Function at 0x1000c5e80
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6f8
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x6e0], rax
mov r14, qword [rsp + 0x760]
mov rsi, qword [rsp + 0x768]
or rbx, 0xffffffffffffffff
mov r13, rbx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x44], r9d
mov r15b, r8b
mov byte [rsp + 0x40], dl
mov r12, rcx
mov rax, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rax, rdi
je 0x1000c5f43
test byte [rax + 0x1c], 4
je 0x1000c5f0a
cmp byte [rax + 0x19], 4
jb 0x1000c5f0a
mov rcx, qword [rax + 0x10]
lea edx, [rbx + 0x6b]
lea r8, [0x100003158]
call fcn.10001c854
mov rax, qword [0x1001653b8]
cmp rax, rdi
je 0x1000c5f43
test byte [rax + 0x1c], 4
je 0x1000c5f43
cmp byte [rax + 0x19], 4
jb 0x1000c5f43
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlNumberOfSetBits]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003158]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x6b
call fcn.10001c878
xor eax, eax
mov rcx, rbx
mov rdi, r14
repne scasw ax, word [rdi]
mov edx, 0x104
not rcx
dec rcx
lea ebp, [rcx + 0x42]
lea eax, [rbp + 1]
cmp eax, edx
ja 0x1000c61fd
lea ebx, [rcx + 0x1b]
lea eax, [rbx + 1]
cmp eax, edx
ja 0x1000c61fd
mov eax, ecx
lea rcx, [rsp + 0x4d0]
mov rdx, r14
lea rdi, [rax + rax]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + rdi + 0x4d0]
lea rdx, [0x10000d1c0]
mov r8d, 0x84
call sub.msvcrt.dll_memcpy
mov ecx, ebp
xor ebp, ebp
mov word [rsp + rcx*2 + 0x4d0], bp
lea rcx, [rsp + 0x2c0]
mov r8, rdi
mov rdx, r14
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + rdi + 0x2c0]
lea r8d, [rbp + 0x36]
lea rdx, [0x10000d248]
call sub.msvcrt.dll_memcpy
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x4d0]
mov word [rsp + rbx*2 + 0x2c0], bp
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1000c600a
xor eax, eax
jmp 0x1000c6208
mov bpl, byte [rsp + 0x40]
mov r14d, dword [rsp + 0x44]
test r15b, r15b
jne 0x1000c6109
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x9c]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 0x4a
jbe 0x1000c60cd
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x9c]
mov r8, rsi
call fcn.1000c58b8
test eax, eax
je 0x1000c609f
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000c614f
test byte [rcx + 0x1c], 4
je 0x1000c614f
cmp byte [rcx + 0x19], 4
jb 0x1000c614f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x6c
mov r9d, eax
call fcn.10001c878
jmp 0x1000c614f
movaps xmm0, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
mov r8, rsi
movdqa xmmword [rsp + 0x50], xmm0
call fcn.1000c5a90
mov edi, eax
test eax, eax
jne 0x1000c61f0
mov r13, qword [rsp + 0x48]
jmp 0x1000c6109
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000c6109
test byte [rcx + 0x1c], 4
je 0x1000c6109
cmp byte [rcx + 0x19], 4
jb 0x1000c6109
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x9c]
lea r8, [0x100003158]
mov edx, 0x6d
call fcn.10001db08
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2c0]
mov r9d, r14d
mov r8b, r15b
mov dl, bpl
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.1000c563c
mov edi, eax
test eax, eax
jne 0x1000c61f0
lea rdi, [0x1001653b8]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1000c6014
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000c6003
test byte [rcx + 0x1c], 4
je 0x1000c61b9
cmp byte [rcx + 0x19], 4
jb 0x1000c61b9
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlNumberOfSetBits]
mov rcx, qword [0x1001653b8]
lea r8, [0x100003158]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
mov edx, 0x6e
call fcn.10001c878
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000c6003
test byte [rcx + 0x1c], 4
je 0x1000c6003
cmp byte [rcx + 0x19], 4
jb 0x1000c6003
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003158]
mov edx, 0x6f
call fcn.10001c854
jmp 0x1000c6003
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
jmp 0x1000c6208
mov dword [rsi], 0x57
mov eax, 2
mov rcx, qword [rsp + 0x6e0]
xor rcx, rsp
call fcn.10014e600
add rsp, 0x6f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret