Function at 0x140044cf0
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x468]
sub rsp, 0x540
mov rax, qword [0x14012bd38]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rdi, rcx
lea rax, vtable.CMenu.0
mov qword [rbp - 0x70], rax
and qword [rbp - 0x68], 0
mov qword [rsp + 0x40], rax
and qword [rsp + 0x48], 0
xor r13d, r13d
mov dword [rsp + 0x38], r13d
and dword [rsp + 0x30], r13d
xor esi, esi
and dword [rsp + 0x50], esi
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x140045522
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x78], rax
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x14004552d
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x28], rax
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x140045538
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
xor ecx, ecx
call fcn.1400bd910
mov rcx, rax
call fcn.1400bd8f8
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0xd8]
test rax, rax
jne 0x140044dd9
xor edx, edx
jmp 0x140044ddd
mov rdx, qword [rax + 8]
lea rcx, [rbp - 0x70]
call fcn.14008969c
mov edx, 3
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.140089788
test rax, rax
jne 0x140044e06
xor edx, edx
jmp 0x140044e0a
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.14008969c
mov r8, qword [rdi + 0x210]
lea rdx, str._s.
lea rcx, [rbp - 0x78]
call fcn.140002f84
lea r8, [rdi + 0x240]
lea r15, [rdi + 0x238]
mov rdx, r15
lea rcx, [rbp - 0x50]
call fcn.140005ac8
mov r9, qword [rax]
xor edx, edx
mov r8d, 0x8c00
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140044e79
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r12, [rdi + 0x320]
mov r8, r15
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.14008dd70
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140044fd1
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140044fd1
mov r13d, 0x8c01
mov r15d, dword [rsp + 0x38]
lea eax, [r13 - 0x8c00]
cmp eax, 0xff
jg 0x140044fc0
test byte [rbp - 0x20], 0x10
je 0x140044fab
lea rdx, [rbp + 0xc]
lea rcx, [rbp - 0x58]
call fcn.140001340
nop
mov rcx, qword [rbp - 0x58]
add rcx, 0xffffffffffffffe8
call fcn.140001888
add rax, 0x18
mov qword [rbp - 0x60], rax
mov rax, qword [rdi]
lea rdx, [rbp - 0x60]
mov rcx, rdi
call qword [rax + 0x348]
test eax, eax
je 0x140044f8d
mov ebx, r13d
mov eax, r13d
mov dword [rsp + 0x38], eax
inc r13d
mov r8d, eax
lea r9, [rbp + 0xc]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea r8, [rbp + 0xc]
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.14008dde4
lea rdx, [rbp + 0xc]
mov rcx, qword [rdi + 0x218]
call fcn.1400b7028
test eax, eax
mov ecx, 1
cmove r15d, ecx
cmovne ebx, esi
mov esi, ebx
mov rdx, qword [rdi + 0x220]
lea rcx, [rbp + 0xc]
call fcn.1400b2918
test rax, rax
je 0x140044f8d
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x50], eax
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140044fab
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x20]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140044ecb
mov dword [rsp + 0x38], r15d
lea r15, [rdi + 0x238]
mov r13d, dword [rsp + 0x38]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdx, qword [r15]
test rdx, rdx
je 0x14004550c
lea rbx, [rdi + 0x218]
mov rcx, qword [rbx]
call fcn.1400b7028
test eax, eax
jne 0x1400450fe
lea rdx, [rbp - 0x48]
mov rcx, rdi
call fcn.140044c1c
nop
mov rdx, rax
mov rcx, rbx
call fcn.14000179c
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor r13d, r13d
sub eax, 1
jg 0x140045037
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, rbx
lea rdx, [0x1400e7530]
lea rcx, [rbp - 0x38]
call fcn.14000e634
nop
lea r8, [0x1400eabb8]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.140005b68
nop
mov rdx, rax
lea rbx, [rdi + 0x240]
mov rcx, rbx
call fcn.14000179c
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140045091
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400450af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov esi, 0x8c00
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x30]
call fcn.140005ac8
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov r9d, esi
xor r8d, r8d
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_ModifyMenuW]
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140045119
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140045119
test r13d, r13d
jne 0x140045116
