Function at 0x140041590
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1400f0158]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov qword [rsp + 0x60], rcx
lea rcx, [rbp - 0x38]
call fcn.140044410
nop
mov rsi, qword [rbp - 0x28]
movabs r12, 0x7ffffffffffffffe
mov rax, r12
sub rax, rsi
cmp rax, 6
jb 0x140041d48
lea r15, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r15, qword [rbp - 0x38]
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
lea r14, [rsi + 6]
mov ebx, 7
lea rdi, [rsp + 0x68]
lea eax, [rbx + 3]
cmp r14, rbx
jbe 0x140041657
mov rbx, r14
or rbx, 7
cmp rbx, r12
jbe 0x14004163a
mov rbx, r12
jmp 0x140041641
cmp rbx, rax
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x68]
call fcn.140003f10
mov rdi, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140079530
movsd xmm0, qword [str..exe]
movsd qword [rdi + rbx], xmm0
mov eax, dword [0x1400bd908]
mov dword [rdi + rbx + 8], eax
xor esi, esi
mov word [rdi + r14*2], si
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x10]
lea edx, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x140041c83
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
nop
test byte [rbp + 0x10], 0x10
jne 0x140041ac4
mov qword [rbp - 0x18], rsi
mov qword [rbp - 8], rsi
mov qword [rbp], 7
mov word [rbp - 0x18], si
lea rax, [rbp + 0x3c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140041710
lea rdx, [rbp + 0x3c]
lea rcx, [rbp - 0x18]
call fcn.140003fa0
nop
mov r14, qword [rbp - 0x28]
mov rax, r12
sub rax, r14
cmp rax, 1
jb 0x140041d66
lea r15, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r15, qword [rbp - 0x38]
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
lea rsi, [r14 + 1]
mov ebx, 7
lea rdi, [rbp - 0x78]
cmp rsi, rbx
jbe 0x14004179b
mov rbx, rsi
or rbx, 7
cmp rbx, r12
jbe 0x14004177a
mov rbx, r12
jmp 0x140041787
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x78]
call fcn.140003f10
mov rdi, rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140079530
mov eax, 0x5c
mov word [rdi + rbx], ax
xor eax, eax
mov word [rdi + rsi*2], ax
lea rax, [rbp + 0x3c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400417d0
lea rdx, [rbp + 0x3c]
lea rcx, [rbp - 0x78]
call fcn.140016340
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x140041848
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041843
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d54
call fcn.140071a3c
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], si
lea r9, [rbp - 0x18]
mov r15, qword [rbp - 0x18]
mov r12, qword [rbp]
cmp r12, 8
cmovae r9, r15
mov r10, qword [rbp - 8]
cmp r10, 0xe
jne 0x1400418b7
mov r8, r10
lea r11, [0x1400bd910]
mov rax, r11
movzx ecx, word [r9]
mov edx, 0x57
cmp cx, dx
jb 0x1400418b7
sub r9, r11
cmp cx, dx
ja 0x1400418b7
cmp r8, 1
je 0x140041951
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140041897
lea r9, [rbp - 0x18]
cmp r12, 8
cmovae r9, r15
cmp r10, 0x13
jne 0x14004190a
mov r8, r10
lea rbx, str.windscribectrld.exe
mov rax, rbx
movzx ecx, word [r9]
mov edx, 0x77
cmp cx, dx
jb 0x14004190a
sub r9, rbx
cmp cx, dx
ja 0x14004190a
cmp r8, 1
je 0x140041a3e
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400418ea
mov rbx, qword [rsp + 0x50]
cmp rbx, qword [rsp + 0x58]
je 0x140041a2c
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
lea rsi, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rsi, qword [rbp - 0x58]
mov r14, qword [rbp - 0x48]
cmp r14, 8
jae 0x1400419e0
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov edi, 7
jmp 0x140041a1a
mov rbx, qword [rsp + 0x38]
cmp rbx, qword [rsp + 0x40]
je 0x1400419d9
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
lea rsi, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rsi, qword [rbp - 0x58]
mov r14, qword [rbp - 0x48]
cmp r14, 8
jae 0x14004198d
movups xmm0, xmmword [rsi]
movups xmmword [rbx], xmm0
mov edi, 7
jmp 0x1400419c7
mov rdi, r14
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
mov rcx, rbx
call fcn.140003f10
mov qword [rbx], rax
lea r8, [r14*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140079530
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], rdi
add qword [rsp + 0x38], 0x20
xor esi, esi
jmp 0x140041a3e
lea rcx, [rsp + 0x30]
jmp 0x140041a31
mov rdi, r14
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rdx, [rdi + 1]
mov rcx, rbx
call fcn.140003f10
mov qword [rbx], rax
lea r8, [r14*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140079530
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], rdi
add qword [rsp + 0x50], 0x20
xor esi, esi
jmp 0x140041a3e
lea rcx, [rsp + 0x48]
lea r8, [rbp - 0x58]
mov rdx, rbx
call fcn.140002bd0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140041a7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041a79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d5a
call fcn.140071a3c
nop
cmp r12, 8
jb 0x140041aba
lea rdx, [r12*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x140041ab2
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d60
mov rcx, r15
call fcn.140071a3c
movabs r12, 0x7ffffffffffffffe
lea rdx, [rbp + 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400416e0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x60]
lea rcx, [rbx + 0x500]
lea rdx, [rsp + 0x30]
call fcn.140006100
lea rcx, [rbx + 0x518]
lea rdx, [rsp + 0x48]
call fcn.140006100
nop
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140041bc5
mov rdi, qword [rsp + 0x38]
cmp rbx, rdi
je 0x140041b7e
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140041b61
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140041b5c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140041d4e
mov rcx, r8
call fcn.140071a3c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
add rbx, 0x20
cmp rbx, rdi
jne 0x140041b22
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140041baf
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d4e
mov rcx, rbx
call fcn.140071a3c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x140041c83
mov rdi, qword [rsp + 0x50]
cmp rbx, rdi
je 0x140041c3c
nop dword [rax]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140041c1f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140041c1a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140041d6c
mov rcx, r8
call fcn.140071a3c
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
add rbx, 0x20
cmp rbx, rdi
jne 0x140041be0
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x58]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140041c6d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d6c
mov rcx, rbx
call fcn.140071a3c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140041cc4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041cbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d72
call fcn.140071a3c
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140041d12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041d0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d42
call fcn.140071a3c
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.140071b40
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140085c7c
nop
call fcn.140003e60
nop
call fcn.140085c7c
nop
call fcn.140085c7c
nop
call fcn.140085c7c
nop
call fcn.140085c7c
nop
call fcn.140003e60
nop
call fcn.140085c7c
nop
call fcn.140085c7c
int3