Function at 0x14009d720
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x538
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov rax, qword [0x1401620c0]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov qword [rsp + 0x40], r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x58], rdx
mov r13, rcx
mov qword [rsp + 0x50], rcx
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x48], rax
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140038c80
nop
mov edx, 1
mov rcx, r13
call fcn.1400390f0
lea rdx, [rsp + 0x410]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x29]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rcx, [rsp + 0x410]
call fcn.1400b3390
xor r15d, r15d
mov rcx, r15
nop
nop
nop
nop
movzx eax, byte [rsp + rcx + 0x410]
mov byte [rsp + rcx + 0x1f0], al
add rcx, 1
test al, al
jne 0x14009d7e0
lea rdi, [rsp + 0x1f0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.32.dll]
mov qword [rdi - 1], rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14009d8b9
test byte [rsp + 0xb0], 0x10
jne 0x14009d89b
cmp byte [rsp + 0xdc], 0x2e
je 0x14009d89b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xdc]
repne scasb al, byte [rdi]
not rcx
call fcn.14008c4a0
mov rdi, rax
lea rdx, [rsp + 0xdc]
lea rcx, [rsp + 0xdc]
sub rax, rcx
nop
nop
nop
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
add rdx, 1
test cl, cl
jne 0x14009d880
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140038ce0
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14009d835
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
test rbx, rbx
je 0x14009d91a
mov rdx, qword [rbx]
test rdx, rdx
je 0x14009d91a
nop
nop
nop
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
call fcn.14008c4a0
mov rdi, rax
mov rdx, qword [rbx]
nop
nop
movzx ecx, byte [rdx]
mov byte [rax], cl
add rdx, 1
add rax, 1
test cl, cl
jne 0x14009d8f0
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140038ce0
add rbx, 8
mov rdx, qword [rbx]
test rdx, rdx
jne 0x14009d8d0
mov r12d, r15d
nop
lea rcx, [rsp + 0x60]
call fcn.140039650
test eax, eax
je 0x14009dabc
test r12d, r12d
jle 0x14009d942
mov ecx, SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_Sleep]
add r12d, 1
lea rcx, [rsp + 0x60]
call fcn.140039050
mov rsi, rax
test rax, rax
je 0x14009dab2
nop
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140039060
mov rbp, rax
mov rcx, rsi
call fcn.140038640
mov rbx, rax
test rax, rax
je 0x14009da96
mov rdx, r15
nop
nop
nop
movzx ecx, byte [rsp + rdx + 0x410]
mov byte [rsp + rdx + 0x1f0], cl
add rdx, 1
test cl, cl
jne 0x14009d990
lea rdi, [rsp + 0x1f0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
movzx eax, byte [rbx + rcx]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x14009d9c0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14009daa6
mov byte [rsp + 0x1f0], r15b
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x88]
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rsp + 0x1f0], 0x4d
jne 0x14009da5c
cmp byte [rsp + 0x1f1], 0x5a
jne 0x14009da5c
mov rcx, rbx
call fcn.14008c4f0
jmp 0x14009da84
mov byte [rsp + 0x2f3], r15b
mov rdx, r14
lea rcx, [rsp + 0x1f0]
call fcn.1400c2e00
test rax, rax
je 0x14009da84
mov rdx, rbx
mov rcx, r13
call fcn.140038ce0
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140038f30
jmp 0x14009daa6
xor r8d, r8d
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140038f30
mov rsi, rbp
test rbp, rbp
jne 0x14009d960
cmp r12d, 0x32
jl 0x14009d920
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.1400390f0
mov r12, qword [rsp + 0x40]
test r12, r12
je 0x14009dde0
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x14009dde0
mov rcx, r13
call fcn.140039650
cmp eax, 1
jbe 0x14009dde0
mov rcx, r13
call fcn.140039050
mov r15, rax
test rax, rax
je 0x14009dde0
nop
mov rdx, r15
mov rcx, r13
call fcn.140039060
mov rbx, rax
mov qword [rsp + 0x90], rax
mov rcx, r15
call fcn.140038640
mov rbp, rax
test rax, rax
je 0x14009ddcf
mov byte [rsp + 0x300], 0
xor eax, eax
mov rdx, rax
nop
nop
nop
movzx ecx, byte [rsp + rdx + 0x410]
mov byte [rsp + rdx + 0x1f0], cl
add rdx, 1
test cl, cl
jne 0x14009db50
lea rdi, [rsp + 0x1f0]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rcx + rbp]
mov byte [rdi + rcx - 1], al
add rcx, 1
test al, al
jne 0x14009db80
mov ecx, 0x148
call fcn.14008c4a0
mov qword [rsp + 0xa0], rax
test rax, rax
je 0x14009dbc6
mov r9, rsi
lea r8, [rsp + 0x1f0]
mov edx, 1
mov rcx, rax
call fcn.140072010
mov rdi, rax
xor ecx, ecx
jmp 0x14009dbcb
xor ecx, ecx
mov rdi, rcx
test rdi, rdi
je 0x14009dc60
mov rax, qword [rdi]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x104
lea rcx, [rsp + 0x300]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8, r12
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x10]
cmp byte [rsp + 0x300], 0
jne 0x14009dc53
mov rax, qword [rdi]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x104
lea rcx, [rsp + 0x300]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8, qword [rsp + 0x98]
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x10]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp byte [rsp + 0x300], 0
je 0x14009ddb9
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x300]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14009ddaf
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
test rax, rax
je 0x14009dda1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x14009dd93
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasb al, byte [rdi]
not rcx
movsxd rsi, ecx
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
sub ebx, esi
mov rdi, r14
je 0x14009dd64
nop
nop
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.1400c3e90
test eax, eax
jne 0x14009dd5b
cmp ebx, 0x104
jbe 0x14009dd5b
add rdi, 0x20
add ebx, 0xffffffe0
cmp byte [rdi], al
jne 0x14009dd5b
lea rdx, [rdi + 1]
mov r8d, 0x80
mov rcx, rdi
call fcn.1400c3e90
test eax, eax
je 0x14009dd64
add rdi, 1
add ebx, 0xffffffff
jne 0x14009dd20
movzx eax, byte [rsp + 0x300]
test ebx, ebx
mov ecx, 0
cmove eax, ecx
mov byte [rsp + 0x300], al
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rbx, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x50]
cmp byte [rsp + 0x300], 0
jne 0x14009ddcf
xor r8d, r8d
mov rdx, r15
mov rcx, r13
call fcn.140038f30
mov rcx, rbp
call fcn.14008c4f0
mov r15, rbx
test rbx, rbx
mov r12, qword [rsp + 0x40]
jne 0x14009db10
mov rcx, r13
call fcn.140039650
mov edi, eax
lea rcx, [rsp + 0x60]
call fcn.1400394e0
mov eax, edi
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1400c2a20
add rsp, 0x538
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret