Function at 0x1001239ac
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
mov r15, rcx
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100123a11
test byte [rcx + 0x1c], 1
je 0x100123a11
cmp byte [rcx + 0x19], 4
jb 0x100123a11
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f40]
mov edx, 0x46
call fcn.10001c7b8
and qword [rsp + 0x30], 0
xor ebp, ebp
or r14, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
test rsi, rsi
jne 0x100123a3f
lea r8, [0x100013ac0]
lea rcx, [0x1000138c0]
mov edx, 0x93a
call fcn.100099ad8
cmp qword [rsi + 8], rbp
je 0x100123a5d
lea r8, [0x100013ad8]
lea rcx, [0x1000138c0]
mov edx, 0x93b
call fcn.100099ad8
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r15
call fcn.1001237a4
mov ebx, eax
test eax, eax
js 0x100123cab
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x250
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x100123af2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123adf
bt dword [rcx + 0x1c], 9
jae 0x100123adf
cmp byte [rcx + 0x19], 3
jb 0x100123adf
mov r9, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
lea edx, [r14 + 0x48]
lea r8, [0x100002f40]
mov dword [rsp + 0x20], eax
call fcn.10001daa4
cmp edi, 5
jne 0x100123cab
mov ebx, 0x80070005
jmp 0x100123cab
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123b24
test byte [rcx + 0x1c], 1
je 0x100123b24
cmp byte [rcx + 0x19], 4
jb 0x100123b24
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x6c]
lea r8, [0x100002f40]
mov edx, 0x48
call fcn.10001da24
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x6c]
repne scasw ax, word [rdi]
lea rdi, [0x10000a0dc]
not rcx
lea r12, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp r12, rcx
jb 0x100123b6b
lea rdx, [0x10000a0dc]
lea rcx, [rsp + 0x6c]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x100123bf3
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x10000a0e0]
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp r12, rcx
jb 0x100123b9b
lea rdx, [0x10000a0e0]
lea rcx, [rsp + 0x6c]
call sub.msvcrt.dll__wcsicmp
test eax, eax
je 0x100123bf3
test byte [rsp + 0x40], 0x10
je 0x100123bf3
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x6c]
xor r8d, r8d
call fcn.10009b4ec
mov ebx, eax
test eax, eax
js 0x100123c2e
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
jb 0x100123bd4
lea rdx, [rdi + 1]
mov rcx, rsi
call fcn.100043a28
test al, al
je 0x100123c23
mov rax, qword [rsi]
lea rcx, [rax + rdi*8]
test rcx, rcx
je 0x100123be8
mov rax, qword [rsp + 0x38]
mov qword [rcx], rax
inc qword [rsi + 8]
xor ebp, ebp
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0x250
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x100123c3c
lea r12, [0x1001653b8]
jmp 0x100123af2
mov ecx, 0x8007000e
call fcn.100019658
int3
mov rbp, qword [rsp + 0x38]
lea r12, [0x1001653b8]
jmp 0x100123c94
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x100123ca4
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x100123c86
test byte [rcx + 0x1c], 1
je 0x100123c86
cmp byte [rcx + 0x19], 2
jb 0x100123c86
mov r9, qword [rsp + 0x30]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f40]
mov edx, 0x49
mov dword [rsp + 0x20], eax
call fcn.10001daa4
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
test rbp, rbp
je 0x100123cab
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x100123cab
lea r12, [0x1001653b8]
cmp qword [rsp + 0x30], 0
je 0x100123cbe
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jns 0x100123cff
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123d2c
test byte [rcx + 0x1c], 1
je 0x100123d06
cmp byte [rcx + 0x19], 3
jb 0x100123d06
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f40]
mov edx, 0x4a
mov r9, r15
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x100123d2c
test byte [rcx + 0x1c], 1
je 0x100123d2c
cmp byte [rcx + 0x19], 4
jb 0x100123d2c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002f40]
mov edx, 0x4b
call fcn.10001c7b8
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10014e480
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret