Function at 0x140009a20
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x450]
sub rsp, 0x550
mov rax, qword [0x1400e00c0]
xor rax, rsp
mov qword [rbp + 0x440], rax
mov qword [rsp + 0x40], rdx
mov r12, rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
cmp qword [rcx + 0x18], 8
jb 0x140009a6a
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x140009a9e
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.140070140
mov rbx, qword [rsp + 0x5a0]
add rsp, 0x550
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x70]
call fcn.140013e80
nop
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140009ab8
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
lea rcx, [rbp - 0x80]
call fcn.1400192e0
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x140009ad5
mov rcx, qword [r12]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140009ae0
cdqe
movzx edx, word [rcx + rax*2 - 2]
cmp dx, 0x2f
je 0x140009b04
cmp dx, 0x5c
lea rdx, [0x1400bc204]
jne 0x140009b0b
lea rdx, [0x1400bc2c0]
lea rcx, [rbp - 0x80]
call fcn.140016680
lea rdx, str.oem.inf
lea rcx, [rbp - 0x80]
call fcn.140016680
nop
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1c0], r15
mov r9d, 7
mov qword [rbp + 0x1c8], r9
mov word [rbp + 0x1b0], r15w
mov dword [rsp + 0x20], 8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
mov rcx, qword [rbp - 8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140009b8f
mov rax, qword [rbp - 0x38]
mov r8, qword [rax]
test r8, r8
je 0x140009b8f
mov rax, qword [rbp - 0x58]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x10]
cmovb r8, qword [rbp - 0x10]
sub r8, rdx
sar r8, 1
jmp 0x140009bc6
test cl, 4
jne 0x140009bbc
mov rax, qword [rbp - 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140009bbc
mov rax, qword [rbp - 0x60]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x28]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x140009bc6
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140009bde
lea rcx, [rbp + 0x1b0]
call fcn.1400027d0
mov r9, qword [rbp + 0x1c8]
mov r14d, 4
lea rcx, [rbp + 0x1b0]
cmp r9, 8
cmovae rcx, qword [rbp + 0x1b0]
lea rdx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 8
jb 0x140009c52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a22a
call fcn.140070654
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r15w
cmp rbx, 0xffffffffffffffff
jne 0x140009c80
xor bl, bl
jmp 0x140009f69
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], r15w
lea rax, [rbp + 0x21c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140009cb0
lea rdx, [rbp + 0x21c]
lea rcx, [rbp + 0x170]
call fcn.1400027d0
nop
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r15w
mov r8d, 1
lea rdx, [0x1400bc06c]
lea rcx, [rbp + 0x190]
call fcn.1400027d0
nop
or r14d, 1
mov dword [rsp + 0x20], r14d
lea rax, [rbp + 0x190]
mov r15, qword [rbp + 0x190]
mov r13, qword [rbp + 0x1a8]
cmp r13, 8
cmovae rax, r15
lea r9, [rbp + 0x170]
mov r11, qword [rbp + 0x170]
mov rsi, qword [rbp + 0x188]
cmp rsi, 8
cmovae r9, r11
mov r8, qword [rbp + 0x180]
cmp r8, qword [rbp + 0x1a0]
jne 0x140009d98
test r8, r8
je 0x140009f7b
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140009d98
sub r9, rax
cmp cx, dx
ja 0x140009d98
cmp r8, 1
je 0x140009f7b
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140009d78
xor eax, eax
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1e8], 7
lea r8d, [rax + 2]
lea rdx, [0x1400bc070]
lea rcx, [rbp + 0x1d0]
call fcn.1400027d0
or r14d, 2
lea rax, [rbp + 0x1d0]
mov r10, qword [rbp + 0x1d0]
mov rdi, qword [rbp + 0x1e8]
cmp rdi, 8
cmovae rax, r10
lea r9, [rbp + 0x170]
mov r11, qword [rbp + 0x170]
mov rsi, qword [rbp + 0x188]
cmp rsi, 8
cmovae r9, r11
mov r8, qword [rbp + 0x180]
cmp r8, qword [rbp + 0x1e0]
jne 0x140009e53
test r8, r8
je 0x140009f89
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140009e53
sub r9, rax
cmp cx, dx
ja 0x140009e53
cmp r8, 1
je 0x140009f89
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x140009e33
xor bl, bl
test r14b, 2
je 0x140009ea8
and r14d, 0xfffffffd
cmp rdi, 8
jb 0x140009ea8
lea rdx, [rdi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140009e92
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a230
mov rcx, r10
call fcn.140070654
mov rsi, qword [rbp + 0x188]
mov r11, qword [rbp + 0x170]
test r14b, 1
je 0x140009efb
and r14d, 0xfffffffe
cmp r13, 8
jb 0x140009efb
lea rdx, [r13*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140009ee5
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a236
mov rcx, r15
call fcn.140070654
mov rsi, qword [rbp + 0x188]
mov r11, qword [rbp + 0x170]
test bl, bl
je 0x140009f90
cmp rsi, 8
jb 0x140009f3e
lea rdx, [rsi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x140009f36
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a217
mov rcx, r11
call fcn.140070654
xor r15d, r15d
lea rdx, [rbp + 0x1f0]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140009c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
lea rcx, [rsp + 0x70]
call fcn.140009920
movzx eax, bl
jmp 0x140009a74
mov rdi, qword [rbp + 0x1e8]
mov r10, qword [rbp + 0x1d0]
mov bl, 1
jmp 0x140009e55
lea rcx, [rbp + 0x70]
call fcn.140013e80
nop
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140009fa9
mov rdx, qword [r12]
mov r8, qword [r12 + 0x10]
lea rcx, [rbp + 0x80]
call fcn.1400192e0
mov r8, rax
mov rdx, r12
cmp qword [r12 + 0x18], 8
jb 0x140009fcc
mov rdx, qword [r12]
mov rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x140009fd3
movsxd rax, ecx
movzx ecx, word [rdx + rax*2 - 2]
cmp cx, 0x2f
je 0x140009ff8
cmp cx, 0x5c
lea rdx, [0x1400bc204]
jne 0x140009fff
lea rdx, [0x1400bc2c0]
mov rcx, r8
call fcn.140016680
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rdx, qword [rbp + 0x170]
mov r8, qword [rbp + 0x180]
mov rcx, rax
call fcn.1400192e0
nop
xor r15d, r15d
mov qword [rbp + 0x190], r15
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1a8], 7
mov word [rbp + 0x190], r15w
bts r14d, 9
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov ecx, dword [rbp + 0xf8]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000a0a2
mov rax, qword [rbp + 0xc8]
mov r8, qword [rax]
test r8, r8
je 0x14000a0a2
mov rax, qword [rbp + 0xa8]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0xf0]
cmovb r8, qword [rbp + 0xf0]
sub r8, rdx
sar r8, 1
jmp 0x14000a0e2
test cl, 4
jne 0x14000a0d8
mov rax, qword [rbp + 0xc0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000a0d8
mov rax, qword [rbp + 0xa0]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xd8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
jmp 0x14000a0e2
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14000a0f3
lea rcx, [rbp + 0x190]
call fcn.1400027d0
btr r14d, 9
bts r14d, 8
lea r8, [0x1400bc738]
lea rdx, [0x1400bc204]
lea rcx, [rbp + 0x190]
call fcn.14000a250
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsi]
movabs rax, 0x555555555555555
cmp qword [rsi + 8], rax
je 0x14000a21d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r15
mov ecx, 0x30
call fcn.1400703c8
mov rbx, rax
mov qword [rsp + 0x30], rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0x190]
call fcn.1400025c0
nop
inc qword [rsi + 8]
mov rcx, qword [rdi + 8]
mov qword [rbx], rdi
mov qword [rbx + 8], rcx
mov qword [rsp + 0x30], r15
mov qword [rdi + 8], rbx
mov qword [rcx], rbx
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 8
jb 0x14000a1c2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a23c
call fcn.140070654
nop
lea rcx, [rbp + 0x70]
call fcn.140009920
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 8
jb 0x140009f41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a20d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a217
call fcn.140070654
jmp 0x140009f41
call fcn.14007d0fc
nop
lea rcx, str.list_too_long
call fcn.14006ca70
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
nop
call fcn.14007d0fc
int3