Function at 0x1400012c1
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Set current directory

Disassembly:
jmp 0x14000d190
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x538
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0xde
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x558]
mov rax, qword [0x140028018]
xor rax, rbp
mov qword [rbp + 0x4e8], rax
lea rcx, [0x14002e556]
call fcn.140001645
mov dword [rbp + 4], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x318], 0
mov qword [rbp + 0x338], 0
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14000d240
jmp 0x14000d422
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x14000d265
jmp 0x14000d422
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x14000d290
jmp 0x14000d422
mov rdx, qword [rbp + 0x48]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x14000d2ad
jmp 0x14000d422
mov edx, 0x104
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14000d2ca
jmp 0x14000d422
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x14000d2e2
jmp 0x14000d422
mov dword [rbp + 0x24], 1
lea rdx, [rbp + 0xb0]
lea rcx, str..dll
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x318], rax
cmp qword [rbp + 0x318], 0xffffffffffffffff
jne 0x14000d318
jmp 0x14000d422
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
mov edx, 0xc0000000
lea rcx, [rbp + 0xdc]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x338], rax
cmp qword [rbp + 0x338], 0xffffffffffffffff
jne 0x14000d367
jmp 0x14000d3f4
xor edx, edx
mov rcx, qword [rbp + 0x338]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x354], eax
cmp dword [rbp + 0x354], 0xffffffff
je 0x14000d393
mov eax, dword [rbp + 0x510]
cmp dword [rbp + 0x354], eax
jae 0x14000d397
jmp 0x14000d3f4
mov edx, 0x20a
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rcx, qword [rbp + 0x518]
mov qword [rcx], rax
mov rax, qword [rbp + 0x518]
cmp qword [rax], 0
jne 0x14000d3c2
jmp 0x14000d3f4
lea rax, [rbp + 0xdc]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x68]
lea r8, [0x14001d2b8]
mov edx, 0x104
mov rax, qword [rbp + 0x518]
mov rcx, qword [rax]
call fcn.140001226
mov dword [rbp + 4], 1
lea rcx, [rbp + 0x338]
call fcn.140001113
lea rdx, [rbp + 0xb0]
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14000d422
cmp dword [rbp + 4], 0
je 0x14000d318
cmp dword [rbp + 0x24], 0
je 0x14000d432
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp qword [rbp + 0x318], 0
je 0x14000d453
cmp qword [rbp + 0x318], 0xffffffffffffffff
je 0x14000d453
mov rcx, qword [rbp + 0x318]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp + 0x48]
call fcn.1400010a5
lea rcx, [rbp + 0x68]
call fcn.1400010a5
lea rcx, [rbp + 0x88]
call fcn.1400010a5
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140020200]
call fcn.140001546
mov eax, edi
mov rcx, qword [rbp + 0x4e8]
xor rcx, rbp
call fcn.14000132a
lea rsp, [rbp + 0x4f8]
pop rdi
pop rbp
ret