Function at 0x43e930
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x358
mov rdi, qword [rdx]
mov rsi, qword [rdx + 8]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x3a0], rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
add rsi, rsi
mov qword [rsp + 0x80], rax
mov rax, rdi
add rax, rsi
je 0x43e98b
test rdi, rdi
jne 0x43e98b
lea rcx, [0x00804088]
call fcn.007cd620
mov rax, rsi
sar rax, 1
cmp rax, 7
mov rdx, rax
mov qword [rsp + 0x100], rax
ja 0x43ef7f
cmp rax, 1
je 0x43ea52
mov rbx, qword [rsp + 0x58]
add rbx, 0x10
test rax, rax
jne 0x43f078
lea rsi, [rdx + rdx]
xor r12d, r12d
mov qword [rsp + 0x88], rdx
lea rax, [rbx + rsi]
mov word [rax], r12w
cmp word [rbx + rdx*2 - 2], 0x5c
je 0x43ea24
mov rcx, qword [rsp + 0x58]
lea rdi, [rdx + 1]
add rcx, 0x10
cmp rbx, rcx
je 0x43f0ac
mov rcx, qword [rsp + 0x90]
cmp rdi, rcx
ja 0x43ef0e
lea rsi, [rdi + rdi]
mov r11d, 0x5c
xor ebp, ebp
mov word [rax], r11w
mov qword [rsp + 0x88], rdi
mov word [rbx + rdi*2], bp
lea rax, [rsp + 0xa0]
test rbx, rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xa0], rax
jne 0x43eaaa
lea rcx, [0x00804088]
call fcn.007cd620
movzx eax, word [rdi]
xor r13d, r13d
mov qword [rsp + 0x88], 1
mov word [rsp + 0x92], r13w
cmp ax, 0x5c
mov word [rsp + 0x90], ax
jne 0x43f004
lea rax, [rsp + 0xa0]
mov esi, 2
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x58]
lea rbx, [rax + 0x10]
mov rcx, rsi
sar rcx, 1
cmp rcx, 7
mov rax, rcx
mov qword [rsp + 0x68], rcx
ja 0x43ef38
cmp rax, 1
je 0x43efeb
mov rdi, qword [rsp + 0x40]
test rcx, rcx
lea rdx, [rdi + 0x10]
jne 0x43f070
xor r10d, r10d
mov qword [rsp + 0xa8], rax
lea rcx, [0x0080405a]
mov word [rdx + rax*2], r10w
call sub.msvcrt.dll_wcslen
movabs rdx, 0x3fffffffffffffff
sub rdx, qword [rsp + 0xa8]
mov r8, rax
cmp rax, rdx
ja 0x43f0a0
mov rcx, qword [rsp + 0x40]
lea rdx, [0x0080405a]
call fcn.0079f760
lea rsi, [rsp + 0x100]
mov rcx, qword [rsp + 0xa0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor ebx, ebx
cmp rax, 0xffffffffffffffff
mov rdi, rax
je 0x43ee69
lea rax, [rsp + 0xc0]
mov r13, qword [sym.imp.msvcrt.dll__wcsicmp]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xe0]
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0xf0]
lea r14, [rsp + 0xd0]
mov qword [rsp + 0x38], rax
jmp 0x43ebb8
mov eax, dword [rsp + 0x11c]
mov edx, dword [rsp + 0x120]
shl rax, 0x20
or rax, rdx
add rbx, rax
mov rdx, rsi
mov rcx, rdi
call rbp
test eax, eax
je 0x43ee60
test byte [rsp + 0x100], 0x10
je 0x43eb90
lea rcx, [rsi + 0x2c]
lea rdx, [0x00804078]
call r13
test eax, eax
je 0x43eba8
lea rcx, [rsi + 0x2c]
lea rdx, [0x0080407c]
call r13
test eax, eax
je 0x43eba8
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xc0], r14
mov r15, qword [rsp + 0x80]
lea r12, [rax + rax]
mov rax, r15
add rax, r12
je 0x43ec20
test r15, r15
jne 0x43ec20
lea rcx, [0x00804088]
call fcn.007cd620
nop dword [rax + rax]
mov rdx, r12
sar rdx, 1
cmp rdx, 7
mov rax, rdx
mov qword [rsp + 0x70], rdx
ja 0x43edc0
cmp rax, 1
je 0x43eec0
test rdx, rdx
mov rcx, r14
jne 0x43edea
lea r12, [rsi + 0x2c]
xor r9d, r9d
mov qword [rsp + 0xc8], rax
mov word [rcx + rax*2], r9w
mov rcx, r12
call sub.msvcrt.dll_wcslen
movabs rcx, 0x3fffffffffffffff
sub rcx, qword [rsp + 0xc8]
mov r8, rax
cmp rax, rcx
ja 0x43f0d4
mov rcx, qword [rsp + 0x48]
mov rdx, r12
call fcn.0079f760
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xa0]
cmp rax, r14
je 0x43efcf
mov rdx, qword [rsp + 0x40]
add rdx, 0x10
cmp rcx, rdx
je 0x43eef0
movdqu xmm0, xmmword [rsp + 0xc8]
test rcx, rcx
mov qword [rsp + 0xa0], rax
mov rdx, qword [rsp + 0xb0]
movups xmmword [rsp + 0xa8], xmm0
je 0x43ed13
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xd0], rdx
mov qword [rsp + 0xc8], 0
xor r8d, r8d
cmp rcx, r14
mov word [rcx], r8w
je 0x43ed13
call fcn.007da050
mov rax, qword [rsp + 0x38]
mov r15, qword [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xa8]
lea r12, [rax + rax]
mov rax, r15
add rax, r12
je 0x43ed50
test r15, r15
jne 0x43ed50
lea rcx, [0x00804088]
call fcn.007cd620
nop dword [rax]
mov rdx, r12
sar rdx, 1
cmp rdx, 7
mov rax, rdx
mov qword [rsp + 0x78], rdx
ja 0x43ee10
cmp rax, 1
je 0x43eed4
test rdx, rdx
mov rcx, qword [rsp + 0x38]
jne 0x43ee3a
xor edx, edx
mov qword [rsp + 0xe8], rax
mov word [rcx + rax*2], dx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x3a0]
call fcn.0043e930
add rbx, rax
mov rcx, qword [rsp + 0xe0]
cmp rcx, qword [rsp + 0x38]
je 0x43eba8
call fcn.007da050
jmp 0x43eba8
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x70]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xd0], rax
mov r8, r12
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xc0]
jmp 0x43ec4e
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x78]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0xf0], rax
mov r8, r12
mov rdx, r15
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0xe0]
jmp 0x43ed80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
add rax, 0x10
cmp rcx, rax
je 0x43ee84
call fcn.007da050
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
add rax, 0x10
cmp rcx, rax
je 0x43ee9f
call fcn.007da050
mov rax, rbx
add rsp, 0x358
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx edx, word [r15]
mov rcx, r14
mov word [rsp + 0xd0], dx
jmp 0x43ec4e
movzx edx, word [r15]
mov rcx, qword [rsp + 0x38]
mov word [rsp + 0xf0], dx
jmp 0x43ed80
movdqu xmm0, xmmword [rsp + 0xc8]
mov qword [rsp + 0xa0], rax
movups xmmword [rsp + 0xa8], xmm0
jmp 0x43ed13
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 1
call fcn.0079f930
mov rbx, qword [rsp + 0x80]
lea rax, [rbx + rsi]
jmp 0x43ea08
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xb0], rax
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xa0]
jmp 0x43eade
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x100]
xor r8d, r8d
call fcn.0079f8b0
mov rcx, rax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x90], rax
mov rdx, rdi
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x100]
mov rbx, qword [rsp + 0x80]
jmp 0x43e9c2
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call fcn.0079f7f0
mov rcx, qword [rsp + 0xc0]
jmp 0x43ecf6
movzx edx, word [rbx]
mov rbx, qword [rsp + 0x40]
mov word [rsp + 0xb0], dx
lea rdx, [rbx + 0x10]
jmp 0x43eade
mov rbx, qword [rsp + 0x58]
mov edi, 2
mov rax, rbx
add rbx, 0x10
add rax, 0x12
jmp 0x43ea08
mov rcx, rdx
jmp 0x43ef62
mov rcx, rbx
jmp 0x43efaf
lea rcx, [0x00804062]
call fcn.007cd940
mov ecx, 7
jmp 0x43e9ff
lea rcx, [0x00804062]
call fcn.007cd940
nop
nop
nop word cs:[rax + rax]