Function at 0x10001b194
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x6c0
mov rax, qword [0x100032110]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
mov rsi, rdx
lea rcx, [rsp + 0x44]
xor r15d, r15d
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0x40], r15d
call sub.msvcrt.dll_memset
mov edi, 0x206
lea rcx, [rsp + 0x292]
mov r8, rdi
xor edx, edx
mov r14, r15
mov word [rsp + 0x290], r15w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x4a2]
mov r8, rdi
xor edx, edx
mov word [rsp + 0x4a0], r15w
call sub.msvcrt.dll_memset
mov dword [rsp + 0x30], 1
mov r12, r15
cmp rsi, r15
je 0x10001b87b
cmp word [rsi], r15w
je 0x10001b87b
lea rax, [rsp + 0x290]
mov r8d, 0x104
lea rcx, [rsp + 0x290]
sub rsi, rax
mov rdx, r8
mov edi, r15d
lea rax, [rdx + 0x7ffffefa]
cmp rax, r15
je 0x10001b282
movzx eax, word [rsi + rcx]
cmp ax, r15w
je 0x10001b282
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10001b25f
cmp rdx, r15
jne 0x10001b290
sub rcx, 2
mov edi, 0x8007007a
cmp edi, r15d
mov word [rcx], r15w
jge 0x10001b2df
mov rcx, qword [0x100032328]
lea rbx, [0x100032328]
cmp rcx, rbx
je 0x10001b8b9
test byte [rcx + 0x1c], 4
je 0x10001b8b9
mov edx, 0x25
lea r9, [0x100004b50]
mov dword [rsp + 0x20], edi
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
call fcn.10001a3dc
jmp 0x10001b8b9
mov rax, r8
lea rcx, [rsp + 0x290]
mov edi, r15d
cmp word [rcx], r15w
je 0x10001b2fd
add rcx, 2
sub rax, 1
jne 0x10001b2ed
cmp rax, r15
jne 0x10001b30c
mov edi, 0x80070057
mov rbp, r15
jmp 0x10001b312
mov rbp, r8
sub rbp, rax
cmp edi, r15d
jge 0x10001b346
mov rcx, qword [0x100032328]
lea rbx, [0x100032328]
cmp rcx, rbx
je 0x10001b8b9
test byte [rcx + 0x1c], 4
je 0x10001b8b9
mov edx, 0x26
lea r9, [0x100004b80]
jmp 0x10001b2c6
mov edi, 0x5c
cmp rbp, r15
jbe 0x10001b369
cmp word [rsp + rbp*2 + 0x28e], di
jne 0x10001b369
sub rbp, 1
mov word [rsp + rbp*2 + 0x290], r15w
jne 0x10001b350
lea rcx, [rsp + 0x290]
mov edx, edi
call sub.msvcrt.dll_wcschr
cmp rax, r15
jne 0x10001b3b5
mov rcx, qword [0x100032328]
lea rbx, [0x100032328]
cmp rcx, rbx
je 0x10001b3ab
test byte [rcx + 0x1c], 4
je 0x10001b3ab
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
mov edx, 0x27
call fcn.10000b094
mov edi, 0x80070057
jmp 0x10001b8b9
lea rcx, [rsp + 0x290]
mov edx, edi
call sub.msvcrt.dll_wcsrchr
xor r8d, r8d
lea rsi, [rsp + 0x290]
mov r15, rax
lea rax, [rsp + 0x4a0]
mov edx, 0x104
lea rcx, [rsp + 0x4a0]
mov edi, r8d
sub rsi, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r8
je 0x10001b410
movzx eax, word [rcx + rsi]
cmp ax, r8w
je 0x10001b410
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10001b3ed
xor esi, esi
cmp rdx, rsi
jne 0x10001b420
sub rcx, 2
mov edi, 0x8007007a
cmp edi, esi
mov word [rcx], si
jge 0x10001b452
mov rcx, qword [0x100032328]
lea rbx, [0x100032328]
cmp rcx, rbx
je 0x10001b8b9
test byte [rcx + 0x1c], 4
je 0x10001b8b9
mov edx, 0x28
jmp 0x10001b2bf
lea r8, [r15 + 2]
lea rdx, [rsp + 0x290]
xor r9d, r9d
mov rcx, rbx
mov dword [rsp + 0x20], 1
call fcn.10001acfc
cmp eax, esi
mov edi, eax
jge 0x10001b4ad
mov rcx, qword [0x100032328]
lea rbx, [0x100032328]
cmp rcx, rbx
je 0x10001b8b9
test byte [rcx + 0x1c], 4
je 0x10001b8b9
mov edx, 0x29
mov dword [rsp + 0x20], eax
lea r9, [0x100004ab0]
jmp 0x10001b2ca
lea rbx, [0x100032328]
lea rax, [rbp + 3]
mov edx, 0x2a
cmp rax, 0x104
ja 0x10001b852
lea eax, [rdx + 0x32]
mov word [rsp + rbp*2 + 0x290], ax
mov word [rsp + rbp*2 + 0x292], dx
mov word [rsp + rbp*2 + 0x294], si
lea rdx, [rsp + 0x40]
cmp r14, rsi
je 0x10001b4fd
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [rsp + 0x30], eax
jmp 0x10001b51c
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x10001b809
mov eax, dword [rsp + 0x30]
cmp eax, esi
je 0x10001b633
lea rsi, [0x100004b40]
lea rdi, [rsp + 0x6c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x10001b617
lea rsi, [0x100004b44]
lea rdi, [rsp + 0x6c]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x10001b617
lea r8, [rsp + 0x6c]
lea rcx, [rsp + 0x290]
xor esi, esi
mov edx, 0x104
mov word [rsp + rbp*2 + 0x292], si
call fcn.10001b8f0
cmp eax, esi
mov edi, eax
jl 0x10001b792
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
lea r8, [r15 + 2]
lea rdx, [rsp + 0x290]
mov dword [rsp + 0x20], esi
call fcn.10001acfc
cmp eax, esi
mov edi, eax
jl 0x10001b753
test byte [rsp + 0x40], 0x10
je 0x10001b619
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b5e0
test byte [rcx + 0x1c], 2
je 0x10001b5e0
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x2e]
lea r9, [rsp + 0x290]
lea r8, [0x100001960]
call fcn.10000d674
mov edx, 0x104
lea rcx, [rsp + 0x290]
mov edi, esi
mov rax, rdx
cmp word [rcx], si
je 0x10001b601
add rcx, 2
sub rax, 1
jne 0x10001b5f2
cmp rax, rsi
jne 0x10001b6c9
mov edi, 0x80070057
mov rbp, rsi
jmp 0x10001b6cf
xor esi, esi
lea rdx, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [rsp + 0x30], eax
cmp eax, esi
jne 0x10001b51c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x10001b7c1
lea rax, [rsp + 0x290]
lea rdi, [rsp + 0x4a0]
mov word [rsp + rbp*2 + 0x290], si
sub rdi, rax
movzx ecx, word [rax]
movzx edx, word [rax + rdi]
sub ecx, edx
jne 0x10001b670
add rax, 2
test edx, edx
jne 0x10001b65d
cmp ecx, esi
je 0x10001b7ba
lea rcx, [rsp + 0x290]
mov edx, 0x5c
call sub.msvcrt.dll_wcsrchr
mov rcx, r14
mov rbp, rax
mov word [rax], si
lea rax, [rsp + 0x290]
sub rbp, rax
sar rbp, 1
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, rsi
cmp r12, rsi
je 0x10001b4b4
mov rcx, r12
mov r12, qword [r12 + 8]
mov r14, qword [rcx]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10001b4b4
mov rbp, rdx
sub rbp, rax
mov edx, 0x10
lea ecx, [rdx + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp rax, rsi
je 0x10001b6f4
mov qword [rax], r14
mov qword [rax + 8], r12
mov r12, rax
mov r14, rsi
jmp 0x10001b4b4
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b882
test byte [rcx + 0x1c], 4
je 0x10001b726
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
mov edx, 0x24
call fcn.10000b094
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b882
test byte [rcx + 0x1c], 4
je 0x10001b882
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
mov edx, 0x2f
call fcn.10000b094
jmp 0x10001b882
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b882
test byte [rcx + 0x1c], 4
je 0x10001b882
mov edx, 0x2d
lea r9, [0x100004ab0]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
mov dword [rsp + 0x20], eax
call fcn.10001a3dc
jmp 0x10001b882
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b882
test byte [rcx + 0x1c], 4
je 0x10001b882
mov edx, 0x2c
lea r9, [0x100004bb8]
jmp 0x10001b779
mov edi, esi
jmp 0x10001b882
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, esi
cmovle edi, eax
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b882
test byte [rcx + 0x1c], 4
je 0x10001b882
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
mov edx, 0x30
mov r9d, edi
call fcn.10000b0b8
jmp 0x10001b882
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
cmp eax, esi
cmovle edi, eax
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b887
test byte [rcx + 0x1c], 4
je 0x10001b887
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x290]
lea r8, [0x100001960]
mov edx, 0x2b
mov dword [rsp + 0x20], edi
call fcn.10001a3dc
jmp 0x10001b887
mov rcx, qword [0x100032328]
cmp rcx, rbx
je 0x10001b874
test byte [rcx + 0x1c], 4
je 0x10001b874
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001960]
call fcn.10000b094
mov edi, 0x8007007a
jmp 0x10001b882
mov edi, 0x80070057
xor esi, esi
cmp r14, rsi
je 0x10001b890
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp r12, rsi
je 0x10001b8b9
mov rsi, r12
mov r12, qword [r12 + 8]
mov rcx, qword [rsi]
test rcx, rcx
je 0x10001b8ab
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test r12, r12
jne 0x10001b895
mov eax, edi
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.10002e370
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret