Function at 0x14002c010
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xac0]
sub rsp, 0xbc0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0xab0], rax
mov r12, rdx
mov rbx, rcx
xor r13d, r13d
mov edx, 0x7f02
xor ecx, ecx
mov r15d, r9d
mov esi, r13d
mov rdi, r8
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
lea r9, [0x140208860]
lea r8d, [r13 + 1]
lea rdx, str.ShowHiddenFiles
lea rcx, str.Viewing
mov word [rbp + 0x480], r13w
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1009
mov rcx, rdi
movsxd r14, eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rbx
call fcn.1400e47e0
lea rdx, [0x140186bd0]
lea rcx, [rbp + 0x8a0]
mov r8, rbx
call fcn.1400f98c8
mov r9d, 1
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0x8a0]
mov edx, r9d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002c112
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x8a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14002c2fa
mov eax, dword [rbp + 0x20]
test al, 0x10
je 0x14002c2d4
test al, 2
je 0x14002c12a
test r14, r14
je 0x14002c2d4
lea r8, [rbp + 0x4c]
lea rdx, [0x140186be0]
lea rcx, [rbp + 0x270]
call fcn.1400f98c8
lea rdx, [0x140186bec]
lea rcx, [rbp + 0x690]
call fcn.1400f98c8
lea rcx, [rbp + 0x4c]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14002c160
cmp rax, 1
jne 0x14002c217
cmp word [rbp + 0x4c], 0x2e
jne 0x14002c217
inc esi
test r15d, r15d
je 0x14002c217
mov rcx, qword [0x1401fbba0]
lea r9d, [rax + 0x3f]
lea r8, [rbp + 0x480]
mov edx, 0x4e7b
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [rbp + 0x480]
lea r8, [rbp + 0x4c]
lea rdx, [0x140186bf0]
lea rcx, [rbp + 0x270]
call fcn.1400f98c8
mov rax, r13
nop dword [rax + rax]
movzx ecx, word [rbp + rax + 0x270]
lea rax, [rax + 2]
mov word [rbp + rax + 0x47e], cx
test cx, cx
jne 0x14002c1d0
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [0x140182ce0]
lea rcx, [rbp + 0x690]
mov r8, rax
call fcn.1400f98c8
lea rcx, [rbp + 0x4c]
or rax, 0xffffffffffffffff
nop
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14002c220
cmp rax, 2
jne 0x14002c241
cmp word [rbp + 0x4c], 0x2e
jne 0x14002c241
cmp word [rbp + 0x4e], 0x2e
jne 0x14002c241
add esi, 3
lea rax, [rbp + 0x270]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rdi
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x6c], r13
mov dword [rsp + 0x68], r13d
mov dword [rbp - 0x80], 0x104
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rbp + 0x270]
lea r9, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x1053
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14002c2d4
lea rcx, [rbp + 0x690]
lea r9, [rbp - 0x40]
movsxd r8, eax
mov qword [rbp - 0x28], rcx
mov edx, 0x1074
mov rcx, rdi
mov dword [rbp - 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002c112
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x14002c3d0
lea rdx, [0x140186c08]
lea rcx, [rbp + 0x480]
call fcn.1400f98c8
mov rcx, qword [0x1401fbab8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [0x140182ce0]
lea rcx, [rbp + 0x690]
mov r8, rax
call fcn.1400f98c8
lea rax, [rbp + 0x480]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rdi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x6c], r13
mov dword [rsp + 0x68], r13d
mov dword [rbp - 0x80], 0x104
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rbp + 0x480]
lea r9, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x1053
mov rcx, rdi
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14002c3d9
lea rcx, [rbp + 0x690]
lea r9, [rbp - 0x40]
movsxd r8, eax
mov qword [rbp - 0x28], rcx
mov edx, 0x1074
mov rcx, rdi
mov dword [rbp - 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14002c3d9
cmp esi, 3
jge 0x14002c478
lea rdx, str._.._
lea rcx, [rbp + 0x270]
call fcn.1400f98c8
lea rax, [rbp + 0x270]
lea rdx, [0x140186bec]
lea rcx, [rbp + 0x690]
mov qword [rsp + 0x78], rax
call fcn.1400f98c8
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x104d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rbp + 0x270]
lea r9, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x1053
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x14002c478
lea rcx, [rbp + 0x690]
lea r9, [rbp - 0x40]
movsxd r8, eax
mov qword [rbp - 0x28], rcx
mov edx, 0x1074
mov rcx, rdi
mov dword [rbp - 0x38], 1
call qword [sym.imp.USER32.dll_SendMessageW]
mov ebx, r13d
cmp word [rbp + 0x480], bx
je 0x14002c4b8
lea rax, [rbp + 0x480]
lea r9, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x1053
mov rcx, rdi
mov dword [rsp + 0x30], 2
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
test eax, eax
cmovs ebx, r13d
test r12, r12
je 0x14002c50d
cmp word [r12], r13w
je 0x14002c50d
lea rdx, [0x140186be0]
lea rcx, [rbp + 0x270]
mov r8, r12
call fcn.1400f98c8
lea rax, [rbp + 0x270]
lea r9, [rsp + 0x30]
or r8, 0xffffffffffffffff
mov edx, 0x1053
mov rcx, rdi
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
cmovs eax, r13d
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
movsxd rbx, ebx
lea r9, [rbp - 0x40]
mov r8, rbx
mov edx, 0x102b
mov rcx, rdi
mov dword [rbp - 0x30], 3
mov dword [rbp - 0x34], 3
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 1
mov r8, rbx
mov edx, 0x1013
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rbp + 0xab0]
xor rcx, rsp
call fcn.1400f9a80
mov rbx, qword [rsp + 0xc18]
add rsp, 0xbc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret