Function at 0x1000feb94
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x430
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x490]
mov r14, qword [rsp + 0x498]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x80], rax
mov rdi, r8
mov qword [rsp + 0x78], r8
mov esi, edx
mov dword [rsp + 0x48], edx
mov r13, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000fec1f
test byte [rcx + 0x1c], 1
je 0x1000fec1f
cmp byte [rcx + 0x19], 5
jb 0x1000fec1f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x16
call fcn.10001c7b8
mov eax, dword [rsp + 0x14c]
xor ebp, ebp
lea rcx, [rsp + 0x150]
and eax, 0xfffffffe
lea edx, [rbp + 0x18]
mov qword [rsp + 0x140], rcx
and eax, 0xfffffffb
lea rcx, [rsp + 0x1a0]
mov dword [rsp + 0x138], edx
or eax, 2
mov qword [rsp + 0x190], rcx
mov dword [rsp + 0x188], edx
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x19c]
lea rcx, [rsp + 0x1d0]
and eax, 0xfffffffe
xor edx, edx
mov r8d, 0x250
and eax, 0xfffffffb
mov ebx, ebp
mov qword [rsp + 0x58], rbp
or eax, 2
mov r15, rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x19c], eax
mov eax, esi
mov r12, rbp
shr eax, 1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x130], rbp
and al, 1
mov dword [rsp + 0x148], ebp
mov word [rsp + 0x150], bp
mov qword [rsp + 0x180], rbp
mov dword [rsp + 0x198], ebp
mov word [rsp + 0x1a0], bp
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x34], ebp
call sub.msvcrt.dll_memset
mov eax, esi
mov byte [r14], bpl
and eax, 4
mov dword [rsp + 0x50], eax
jne 0x1000fed07
cmp dword [r13 + 0x10], 0x64
jbe 0x1000fed07
mov ebx, 0x80070057
jmp 0x1000ff288
bt dword [r13], 0xa
mov byte [r13 + 0x14], 1
jae 0x1000fed5d
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000ff28f
test byte [rcx + 0x1c], 1
je 0x1000ff28f
cmp byte [rcx + 0x19], 5
jb 0x1000ff28f
mov r9, qword [r13 + 8]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x17
call fcn.10001da24
jmp 0x1000ff28f
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1000fe618
cmp eax, ebp
mov ebx, eax
jge 0x1000fedb8
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000ff28f
test byte [rcx + 0x1c], 1
je 0x1000ff28f
cmp byte [rcx + 0x19], 2
jb 0x1000ff28f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x18
mov r9d, eax
call fcn.10001c7dc
jmp 0x1000ff28f
mov rdx, qword [r13 + 8]
lea rcx, [rsp + 0x88]
xor r8d, r8d
call fcn.1000f24ac
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xd8]
xor r8d, r8d
mov rdi, rax
call fcn.1000f24ac
lea r8, [rsp + 0x180]
mov rdx, rdi
mov rcx, rax
call fcn.1000fbf88
lea rcx, [rsp + 0xd8]
call fcn.1000f2568
lea rcx, [rsp + 0x88]
call fcn.1000f2568
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x180]
call fcn.1000fca68
mov r15, qword [rsp + 0x38]
cmp eax, ebp
mov ebx, eax
jl 0x1000ff288
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
add ecx, 0x105
mov esi, ecx
lea rdi, [rcx + rcx]
mov qword [rsp + 0x60], rsi
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x1000fee6f
mov ebx, 0x8007000e
jmp 0x1000ff278
mov r8, rdi
xor edx, edx
mov rcx, rbp
call sub.msvcrt.dll_memset
mov r8, r15
mov rdx, rsi
mov rcx, rbp
call fcn.100043e4c
xor esi, esi
cmp eax, esi
mov ebx, eax
jl 0x1000ff276
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
mov eax, ecx
lea edi, [rcx + 1]
lea ecx, [rsi + 0x5c]
mov word [rbp + rax*2], cx
mov word [rbp + rdi*2], si
cmp r15, rsi
jne 0x1000feed3
mov rax, qword [rsp + 0x140]
mov word [rax], si
mov dword [rsp + 0x148], esi
jmp 0x1000feeef
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x130]
mov rdx, r15
mov r8d, eax
call fcn.1000f2a80
lea rdx, [0x10000a0d4]
lea rcx, [rsp + 0x130]
call fcn.1000f2c3c
mov rcx, qword [rsp + 0x140]
lea rdx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x1000fef89
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
je 0x1000fef82
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff254
test byte [rcx + 0x1c], 1
je 0x1000ff254
cmp byte [rcx + 0x19], 2
jb 0x1000ff254
mov r9, qword [rsp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x19
mov dword [rsp + 0x20], edi
call fcn.10001daa4
jmp 0x1000ff254
mov ebx, esi
