Function at 0x4116a680
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf50
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xfa8], rbx
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0xf40], rax
mov rbp, r8
mov qword [rsp + 0x58], r8
mov r12, rdx
mov qword [rsp + 0x30], rdx
mov r15, rcx
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r15
call fcn.41024690
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov word [rsp + 0xd30], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xd32]
call fcn.412121c0
mov word [rsp + 0x4f0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x4f2]
call fcn.412121c0
mov r8, rbp
lea rdx, [0x4129b194]
lea rcx, [rsp + 0xd30]
call fcn.412122b0
mov word [rsp + 0x700], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x702]
call fcn.412121c0
mov word [rsp + 0x910], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x912]
call fcn.412121c0
mov word [rsp + 0xb20], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xb22]
call fcn.412121c0
lea r8, [rsp + 0xd30]
lea rdx, [0x4129b260]
lea rcx, [rsp + 0xb20]
call fcn.412122b0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xb20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, r13
je 0x4116a9fe
movabs r12, 0x7ffffffffffffffe
nop
lea rdx, [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4116a9f9
cmp word [rsp + 0xbc], 0x2e
je 0x4116a7f0
movzx eax, word [rsp + 0xbe]
test ax, ax
je 0x4116a7f0
cmp ax, 0x2e
jne 0x4116a832
cmp word [rsp + 0xc0], 0
je 0x4116a7f0
test byte [rsp + 0x90], 0x10
jne 0x4116a7f0
lea r8, [rsp + 0xbc]
lea rdx, [0x4129b194]
lea rcx, [rsp + 0x700]
call fcn.412122b0
lea rcx, [rsp + 0x700]
call fcn.412125d0
lea rdx, str..zncel
lea rcx, [rsp + 0x700]
call fcn.41212810
test rax, rax
je 0x4116a7f0
mov word [rsp + 0x2e0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2e2]
call fcn.412121c0
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x700]
call fcn.41035d80
lea rsi, [rsp + 0x2e0]
lea rdi, str..zncel
mov ecx, 7
repe cmpsw word [rsi], word [rdi]
jne 0x4116a7f0
lea r8, [rsp + 0xbc]
lea rdx, [0x4129b194]
lea rcx, [rsp + 0x910]
call fcn.412122b0
mov edx, 7
mov qword [rsp + 0x88], rdx
mov r8, r14
mov qword [rsp + 0x80], r14
mov word [rsp + 0x70], r8w
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x910]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
cmp rcx, r12
jbe 0x4116a941
call fcn.4120fbc0
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
cmp rdx, rsi
jae 0x4116a95d
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.41022ab0
mov rdx, qword [rsp + 0x88]
jmp 0x4116a97e
test rsi, rsi
jne 0x4116a97e
mov qword [rsp + 0x80], r14
lea rax, [rsp + 0x70]
cmp rdx, 8
cmovae rax, qword [rsp + 0x70]
mov word [rax], si
jmp 0x4116a9cb
test rsi, rsi
je 0x4116a9cb
lea rcx, [rsp + 0x70]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x70]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x910]
call fcn.412118b0
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rdi + rax], 0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.410403d0
nop
cmp qword [rsp + 0x88], 8
jb 0x4116a7f0
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
jmp 0x4116a7f0
mov r12, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14b, 1
mov rcx, qword [rsp + 0x40]
mov r13, rcx
mov rsi, qword [rsp + 0x48]
cmp rcx, rsi
jbe 0x4116aa30
call fcn.41211d60
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
nop
nop
mov rdi, rsi
cmp rcx, rsi
jbe 0x4116aa47
call fcn.41211d60
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
cmp r13, rdi
je 0x4116b112
cmp r13, rsi
jb 0x4116aa5a
call fcn.41211d60
cmp qword [r13 + 0x20], 8
jb 0x4116aa67
mov rbx, qword [r13 + 8]
jmp 0x4116aa6b
lea rbx, [r13 + 8]
mov r9, rbx
mov r8, rbp
lea rdx, [0x4129a250]
lea rcx, [rsp + 0x4f0]
call fcn.412122b0
mov ecx, 0xe0
call fcn.41211580
mov qword [rsp + 0x20], rax
test rax, rax
je 0x4116aaa3
mov rcx, rax
call fcn.411c5be0
jmp 0x4116aaa5
xor eax, eax
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rax
call fcn.411c6600
lea r9, [rsp + 0x4f0]
mov r8, rbx
mov rdx, r12
mov rcx, qword [rsp + 0x28]
call fcn.411c6630
test eax, eax
jne 0x4116afde
cmp r14b, 1
jne 0x4116aae0
xor r14b, r14b
jmp 0x4116aaf6
lea rcx, [r15 + 0x28]
mov r8d, 1
lea rdx, [0x4129b7fc]
call fcn.41022fe0
mov ebp, 7
mov qword [rsp + 0x88], rbp
xor r12d, r12d
mov qword [rsp + 0x80], r12
mov word [rsp + 0x70], r12w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x4116ab4e
call fcn.4120fbc0
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
cmp rbp, rsi
jae 0x4116ab75
mov r8, r12
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.41022ab0
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
jmp 0x4116aba6
test rsi, rsi
jne 0x4116aba6
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x70]
cmp rbp, 8
cmovae rax, qword [rsp + 0x70]
mov word [rax], si
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
jmp 0x4116ac00
test rsi, rsi
je 0x4116ac00
lea rcx, [rsp + 0x70]
cmp rbp, 8
cmovae rcx, qword [rsp + 0x70]
lea rdi, [rsi + rsi]
lea rdx, [rbp + rbp]
mov r9, rdi
mov r8, rbx
call fcn.412118b0
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rax + rdi], 0
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov word [rsp + 0x20], 0x2e
mov rbx, qword [rsp + 0x70]
test r12, r12
je 0x4116acbc
mov r8, r12
cmp r12, 1
jb 0x4116acbc
lea r9, [rsp + 0x70]
cmp rbp, 8
cmovae r9, rbx
nop
mov rax, r8
mov rdi, r9
test r8, r8
je 0x4116acbc
nop
cmp word [rdi], 0x2e
je 0x4116ac52
add rdi, 2
sub rax, 1
je 0x4116acbc
jmp 0x4116ac40
test rdi, rdi
je 0x4116acbc
mov ecx, 1
lea rdx, [rsp + 0x20]
mov rsi, rdi
movzx eax, word [rdx]
cmp word [rsi], ax
jne 0x4116ac7c
add rsi, 2
add rdx, 2
sub rcx, 1
je 0x4116aca7
jmp 0x4116ac64
mov ecx, 1
cmp word [rsi], ax
mov rax, 0xffffffffffffffff
cmovb ecx, eax
test ecx, ecx
je 0x4116aca7
mov rcx, rdi
sub rcx, r9
sar rcx, 1
sub rax, rcx
add r8, rax
lea r9, [rdi + 2]
jmp 0x4116ac30
lea rax, [rsp + 0x70]
cmp rbp, 8
cmovae rax, rbx
sub rdi, rax
sar rdi, 1
jmp 0x4116acc0
or rdi, 0xffffffffffffffff
mov word [rsp + 0x2e0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2e2]
call fcn.412121c0
movsxd rdx, edi
mov r9, rdx
cmp r12, rdx
cmovb r9, r12
lea r8, [rsp + 0x70]
cmp rbp, 8
cmovae r8, rbx
add r9, r9
add rdx, rdx
lea rcx, [rsp + 0x2e0]
call fcn.412118b0
xor eax, eax
or r12, 0xffffffffffffffff
mov rcx, r12
lea rdi, [rsp + 0x2e0]
repne scasw ax, word [rdi]
not rcx
lea rbp, [rcx - 1]
mov rdx, qword [r15 + 0x48]
cmp rdx, 8
jb 0x4116ad3a
lea rdi, [r15 + 0x30]
mov rax, qword [rdi]
jmp 0x4116ad41
lea rdi, [r15 + 0x30]
mov rax, rdi
lea rcx, [rsp + 0x2e0]
cmp rcx, rax
jb 0x4116ad9d
cmp rdx, 8
jb 0x4116ad59
mov rcx, qword [rdi]
jmp 0x4116ad5c
mov rcx, rdi
mov rax, qword [r15 + 0x40]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x2e0]
cmp rcx, rax
jbe 0x4116ad9d
cmp rdx, 8
jb 0x4116ad7a
mov rdi, qword [rdi]
lea r8, [rsp + 0x2e0]
sub r8, rdi
sar r8, 1
mov r9, rbp
lea rdx, [r15 + 0x28]
lea rcx, [r15 + 0x28]
call fcn.41022c90
jmp 0x4116ae5d
mov rcx, qword [r15 + 0x40]
mov rax, r12
sub rax, rcx
cmp rax, rbp
jbe 0x4116adb5
lea rax, [rcx + rbp]
cmp rax, rcx
jae 0x4116adba
call fcn.4120fbc0
test rbp, rbp
je 0x4116ae5d
mov rbx, qword [r15 + 0x40]
add rbx, rbp
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
jbe 0x4116adde
call fcn.4120fbc0
mov rax, qword [r15 + 0x48]
cmp rax, rbx
jae 0x4116adf9
mov r8, qword [r15 + 0x40]
mov rdx, rbx
lea rcx, [r15 + 0x28]
call fcn.41022ab0
jmp 0x4116ae12
test rbx, rbx
jne 0x4116ae12
mov qword [r15 + 0x40], rbx
cmp rax, 8
jb 0x4116ae0b
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x4116ae5d
test rbx, rbx
je 0x4116ae5d
mov rdx, qword [r15 + 0x48]
cmp rdx, 8
jb 0x4116ae26
mov rcx, qword [rdi]
jmp 0x4116ae29
mov rcx, rdi
mov rax, qword [r15 + 0x40]
sub rdx, rax
lea rcx, [rcx + rax*2]
lea r9, [rbp + rbp]
add rdx, rdx
lea r8, [rsp + 0x2e0]
call fcn.412118b0
mov qword [r15 + 0x40], rbx
cmp qword [r15 + 0x48], 8
jb 0x4116ae57
mov rdi, qword [rdi]
mov word [rdi + rbx*2], 0
lea rcx, [rsp + 0x2e0]
call fcn.41214380
mov dword [rsp + 0x20], eax
lea rcx, [r15 + 0x58]
lea rdx, [rsp + 0x20]
call fcn.4116a0e0
mov rsi, rax
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x4f0]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x4116aea9
lea rdi, [rsi + 8]
mov rax, qword [rdi]
jmp 0x4116aeb0
lea rdi, [rsi + 8]
mov rax, rdi
lea rcx, [rsp + 0x4f0]
cmp rcx, rax
jb 0x4116af0a
cmp rdx, 8
jb 0x4116aec8
mov rcx, qword [rdi]
jmp 0x4116aecb
mov rcx, rdi
mov rax, qword [rsi + 0x18]
lea rcx, [rcx + rax*2]
lea rax, [rsp + 0x4f0]
cmp rcx, rax
jbe 0x4116af0a
cmp rdx, 8
jb 0x4116aee9
mov rdi, qword [rdi]
lea r8, [rsp + 0x4f0]
sub r8, rdi
sar r8, 1
mov r9, rbx
mov rdx, rsi
mov rcx, rsi
call fcn.41022de0
jmp 0x4116af93
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
jbe 0x4116af1e
call fcn.4120fbc0
mov rax, qword [rsi + 0x20]
cmp rax, rbx
jae 0x4116af38
mov r8, qword [rsi + 0x18]
mov rdx, rbx
mov rcx, rsi
call fcn.41022ab0
jmp 0x4116af51
test rbx, rbx
jne 0x4116af51
mov qword [rsi + 0x18], rbx
cmp rax, 8
jb 0x4116af4a
mov rdi, qword [rdi]
mov word [rdi], 0
jmp 0x4116af93
test rbx, rbx
je 0x4116af93
mov rdx, qword [rsi + 0x20]
cmp rdx, 8
jb 0x4116af65
mov rcx, qword [rdi]
jmp 0x4116af68
mov rcx, rdi
lea rbp, [rbx + rbx]
add rdx, rdx
mov r9, rbp
lea r8, [rsp + 0x4f0]
call fcn.412118b0
mov qword [rsi + 0x18], rbx
cmp qword [rsi + 0x20], 8
jb 0x4116af8d
mov rdi, qword [rdi]
mov word [rdi + rbp], 0
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x4116afb6
mov rcx, rdi
call fcn.411c59e0
mov rcx, rdi
call fcn.41210d60
mov qword [rsp + 0x28], 0
cmp qword [rsp + 0x88], 8
jb 0x4116b0e6
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
jmp 0x4116b0f0
mov edx, 7
mov qword [rsp + 0x88], rdx
xor r8d, r8d
mov qword [rsp + 0x80], r8
mov word [rsp + 0x70], r8w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x4116b036
call fcn.4120fbc0
mov rdx, qword [rsp + 0x88]
mov r8, qword [rsp + 0x80]
cmp rdx, rsi
jae 0x4116b052
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.41022ab0
mov rdx, qword [rsp + 0x88]
jmp 0x4116b073
test rsi, rsi
jne 0x4116b073
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x70]
cmp rdx, 8
cmovae rax, qword [rsp + 0x70]
mov word [rax], si
jmp 0x4116b0bb
test rsi, rsi
je 0x4116b0bb
lea rcx, [rsp + 0x70]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x70]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
mov r8, rbx
call fcn.412118b0
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x70]
cmp qword [rsp + 0x88], 8
cmovae rax, qword [rsp + 0x70]
mov word [rdi + rax], 0
mov rcx, qword [r15 + 0x50]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x68]
call qword [rax]
nop
cmp qword [rsp + 0x88], 8
jb 0x4116b0f0
mov rcx, qword [rsp + 0x70]
call fcn.41210d60
jmp 0x4116b0f0
mov rbp, qword [rsp + 0x58]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp r13, rsi
jb 0x4116b104
call fcn.41211d60
mov rsi, qword [rsp + 0x48]
add r13, 0x28
mov rcx, qword [rsp + 0x40]
jmp 0x4116aa30
test rcx, rcx
je 0x4116b162
cmp rcx, rsi
je 0x4116b156
lea rdi, [rcx + 0x20]
cmp qword [rdi], 8
jb 0x4116b12f
mov rcx, qword [rdi - 0x18]
call fcn.41210d60
mov qword [rdi], 7
mov qword [rdi - 8], 0
mov word [rdi - 0x18], 0
add rdi, 0x28
lea rcx, [rdi - 0x20]
cmp rcx, rsi
jne 0x4116b120
mov rcx, qword [rsp + 0x40]
call fcn.41210d60
mov eax, 1
jmp 0x4116b167
mov eax, 1
mov rcx, qword [rsp + 0xf40]
xor rcx, rsp
call fcn.41211b80
mov rbx, qword [rsp + 0xfa8]
add rsp, 0xf50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret