Function at 0x140043c10
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1068]
mov eax, 0x1168
call fcn.1400f9a20
sub rsp, rax
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x1050], rax
mov r14, qword [rbp + 0x10e0]
mov r12, rcx
mov rcx, qword [rbp + 0x10d0]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbp + 0x10d8]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x48], rcx
lea rdx, [0x140186bd0]
lea rcx, [rbp + 0xc40]
mov r15, r9
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x40], r8
xor esi, esi
xor edi, edi
xor ebx, ebx
xor r13d, r13d
call fcn.1400f98c8
lea r8d, [rsi + 8]
lea rdx, [rbp + 0xa30]
mov rcx, r15
call fcn.1400ed200
cmp word [rbp + 0xa30], bx
je 0x140043cd3
lea rdx, str._s_s
mov r8, qword [rsp + 0x40]
lea rcx, [rbp + 0xc40]
mov r9, r15
call fcn.1400f98c8
mov ecx, 1
mov edi, ecx
jmp 0x140043cf3
mov edx, 0x2a
mov rcx, r15
call fcn.1400f9cdc
test rax, rax
je 0x140043cee
lea rdx, str._s_s.
jmp 0x140043cb6
mov ecx, 1
mov rax, qword [rsp + 0x50]
cmp dword [rax], ebx
je 0x140043d10
cmp dword [rax + 4], ebx
je 0x140043d10
mov rax, qword [rsp + 0x48]
cmp dword [rax], ebx
je 0x140043d10
cmp dword [rax + 4], ebx
cmovne ebx, ecx
mov rcx, r14
call fcn.1400fa1a4
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [r14 + rax*2], si
jne 0x140043d20
test rax, rax
je 0x140043d72
cmp dword [rbp + 0x10e8], esi
jne 0x140043d47
cmp dword [rbp + 0x10f0], esi
jne 0x140043d47
cmp dword [rbp + 0x10f8], esi
je 0x140043d72
mov edx, 0x10a18
mov ecx, 0x40
mov r13d, 0x850c
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x14004415e
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xc40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14004413a
mov r15d, dword [rsp + 0x30]
movsxd rax, ebx
mov rbx, qword [rsp + 0x38]
movsxd rdi, edi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], rdi
nop dword [rax]
lea rcx, [rbp - 0x80]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140043e03
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rbp - 0x80]
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140043dd0
cmp dword [0x14020bda8], 0
jne 0x140044131
mov eax, dword [rbp - 0x50]
test al, 0x10
jne 0x140044117
test al, 2
je 0x140043e2c
cmp dword [rbp + 0x1100], 0
je 0x140044117
test rdi, rdi
jne 0x140043ea9
xor eax, eax
movzx ecx, word [rbp + rax - 0x24]
lea rax, [rax + 2]
mov word [rbp + rax + 0x81e], cx
test cx, cx
jne 0x140043e33
lea rcx, [rbp + 0x820]
call fcn.1400fa1a4
mov rcx, qword [rsp + 0x78]
lea rdx, [rbp + 0x610]
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x140043e70
lea rcx, [rbp + 0x610]
call fcn.1400fa1a4
lea rdx, [rbp + 0x610]
lea rcx, [rbp + 0x820]
call fcn.1400f9d68
test rax, rax
je 0x140044117
cmp qword [rsp + 0x70], 0
je 0x140043ef4
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp ebx, 1
jne 0x140044112
cmp eax, 0xffffffff
jne 0x140044112
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140043f00
test rax, rax
je 0x1400440dc
cmp dword [rbp + 0x10e8], 0
mov ebx, dword [rbp + 0x10f0]
jne 0x140043f33
test ebx, ebx
jne 0x140043f33
cmp dword [rbp + 0x10f8], ebx
je 0x1400440dc
mov r8, qword [rsp + 0x40]
lea r9, [rbp - 0x24]
lea rdx, str._s_s
lea rcx, [rbp + 0x200]
call fcn.1400f98c8
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x200]
call fcn.1400e5350
test eax, eax
jne 0x140044112
xor edi, edi
cmp dword [rbp + 0x10e8], edi
je 0x140043fd8
mov ecx, dword [rsp + 0x30]
call fcn.1400dcc50
test eax, eax
je 0x140043fd8
mov edx, dword [rsp + 0x30]
lea rcx, [rbp + 0x200]
call fcn.1400dcb00
test eax, eax
je 0x140043fd8
mov rax, qword [0x1401fbb00]
lea rcx, [rbp + 0x200]
mov r8d, r13d
mov qword [rsp + 0x28], rax
mov eax, 1
mov rdx, rsi
mov r9d, eax
mov dword [rsp + 0x20], eax
call fcn.1400dcd80
mov rcx, rsi
mov r15d, eax
call fcn.1400fa1a4
mov r8, r14
mov edx, r15d
mov rcx, rsi
call fcn.1400453b0
mov edi, eax
test ebx, ebx
je 0x14004404e
test edi, edi
jne 0x14004404e
mov ebx, dword [rsp + 0x30]
test ebx, ebx
je 0x140043ff7
cmp ebx, 6
je 0x140043ff7
cmp ebx, 0x4a
je 0x140043ff7
cmp ebx, 0x55
jne 0x140044052
lea rcx, [rbp + 0x200]
call fcn.1400dcc80
test eax, eax
je 0x14004404e
mov rax, qword [0x1401fbb00]
lea rcx, [rbp + 0x200]
mov r9d, 1
mov qword [rsp + 0x28], rax
mov r8d, r13d
mov rdx, rsi
mov dword [rsp + 0x20], 2
call fcn.1400dcd80
mov rcx, rsi
mov r15d, eax
call fcn.1400fa1a4
mov r8, r14
mov edx, r15d
mov rcx, rsi
call fcn.1400453b0
mov edi, eax
mov ebx, dword [rsp + 0x30]
cmp dword [rbp + 0x10f8], 0
je 0x1400440d8
test edi, edi
jne 0x1400440dc
test ebx, ebx
je 0x14004406f
lea eax, [rbx - 0x46]
cmp eax, 1
ja 0x140044112
movsxd r8, r13d
xor edx, edx
mov rcx, rsi
add r8, r8
call fcn.1400f9ab0
lea eax, [rbx - 0x46]
lea rcx, [rbp + 0x200]
cmp eax, 1
jbe 0x1400440a6
lea r8d, [r13 - 0x10]
lea r9, [0x140208860]
mov rdx, rsi
call fcn.1400dbfe0
mov r15d, eax
jmp 0x1400440c0
lea r9d, [r13 - 0x10]
mov r8, rsi
xor edx, edx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], ebx
call fcn.140074f70
mov rcx, rsi
call fcn.1400fa1a4
mov r8, r14
mov edx, r15d
mov rcx, rsi
call fcn.1400453b0
mov edi, eax
test edi, edi
je 0x140044112
mov r8, qword [rsp + 0x40]
lea r9, [rbp - 0x24]
lea rdx, str._s_s
lea rcx, [rbp + 0x200]
call fcn.1400f98c8
mov rcx, qword [rsp + 0x60]
lea r9, [rbp + 0x200]
xor r8d, r8d
mov edx, 0x180
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov rdi, qword [rsp + 0x68]
test eax, eax
jne 0x140043db0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp + 0x1050]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x1168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret