Function at 0xbef03cb0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov rax, rsp
sub rsp, 0x2c8
mov qword [rax + 8], rbx
mov rbx, qword [0xbef0dd48]
mov qword [rax + 0x10], rbp
mov rbp, rcx
mov qword [rax - 0x10], rdi
mov rdi, r8
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r14
mov r14, rdx
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x40]
call rbx
xor r12d, r12d
test eax, eax
jne 0xbef03cf9
mov qword [rsp + 0x40], r12
mov rax, qword [0xbef13380]
mov qword [rsp + 0x2c0], rsi
test rax, rax
jne 0xbef03df6
mov rcx, qword [0xbef0e4e0]
xor edx, edx
mov r8d, 0x400
mov rsi, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0xbef03db1
mov edx, 0x200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r9d, eax
mov edx, r12d
lea r10, [0xbeef25d0]
mov word [rbx + r9*2], 0x5c
lea r8d, [r9 + 1]
nop dword [rax + rax]
lea ecx, [r8 + rdx]
cmp ecx, 0x200
jae 0xbef03d80
mov eax, edx
inc edx
movzx eax, word [r10 + rax*2]
mov word [rbx + rcx*2], ax
cmp word [r10 + rdx*2], si
jne 0xbef03d60
lea eax, [r9 + 1]
xor r8d, r8d
add eax, edx
mov rcx, rbx
xor edx, edx
mov word [rbx + rax*2], r12w
mov rax, qword [0xbef0e510]
call rax
mov rcx, qword [0xbef0e4e0]
mov r8, rbx
xor edx, edx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [0xbef0e568]
lea rbx, [0xbeef49b8]
test rax, rax
je 0xbef03de3
cmp rbx, qword [0xbef0dab0]
jb 0xbef03de3
cmp rbx, qword [0xbef0dab8]
ja 0xbef03de3
mov rdx, rbx
mov rcx, rsi
call rax
test rax, rax
jne 0xbef03def
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0xbef13380], rax
lea r9, [rsp + 0x2e8]
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call rax
test eax, eax
jne 0xbef03feb
mov rcx, qword [rsp + 0x2e8]
mov qword [rsp + 0x2a0], r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x2e8]
mov ebx, eax
lea edx, [rbx + 0x104]
add rdx, rdx
call qword [sym.imp.ole32.dll_CoTaskMemRealloc]
lea r15, [rbx + rbx]
mov rdx, r14
mov qword [rsp + 0x2e8], rax
lea rcx, [r15 + rax]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, qword [rsp + 0x2e8]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
mov edx, 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov rbp, rax
mov esi, r12d
cmp rax, 0xffffffffffffffff
je 0xbef03fd5
nop dword [rax]
cmp word [rsp + 0x7c], 0x2e
je 0xbef03fae
mov rcx, qword [rsp + 0x2e8]
lea rdx, [rsp + 0x7c]
add rcx, 2
add rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov r9d, dword [rdi + 0xc]
xor edx, edx
mov r8, qword [rdi]
add r9d, 0x20c
mov rcx, qword [0xbef0e4e0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0xbef03fcc
mov ecx, dword [rdi + 0xc]
xor edx, edx
mov r8, qword [rsp + 0x2e8]
add rcx, rax
mov qword [rsp + 0x38], r12
add r8, 2
mov qword [rsp + 0x30], r12
add r8, r15
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rcx
mov ecx, 0xfde9
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
je 0xbef03f26
dec ebx
mov rcx, qword [rsp + 0x2e8]
lea rdx, [rsp + 0x7c]
call fcn.bef03a60
test eax, eax
je 0xbef03f8f
test ebx, ebx
je 0xbef03f4c
mov ecx, dword [rdi + 0xc]
mov rax, qword [rdi]
add ecx, ebx
mov byte [rcx + rax], 9
mov qword [rsp + 0x38], r12
lea eax, [rbx + 1]
add dword [rdi + 0xc], eax
lea r8, [rsp + 0x7c]
mov eax, dword [rdi + 0xc]
mov r9d, 0xffffffff
add rax, qword [rdi]
xor edx, edx
mov qword [rsp + 0x30], r12
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test eax, eax
je 0xbef03f8f
dec ebx
add dword [rdi + 0xc], ebx
mov ecx, dword [rdi + 0xc]
mov rax, qword [rdi]
mov byte [rcx + rax], reloc.WS2_32.dll_listen
inc dword [rdi + 0xc]
mov ecx, dword [rdi + 0xc]
mov rax, qword [rdi]
mov byte [rcx + rax], 0xa
inc dword [rdi + 0xc]
inc esi
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0xbef03fcc
cmp esi, 0x100
jb 0xbef03e90
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x2e8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r15, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x2a8]
mov r12, qword [rsp + 0x2b0]
mov rdi, qword [rsp + 0x2b8]
mov rsi, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2d8]
mov rbx, qword [rsp + 0x2d0]
test rcx, rcx
je 0xbef0402b
call qword [0xbef0e4f8]
add rsp, 0x2c8
ret