jmp 0x1000ff262
movsxd rax, edi
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x1fc]
lea rdi, [0x10000a0dc]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1000ff193
lea rsi, [rsp + 0x1fc]
lea rdi, [0x10000a0e0]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1000ff193
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x1fc]
xor esi, esi
mov rcx, rbp
mov word [rbp + rax*2], si
call fcn.1000590dc
cmp eax, esi
mov ebx, eax
jl 0x1000ff1ff
mov edx, dword [rsp + 0x1d0]
test dl, 0x10
je 0x1000ff117
bt edx, 0xa
jb 0x1000ff117
cmp dword [rsp + 0x50], esi
jne 0x1000ff06b
cmp dword [r13 + 0x10], 0x64
jne 0x1000ff06b
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff195
test byte [rcx + 0x1c], 1
je 0x1000ff195
cmp byte [rcx + 0x19], 3
jb 0x1000ff195
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x1a]
lea r9, [rsp + 0x1fc]
lea r8, [0x100003000]
mov dword [rsp + 0x20], 0x64
call fcn.10001daa4
jmp 0x1000ff195
test byte [rsp + 0x48], 8
mov edi, dword [rsp + 0x34]
jne 0x1000ff0c8
cmp edi, 0x64
jb 0x1000ff0c8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff0b8
test byte [rcx + 0x1c], 1
je 0x1000ff0b8
cmp byte [rcx + 0x19], 4
jb 0x1000ff0b8
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
lea r8, [0x100003000]
lea r9d, [rdx + 0x49]
mov qword [rsp + 0x20], r15
call fcn.10001d8f8
mov rax, qword [rsp + 0x80]
mov byte [rax], 1
jmp 0x1000ff195
mov r8d, dword [r13 + 0x10]
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x1fc]
inc r8d
call fcn.1000fe190
mov r12, qword [rsp + 0x40]
cmp eax, esi
mov ebx, eax
jl 0x1000ff1ff
mov rcx, qword [rsp + 0x78]
mov rdx, r12
call fcn.1000fe294
cmp eax, esi
mov ebx, eax
jl 0x1000ff1ff
inc edi
mov r12, rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x34], edi
jmp 0x1000ff195
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1d0]
mov rcx, rbp
mov byte [rsp + 0x30], 1
call fcn.1000fe878
cmp eax, esi
mov ebx, eax
jge 0x1000ff189
mov al, byte [rsp + 0x30]
mov byte [r14], al
cmp byte [rsp + 0x4c], sil
je 0x1000ff1b6
cmp al, sil
je 0x1000ff1b6
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff185
test byte [rcx + 0x1c], 1
je 0x1000ff185
cmp byte [rcx + 0x19], 4
jb 0x1000ff185
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x1c
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
mov ebx, esi
jmp 0x1000ff195
mov rax, qword [rsp + 0x68]
inc qword [rax]
jmp 0x1000ff195
xor esi, esi
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
je 0x1000ff204
mov rax, qword [rsp + 0x70]
jmp 0x1000fef91
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff262
test byte [rcx + 0x1c], 1
je 0x1000ff262
cmp byte [rcx + 0x19], 2
jb 0x1000ff262
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x1d
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
jmp 0x1000ff262
mov byte [r14], sil
jmp 0x1000ff262
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x1000ff262
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff251
test byte [rcx + 0x1c], 1
je 0x1000ff251
cmp byte [rcx + 0x19], 2
jb 0x1000ff251
mov r9, qword [rsp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x1e
mov dword [rsp + 0x20], edi
call fcn.10001daa4
mov byte [r14], sil
movzx ebx, di
or ebx, 0x80070000
cmp edi, esi
cmovle ebx, edi
mov rax, qword [rsp + 0x38]
cmp rax, 0xffffffffffffffff
je 0x1000ff276
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp rbp, rax
je 0x1000ff286
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor ebp, ebp
lea rdi, [0x1001653b8]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
cmp r12, rbp
je 0x1000ff2c1
mov rcx, qword [r12 + 8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r12
mov qword [r12 + 8], rbp
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000ff2ee
test byte [rcx + 0x1c], 1
je 0x1000ff2ee
cmp byte [rcx + 0x19], 5
jb 0x1000ff2ee
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003000]
mov edx, 0x1f
call fcn.10001c7b8
lea rcx, [rsp + 0x180]
call fcn.1000f2568
lea rcx, [rsp + 0x130]
call fcn.1000f2568
mov eax, ebx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x478]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret