Function at 0x140009fa0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1c8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x140], 0xfffffffffffffffe
mov rbx, rdx
mov rdi, rcx
call fcn.140008ee0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
call fcn.14000ad20
cdqe
lea rsi, [0x140084240]
mov rax, qword [rsi + rax*8]
mov qword [rdi + 0x10], rax
call fcn.14000ad60
cdqe
mov rax, qword [rsi + rax*8]
mov qword [rdi + 0x18], rax
call fcn.14000ada0
cdqe
mov rax, qword [rsi + rax*8]
mov qword [rdi + 0x10], rax
call fcn.140009170
cdqe
lea rcx, [0x140084180]
mov rax, qword [rcx + rax*8]
mov qword [rdi + 0x18], rax
call fcn.140009170
cdqe
lea rcx, [0x1400841cb]
mov al, byte [rax + rcx]
mov qword [rbp + 0x138], rdi
mov byte [rdi], al
mov rsi, qword [rbx + 0x10]
call fcn.140008c90
call fcn.140008c60
cdqe
lea rcx, [0x140084140]
mov rax, qword [rcx + rax*8]
movabs rcx, 0x8000000000000000
cmp rax, rcx
cmova rcx, rax
not rcx
mov rax, rsi
not rax
mov rdx, rcx
and rdx, rax
or rax, rcx
add rax, rdx
add rax, 1
cmp rax, 1
mov qword [rbp + 0x130], rbx
jbe 0x14000a39a
mov rdi, qword [rbx + 0x18]
call fcn.14000ac90
cdqe
lea rcx, [0x140084200]
mov r9, rbx
cmp qword [rcx + rax*8], rdi
ja 0x14000a0af
mov r9, qword [rbx]
lea rax, [0x140098794]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], 2
lea rsi, [rbp + 0xf8]
mov rcx, rsi
mov r8, rbx
call fcn.1400051d0
mov rdi, qword [rbp + 0x110]
call fcn.14000ac90
cdqe
lea rcx, [0x140084200]
cmp qword [rcx + rax*8], rdi
ja 0x14000a0fd
mov rsi, qword [rbp + 0xf8]
lea rdx, [rbp - 0x48]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
call fcn.140008c60
cmp r15, 0xffffffffffffffff
je 0x14000a346
cdqe
lea rcx, [0x140084218]
mov r13d, dword [rcx + rax*4]
lea r12, [rbp - 0x1c]
mov qword [rbp + 0x128], r15
jmp 0x14000a16f
mov eax, r13d
and eax, 1
lea eax, [rax + r13*2]
xor eax, 1
or r13d, 1
sub eax, r13d
add eax, 1
mov r13d, eax
mov rcx, r15
lea rdx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000a33d
cmp r13d, 1
jle 0x14000a140
mov rcx, r12
call fcn.14005bd00
mov rdi, rax
mov rcx, qword [rbp + 0x138]
mov rsi, r12
mov r12, qword [rcx + 0x10]
mov r15, qword [rcx + 0x18]
mov r14, r12
not r14
mov rax, r15
and rax, r14
mov rdx, r15
or rdx, r12
add rax, r15
sub rax, rdx
cmp rax, rdi
jae 0x14000a1e0
mov qword [rsp + 0x20], rdi
mov rdx, rdi
mov r9, rsi
call fcn.1400066b0
mov r15, qword [rbp + 0x128]
mov r12, rsi
call fcn.14000acd0
jmp 0x14000a273
mov rax, r12
or rax, rdi
mov qword [rbp + 0x118], rax
lea rsi, [r12 + rdi]
mov qword [rcx + 0x10], rsi
call fcn.14000ac90
mov rcx, qword [rbp + 0x138]
movsxd rbx, eax
mov rax, rcx
lea rdx, [0x140084200]
cmp qword [rdx + rbx*8], r15
ja 0x14000a217
mov rax, qword [rcx]
mov qword [rbp + 0x120], rax
mov rbx, rdi
not rbx
lea rcx, [rax + r12]
lea r15, [rbp - 0x1c]
mov rdx, r15
mov r8, rdi
call fcn.14004edb0
mov rax, r12
and rax, rdi
mov rcx, r12
xor rcx, rdi
or rbx, r12
mov r12, r15
or r14, rdi
add rsi, rax
sub rsi, qword [rbp + 0x118]
add rsi, rbx
add rsi, r14
lea rax, [rsi + rcx*2]
mov rcx, qword [rbp + 0x120]
mov byte [rcx + rax + 2], 0
mov r15, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x138]
mov rdi, qword [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov rsi, rdi
not rsi
mov rax, rbx
and rax, rsi
mov rdx, rbx
or rdx, rdi
add rax, rbx
sub rax, rdx
cmp rax, 3
jae 0x14000a2d0
mov qword [rsp + 0x20], 3
mov edx, 3
lea r9, [0x14009804e]
call fcn.1400066b0
call fcn.14000acd0
jmp 0x14000a15a
mov r14, rdi
or r14, 3
lea rax, [rdi + 3]
mov qword [rcx + 0x10], rax
call fcn.14000ac90
mov rdx, qword [rbp + 0x138]
movsxd r8, eax
mov rax, rdx
lea rcx, [0x140084200]
cmp qword [rcx + r8*8], rbx
ja 0x14000a301
mov rax, qword [rdx]
mov word [rax + rdi], 0x3025
mov byte [rax + rdi + 2], 0x41
mov ecx, edi
and ecx, 3
lea rdx, [rdi + rdi]
xor rdx, 6
mov rbx, rdi
or rbx, 0xfffffffffffffffc
or rsi, 3
add rcx, rdi
sub rcx, r14
add rcx, rbx
add rcx, rsi
add rcx, rdx
mov byte [rax + rcx + 5], 0
jmp 0x14000a15a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
call fcn.140008c60
movsxd rsi, eax
lea rdi, [0x1400841b8]
lea rcx, [rbp + 0xf8]
call fcn.140004dd0
cmp byte [rsi + rdi], 0
jne 0x14000a373
mov rcx, qword [rbp + 0x138]
call fcn.140004dd0
mov rcx, qword [rbp + 0x130]
call fcn.140004dd0
mov rax, qword [rbp + 0x138]
add rsp, 0x1c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140004170
int3