Function at 0x10009ed90
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rax, qword [rsp + 0x350]
mov r12, qword [rsp + 0x358]
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
mov r14, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009ee0f
test byte [rcx + 0x1c], 1
je 0x10009ee0f
cmp byte [rcx + 0x19], 5
jb 0x10009ee0f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x1b
call fcn.10001c854
or qword [rsp + 0x60], 0xffffffffffffffff
xor eax, eax
lea rcx, [rsp + 0x90]
xor edx, edx
mov r8d, 0x250
mov ebx, eax
mov rsi, rax
mov rdi, rax
mov qword [rsp + 0x38], rax
mov r13, rax
mov qword [rsp + 0x40], rax
mov r15, rax
mov qword [rsp + 0x48], rax
mov rbp, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], eax
call sub.msvcrt.dll_memset
xor eax, eax
mov byte [r12], al
cmp dword [r14 + 0x10], 0x64
jbe 0x10009ee6c
mov ebx, 0x80070057
jmp 0x10009efbc
bt dword [r14], 0xa
mov byte [r14 + 0x14], 1
jae 0x10009eec1
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009efc3
test byte [rcx + 0x1c], 1
je 0x10009efc3
cmp byte [rcx + 0x19], 5
jb 0x10009efc3
mov r9, qword [r14 + 8]
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x1c
call fcn.10001db08
jmp 0x10009efc3
mov rcx, qword [rsp + 0x68]
lea rdx, [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rcx]
call fcn.10009bac4
mov ebx, eax
xor eax, eax
cmp ebx, eax
jge 0x10009ef24
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009f3ba
test byte [rcx + 0x1c], 1
je 0x10009f3ba
cmp byte [rcx + 0x19], 2
jb 0x10009f3ba
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1d]
lea r8, [0x100003aa8]
mov r9d, ebx
call fcn.10001c878
jmp 0x10009f3ba
mov rdi, qword [rsp + 0x38]
mov rdx, qword [r14 + 8]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.10009ec68
mov ebx, eax
xor eax, eax
cmp ebx, eax
jge 0x10009ef7e
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009ef77
test byte [rcx + 0x1c], 1
je 0x10009ef77
cmp byte [rcx + 0x19], 2
jb 0x10009ef77
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x1e]
lea r8, [0x100003aa8]
mov r9d, ebx
call fcn.10001c878
mov r13, qword [rsp + 0x40]
jmp 0x10009efc3
mov r13, qword [rsp + 0x40]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
add ecx, 0x105
mov ebx, ecx
lea rax, [rcx + rcx]
mov ecx, 0xffffffff
mov qword [rsp + 0x80], rbx
cmp rax, rcx
jbe 0x10009f089
mov ebx, 0x80070216
mov rdi, qword [rsp + 0x38]
lea r12, [0x1001653b8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp r15, rax
je 0x10009efde
mov rcx, r15
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor r15d, r15d
cmp rsi, r15
je 0x10009efef
mov rcx, rsi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rdi, r15
je 0x10009effd
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp r13, r15
je 0x10009f00b
mov rcx, r13
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp rbp, r15
je 0x10009f02f
mov rcx, qword [rbp + 8]
cmp rcx, r15
je 0x10009f023
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbp + 8], r15
mov rcx, rbp
mov qword [rbp + 8], r15
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [0x1001653b8]
cmp rcx, r12
je 0x10009f05c
test byte [rcx + 0x1c], 1
je 0x10009f05c
cmp byte [rcx + 0x19], 5
jb 0x10009f05c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x25
call fcn.10001c854
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10014e600
mov rbx, qword [rsp + 0x338]
add rsp, 0x2f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
mov edi, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rsi, rax
mov qword [rsp + 0x40], rax
xor eax, eax
cmp rsi, rax
jne 0x10009f0ac
mov ebx, 0x8007000e
jmp 0x10009efb7
mov r8, rdi
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov r8, r13
mov rdx, rbx
mov rcx, rsi
call fcn.1000c23ac
xor edx, edx
cmp eax, edx
mov ebx, eax
jl 0x10009efb7
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
lea r8, [rsp + 0x48]
not rcx
dec rcx
mov eax, ecx
lea edi, [rcx + 1]
lea ecx, [rdx + 0x5c]
mov word [rsi + rax*2], cx
mov word [rsi + rdi*2], dx
lea rdx, [0x10000a054]
mov rcx, r13
call fcn.10009bb88
mov r15, qword [rsp + 0x48]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009efb7
lea rdx, [rsp + 0x90]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x10009f19c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
je 0x10009f193
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009f17e
test byte [rcx + 0x1c], 1
je 0x10009f17e
cmp byte [rcx + 0x19], 2
jb 0x10009f17e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x1f
mov r9, r15
mov dword [rsp + 0x20], eax
call fcn.10001ddb0
movzx ebx, di
xor eax, eax
or ebx, 0x80070000
cmp edi, eax
cmovle ebx, edi
jmp 0x10009f3ba
xor eax, eax
mov ebx, eax
jmp 0x10009efb7
movsxd rax, edi
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0xbc]
lea rdi, [0x10000a05c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x10009f34f
lea rsi, [rsp + 0xbc]
lea rdi, [0x10000a060]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
mov rsi, qword [rsp + 0x40]
je 0x10009f354
mov rdx, qword [rsp + 0x80]
xor ecx, ecx
lea r8, [rsp + 0xbc]
mov word [rsi + rax*2], cx
mov rcx, rsi
call fcn.100059424
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009f420
mov edx, dword [rsp + 0x90]
test dl, 0x10
je 0x10009f323
bt edx, 0xa
jb 0x10009f323
mov r8d, dword [r14 + 0x10]
lea r9d, [rax + 0x64]
cmp r8d, r9d
jne 0x10009f285
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009f354
test byte [rcx + 0x1c], 1
je 0x10009f354
cmp byte [rcx + 0x19], 3
jb 0x10009f354
mov rcx, qword [rcx + 0x10]
lea edx, [r9 - 0x44]
mov dword [rsp + 0x20], r9d
lea r9, [rsp + 0xbc]
lea r8, [0x100003aa8]
call fcn.10001ddb0
jmp 0x10009f354
mov edi, dword [rsp + 0x50]
cmp edi, r9d
jb 0x10009f2d4
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009f2c7
test byte [rcx + 0x1c], 1
je 0x10009f2c7
cmp byte [rcx + 0x19], 4
jb 0x10009f2c7
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x21
mov qword [rsp + 0x20], r13
call fcn.10001d9dc
mov rax, qword [rsp + 0x70]
mov byte [rax], 1
jmp 0x10009f354
lea r9, [rsp + 0x58]
lea rcx, [rsp + 0xbc]
inc r8d
call fcn.10009e6c0
mov rbp, qword [rsp + 0x58]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009f420
mov rcx, qword [rsp + 0x68]
mov rdx, rbp
call fcn.10009e884
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009f420
inc edi
mov rbp, rax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], edi
jmp 0x10009f354
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x90]
mov rcx, rsi
mov byte [rsp + 0x30], 1
call fcn.10009de6c
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10009f377
mov rax, qword [rsp + 0x78]
inc qword [rax]
jmp 0x10009f354
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
cmp eax, ecx
je 0x10009f3c4
mov rax, qword [rsp + 0x48]
jmp 0x10009f1a4
mov al, byte [rsp + 0x30]
mov byte [r12], al
mov rcx, qword [0x1001653b8]
lea r12, [0x1001653b8]
cmp rcx, r12
je 0x10009f3ba
test byte [rcx + 0x1c], 1
je 0x10009f3ba
cmp byte [rcx + 0x19], 2
jb 0x10009f3ba
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x23
mov r9, rsi
mov dword [rsp + 0x20], ebx
call fcn.10001ddb0
mov rdi, qword [rsp + 0x38]
jmp 0x10009efc3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x12
je 0x10009efb7
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10009f410
test byte [rcx + 0x1c], 1
je 0x10009f410
cmp byte [rcx + 0x19], 2
jb 0x10009f410
mov rcx, qword [rcx + 0x10]
lea r8, [0x100003aa8]
mov edx, 0x24
mov r9, r15
mov dword [rsp + 0x20], edi
call fcn.10001ddb0
movzx ebx, di
xor eax, eax
or ebx, 0x80070000
cmp edi, eax
cmovle ebx, edi
mov byte [r12], al
jmp 0x10009efb7