Function at 0x43cd10
Capabilities:
Enumerate files on windows

Disassembly:
sub rsp, 0x2f8
mov qword [rsp + 0x2f0], rbx
mov qword [rsp + 0x2e8], rsi
mov qword [rsp + 0x2e0], rdi
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x58], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x43cdc1
xor r8d, r8d
lea rdx, str.CInstallPath_::_ValidateInstallPaths_n
lea rcx, [rsp + 0x1a0]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0xa0], rdx
lea rdi, [rsp + 0xa0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x43cd90
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov rdi, qword [rbx + 8]
test rdi, rdi
je 0x43cfde
nop
mov rdx, rdi
test rdi, rdi
je 0x43cfd9
mov rdi, qword [rdi]
add rdx, 0x10
lea rcx, [rsp + 0x28]
call fcn.0049b31c
call fcn.004545a0
test eax, eax
je 0x43ce34
mov r8, qword [rsp + 0x28]
lea rdx, str.csPossibleInstallPath___s_n
lea rcx, [rsp + 0xa0]
call fcn.00486850
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
lea r8, str..INF
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
mov edx, 0xa
lea rcx, [rsp + 0x60]
call fcn.0049a7a0
nop
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x38], rax
mov dl, 0x5c
lea rcx, [rsp + 0x30]
call fcn.00499914
inc eax
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.00499e24
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
mov rdx, qword [0x004dfd00]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x43cf98
nop
nop
nop
lea rdx, [rsp + 0x1cc]
lea rcx, [rsp + 0x20]
call fcn.0049b398
lea rdx, [0x004a9cd4]
mov rcx, qword [rsp + 0x20]
call fcn.00485fd0
test eax, eax
je 0x43cf75
lea rdx, [0x004a9cd0]
mov rcx, qword [rsp + 0x20]
call fcn.00485fd0
test eax, eax
je 0x43cf75
lea r8, [rsp + 0x1cc]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.0049b8ec
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
lea rcx, [rsp + 0x20]
call fcn.0049b664
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.0049a8fc
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x43cef0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x20]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x38]
call fcn.0049b1dc
nop
cmp qword [rsp + 0x78], 0
jle 0x43cfc4
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.0049a8fc
nop
lea rcx, [rsp + 0x60]
call fcn.0049a80c
test rdi, rdi
jne 0x43cde0
jmp 0x43cfde
call fcn.004998f0
call fcn.004545a0
test eax, eax
je 0x43d062
mov r8, qword [rsi + 0x18]
lea rdx, str.CInstallPath_::_ValidateInstallPaths_:_pcslVerifiedInstallPaths__GetCount_____d_n
lea rcx, [rsp + 0x1a0]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0xa0], rdx
lea rdi, [rsp + 0xa0]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x43d030
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0xa0]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x28]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x2f0]
mov rsi, qword [rsp + 0x2e8]
mov rdi, qword [rsp + 0x2e0]
add rsp, 0x2f8
ret