Function at 0x440690
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x348
xor r15d, r15d
lea r14, [rsp + 0x50]
cmp edx, 0x20
mov edi, edx
mov word [rsp + 0x60], r15w
mov qword [rsp + 0x58], 0
lea rax, [r14 + 0x10]
mov qword [rsp + 0x50], rax
je 0x4406f0
xor esi, esi
cmp edx, 0x40
je 0x440b71
mov eax, esi
add rsp, 0x348
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rsi, [rsp + 0x70]
mov rdx, rcx
mov rcx, rsi
call fcn.0043feb0
lea rcx, [0x008042a4]
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0x78]
mov r8, rax
cmp rax, rdx
ja 0x440e26
lea rdx, [0x008042a4]
mov rcx, rsi
call fcn.0079f760
lea rbx, [rsp + 0xf0]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0xf0], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x440d20
mov qword [rsp + 0xf0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
mov rcx, qword [rax + 8]
xor r13d, r13d
mov qword [rsp + 0xf8], rcx
mov qword [rax], rdx
lea rdx, [rbx + 0x10]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], 0
mov word [rax + 0x10], r13w
mov rax, qword [rsp + 0xf0]
cmp rax, rdx
je 0x440d5a
lea rdx, [r14 + 0x10]
cmp rcx, rdx
je 0x440cf0
test rcx, rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movdqu xmm0, xmmword [rsp + 0xf8]
movups xmmword [rsp + 0x58], xmm0
je 0x440802
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x100], rdx
lea rax, [rbx + 0x10]
xor r12d, r12d
mov qword [rsp + 0xf8], 0
cmp rcx, rax
mov word [rcx], r12w
je 0x440802
call fcn.007da050
mov rcx, qword [rsp + 0x70]
add rsi, 0x10
cmp rcx, rsi
je 0x440815
call fcn.007da050
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
mov r12, rax
mov esi, 0x905
je 0x440ad9
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
mov rax, qword [sym.imp.msvcrt.dll__wtoi]
lea r13, [rsp + 0xa0]
lea r15, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
jmp 0x4408d2
cmp rdx, 1
mov rcx, qword [rsp + 0x90]
je 0x440951
test rdx, rdx
jne 0x440933
xor r8d, r8d
cmp edi, 0x20
mov qword [rsp + 0x98], r9
mov word [rcx + r9*2], r8w
je 0x440990
xor eax, eax
cmp edi, 0x40
je 0x440a42
cmp esi, eax
cmovl esi, eax
cmp rcx, r13
je 0x4408be
call fcn.007da050
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x440ad0
test byte [rsp + 0xf0], 0x10
jne 0x4408be
lea rcx, [rbx + 0x2c]
mov qword [rsp + 0x90], r13
call sub.msvcrt.dll_wcslen
lea rbp, [rax + rax]
mov rdx, rbp
sar rdx, 1
cmp rdx, 7
mov r9, rdx
mov qword [rsp + 0x48], rdx
jbe 0x440870
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x48]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xa0], rax
lea rdx, [rbx + 0x2c]
mov r8, rbp
call sub.msvcrt.dll_memcpy
mov r9, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
jmp 0x44088b
movzx edx, word [rsp + 0x11c]
xor r10d, r10d
cmp edi, 0x20
mov word [rcx], dx
mov qword [rsp + 0x98], 1
mov word [rcx + rax*2], r10w
je 0x440df3
cmp edi, 0x40
je 0x440e3a
xor eax, eax
jmp 0x4408af
cmp r9, 5
jbe 0x440df3
lea rbp, [rsp + 0xb0]
sub r9, 6
lea rax, [rbp + 0x10]
cmp r9, 3
mov qword [rsp + 0xb0], rax
mov eax, 3
cmova r9, rax
lea r8, [rcx + 0xc]
add r9, r9
mov rax, r8
add rax, r9
je 0x4409e0
test r8, r8
jne 0x4409e0
lea rcx, [0x00804088]
call fcn.007cd620
nop
mov rdx, r9
sar rdx, 1
cmp rdx, 1
je 0x440b60
test rdx, rdx
jne 0x440af5
mov qword [rsp + 0xb8], rdx
lea rcx, [rbp + 0x10]
xor edx, edx
mov rax, qword [rsp + 0x30]
mov word [rsp + r9 + 0xc0], dx
call rax
mov rcx, qword [rsp + 0xb0]
add rbp, 0x10
cmp rcx, rbp
je 0x440a35
mov dword [rsp + 0x28], eax
call fcn.007da050
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
jmp 0x4408af
cmp r9, 9
jbe 0x440e3a
lea rdx, [rcx + 0x14]
sub r9, 0xa
mov eax, 3
mov qword [rsp + 0xd0], r15
cmp r9, 3
cmova r9, rax
mov rax, rdx
add r9, r9
add rax, r9
je 0x440a85
test rdx, rdx
jne 0x440a85
lea rcx, [0x00804088]
call fcn.007cd620
mov rax, r9
sar rax, 1
cmp rax, 1
je 0x440ca1
test rax, rax
jne 0x440b30
mov qword [rsp + 0xd8], rax
xor eax, eax
mov rcx, r15
mov word [rsp + r9 + 0xe0], ax
call qword [sym.imp.msvcrt.dll__wtoi]
mov rcx, qword [rsp + 0xd0]
cmp rcx, r15
jne 0x440a28
jmp 0x440a35
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x50]
add r14, 0x10
cmp rcx, r14
je 0x4406d5
call fcn.007da050
jmp 0x4406d5
lea r10, [rbp + 0x10]
test r9d, r9d
mov r11d, r9d
je 0x4409f9
xor eax, eax
mov qword [rsp + 0x28], rdx
mov ecx, eax
add eax, 1
movzx edx, byte [r8 + rcx]
cmp eax, r11d
mov byte [r10 + rcx], dl
jb 0x440b0c
mov rdx, qword [rsp + 0x28]
jmp 0x4409f9
test r9d, r9d
mov r10d, r9d
je 0x440a9e
xor ecx, ecx
mov r8d, ecx
add ecx, 1
movzx r11d, byte [rdx + r8]
cmp ecx, r10d
mov byte [r15 + r8], r11b
jb 0x440b3e
jmp 0x440a9e
movzx eax, word [rcx + 0xc]
mov word [rsp + 0xc0], ax
jmp 0x4409f9
lea rsi, [rsp + 0x90]
mov rdx, rcx
mov rcx, rsi
call fcn.0043feb0
lea rcx, str.SDI_x64_R.exe
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0x98]
mov r8, rax
cmp rax, rdx
ja 0x440de7
lea rdx, str.SDI_x64_R.exe
mov rcx, rsi
call fcn.0079f760
lea rbx, [rsp + 0xf0]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0xf0], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x440d3d
mov qword [rsp + 0xf0], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x100], rcx
mov rcx, qword [rax + 8]
xor ebp, ebp
mov qword [rsp + 0xf8], rcx
mov qword [rax], rdx
lea rdx, [rbx + 0x10]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], 0
mov word [rax + 0x10], bp
mov rax, qword [rsp + 0xf0]
cmp rax, rdx
je 0x440d72
lea rdx, [r14 + 0x10]
cmp rcx, rdx
je 0x440d08
test rcx, rcx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movdqu xmm0, xmmword [rsp + 0xf8]
movups xmmword [rsp + 0x58], xmm0
je 0x440c87
mov qword [rsp + 0xf0], rcx
mov qword [rsp + 0x100], rdx
lea rax, [rbx + 0x10]
xor r11d, r11d
mov qword [rsp + 0xf8], 0
cmp rcx, rax
mov word [rcx], r11w
je 0x440c87
call fcn.007da050
mov rcx, qword [rsp + 0x90]
add rsi, 0x10
cmp rcx, rsi
jne 0x440810
jmp 0x440815
movzx edx, word [rcx + 0x14]
mov word [rsp + 0xe0], dx
jmp 0x440a9e
call fcn.007da050
mov rcx, qword [rsp + 0x50]
add r14, 0x10
cmp rcx, r14
je 0x440ce3
call fcn.007da050
mov rcx, rbx
call fcn.0067d310
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + 0xf8]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
jmp 0x440802
movdqu xmm0, xmmword [rsp + 0xf8]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
jmp 0x440c87
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0x100], r9
mov qword [rsp + 0x108], r10
jmp 0x44076e
mov r9, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov qword [rsp + 0x100], r9
mov qword [rsp + 0x108], r10
jmp 0x440bf5
mov rcx, r14
mov rdx, rbx
call fcn.0079f7f0
mov rcx, qword [rsp + 0xf0]
jmp 0x4407e1
mov rcx, r14
mov rdx, rbx
call fcn.0079f7f0
mov rcx, qword [rsp + 0xf0]
jmp 0x440c66
lea rcx, [0x00804062]
call fcn.007cd940
lea rdx, [0x008042e0]
mov r8d, 6
lea rcx, [0x008042f8]
call fcn.007d05c0
mov rcx, qword [rsp + 0x70]
add rsi, 0x10
mov rbx, rax
cmp rcx, rsi
jne 0x440ccb
jmp 0x440cd0
lea rcx, [0x00804062]
call fcn.007cd940
mov rbx, rax
jmp 0x440cd0
lea rdx, [0x008042e0]
mov r8d, 0xa
lea rcx, [0x008042f8]
call fcn.007d05c0
nop
nop word cs:[rax + rax]