Function at 0x10000e184
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb00
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0xaf0], rax
or qword [rsp + 0x68], 0xffffffffffffffff
mov r12d, 0x400
xor ebp, ebp
mov edi, edx
mov dword [rsp + 0x50], edx
mov rsi, rcx
mov qword [rsp + 0x60], r12
mov r15d, ebp
mov qword [rsp + 0x70], rcx
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r13, rax
cmp rax, rbp
jne 0x10000e207
mov ebx, 0x8007000e
jmp 0x10000e4ac
mov word [rax], bp
mov r14, qword [rsi]
mov qword [rsp + 0x58], rax
mov rbp, rax
xor eax, eax
cmp word [r14], ax
je 0x10000e448
xor esi, esi
mov ecx, 0x100
lea rax, [rsp + 0x6f0]
lea r9, [rsp + 0x2e0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x8f0]
lea rdx, [rsp + 0x2d0]
mov r8d, 3
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, r14
call sub.msvcrt.dll__wsplitpath_s
lea rdx, [rsp + 0x80]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x10000e39a
lea rsi, [rsp + 0xac]
lea rdi, [0x100005bd4]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x10000e374
lea rsi, [rsp + 0xac]
lea rdi, [0x100005bd8]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x10000e374
lea rax, [0x100001870]
lea r9, [rsp + 0x2e0]
lea r8, [rsp + 0x2d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xac]
lea rcx, [rsp + 0x4e0]
mov edx, 0x104
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__wmakepath_s
lea rax, [rsp + 0x60]
xor esi, esi
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x4e0]
mov rdx, r12
mov rcx, rbp
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call fcn.100007d08
cmp eax, esi
mov ebx, eax
jl 0x10000e47f
mov r12, qword [rsp + 0x60]
cmp r12, rsi
je 0x10000e43c
mov edi, dword [rsp + 0x50]
inc r15d
cmp edi, esi
je 0x10000e443
mov rbp, qword [rsp + 0x58]
mov rax, qword [rsp + 0x68]
add rbp, 2
dec r12
mov word [rbp], si
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], rbp
jmp 0x10000e37a
mov edi, dword [rsp + 0x50]
xor esi, esi
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
mov rax, qword [rsp + 0x68]
jne 0x10000e28f
jmp 0x10000e416
mov edx, 0x2a
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rsi
jne 0x10000e416
mov edx, 0x3f
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rsi
jne 0x10000e416
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x58]
mov r8, r14
mov rdx, r12
mov rcx, rbp
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call fcn.100007d08
cmp eax, esi
mov ebx, eax
jl 0x10000e47f
mov r12, qword [rsp + 0x60]
cmp r12, rsi
je 0x10000e43c
inc r15d
cmp edi, esi
je 0x10000e443
mov rbp, qword [rsp + 0x58]
add rbp, 2
dec r12
mov word [rbp], si
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], rbp
cmp edi, esi
je 0x10000e443
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r14, [r14 + rcx*2]
cmp word [r14], si
je 0x10000e443
mov edi, dword [rsp + 0x50]
jmp 0x10000e223
mov ebx, 0x8007007a
jmp 0x10000e47f
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsi]
xor ebp, ebp
cmp rdi, rbp
je 0x10000e469
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsi], rbp
cmp r15d, ebp
je 0x10000e478
mov qword [rsi], r13
xor esi, esi
mov r13, rsi
jmp 0x10000e47f
mov ebx, 0x80070002
xor esi, esi
mov rax, qword [rsp + 0x68]
cmp rax, 0xffffffffffffffff
je 0x10000e493
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp r13, rsi
je 0x10000e4ac
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r13
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
mov rcx, qword [rsp + 0xaf0]
xor rcx, rsp
call fcn.10000f610
lea r11, [rsp + 0xb00]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret