Function at 0x10000d198
Capabilities:
Bypass windows file protection
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbp, rcx
xor r15d, r15d
lea rcx, [rsp + 0x30]
mov ebx, 0x104
xor edx, edx
mov r8d, 0x208
or rdi, 0xffffffffffffffff
mov rsi, r15
mov r14d, r15d
mov dword [rsp + 0x20], ebx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x240]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, r15d
je 0x10000d417
cmp eax, ebx
jae 0x10000d417
movzx ecx, word [rsp + 0x240]
call sub.msvcrt.dll_tolower
movzx ecx, word [rbp + 0x40]
mov ebx, eax
call sub.msvcrt.dll_tolower
cmp ebx, eax
jne 0x10000d467
lea rcx, [0x100002818]
call fcn.1000189a8
mov rsi, rax
cmp rax, r15
jne 0x10000d272
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x10000d445
test byte [rcx + 0x1c], 1
je 0x10000d445
lea edx, [rdi + 0x1e]
jmp 0x10000d435
lea rdx, [0x100002830]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
cmp rax, r15
jne 0x10000d2b5
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x10000d445
test byte [rcx + 0x1c], 1
je 0x10000d445
mov edx, 0x1e
jmp 0x10000d435
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x20]
lea rcx, [rbp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
mov rdi, rax
cmp rax, r15
je 0x10000d445
cmp rax, 0xffffffffffffffff
je 0x10000d445
lea rbx, [0x100023120]
lea rcx, [rsp + 0x30]
call fcn.100017f9c
cmp eax, r15d
je 0x10000d3b1
lea rdx, [rsp + 0x30]
xor ecx, ecx
call r12
cmp eax, r15d
je 0x10000d3d8
mov rcx, rbp
call fcn.10000d4a4
cmp eax, r15d
jne 0x10000d3d8
movzx eax, word [rbp + 0x40]
lea rcx, [rbp + 0x24c]
lea r9, [rsp + 0x30]
mov word [rbp + 0x248], ax
mov eax, 0x3a
mov edx, 0x102
mov r8d, r15d
sub r9, rcx
mov word [rbp + 0x24a], ax
lea rax, [rdx + 0x7ffffefc]
cmp rax, r15
je 0x10000d371
movzx eax, word [r9 + rcx]
cmp ax, r15w
je 0x10000d371
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10000d34d
cmp rdx, r15
jne 0x10000d380
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, r15d
mov word [rcx], r15w
jge 0x10000d40f
mov rcx, qword [0x100023120]
cmp rcx, rbx
je 0x10000d445
test byte [rcx + 0x1c], 1
je 0x10000d445
mov edx, 0x20
jmp 0x10000d435
mov rcx, qword [0x100023120]
cmp rcx, rbx
je 0x10000d3d8
test byte [rcx + 0x1c], 1
je 0x10000d3d8
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
mov edx, 0x1f
call fcn.100004898
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
cmp eax, r15d
je 0x10000d445
jmp 0x10000d2e8
mov r14d, 1
jmp 0x10000d445
mov rcx, qword [0x100023120]
lea rbx, [0x100023120]
cmp rcx, rbx
je 0x10000d467
test byte [rcx + 0x1c], 1
je 0x10000d467
mov edx, 0x1c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100001940]
call fcn.100004898
cmp rsi, r15
je 0x10000d453
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp rdi, r15
je 0x10000d467
cmp rdi, 0xffffffffffffffff
je 0x10000d467
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, r14d
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.10001e7a0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret