Function at 0x14000dec3
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov rax, qword [0x1400ca008]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov r12, r8
mov rsi, rcx
movabs rbx, 0x200000000801
cmp rdx, rcx
je 0x14000df3a
mov al, byte [rdx]
sub al, 0x2f
cmp al, 0x2d
ja 0x14000df26
movsx rax, al
bt rbx, rax
jb 0x14000df3a
mov rcx, rsi
call fcn.140012261
mov rdx, rax
cmp rax, rsi
jne 0x14000df0c
mov r8b, byte [rdx]
cmp r8b, 0x3a
jne 0x14000df69
lea rax, [rsi + 1]
cmp rdx, rax
je 0x14000df69
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14000dd19
jmp 0x14000e226
sub r8b, 0x2f
xor edi, edi
cmp r8b, 0x2d
ja 0x14000df89
movsx rax, r8b
bt rbx, rax
mov al, 1
jb 0x14000df8c
mov al, dil
sub rdx, rsi
mov qword [rbp - 0x60], rdi
inc rdx
mov qword [rbp - 0x58], rdi
neg al
mov qword [rbp - 0x50], rdi
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x48], rdi
sbb r13, r13
mov qword [rbp - 0x40], rdi
and r13, rdx
mov byte [rbp - 0x38], dil
xor edx, edx
call fcn.14000ca07
mov rax, qword [rsp + 0x38]
mov r15d, 0xfde9
cmp dword [rax + 0xc], r15d
jne 0x14000dff2
cmp byte [rsp + 0x48], dil
je 0x14000dfea
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x14000e03b
call fcn.140010782
test eax, eax
jne 0x14000e021
cmp byte [rsp + 0x48], dil
je 0x14000e016
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x14000e03b
cmp byte [rsp + 0x48], dil
je 0x14000e038
mov rax, qword [rsp + 0x30]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.14000d77e
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x30]
test eax, eax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
cmovne rcx, rdi
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000e08d
mov r9, r12
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.14000dd19
mov edi, eax
jmp 0x14000e211
mov r14, qword [r12 + 8]
sub r14, qword [r12]
sar r14, 3
xor edx, edx
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], dil
call fcn.14000ca07
mov rax, qword [rsp + 0x58]
cmp dword [rax + 0xc], r15d
jne 0x14000e0ee
cmp byte [rsp + 0x68], dil
je 0x14000e0e6
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, r15d
jmp 0x14000e137
call fcn.140010782
test eax, eax
jne 0x14000e11d
cmp byte [rsp + 0x68], dil
je 0x14000e112
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x14000e137
cmp byte [rsp + 0x68], dil
je 0x14000e134
mov rax, qword [rsp + 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, edi
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 4]
call fcn.14000d920
mov r15, qword [rbp - 0x80]
test eax, eax
mov rcx, r15
cmovne rcx, rdi
cmp byte [rcx], 0x2e
jne 0x14000e178
mov al, byte [rcx + 1]
test al, al
je 0x14000e192
cmp al, 0x2e
jne 0x14000e178
cmp byte [rcx + 2], dil
je 0x14000e192
mov r9, r12
mov r8, r13
mov rdx, rsi
call fcn.14000dd19
mov edi, eax
test eax, eax
jne 0x14000e1f6
xor edi, edi
cmp byte [rbp - 0x68], dil
je 0x14000e1a4
mov rcx, r15
call fcn.14000cbb5
lea rdx, [rbp - 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r15d, 0xfde9
test eax, eax
jne 0x14000e09a
mov rax, qword [r12]
mov rdx, qword [r12 + 8]
sub rdx, rax
sar rdx, 3
cmp r14, rdx
je 0x14000e208
sub rdx, r14
lea rcx, [rax + r14*8]
lea r9, [0x14000d76a]
mov r8d, 8
call fcn.140011828
jmp 0x14000e208
cmp byte [rbp - 0x68], 0
je 0x14000e208
mov rcx, r15
call fcn.14000cbb5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp - 0x38], 0
je 0x14000e224
mov rcx, qword [rbp - 0x50]
call fcn.14000cbb5
mov eax, edi
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140009348
mov rbx, qword [rsp + 0x388]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret