Function at 0x10009ee0
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
sub rsp, 0x2c8
mov rax, qword [0x1001f320]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov qword [r11 + 0x20], rbp
mov rbp, rcx
mov qword [r11 - 0x10], rdi
mov edi, edx
lea rcx, [r11 - 0x148]
mov r8d, 0x10c
xor edx, edx
call sub.MSVCR80.dll_memset
lea rdx, [rsp + 0x180]
mov r8d, edi
mov rcx, rbp
call fcn.10004db0
cmp eax, edi
je 0x10009f3e
mov eax, 0xffffffff
jmp 0x1000a176
xor eax, eax
mov qword [rsp + 0x2c0], rsi
lea rdi, [rsp + 0x180]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x2b0], r12
mov qword [rsp + 0x2a8], r13
repne scasb al, byte [rdi]
mov eax, dword [str..]
mov dword [rdi - 1], eax
movzx eax, byte [0x10016934]
mov byte [rdi + 3], al
call fcn.10007c20
lea rcx, [rsp + 0x180]
mov r12d, eax
call fcn.10009570
test eax, eax
movsxd r13, eax
jle 0x1000a0c2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x1000a0c2
lea rdi, [r13 + r13*4]
mov qword [rsp + 0x2e0], rbx
mov qword [rsp + 0x2a0], r14
shl rdi, 6
mov rcx, rdi
call sub.MSVCR80.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rbx, rax
call sub.MSVCR80.dll_memset
mov r14, rbx
mov edx, dword [rsp + 0x40]
test dl, 0x10
je 0x1000a007
lea rcx, [rsp + 0x6c]
call fcn.10009550
test eax, eax
jne 0x1000a057
mov dword [rbx], edx
mov eax, dword [rsp + 0x5c]
lea rdx, [rbx + 0xc]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x60]
lea rcx, [rsp + 0x6c]
mov dword [rbx + 8], eax
lea rax, [rsp + 0x6c]
sub rdx, rax
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rdx + rcx - 1], al
jne 0x1000a030
lea rdi, [rsp + 0x6c]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rbx, [rbx + rcx + 0xc]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009ff0
mov rcx, rsi
mov dword [rbx], 0xffffffff
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r8d, [r13 + r13*4]
sub ebx, r14d
add ebx, 4
mov r9, r14
mov edx, 0xa000
shl r8d, 6
mov rcx, rbp
mov word [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
call fcn.10004e70
mov rcx, r14
call sub.MSVCR80.dll_void___cdecl_operator_delete_void____ptr64_
mov r14, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x2e0]
test r12d, r12d
jmp 0x1000a151
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x52e
je 0x1000a11b
cmp eax, 5
je 0x1000a11b
cmp eax, 0x3ed
je 0x1000a11b
cmp eax, 0x15
je 0x1000a11b
cmp eax, 3
je 0x1000a11b
cmp eax, 0x7b
je 0x1000a11b
lea r9, [rsp + 0x30]
mov edx, 0xa000
mov r8d, 0xffffffff
mov rcx, rbp
mov word [rsp + 0x28], 0
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x20], 4
call fcn.10004e70
jmp 0x1000a14e
lea r9, [rsp + 0x30]
mov edx, 0xa000
mov r8d, 0xffffffff
mov rcx, rbp
mov word [rsp + 0x28], 0
mov dword [rsp + 0x30], 0xfffffffe
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 8
call fcn.10004e70
test r12d, r12d
je 0x1000a159
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2c0]
mov r13, qword [rsp + 0x2a8]
mov eax, 1
mov rdi, qword [rsp + 0x2b8]
mov rbp, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.10010cd0
add rsp, 0x2c8
ret