mov esi, dword [rsp + 0x50]
lea rdx, [rdi + 0x220]
mov rcx, rbx
call fcn.14000179c
xor r13d, r13d
lea r14, vtable.CMenu.0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r13
mov r8d, dword [rdi + 0x330]
add r8d, 0x8c00
mov dword [rsp + 0x20], r13d
mov r9d, esi
mov edx, 0x8c00
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea rcx, [rsp + 0x40]
call fcn.140089744
mov edx, 6
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.140089788
test rax, rax
mov rdx, r13
je 0x140045187
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x40]
call fcn.14008969c
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.140089788
test rax, rax
mov rdx, r13
je 0x1400451b2
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x70]
call fcn.14008969c
mov ebx, 0x400
mov r8d, ebx
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetSubMenu]
mov rcx, rax
call fcn.140089788
test rax, rax
mov rdx, r13
je 0x1400451f5
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x60]
call fcn.14008969c
mov r8d, ebx
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_RemoveMenu]
mov r8, qword [rdi + 0x248]
lea rdx, str._s.lang
lea rcx, [rbp - 0x80]
call fcn.140002f84
lea rdx, [rbp - 0x20]
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
mov r12d, 0x8d00
cmp rax, 0xffffffffffffffff
je 0x1400453b8
mov r14d, r12d
cmp dword [rbp - 0x20], 0x10
je 0x140045384
mov r12d, r14d
mov ebx, r14d
inc r14d
call fcn.140077d4c
mov rcx, rax
test rax, rax
je 0x140045517
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea r9, [rbp + 0xc]
mov r8, qword [rdi + 0x248]
lea rdx, str._s_s
lea rcx, [rsp + 0x58]
call fcn.140002f84
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r9, [rbp + 0x230]
lea r8, [0x1400e02c0]
lea rdx, str.LANGUAGE
lea rcx, [0x1400e9750]
call fcn.14004bca0
mov edx, 0x2e
lea rcx, [rbp + 0xc]
call fcn.1400b2628
test rax, rax
je 0x1400452e6
mov word [rax], r13w
lea r9, [rbp + 0xc]
lea r8, [rbp + 0x230]
lea rdx, str._s____s_
lea rcx, [rsp + 0x58]
call fcn.140002f84
mov r8, rbx
movzx eax, word [rbp + 0xc]
sub ax, 0x41
mov rbx, qword [rsp + 0x58]
xor edx, edx
mov r9, rbx
cmp ax, 0xd
mov rcx, qword [rsp + 0x78]
jbe 0x140045327
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rdi + 0x348]
lea r8, [rbp + 0xc]
mov rdx, qword [rcx + 0x10]
call fcn.14008dde4
lea rdx, [rbp + 0xc]
mov rcx, qword [rdi + 0x250]
call fcn.1400b7028
mov ecx, dword [rsp + 0x30]
test eax, eax
mov edx, 1
cmove ecx, edx
mov dword [rsp + 0x30], ecx
cmovne r12d, esi
mov esi, r12d
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140045384
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, [rbp - 0x20]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400453a7
lea eax, [r14 - 0x8d00]
cmp eax, 0xff
jle 0x14004524d
mov rbx, qword [rbp - 0x80]
lea r14, vtable.CMenu.0
mov r12d, 0x8d00
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r8, qword [rdi + 0x358]
add r8d, 0x8d00
mov dword [rsp + 0x20], r13d
mov r9d, esi
mov edx, r12d
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov r8d, dword [rdi + 0x358]
add r8d, r12d
mov dword [rsp + 0x20], r13d
mov r9d, esi
mov edx, r12d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea rcx, [rsp + 0x60]
call fcn.140089744
lea rcx, [rsp + 0x70]
call fcn.140089744
lea rcx, [rsp + 0x40]
call fcn.140089744
lea rcx, [rbp - 0x70]
call fcn.140089744
cmp dword [rsp + 0x30], r13d
jne 0x140045445
xor r8d, r8d
xor edx, edx
lea rcx, str.FATAL_ERROR:_Missing_Language_Files__
call fcn.140085968
nop
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x60]
call fcn.14008971c
nop
mov qword [rsp + 0x70], r14
lea rcx, [rsp + 0x70]
call fcn.14008971c
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140045480
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004549f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400454be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov qword [rsp + 0x40], r14
lea rcx, [rsp + 0x40]
call fcn.14008971c
nop
mov qword [rbp - 0x70], r14
lea rcx, [rbp - 0x70]
call fcn.14008971c
nop
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.1400b0010
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.140001860
nop
mov ecx, 0x80004005
call fcn.140001860
nop
mov ecx, 0x80004005
call fcn.140001860
nop
mov ecx, 0x80004005
call fcn.140001860
nop
mov ecx, 0x80004005
call fcn.140001860
int3