Function at 0x140001460
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4a8]
sub rsp, 0x580
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400100a8]
xor rax, rsp
mov qword [rbp + 0x470], rax
mov r13, rcx
xor edi, edi
mov dword [rbp + 0x250], edi
mov esi, edi
mov qword [rsp + 0x20], rdi
mov ebx, edi
mov qword [rsp + 0x28], rbx
mov r14d, edi
mov qword [rsp + 0x30], rdi
mov edx, 0x104
lea rcx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400018f0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x260]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x260]
lea rcx, [0x1400af240]
call fcn.140002820
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x260]
repne scasw ax, word [rdi]
not rcx
movzx edx, word [rbp + rcx*2 + 0x25c]
lea rcx, [0x14000d590]
call fcn.140003adc
test rax, rax
jne 0x140001548
lea r8d, [r14 + 1]
lea rdx, [0x14000d590]
lea rcx, [0x1400af240]
call fcn.140002130
mov dword [rbp + 0x250], 0x7dad205f
mov word [rbp + 0x254], 0x5af
xor r8d, r8d
mov ecx, r8d
lea rdx, [rbp + 0x250]
nop dword [rax + rax]
movzx eax, byte [rdx]
sub al, cl
ror al, 1
neg al
ror al, 3
mov byte [rdx], al
inc ecx
inc rdx
cmp ecx, 6
jb 0x140001570
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], r8
mov byte [rsp + 0x58], r8b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x250]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x250]
lea rcx, [rsp + 0x58]
call fcn.140002550
nop
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x58]
call fcn.140001060
nop
cmp qword [rax + 0x18], 8
jb 0x1400015dc
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.140003160
nop
cmp qword [rbp - 0x40], 8
jb 0x1400015f9
mov rcx, qword [rbp - 0x58]
call fcn.140003b4c
mov qword [rbp - 0x40], 7
xor edi, edi
mov qword [rbp - 0x48], rdi
mov word [rbp - 0x58], di
cmp qword [rsp + 0x70], 0x10
jb 0x14000161d
mov rcx, qword [rsp + 0x58]
call fcn.140003b4c
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x68], rdi
mov byte [rsp + 0x58], 0
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x1400018b3
test rax, rax
je 0x1400018b3
nop
test byte [rbp], 0x10
jne 0x140001871
lea rdx, [rbp + 0x2c]
lea rcx, [rbp - 0x30]
call fcn.140003160
mov r12, rax
cmp rax, rbx
jae 0x140001784
cmp rsi, rax
ja 0x140001784
sub r12, rsi
movabs r8, 0x6666666666666667
mov rax, r8
imul r12
mov r12, rdx
sar r12, 4
mov rax, r12
shr rax, 0x3f
add r12, rax
cmp rbx, r14
jne 0x140001750
mov rcx, rbx
sub rcx, rsi
mov rax, r8
imul rcx
mov rdi, rdx
sar rdi, 4
mov rax, rdi
shr rax, 0x3f
add rdi, rax
movabs rax, 0x666666666666665
cmp rdi, rax
ja 0x140001887
inc rdi
mov rcx, r14
sub rcx, rsi
mov rax, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jbe 0x14000174e
mov rcx, rdx
shr rcx, 1
movabs rax, 0x666666666666666
sub rax, rcx
cmp rax, rdx
jae 0x14000172b
xor r8d, r8d
mov edx, r8d
jmp 0x14000172e
add rdx, rcx
cmp rdx, rdi
cmovb rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140002b00
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
xor edi, edi
lea rax, [r12 + r12*4]
lea rdx, [rsi + rax*8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
test rbx, rbx
je 0x14000177f
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
mov rcx, rbx
call fcn.1400020a0
nop
jmp 0x140001858
cmp rbx, r14
jne 0x14000182e
mov rcx, rbx
sub rcx, rsi
movabs r8, 0x6666666666666667
mov rax, r8
imul rcx
mov rdi, rdx
sar rdi, 4
mov rax, rdi
shr rax, 0x3f
add rdi, rax
movabs rax, 0x666666666666665
cmp rdi, rax
ja 0x140001894
inc rdi
mov rcx, r14
sub rcx, rsi
mov rax, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdi, rdx
jbe 0x14000182c
mov rcx, rdx
shr rcx, 1
movabs rax, 0x666666666666666
sub rax, rcx
cmp rax, rdx
jae 0x140001809
xor r8d, r8d
mov edx, r8d
jmp 0x14000180c
add rdx, rcx
cmp rdx, rdi
cmovb rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140002b00
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
xor edi, edi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
test rbx, rbx
je 0x140001858
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
mov rdx, r12
mov rcx, rbx
call fcn.1400020a0
nop
add rbx, 0x28
mov qword [rsp + 0x28], rbx
cmp qword [rbp - 0x18], 8
jb 0x140001871
mov rcx, qword [rbp - 0x30]
call fcn.140003b4c
lea rdx, [rbp]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400018a1
jmp 0x140001660
lea rcx, str.vector_T__too_long
call fcn.140003370
int3
lea rcx, str.vector_T__too_long
call fcn.140003370
nop
cmp qword [rbp - 0x68], 8
jb 0x1400018f0
mov rcx, qword [rbp - 0x80]
call fcn.140003b4c
jmp 0x1400018f0
mov qword [r13], rdi
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], rdi
lea rax, [rsp + 0x20]
cmp r13, rax
je 0x1400018dd
mov rcx, r13
call fcn.1400024d0
mov qword [r13], rdi
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], rdi
cmp qword [rbp - 0x68], 8
jb 0x1400018ee
mov rcx, qword [rbp - 0x80]
call fcn.140003b4c
nop
jmp 0x140001961
mov qword [r13], rdi
mov qword [r13 + 8], rdi
mov qword [r13 + 0x10], rdi
lea rax, [rsp + 0x20]
cmp r13, rax
je 0x140001920
mov rcx, r13
call fcn.1400024d0
mov qword [r13], rsi
mov qword [r13 + 8], rbx
mov qword [r13 + 0x10], r14
mov rsi, rdi
mov rbx, rdi
test rsi, rsi
je 0x140001961
mov rdi, rsi
cmp rsi, rbx
je 0x140001959
xor eax, eax
nop
cmp qword [rdi + 0x18], 8
jb 0x140001941
mov rcx, qword [rdi]
call fcn.140003b4c
xor eax, eax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rax
mov word [rdi], ax
add rdi, 0x28
cmp rdi, rbx
jne 0x140001930
mov rcx, rsi
call fcn.140003b4c
mov rax, r13
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140003470
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret