
mov edx, 0x5230197
jmp 0x1000cd223
mov eax, dword [rsp + 0x38]
and eax, 1
cmp al, cl
jne 0x1000cd59b
cmp r14d, ecx
je 0x1000cd594
cmp r13d, ecx
jne 0x1000cd5a5
mov edx, 0x5770197
jmp 0x1000cd5cc
cmp r14d, ecx
jne 0x1000cd5c7
cmp r13d, ecx
jne 0x1000cd5c7
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rax]
sub eax, dword [rcx]
inc eax
cmp eax, edi
je 0x1000cd5c3
mov edx, 0x5840197
jmp 0x1000cd2b8
xor ebx, ebx
jmp 0x1000cd5d7
mov edx, 0x57e0197
mov r8d, ebx
xor r9d, r9d
call fcn.1000b51b8
test rbp, rbp
je 0x1000cd5e5
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x1000cd5f3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp r15, 0xffffffffffffffff
je 0x1000cd602
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
mov rcx, qword [rsp + 0x8d0]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + 0x928]
add rsp, 0x8e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret