Function at 0x140044c38
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14006f0d8]
xor rax, rsp
mov qword [rbp + 0x1c8], rax
xor edi, edi
mov qword [rsp + 0x60], rdx
mov r13, rcx
test rdx, rdx
jne 0x140044699
call fcn.14003e25c
lea ebx, [rdi + 0x16]
mov dword [rax], ebx
call fcn.14003e114
mov eax, ebx
jmp 0x140044a6a
xorps xmm0, xmm0
mov qword [rdx], rdi
mov rax, qword [rcx]
movdqu xmmword [rsp + 0x30], xmm0
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
test rax, rax
je 0x140044909
lea rdx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x3f002a
mov rcx, rax
mov word [rbp + 0x1c4], di
movabs rbx, 0x200000000801
call fcn.140046064
mov r15, qword [r13]
mov rcx, rax
test rax, rax
jne 0x140044722
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140044aac
mov rsi, qword [rsp + 0x30]
mov r15d, eax
test eax, eax
jne 0x140044892
mov r14, qword [rsp + 0x38]
jmp 0x140044885
cmp rax, r15
je 0x140044746
movzx eax, word [rcx]
sub ax, 0x2f
cmp ax, 0x2d
ja 0x14004473d
movzx eax, ax
bt rbx, rax
jb 0x140044746
sub rcx, 2
cmp rcx, r15
jne 0x140044727
movzx edx, word [rcx]
cmp dx, 0x3a
jne 0x140044772
lea rax, [r15 + 2]
cmp rcx, rax
je 0x140044772
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.140044aac
mov r12d, eax
jmp 0x140044876
sub dx, 0x2f
cmp dx, 0x2d
ja 0x140044787
movzx eax, dx
bt rbx, rax
mov al, 1
jb 0x14004478a
mov al, dil
sub rcx, r15
mov dword [rsp + 0x28], edi
sar rcx, 1
lea r8, [rsp + 0x70]
inc rcx
mov qword [rsp + 0x20], rdi
neg al
sbb r12, r12
xor r9d, r9d
and r12, rcx
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x48], r12
call qword [sym.imp.kernel32.dll_FindFirstFileExW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140044758
sub r14, rsi
sar r14, 3
mov qword [rsp + 0x50], r14
cmp word [rbp - 0x64], 0x2e
jne 0x1400447eb
cmp word [rbp - 0x62], di
je 0x14004480b
cmp word [rbp - 0x62], 0x2e
jne 0x1400447eb
cmp word [rbp - 0x60], di
je 0x14004480b
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, r15
lea rcx, [rbp - 0x64]
call fcn.140044aac
mov r12d, eax
test eax, eax
jne 0x14004486d
mov r12, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
jne 0x1400447d1
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdx, r14
mov rax, qword [rsp + 0x50]
sub rdx, rsi
sar rdx, 3
cmp rax, rdx
jne 0x140044846
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FindClose]
jmp 0x140044885
sub rdx, rax
lea rcx, [rsi + rax*8]
lea r9, [0x140044630]
mov r8d, 8
call fcn.1400496d0
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FindClose]
mov r12d, edi
jmp 0x140044880
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FindClose]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
test r12d, r12d
jne 0x1400448d0
add r13, 8
mov rax, qword [r13]
jmp 0x1400446b7
mov rbx, qword [rsp + 0x38]
mov r14, rsi
sub rbx, rsi
add rbx, 7
shr rbx, 3
cmp rsi, qword [rsp + 0x38]
cmova rbx, rdi
test rbx, rbx
je 0x1400449a3
mov rcx, qword [r14]
call fcn.140042374
inc rdi
lea r14, [r14 + 8]
cmp rdi, rbx
jne 0x1400448b7
jmp 0x1400449a3
mov rbx, r14
mov r15, rsi
sub rbx, rsi
add rbx, 7
shr rbx, 3
cmp rsi, r14
cmova rbx, rdi
test rbx, rbx
je 0x140044901
mov rcx, qword [r15]
call fcn.140042374
inc rdi
lea r15, [r15 + 8]
cmp rdi, rbx
jne 0x1400448ed
mov r15d, r12d
jmp 0x1400449a3
mov rax, r14
mov qword [rsp + 0x48], rdi
sub rax, rsi
mov r9, rdi
mov r12, rax
mov rcx, rsi
sar r12, 3
mov rdx, rdi
inc r12
lea r15, [rax + 7]
shr r15, 3
cmp rsi, r14
cmova r15, rdi
test r15, r15
je 0x140044963
mov r10, qword [rcx]
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], di
jne 0x140044942
inc r9
add rcx, 8
add r9, rax
inc rdx
cmp rdx, r15
jne 0x14004493b
mov qword [rsp + 0x48], r9
mov r8d, 2
mov rdx, r9
mov rcx, r12
call fcn.1400403d4
mov rbx, rax
test rax, rax
jne 0x1400449b3
xor ecx, ecx
call fcn.140042374
mov rbx, rsi
test r15, r15
je 0x14004499f
mov rcx, qword [rbx]
call fcn.140042374
inc rdi
lea rbx, [rbx + 8]
cmp rdi, r15
jne 0x14004498b
or r15d, 0xffffffff
mov rcx, rsi
call fcn.140042374
mov eax, r15d
jmp 0x140044a6a
lea rdx, [rax + r12*8]
mov r12, rsi
mov qword [rsp + 0x58], rdx
mov rcx, rdx
mov qword [rbp + 0x1c0], rdx
cmp rsi, r14
je 0x140044a35
sub rax, rsi
mov qword [rsp + 0x50], rax
mov r8, qword [r12]
or r13, 0xffffffffffffffff
inc r13
cmp word [r8 + r13*2], di
jne 0x1400449de
mov rax, rcx
inc r13
sub rax, rdx
mov r9, r13
mov rdx, qword [rsp + 0x48]
sar rax, 1
sub rdx, rax
call fcn.14003fa20
test eax, eax
jne 0x140044a94
mov rcx, qword [rbp + 0x1c0]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov qword [r12 + rax], rcx
add r12, 8
lea rcx, [rcx + r13*2]
mov qword [rbp + 0x1c0], rcx
cmp r12, r14
jne 0x1400449d6
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rax], rbx
call fcn.140042374
mov rbx, rsi
test r15, r15
je 0x140044a60
mov rcx, qword [rbx]
call fcn.140042374
inc rdi
lea rbx, [rbx + 8]
cmp rdi, r15
jne 0x140044a4c
mov rcx, rsi
call fcn.140042374
xor eax, eax
mov rcx, qword [rbp + 0x1c8]
xor rcx, rsp
call fcn.14001a210
mov rbx, qword [rsp + 0x320]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.14003e164
int3
jmp 0x140044644