Function at 0x4104fb00
Capabilities:
Enumerate files on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x6e0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x41359af8]
xor rax, rsp
mov qword [rsp + 0x6d0], rax
mov rsi, rdx
mov r8, rcx
lea rdx, [0x4129b260]
lea rcx, [r11 - 0x248]
call fcn.412122b0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x4104feef
xor r12d, r12d
or r13, 0xffffffffffffffff
movabs r14, 0x7ffffffffffffffe
nop
lea rdx, [rsp + 0x60]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4104feef
cmp word [rsp + 0x8c], 0x2e
je 0x4104fb80
movzx eax, word [rsp + 0x8e]
test ax, ax
je 0x4104fb80
cmp ax, 0x2e
jne 0x4104fbbf
cmp word [rsp + 0x90], 0
je 0x4104fb80
test byte [rsp + 0x60], 0x10
jne 0x4104fb80
xor bl, bl
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r12
mov word [rsp + 0x30], 0
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x51], bl
lea rdx, str..znpf
lea rcx, [rsp + 0x8c]
call fcn.41212810
test rax, rax
je 0x4104fc3b
mov byte [rsp + 0x50], bl
mov bl, 1
lea r8, [rsp + 0x8c]
lea rdx, [0x4129b194]
lea rcx, [rsp + 0x2b0]
call fcn.412122b0
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x2a4], ax
lea rdx, str..sznpf
lea rcx, [rsp + 0x8c]
call fcn.41212810
test rax, rax
je 0x4104fc92
mov byte [rsp + 0x50], 1
lea r8, [rsp + 0x8c]
lea rdx, [0x4129b194]
lea rcx, [rsp + 0x2b0]
call fcn.412122b0
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x2a2], ax
jmp 0x4104fcb1
test bl, bl
jne 0x4104fcb1
cmp qword [rsp + 0x48], 8
jb 0x4104fb80
mov rcx, qword [rsp + 0x30]
call fcn.41210d60
jmp 0x4104fb80
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
lea rax, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
cmovae rax, rdi
lea rcx, [rsp + 0x2b0]
mov r8, qword [rsp + 0x40]
cmp rcx, rax
jb 0x4104fd41
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, rdi
lea rax, [rax + r8*2]
lea rcx, [rsp + 0x2b0]
cmp rax, rcx
jbe 0x4104fd41
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, rdi
lea r8, [rsp + 0x2b0]
sub r8, rax
sar r8, 1
mov r9, rbx
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.41022de0
jmp 0x4104fdd9
cmp rbx, r14
jbe 0x4104fd5a
call fcn.4120fbc0
mov rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x30]
cmp rdx, rbx
jae 0x4104fd78
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.41022ab0
mov rdx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x30]
jmp 0x4104fd94
test rbx, rbx
jne 0x4104fd94
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x30]
cmp rdx, 8
cmovae rax, rdi
mov word [rax], bx
jmp 0x4104fdd9
test rbx, rbx
je 0x4104fdd9
lea rcx, [rsp + 0x30]
cmp rdx, 8
cmovae rcx, rdi
lea rdi, [rbx + rbx]
add rdx, rdx
mov r9, rdi
lea r8, [rsp + 0x2b0]
call fcn.412118b0
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov word [rdi + rax], 0
lea rcx, [rsp + 0x2b0]
call fcn.4104d050
cmp eax, 1
sete byte [rsp + 0x51]
mov rbx, qword [rsi + 8]
cmp rbx, qword [rsi + 0x10]
jbe 0x4104fe00
call fcn.41211d60
nop
mov rdi, qword [rsi + 0x10]
cmp qword [rsi + 8], rdi
jbe 0x4104fe0f
call fcn.41211d60
cmp rbx, rdi
je 0x4104fec6
cmp rbx, qword [rsi + 0x10]
jb 0x4104fe23
call fcn.41211d60
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r9, rcx
mov r8, qword [rbx + 0x18]
cmp r8, r8
cmovb r8, r8
cmp qword [rbx + 0x20], 8
jb 0x4104fe55
mov rdx, qword [rbx + 8]
jmp 0x4104fe59
lea rdx, [rbx + 8]
mov rdi, rcx
cmp r8, rcx
cmovb rdi, r8
lea rcx, [rsp + 0x2b0]
test rdi, rdi
je 0x4104fe96
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x4104fe88
add rdx, 2
add rcx, 2
sub rdi, 1
jne 0x4104fe70
jmp 0x4104fe96
mov edi, 1
cmp word [rdx], ax
cmovb edi, r13d
jmp 0x4104fe99
mov edi, r12d
movsxd rax, edi
test edi, edi
jne 0x4104feae
cmp r8, r9
jb 0x4104feb2
mov eax, r12d
cmp r8, r9
setne al
test eax, eax
je 0x4104fed4
cmp rbx, qword [rsi + 0x10]
jb 0x4104febd
call fcn.41211d60
add rbx, 0x30
jmp 0x4104fe00
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.4104f020
nop
cmp qword [rsp + 0x48], 8
jb 0x4104fb80
mov rcx, qword [rsp + 0x30]
call fcn.41210d60
jmp 0x4104fb80
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x6d0]
xor rcx, rsp
call fcn.41211b80
lea r11, [rsp + 0x6e0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret