Function at 0x44d076
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x198
mov ebp, dword [rcx + 0x48]
mov r8, qword [rcx + 0x28]
mov qword [rcx + 0x10], 0xffffffffffffffff
mov rbx, rcx
mov r13, rdx
mov eax, ebp
mov rdi, r8
mov qword [rsp + 0x20], r8
and eax, 0xfffffff9
test bpl, 1
cmove ebp, eax
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rsi, rcx
mov ecx, 0x104
call sym.malloc
not rsi
mov r8, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
lea rsi, [rsi - 1]
lea rcx, [r13 + 8]
mov r12, rax
call sym.wd_expand
test esi, esi
mov r9, rax
lea r8, [0x00486da0]
je 0x44d10e
movsxd rsi, esi
mov al, byte [rax + rsi - 1]
cmp al, 0x2f
je 0x44d107
cmp al, 0x5c
lea r8, str._s_
jne 0x44d10e
lea r8, [0x00486da4]
mov edx, 0x104
mov rcx, r12
call qword [sym.imp.msvcrt.dll__snprintf]
lea rax, [rsp + 0x50]
mov rcx, r12
mov rdx, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, r12
mov qword [rsp + 0x28], rax
call sym.free
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x44d1aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
je 0x44d188
ja 0x44d15e
cmp eax, 2
je 0x44d16a
cmp eax, 3
jmp 0x44d166
cmp eax, 0x12
je 0x44d177
cmp eax, 0x7b
jne 0x44d199
jmp 0x44d177
mov qword [rbx + 0x10], 0
jmp 0x44d46d
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 2
jmp 0x44d46d
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
jmp 0x44d46d
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x44d46d
test byte [rbx + 0x58], 1
je 0x44d1b9
mov rcx, qword [rbx + 0x28]
call sym.free
or byte [rbx + 0x58], 3
xor r14d, r14d
test ebp, ebp
je 0x44d1d1
mov ecx, 0x800
call sym.malloc
mov r14, rax
mov qword [rbx + 0x28], r14
mov ecx, 0xfe0
call sym.malloc
test rax, rax
mov r13, rax
mov qword [rbx + 0x30], rax
je 0x44d46d
test ebp, ebp
je 0x44d1fc
test r14, r14
je 0x44d46d
lea rax, [rsp + 0x7c]
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x3c], pe_nt_image_headers64
xor r15d, r15d
mov dword [rsp + 0x38], 0xfe0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x28], 0
jne 0x44d2de
movsxd rax, dword [rsp + 0x20]
test bpl, 4
mov dword [rbx + 0x48], ebp
mov qword [rbx + 0x10], rax
je 0x44d24e
and ebp, 2
mov r8d, 7
cmove r8d, ebp
jmp 0x44d264
test bpl, 2
je 0x44d46d
and bpl, 0x80
je 0x44d26a
mov r8d, 7
mov edx, dword [rsp + 0x20]
jmp 0x44d2d1
shl rax, 4
mov rdx, r14
add rax, r14
cmp rax, rdx
jbe 0x44d2c7
mov r8b, byte [rdx + 6]
cmp r8b, 4
jne 0x44d28c
add rdx, 0x10
mov rcx, rax
jmp 0x44d2c2
cmp byte [rax - 0xa], 4
lea rcx, [rax - 0x10]
jne 0x44d2c2
mov esi, dword [rdx]
mov ebx, dword [rdx + 4]
add rdx, 0x10
mov r11b, byte [rdx - 9]
mov r10, qword [rdx - 8]
movups xmm0, xmmword [rax - 0x10]
movups xmmword [rdx - 0x10], xmm0
mov dword [rax - 0x10], esi
mov word [rax - 0xc], bx
mov byte [rax - 0xa], r8b
mov byte [rax - 9], r11b
mov qword [rax - 8], r10
mov rax, rcx
jmp 0x44d274
sub rdx, r14
xor r8d, r8d
sar rdx, 4
mov rcx, r14
call sym.eio_dent_sort.constprop.28
jmp 0x44d46d
mov al, byte [rsp + 0x7c]
cmp al, 0x2e
mov byte [rsp + 0x43], al
jne 0x44d305
mov al, byte [rsp + 0x7d]
test al, al
je 0x44d431
cmp al, 0x2e
jne 0x44d305
cmp byte [rsp + 0x7e], 0
je 0x44d431
mov rax, qword [rsp + 0x30]
or rcx, 0xffffffffffffffff
lea rdi, [rax + 0x2c]
xor eax, eax
repne scasb al, byte [rdi]
mov r12d, ecx
not r12d
lea eax, [r15 + r12]
mov dword [rsp + 0x44], eax
mov edi, dword [rsp + 0x44]
cmp dword [rsp + 0x38], edi
jge 0x44d34b
shl dword [rsp + 0x38], 1
mov rcx, r13
movsxd rdx, dword [rsp + 0x38]
call sym.realloc
test rax, rax
mov r13, rax
mov qword [rbx + 0x30], rax
jne 0x44d324
movsxd rax, r15d
movsxd rcx, r12d
mov rsi, qword [rsp + 0x48]
add rax, r13
test r14, r14
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
je 0x44d428
mov edi, dword [rsp + 0x20]
cmp dword [rsp + 0x3c], edi
jne 0x44d396
shl dword [rsp + 0x3c], 1
mov rcx, r14
movsxd rdx, dword [rsp + 0x3c]
shl rdx, 4
call sym.realloc
test rax, rax
mov r14, rax
mov qword [rbx + 0x28], rax
je 0x44d46d
movsxd rsi, dword [rsp + 0x20]
lea eax, [r12 - 1]
shl rsi, 4
add rsi, r14
mov word [rsi + 4], ax
mov eax, dword [rsp + 0x50]
mov dword [rsi], r15d
mov qword [rsi + 8], 0
mov byte [rsi + 7], 7
and eax, 0x10
cmp eax, 1
sbb eax, eax
and eax, 4
add eax, 4
test bpl, 2
mov byte [rsi + 6], al
je 0x44d428
test al, al
jne 0x44d420
cmp byte [rsp + 0x43], 0x2e
jne 0x44d3e6
mov byte [rsi + 7], 1
jmp 0x44d428
mov rax, qword [rsp + 0x30]
mov edx, 0x2e
lea rcx, [rax + 0x2c]
call sym.strchr
test rax, rax
jne 0x44d428
cmp r12d, 2
mov al, 4
jg 0x44d40b
sub eax, r12d
jmp 0x44d41b
cmp r12d, 4
jle 0x44d41b
cmp r12d, 8
setge al
add eax, 5
mov byte [rsi + 7], al
jmp 0x44d428
cmp al, 4
jne 0x44d428
mov byte [rsi + 7], 0
inc dword [rsp + 0x20]
mov r15d, dword [rsp + 0x44]
cmp byte [rbx + 0x5b], 0
je 0x44d445
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x69
jmp 0x44d46d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x44d221
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x44d22d
add rsp, 0x198
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret