Function at 0x14000de00
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
movaps xmmword [rsp + 0x330], xmm6
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ebx, eax
test eax, eax
jne 0x14000e065
movabs rax, 0x44b31218683c5370
mov qword [rsp + 0x30], rax
movabs rax, 0x9d0394fd8ab1001
mov qword [rsp + 0x38], rax
movabs rax, 0xd24623063207fedf
mov qword [rsp + 0x40], rax
movabs rax, 0x568cb068dddd330c
mov qword [rsp + 0x48], rax
movabs rax, 0x5913a77195b477a4
mov qword [rsp + 0x50], rax
movabs rax, 0x3ffd4bfb0345942d
mov qword [rsp + 0x58], rax
movabs rax, 0x6e67e09ea7683677
mov qword [rsp + 0x60], rax
movabs rax, 0xb89563389a7d7880
mov qword [rsp + 0x68], rax
movabs rax, 0x100d8b5717c4435f
mov qword [rsp + 0x70], rax
movabs rax, 0xf55bd1b54d4717bc
mov qword [rsp + 0x78], rax
movabs rcx, 0x44f0126c68595337
mov qword [rsp + 0xe0], rcx
movabs rcx, 0x9b5393dd8d91074
mov qword [rsp + 0xe8], rcx
movabs rcx, 0xd22f23423273feb1
mov qword [rsp + 0xf0], rcx
movabs rcx, 0x56f8b00bddb8337e
mov qword [rsp + 0xf8], rcx
movabs rcx, 0x5933a70895c677cb
mov qword [rsp + 0x100], rcx
movabs rcx, 0x3f924b8903379448
mov qword [rsp + 0x108], rcx
movabs rcx, 0x6e22e0bea7463605
mov qword [rsp + 0x110], rcx
movabs rcx, 0xb8e763579a0f78f2
mov qword [rsp + 0x118], rcx
movabs rcx, 0x102d8b2417ad437f
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0xe0]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [0x140051ef0]
lea rdx, [rsp + 0x30]
call fcn.140001db0
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov edx, eax
call fcn.14000e8f0
mov rdi, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rax, qword [rdi + rax + 0x40]
mov rcx, qword [rax + 8]
mov qword [rsp + 0xe8], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0xe0]
call fcn.140002d60
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x60]
mov ebp, eax
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000e053
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000e053
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rcx, rdi
mov edx, ebp
call fcn.140007870
mov rcx, rdi
call fcn.1400022a0
mov ecx, ebx
add rcx, rcx
call fcn.1400138f4
mov rdi, rax
mov ecx, ebx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x14000e2aa
movabs rax, 0x44b31218683c5370
mov qword [rsp + 0x30], rax
movabs rax, 0x9d0394fd8ab1001
mov qword [rsp + 0x38], rax
movabs rax, 0xd24623063207fedf
mov qword [rsp + 0x40], rax
movabs rax, 0x568cb068dddd330c
mov qword [rsp + 0x48], rax
movabs rax, 0x5913a77195b477a4
mov qword [rsp + 0x50], rax
movabs rax, 0x3ffd4bfb0345942d
mov qword [rsp + 0x58], rax
movabs rax, 0x6e67e09ea7683677
mov qword [rsp + 0x60], rax
movabs rax, 0xb89563389a7d7880
mov qword [rsp + 0x68], rax
movabs rax, 0x100d8b5717c4435f
mov qword [rsp + 0x70], rax
movabs rax, 0xf55bd1b54d4717bc
mov qword [rsp + 0x78], rax
movabs rcx, 0x44f0126c68595337
mov qword [rsp + 0xe0], rcx
movabs rcx, 0x9b5393dd8d91074
mov qword [rsp + 0xe8], rcx
movabs rcx, 0xd22f23423273feb1
mov qword [rsp + 0xf0], rcx
movabs rcx, 0x56f8b00bddb8337e
mov qword [rsp + 0xf8], rcx
movabs rcx, 0x5933a70895c677cb
mov qword [rsp + 0x100], rcx
movabs rcx, 0x3f924b8903379448
mov qword [rsp + 0x108], rcx
movabs rcx, 0x6e22e0bea7463605
mov qword [rsp + 0x110], rcx
movabs rcx, 0xb8e763579a0f78f2
mov qword [rsp + 0x118], rcx
movabs rcx, 0x102d8b2417ad437f
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rax
lea rax, [rsp + 0xe0]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x40], xmm0
movaps xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rax + 0x40]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [0x140051ef0]
lea rdx, [rsp + 0x30]
call fcn.140001db0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
mov edx, eax
call fcn.14000e8f0
mov rbx, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rax, qword [rbx + rax + 0x40]
mov rcx, qword [rax + 8]
mov qword [rsp + 0xe8], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0xe0]
call fcn.140002d60
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x60]
mov ebp, eax
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000e298
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000e298
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rcx, rbx
mov edx, ebp
call fcn.140007870
mov rcx, rbx
call fcn.1400022a0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xf0], xmm0
movaps xmmword [rsp + 0xe0], xmm0
mov rcx, rdi
call fcn.140023b58
lea rbx, [rsp + 0xe0]
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call fcn.140002040
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
mov rdx, rcx
sub rdx, rax
cmp rdx, 2
jae 0x14000e31e
mov qword [rsp + 0x20], 2
lea r9, [0x14004718a]
lea rcx, [rsp + 0xe0]
mov edx, 2
call fcn.14000f760
mov rbx, rax
jmp 0x14000e349
lea rdx, [rax + 2]
mov qword [rsp + 0xf0], rdx
mov rdx, rbx
cmp rcx, 8
jb 0x14000e33b
mov rdx, qword [rsp + 0xe0]
mov dword [rdx + rax*2], 0x2a005c
mov word [rdx + rax*2 + 4], 0
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0xd0], xmm1
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
mov rax, qword [rsp + 0xf8]
cmp rax, 8
jb 0x14000e3c3
mov rcx, qword [rsp + 0xe0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e3be
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e8df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400138c0
cmp qword [rsp + 0xd8], 8
jb 0x14000e3d8
mov rcx, qword [rsp + 0xc0]
jmp 0x14000e3e0
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e5e9
movabs rax, 0x4494120268305371
mov qword [rsp + 0x80], rax
movabs rax, 0x9c6394fd8b01032
mov qword [rsp + 0x88], rax
movabs rax, 0xd243232b3235fec5
mov qword [rsp + 0x90], rax
movabs rax, 0x568ab06edd98331b
mov qword [rsp + 0x98], rax
movabs rax, 0x591da77a95a977b9
mov qword [rsp + 0xa0], rax
movabs rax, 0x3fe04bfb03729468
mov qword [rsp + 0xa8], rax
movabs rax, 0x6e4be09ea734366a
mov qword [rsp + 0xb0], rax
movabs rax, 0xb8e763579a2f7881
mov qword [rsp + 0xb8], rax
movabs rax, 0x44f0126c68595337
mov qword [rsp + 0x30], rax
movabs rax, 0x9b5393dd8d91074
mov qword [rsp + 0x38], rax
movabs rax, 0xd22f23423273feb1
mov qword [rsp + 0x40], rax
movabs rax, 0x56f8b00bddb8337e
mov qword [rsp + 0x48], rax
movabs rax, 0x5933a70895c677cb
mov qword [rsp + 0x50], rax
movabs rax, 0x3f924b8903379448
mov qword [rsp + 0x58], rax
movabs rax, 0x6e22e0bea7463605
mov qword [rsp + 0x60], rax
movabs rax, 0xb8e763579a0f78f2
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x90]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
lea rcx, [0x140051ef0]
lea rdx, [rsp + 0x80]
call fcn.140001db0
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, r14
mov edx, eax
call fcn.14000e8f0
mov r14, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rax, qword [r14 + rax + 0x40]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x30]
call fcn.140002d60
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x60]
mov ebp, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000e5d7
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000e5d7
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rcx, r14
mov edx, ebp
call fcn.140007870
mov rcx, r14
call fcn.1400022a0
lea r14, [rsp + 0x10c]
xorps xmm6, xmm6
lea r15, [rsp + 0xe0]
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x14000e62d
mov rcx, rsi
mov rdx, r12
mov r8, r14
call fcn.14000f8f0
nop word cs:[rax + rax]
mov rcx, rbx
mov rdx, r15
call r13
test eax, eax
je 0x14000e669
test byte [rsp + 0xe0], 0x10
jne 0x14000e620
mov r12, qword [rsi + 8]
cmp r12, qword [rsi + 0x10]
je 0x14000e605
movups xmmword [r12 + 0x10], xmm6
movups xmmword [r12], xmm6
mov rcx, r14
call fcn.140023b58
mov rcx, r12
mov rdx, r14
mov r8, rax
call fcn.140002040
add qword [rsi + 8], 0x20
jmp 0x14000e620
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x14000e85f
mov ebp, eax
movabs rax, 0x4494120268305371
mov qword [rsp + 0x80], rax
movabs rax, 0x9c13945d8bc103a
mov qword [rsp + 0x88], rax
movabs rax, 0xd24a232e321afef7
mov qword [rsp + 0x90], rax
movabs rax, 0x568ab079dddd335e
mov qword [rsp + 0x98], rax
movabs rax, 0x5913a72695b477a4
mov qword [rsp + 0xa0], rax
movabs rax, 0x3ffd4bfb0345940d
mov qword [rsp + 0xa8], rax
movabs rax, 0x6e51e0d7a7663677
mov qword [rsp + 0xb0], rax
movabs rax, 0xb8e763579a0f78d2
mov qword [rsp + 0xb8], rax
movabs rax, 0x44f0126c68595337
mov qword [rsp + 0x30], rax
movabs rax, 0x9b5393dd8d91074
mov qword [rsp + 0x38], rax
movabs rax, 0xd22f23423273feb1
mov qword [rsp + 0x40], rax
movabs rax, 0x56f8b00bddb8337e
mov qword [rsp + 0x48], rax
movabs rax, 0x5933a70895c677cb
mov qword [rsp + 0x50], rax
movabs rax, 0x3f924b8903379448
mov qword [rsp + 0x58], rax
movabs rax, 0x6e22e0bea7463605
mov qword [rsp + 0x60], rax
movabs rax, 0xb8e763579a0f78f2
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x30]
movaps xmm0, xmmword [rsp + 0x80]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
movaps xmm0, xmmword [rsp + 0x90]
xorps xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x90], xmm0
movaps xmm0, xmmword [rsp + 0xa0]
xorps xmm0, xmmword [rax + 0x20]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0xb0]
xorps xmm0, xmmword [rax + 0x30]
movaps xmmword [rsp + 0xb0], xmm0
lea rcx, [0x140051ef0]
lea rdx, [rsp + 0x80]
call fcn.140001db0
mov rcx, rax
mov edx, ebp
call fcn.14000e8f0
mov r14, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rax, qword [r14 + rax + 0x40]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rsp + 0x30]
call fcn.140002d60
mov r8, qword [rax]
mov rcx, rax
mov dl, 0xa
call qword [r8 + 0x60]
mov ebp, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000e84d
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000e84d
mov r8, qword [rax]
mov rcx, rax
mov edx, 1
call qword [r8]
mov rcx, r14
mov edx, ebp
call fcn.140007870
mov rcx, r14
call fcn.1400022a0
cmp rbx, 0xffffffffffffffff
je 0x14000e86e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0xd8]
cmp rax, 8
jb 0x14000e8b8
mov rcx, qword [rsp + 0xc0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e8b3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e8df
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.1400138c0
mov rcx, rdi
call fcn.1400138c0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x330]
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140020300
int3