Function at 0x1000fefc0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x430
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x490]
mov r14, qword [rsp + 0x498]
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x80], rax
mov rdi, r8
mov qword [rsp + 0x78], r8
mov esi, edx
mov dword [rsp + 0x48], edx
mov r13, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff04b
test byte [rcx + 0x1c], 1
je 0x1000ff04b
cmp byte [rcx + 0x19], 5
jb 0x1000ff04b
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x16
call fcn.10001c854
mov eax, dword [rsp + 0x14c]
xor ebp, ebp
lea rcx, [rsp + 0x150]
and eax, 0xfffffffe
lea edx, [rbp + 0x18]
mov qword [rsp + 0x140], rcx
and eax, 0xfffffffb
lea rcx, [rsp + 0x1a0]
mov dword [rsp + 0x138], edx
or eax, 2
mov qword [rsp + 0x190], rcx
mov dword [rsp + 0x188], edx
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x19c]
lea rcx, [rsp + 0x1d0]
and eax, 0xfffffffe
xor edx, edx
mov r8d, 0x250
and eax, 0xfffffffb
mov ebx, ebp
mov qword [rsp + 0x58], rbp
or eax, 2
mov r15, rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x19c], eax
mov eax, esi
mov r12, rbp
shr eax, 1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x130], rbp
and al, 1
mov dword [rsp + 0x148], ebp
mov word [rsp + 0x150], bp
mov qword [rsp + 0x180], rbp
mov dword [rsp + 0x198], ebp
mov word [rsp + 0x1a0], bp
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x34], ebp
call sub.msvcrt.dll_memset
mov eax, esi
mov byte [r14], bpl
and eax, 4
mov dword [rsp + 0x50], eax
jne 0x1000ff133
cmp dword [r13 + 0x10], 0x64
jbe 0x1000ff133
mov ebx, 0x80070057
jmp 0x1000ff6b4
bt dword [r13], 0xa
mov byte [r13 + 0x14], 1
jae 0x1000ff189
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000ff6bb
test byte [rcx + 0x1c], 1
je 0x1000ff6bb
cmp byte [rcx + 0x19], 5
jb 0x1000ff6bb
mov r9, qword [r13 + 8]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x17
call fcn.10001db08
jmp 0x1000ff6bb
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1000fea44
cmp eax, ebp
mov ebx, eax
jge 0x1000ff1e4
mov rcx, qword [0x1001653b8]
lea rdi, [0x1001653b8]
cmp rcx, rdi
je 0x1000ff6bb
test byte [rcx + 0x1c], 1
je 0x1000ff6bb
cmp byte [rcx + 0x19], 2
jb 0x1000ff6bb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x18
mov r9d, eax
call fcn.10001c878
jmp 0x1000ff6bb
mov rdx, qword [r13 + 8]
lea rcx, [rsp + 0x88]
xor r8d, r8d
call fcn.1000f29c4
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xd8]
xor r8d, r8d
mov rdi, rax
call fcn.1000f29c4
lea r8, [rsp + 0x180]
mov rdx, rdi
mov rcx, rax
call fcn.1000fc3d4
lea rcx, [rsp + 0xd8]
call fcn.1000f2a80
lea rcx, [rsp + 0x88]
call fcn.1000f2a80
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x180]
call fcn.1000fceb4
mov r15, qword [rsp + 0x38]
cmp eax, ebp
mov ebx, eax
jl 0x1000ff6b4
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasw ax, word [rdi]
not rcx
add ecx, 0x105
mov esi, ecx
lea rdi, [rcx + rcx]
mov qword [rsp + 0x60], rsi
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rbp, rax
xor eax, eax
cmp rbp, rax
jne 0x1000ff29b
mov ebx, 0x8007000e
jmp 0x1000ff6a4
mov r8, rdi
xor edx, edx
mov rcx, rbp
call sub.msvcrt.dll_memset
mov r8, r15
mov rdx, rsi
mov rcx, rbp
call fcn.1000c23ac
xor esi, esi
cmp eax, esi
mov ebx, eax
jl 0x1000ff6a2
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
dec rcx
mov eax, ecx
lea edi, [rcx + 1]
lea ecx, [rsi + 0x5c]
mov word [rbp + rax*2], cx
mov word [rbp + rdi*2], si
cmp r15, rsi
jne 0x1000ff2ff
mov rax, qword [rsp + 0x140]
mov word [rax], si
mov dword [rsp + 0x148], esi
jmp 0x1000ff31b
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x130]
mov rdx, r15
mov r8d, eax
call fcn.1000f2f98
lea rdx, [0x10000a054]
lea rcx, [rsp + 0x130]
call fcn.1000f3154
mov rcx, qword [rsp + 0x140]
lea rdx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x1000ff3b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
je 0x1000ff3ae
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff680
test byte [rcx + 0x1c], 1
je 0x1000ff680
cmp byte [rcx + 0x19], 2
jb 0x1000ff680
mov r9, qword [rsp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x19
mov dword [rsp + 0x20], edi
call fcn.10001ddb0
jmp 0x1000ff680
mov ebx, esi
jmp 0x1000ff68e
movsxd rax, edi
mov qword [rsp + 0x70], rax
lea rsi, [rsp + 0x1fc]
lea rdi, [0x10000a05c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x1000ff5bf
lea rsi, [rsp + 0x1fc]
lea rdi, [0x10000a060]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x1000ff5bf
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x1fc]
xor esi, esi
mov rcx, rbp
mov word [rbp + rax*2], si
call fcn.100059424
cmp eax, esi
mov ebx, eax
jl 0x1000ff62b
mov edx, dword [rsp + 0x1d0]
test dl, 0x10
je 0x1000ff543
bt edx, 0xa
jb 0x1000ff543
cmp dword [rsp + 0x50], esi
jne 0x1000ff497
cmp dword [r13 + 0x10], 0x64
jne 0x1000ff497
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff5c1
test byte [rcx + 0x1c], 1
je 0x1000ff5c1
cmp byte [rcx + 0x19], 3
jb 0x1000ff5c1
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0x1a]
lea r9, [rsp + 0x1fc]
lea r8, [0x100002fc0]
mov dword [rsp + 0x20], 0x64
call fcn.10001ddb0
jmp 0x1000ff5c1
test byte [rsp + 0x48], 8
mov edi, dword [rsp + 0x34]
jne 0x1000ff4f4
cmp edi, 0x64
jb 0x1000ff4f4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff4e4
test byte [rcx + 0x1c], 1
je 0x1000ff4e4
cmp byte [rcx + 0x19], 4
jb 0x1000ff4e4
mov rcx, qword [rcx + 0x10]
mov edx, 0x1b
lea r8, [0x100002fc0]
lea r9d, [rdx + 0x49]
mov qword [rsp + 0x20], r15
call fcn.10001d9dc
mov rax, qword [rsp + 0x80]
mov byte [rax], 1
jmp 0x1000ff5c1
mov r8d, dword [r13 + 0x10]
lea r9, [rsp + 0x40]
lea rcx, [rsp + 0x1fc]
inc r8d
call fcn.1000fe5ac
mov r12, qword [rsp + 0x40]
cmp eax, esi
mov ebx, eax
jl 0x1000ff62b
mov rcx, qword [rsp + 0x78]
mov rdx, r12
call fcn.1000fe6b0
cmp eax, esi
mov ebx, eax
jl 0x1000ff62b
inc edi
mov r12, rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x34], edi
jmp 0x1000ff5c1
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x1d0]
mov rcx, rbp
mov byte [rsp + 0x30], 1
call fcn.1000feca4
cmp eax, esi
mov ebx, eax
jge 0x1000ff5b5
mov al, byte [rsp + 0x30]
mov byte [r14], al
cmp byte [rsp + 0x4c], sil
je 0x1000ff5e2
cmp al, sil
je 0x1000ff5e2
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff5b1
test byte [rcx + 0x1c], 1
je 0x1000ff5b1
cmp byte [rcx + 0x19], 4
jb 0x1000ff5b1
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x1c
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
mov ebx, esi
jmp 0x1000ff5c1
mov rax, qword [rsp + 0x68]
inc qword [rax]
jmp 0x1000ff5c1
xor esi, esi
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
je 0x1000ff630
mov rax, qword [rsp + 0x70]
jmp 0x1000ff3bd
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff68e
test byte [rcx + 0x1c], 1
je 0x1000ff68e
cmp byte [rcx + 0x19], 2
jb 0x1000ff68e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x1d
mov r9, rbp
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
jmp 0x1000ff68e
mov byte [r14], sil
jmp 0x1000ff68e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x1000ff68e
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x1000ff67d
test byte [rcx + 0x1c], 1
je 0x1000ff67d
cmp byte [rcx + 0x19], 2
jb 0x1000ff67d
mov r9, qword [rsp + 0x140]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x1e
mov dword [rsp + 0x20], edi
call fcn.10001ddb0
mov byte [r14], sil
movzx ebx, di
or ebx, 0x80070000
cmp edi, esi
cmovle ebx, edi
mov rax, qword [rsp + 0x38]
cmp rax, 0xffffffffffffffff
je 0x1000ff6a2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp rbp, rax
je 0x1000ff6b2
mov rcx, rbp
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor ebp, ebp
lea rdi, [0x1001653b8]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_free]
cmp r12, rbp
je 0x1000ff6ed
mov rcx, qword [r12 + 8]
call qword [sym.imp.msvcrt.dll_free]
mov rcx, r12
mov qword [r12 + 8], rbp
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [0x1001653b8]
cmp rcx, rdi
je 0x1000ff71a
test byte [rcx + 0x1c], 1
je 0x1000ff71a
cmp byte [rcx + 0x19], 5
jb 0x1000ff71a
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fc0]
mov edx, 0x1f
call fcn.10001c854
lea rcx, [rsp + 0x180]
call fcn.1000f2a80
lea rcx, [rsp + 0x130]
call fcn.1000f2a80
mov eax, ebx
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x478]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret