Function at 0x416ab0
Capabilities:
Enumerate files on windows

Disassembly:
push r15
mov eax, 0x2508
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.0067cdd0
sub rsp, rax
xor edx, edx
lea rax, [rsp + 0x50]
mov rdi, rcx
mov word [rsp + 0x72], dx
mov r8, qword [rdi]
mov rcx, rax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x72]
mov byte [rsp + 0x70], 0
mov qword [rsp + 0x60], rax
lea rdx, str._s_.
lea rax, [0x00840bc0]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], pe_nt_image_headers64
mov qword [rsp + 0x50], rax
call fcn.00403810
lea r12, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x60]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
mov r15, qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x288]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x40], rbx
lea rbp, [r12 + 0x2c]
mov qword [rsp + 0x48], rax
lea rsi, [rsp + 0x500]
nop dword [rax]
mov rdx, r12
mov rcx, qword [rsp + 0x28]
call r14
test eax, eax
je 0x416dd9
lea rdx, [0x007f882e]
mov r8, rbp
mov rcx, rsi
call r15
mov rcx, rbp
call sub.msvcrt.dll_wcslen
lea rdx, [0x007f8836]
lea rcx, [rsi + rax*2 - 6]
call fcn.0068bb48
mov rcx, qword [rsp + 0x30]
mov r8, rsi
lea rdx, [0x007f883c]
call fcn.00403810
mov rdx, qword [rsp + 0x60]
mov eax, 0x44
mov rcx, qword [0x00826970]
mov word [rdx + 0x10], ax
call fcn.0043e750
test al, al
je 0x416c10
mov r8, qword [rsp + 0x60]
lea rdx, str.Skip__S_n
mov rcx, qword [0x00826910]
call fcn.0041e210
jmp 0x416b80
mov rbx, qword [rsp + 0x38]
mov r9, rdi
mov r8, rsi
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call fcn.004137c0
mov rcx, qword [rdi + 0x18]
cmp rcx, qword [rdi + 0x20]
je 0x416dc6
test rcx, rcx
je 0x416c46
mov rdx, rbx
call fcn.00698910
mov rcx, qword [rdi + 0x18]
add rcx, 0x130
mov qword [rdi + 0x18], rcx
mov rcx, qword [rsp + 0x290]
test rcx, rcx
je 0x416c63
call fcn.007da050
mov r13, qword [rsp + 0x268]
test r13, r13
je 0x416c96
mov rcx, qword [r13 + 8]
lea rdx, [r13 + 0x18]
mov rbx, qword [r13]
cmp rcx, rdx
je 0x416c86
call fcn.007da050
mov rcx, r13
mov r13, rbx
call fcn.007da050
test rbx, rbx
jne 0x416c70
mov r8, qword [rsp + 0x260]
xor edx, edx
mov rcx, qword [rsp + 0x258]
shl r8, 3
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x258]
mov qword [rsp + 0x270], 0
cmp rcx, qword [rsp + 0x40]
mov qword [rsp + 0x268], 0
je 0x416cdd
call fcn.007da050
mov rcx, qword [rsp + 0x240]
test rcx, rcx
je 0x416cef
call fcn.007da050
mov rcx, qword [rsp + 0x228]
test rcx, rcx
je 0x416d01
call fcn.007da050
mov rcx, qword [rsp + 0x210]
test rcx, rcx
je 0x416d13
call fcn.007da050
mov rcx, qword [rsp + 0x1f8]
test rcx, rcx
je 0x416d25
call fcn.007da050
mov r13, qword [rsp + 0x1d0]
test r13, r13
je 0x416d58
mov rcx, qword [r13 + 8]
lea rdx, [r13 + 0x18]
mov rbx, qword [r13]
cmp rcx, rdx
je 0x416d48
call fcn.007da050
mov rcx, r13
mov r13, rbx
call fcn.007da050
test rbx, rbx
jne 0x416d32
mov r8, qword [rsp + 0x1c8]
xor edx, edx
mov rcx, qword [rsp + 0x1c0]
shl r8, 3
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x1c0]
mov qword [rsp + 0x1d8], 0
cmp rcx, qword [rsp + 0x48]
mov qword [rsp + 0x1d0], 0
je 0x416d9f
call fcn.007da050
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x416db1
call fcn.007da050
mov rax, qword [rdi + 0x18]
lea rcx, [rax - 0x130]
call fcn.004158e0
jmp 0x416b80
mov rdx, qword [rsp + 0x38]
lea rcx, [rdi + 0x10]
call fcn.007840a0
jmp 0x416c51
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x58]
lea rax, [0x008407e0]
mov qword [rsp + 0x50], rax
test rcx, rcx
je 0x416e00
call fcn.007da030
nop
add rsp, 0x2508
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret