Function at 0x4793ec
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa20
mov qword [rsp + 0x150], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14b, r9b
mov r12, r8
mov rdi, rdx
mov rbp, rcx
xor esi, esi
cmp r9b, sil
je 0x47943d
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 0xb]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, r12
mov ebx, 4
mov r8, rbx
mov r13d, 0x110a
mov edx, r13d
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rsi
je 0x47948d
mov r9, rax
xor r8d, r8d
mov edx, 0x1101
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, r12
mov r8, rbx
mov edx, r13d
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, rsi
jne 0x479460
cmp byte [rbp + 0x1bd], sil
je 0x47957d
mov r13, 0xffffffffffff0000
cmp r12, r13
jne 0x47957d
mov ecx, 0xb0
call fcn.006a494c
mov rbx, rax
cmp rax, rsi
je 0x4794ee
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], si
lea rax, [rbx + 0x50]
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], si
mov qword [rbx + 0xa0], rsi
mov byte [rbx + 0xa8], sil
jmp 0x4794f1
mov rbx, rsi
lea rsi, [rbp + 0xb0]
cmp rsi, rbx
je 0x47950d
mov r8, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x48]
mov rcx, rbx
call fcn.00406d38
lea rcx, [rbx + 0x50]
cmp rsi, rcx
je 0x479523
mov r8, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x48]
call fcn.00406d38
mov rdx, rsi
mov rcx, rbp
call fcn.00478d80
mov edi, eax
mov rdx, rsi
mov rcx, rbp
call fcn.00478c94
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rbx
mov rdx, r13
mov rcx, rbp
call fcn.00478e6c
mov qword [rbp + 0x110], rax
mov r9, rax
mov edx, 0x1102
mov r8d, 2
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4799e8
mov r15d, esi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x88], rax
mov word [rsp + 0x40], si
mov r8, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x48]
mov rax, r8
sub rax, rcx
sar rax, 1
mov ebx, 0x100
cmp word [rcx + rax*2 - 2], 0x5c
je 0x479631
lea r8, [0x00799028]
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.0040fd24
nop
lea rcx, [rsp + 0x40]
cmp rax, rcx
je 0x4795f2
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x40]
call fcn.00406d38
nop
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x479648
cmp rcx, rsi
je 0x479648
mov rax, qword [rsp + 0xb0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rbx
jbe 0x47962a
call fcn.006a4944
jmp 0x479648
call fcn.006a3610
jmp 0x479648
lea rax, [rsp + 0x40]
cmp rdi, rax
je 0x479648
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.00406d38
lea r8, [0x00795b28]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x158]
call fcn.0040fd24
lea rdx, [rsp + 0x3c0]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rax
je 0x4796b2
cmp rcx, rsi
je 0x4796b2
mov rdx, qword [rsp + 0x158]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rbx
jbe 0x4796ad
call fcn.006a4944
jmp 0x4796b2
call fcn.006a3610
cmp r13, 0xffffffffffffffff
je 0x479942
lea r8, [rsp + 0xa68]
lea rdx, [rsp + 0x3ec]
lea rcx, [rsp + 0xb0]
call fcn.004023b4
nop
test byte [rsp + 0x3c0], 0x10
je 0x4798ec
lea rdx, [0x0079902c]
lea rcx, [rsp + 0xb0]
call fcn.004205f4
cmp al, sil
jne 0x4798ec
lea rdx, [0x00799030]
lea rcx, [rsp + 0xb0]
call fcn.004205f4
cmp al, sil
jne 0x4798ec
inc r15d
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x100]
call fcn.0040fc8c
nop
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x810]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x148]
call fcn.006a66cc
lea rdx, [rsp + 0x610]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x1b0]
call fcn.006a675c
mov ecx, 0xb0
call fcn.006a494c
mov rbx, rax
cmp rax, rsi
je 0x4797dd
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], si
lea rax, [rbx + 0x50]
mov qword [rax + 0x40], rax
mov qword [rax + 0x48], rax
mov rax, qword [rax + 0x40]
mov word [rax], si
mov qword [rbx + 0xa0], rsi
mov byte [rbx + 0xa8], sil
jmp 0x4797e0
mov rbx, rsi
lea rax, [rsp + 0x100]
cmp rax, rbx
je 0x479805
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
mov rcx, rbx
call fcn.00406d38
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rsp + rcx*2 + 0x1ae]
lea rcx, [rbx + 0x50]
lea rdx, [rsp + 0x1b0]
call fcn.00406d38
cmp byte [rbp + 0x13e], sil
je 0x479857
lea rcx, [rbp + 0x1c0]
lea rdx, [rsp + 0x100]
call fcn.004780fc
cmp al, sil
je 0x479857
mov sil, 1
lea rdx, [rsp + 0x100]
mov rcx, rbp
call fcn.00478d80
mov edi, eax
lea rdx, [rsp + 0x100]
mov rcx, rbp
call fcn.00478c94
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov r9b, sil
mov r8, rbx
mov rdx, r12
mov rcx, rbp
call fcn.00478e6c
nop
lea rax, [rsp + 0x100]
mov rcx, qword [rsp + 0x148]
cmp rcx, rax
je 0x4798de
xor esi, esi
cmp rcx, rsi
je 0x4798e7
mov rax, qword [rsp + 0x100]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov ebx, 0x100
cmp rdx, rbx
jbe 0x4798d7
call fcn.006a4944
jmp 0x4798ec
call fcn.006a3610
jmp 0x4798ec
xor esi, esi
mov ebx, 0x100
jmp 0x4798ec
mov ebx, 0x100
lea rax, [rsp + 0xb0]
mov rcx, qword [rsp + 0xf8]
cmp rcx, rax
je 0x479929
cmp rcx, rsi
je 0x479929
mov rax, qword [rsp + 0xb0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rbx
jbe 0x479924
call fcn.006a4944
jmp 0x479929
call fcn.006a3610
lea rdx, [rsp + 0x3c0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, esi
jne 0x4796bc
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x90], r12
lea rax, [0x0047a868]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rsi
lea r9, [rsp + 0x90]
xor r8d, r8d
mov edx, 0x1115
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp r15d, esi
jne 0x479997
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.0047a87c
cmp r14b, sil
je 0x4799b2
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
cmp rcx, rax
je 0x4799e8
cmp rcx, rsi
je 0x4799e8
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, rbx
jbe 0x4799e3
call fcn.006a4944
jmp 0x4799e8
call fcn.006a3610
lea r11, [rsp + 0xa20]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret