Function at 0x10009620
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov r11, rsp
sub rsp, 0x1b8
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rdx], 0
mov qword [r11 - 8], rbp
mov qword [r11 - 0x10], rsi
mov rsi, rcx
mov rbp, r8
mov qword [rsp + 0x38], rdx
je 0x1000994e
cmp byte [r8], 0
je 0x1000994e
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x18], rdi
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp ecx, 0x104
mov rbx, rcx
jge 0x1000993e
mov rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x104
jae 0x1000993e
mov ecx, 0x400
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdx, rbp
mov r8, rax
mov qword [rsp + 0x48], rax
sub rax, rbp
nop
nop
nop
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
mov byte [rax + rdx - 1], cl
jne 0x100096d0
movsxd rax, ebx
mov qword [rsp + 0x40], rax
cmp byte [rax + r8 - 1], 0x5c
je 0x10009708
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov word [rdi - 1], ax
mov rdx, qword [rsp + 0x38]
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x10009720
lea rdx, [rsp + 0x50]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x30], rax
je 0x10009934
nop
cmp dword [rsi + 0x64], 0
je 0x10009929
mov rcx, rsi
call fcn.10004a20
test eax, eax
jne 0x10009929
cmp dword [rsi + 0x28], eax
jne 0x10009929
lea rcx, [rsp + 0x7c]
call fcn.10009550
test eax, eax
jne 0x10009911
test byte [rsp + 0x50], 0x10
je 0x1000982d
mov ecx, 0x400
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdx, rbp
mov rbx, rax
sub rax, rbp
nop
nop
nop
nop
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
mov byte [rax + rdx - 1], cl
jne 0x100097b0
mov rax, qword [rsp + 0x40]
cmp byte [rax + rbx - 1], 0x5c
je 0x100097e4
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov word [rdi - 1], ax
xor eax, eax
mov rdi, rbx
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x7c]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x10009800
mov rdx, qword [rsp + 0x38]
mov r8, rbx
mov rcx, rsi
call fcn.10009620
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
jmp 0x10009911
mov ecx, 0x400
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
xor edx, edx
mov r8d, 0x400
mov rcx, rax
mov rbx, rax
call sub.MSVCR80.dll_memset
mov edx, dword [rsp + 0x50]
lea r8, [rbx + 4]
mov dword [rbx], edx
mov ecx, dword [rsp + 0x6c]
add r8, 8
mov dword [r8 - 8], ecx
mov ecx, dword [rsp + 0x70]
mov rdx, r8
mov dword [r8 - 4], ecx
sub rdx, rbp
mov rcx, rbp
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x10009871
mov rax, qword [rsp + 0x40]
cmp byte [rax + r8 - 1], 0x5c
je 0x100098a6
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x10016670]
mov word [rdi - 1], ax
xor eax, eax
mov rdi, r8
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x7c]
nop
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x100098c0
mov rdi, r8
xor eax, eax
sub r8d, ebx
mov rcx, 0xffffffffffffffff
mov r9, rbx
mov edx, 0xa021
repne scasb al, byte [rdi]
mov word [rsp + 0x28], 0
not rcx
lea eax, [rcx + r8]
mov r8d, 0x400
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.10004e70
mov rcx, rbx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009750
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x48]
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x1d8]
mov rdi, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x1b8
ret