Function at 0x10009e7b4
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x350]
mov r12, qword [rsp + 0x358]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
mov r14, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009e833
test byte [rcx + 0x1c], 1
je 0x10009e833
cmp byte [rcx + 0x19], 5
jb 0x10009e833
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x1b
call fcn.10001c7b8
or qword [rsp + 0x60], 0xffffffffffffffff
xor eax, eax
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x250
mov ebx, eax
mov rsi, rax
mov rdi, rax
mov qword [rsp + 0x38], rax
mov r13, rax
mov qword [rsp + 0x40], rax
mov r15, rax
mov qword [rsp + 0x48], rax
mov rbp, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], eax
call sub.msvcrt.dll_memset
xor eax, eax
mov byte [r12], al
cmp dword [r14 + 0x10], 0x64
jbe 0x10009e890
mov ebx, 0x80070057
jmp 0x10009e9e0
bt dword [r14], 0xa
mov byte [r14 + 0x14], 1
jae 0x10009e8e5
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009e9e7
test byte [rcx + 0x1c], 1
je 0x10009e9e7
cmp byte [rcx + 0x19], 5
jb 0x10009e9e7
mov r9, qword [r14 + 8]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x1c
call fcn.10001da24
jmp 0x10009e9e7
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rcx]
call fcn.10009b4ec
mov ebx, eax
xor eax, eax
cmp ebx, eax
jge 0x10009e948
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009edde
test byte [rcx + 0x1c], 1
je 0x10009edde
cmp byte [rcx + 0x19], 2
jb 0x10009edde
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1d]
lea r8, [0x100003ae8]
mov r9d, ebx
call fcn.10001c7dc
jmp 0x10009edde
mov rdi, qword [rsp + 0x38]
mov rdx, qword [r14 + 8]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.10009e68c
mov ebx, eax
xor eax, eax
cmp ebx, eax
jge 0x10009e9a2
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009e99b
test byte [rcx + 0x1c], 1
je 0x10009e99b
cmp byte [rcx + 0x19], 2
jb 0x10009e99b
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1e]
lea r8, [0x100003ae8]
mov r9d, ebx
call fcn.10001c7dc
mov r13, qword [rsp + 0x40]
jmp 0x10009e9e7
mov r13, qword [rsp + 0x40]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
add ecx, 0x105
mov ebx, ecx
lea rax, [rcx + rcx]
mov ecx, 0xffffffff
mov qword [rsp + 0x80], rbx
cmp rax, rcx
jbe 0x10009eaad
mov ebx, 0x80070216
mov rdi, qword [rsp + 0x38]
lea r12, [0x1001653b8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp r15, rax
je 0x10009ea02
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r15d, r15d
cmp rsi, r15
je 0x10009ea13
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rdi, r15
je 0x10009ea21
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r13, r15
je 0x10009ea2f
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbp, r15
je 0x10009ea53
mov rcx, qword [rbp + 8]
cmp rcx, r15
je 0x10009ea47
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp + 8], r15
mov rcx, rbp
mov qword [rbp + 8], r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10009ea80
test byte [rcx + 0x1c], 1
je 0x10009ea80
cmp byte [rcx + 0x19], 5
jb 0x10009ea80
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x25
call fcn.10001c7b8
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10014e480
mov rbx, qword [rsp + 0x338]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
mov edi, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
mov qword [rsp + 0x40], rax
xor eax, eax
cmp rsi, rax
jne 0x10009ead0
mov ebx, 0x8007000e
jmp 0x10009e9db
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call fcn.100043e4c
xor edx, edx
cmp eax, edx
mov ebx, eax
jl 0x10009e9db
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
lea r8, [rsp + 0x48]
not rcx
dec rcx
mov eax, ecx
lea edi, [rcx + 1]
lea ecx, [rdx + 0x5c]
mov word [rsi + rax*2], cx
mov word [rsi + rdi*2], dx
lea rdx, [0x10000a0d4]
mov rcx, r13
call fcn.10009b5b0
mov r15, qword [rsp + 0x48]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009e9db
lea rdx, [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x10009ebc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
je 0x10009ebb7
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009eba2
test byte [rcx + 0x1c], 1
je 0x10009eba2
cmp byte [rcx + 0x19], 2
jb 0x10009eba2
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x1f
mov r9, r15
mov dword [rsp + 0x20], eax
call fcn.10001daa4
movzx ebx, di
xor eax, eax
or ebx, 0x80070000
cmp edi, eax
cmovle ebx, edi
jmp 0x10009edde
xor eax, eax
mov ebx, eax
jmp 0x10009e9db
movsxd rax, edi
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0xbc]
lea rdi, [0x10000a0dc]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x10009ed73
lea rsi, [rsp + 0xbc]
lea rdi, [0x10000a0e0]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
mov rsi, qword [rsp + 0x40]
je 0x10009ed78
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
lea r8, [rsp + 0xbc]
mov word [rsi + rax*2], cx
mov rcx, rsi
call fcn.1000590dc
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009ee44
mov edx, dword [rsp + 0x90]
test dl, 0x10
je 0x10009ed47
bt edx, 0xa
jb 0x10009ed47
mov r8d, dword [r14 + 0x10]
lea r9d, [rax + 0x64]
cmp r8d, r9d
jne 0x10009eca9
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009ed78
test byte [rcx + 0x1c], 1
je 0x10009ed78
cmp byte [rcx + 0x19], 3
jb 0x10009ed78
mov rcx, qword [rcx + 0x10]
lea edx, [r9 - 0x44]
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0xbc]
lea r8, [0x100003ae8]
call fcn.10001daa4
jmp 0x10009ed78
mov edi, dword [rsp + 0x50]
cmp edi, r9d
jb 0x10009ecf8
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009eceb
test byte [rcx + 0x1c], 1
je 0x10009eceb
cmp byte [rcx + 0x19], 4
jb 0x10009eceb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x21
mov qword [rsp + 0x20], r13
call fcn.10001d8f8
mov rax, qword [rsp + 0x70]
mov byte [rax], 1
jmp 0x10009ed78
lea r9, [rsp + 0x58]
lea rcx, [rsp + 0xbc]
inc r8d
call fcn.10009e0e8
mov rbp, qword [rsp + 0x58]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009ee44
mov rcx, qword [rsp + 0x68]
mov rdx, rbp
call fcn.10009e2ac
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009ee44
inc edi
mov rbp, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], edi
jmp 0x10009ed78
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
mov rcx, rsi
mov byte [rsp + 0x30], 1
call fcn.10009d894
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009ed9b
mov rax, qword [rsp + 0x78]
inc qword [rax]
jmp 0x10009ed78
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
cmp eax, ecx
je 0x10009ede8
mov rax, qword [rsp + 0x48]
jmp 0x10009ebc8
mov al, byte [rsp + 0x30]
mov byte [r12], al
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009edde
test byte [rcx + 0x1c], 1
je 0x10009edde
cmp byte [rcx + 0x19], 2
jb 0x10009edde
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x23
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.10001daa4
mov rdi, qword [rsp + 0x38]
jmp 0x10009e9e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x10009e9db
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009ee34
test byte [rcx + 0x1c], 1
je 0x10009ee34
cmp byte [rcx + 0x19], 2
jb 0x10009ee34
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003ae8]
mov edx, 0x24
mov r9, r15
mov dword [rsp + 0x20], edi
call fcn.10001daa4
movzx ebx, di
xor eax, eax
or ebx, 0x80070000
cmp edi, eax
cmovle ebx, edi
mov byte [r12], al
jmp 0x10009e9db