Function at 0x140004790
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0xb40
lea rbp, [rsp + 0x40]
mov qword [rbp + 0xb30], rbx
mov qword [rbp + 0xb40], rsi
mov qword [rbp + 0xb48], rdi
mov rax, qword [0x14003f198]
xor rax, rbp
mov qword [rbp + 0xaf0], rax
mov r14d, r8d
mov r15, rdx
movabs rdi, 0xffffffffffffff0
test rdx, rdx
je 0x140004869
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400047f0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140004869
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000481b
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14000a160
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140004869
xor esi, esi
mov byte [rbx], 0
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov r8, r15
mov dword [rsp + 0x28], eax
xor edx, edx
lea r9d, [rsi - 1]
mov qword [rsp + 0x20], rbx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, rsi
jmp 0x14000486d
xor esi, esi
mov ebx, esi
mov rdx, rbx
lea rcx, str.CQueryCancelAutoPlay::AllowAutoPlay_____path___s
call fcn.1400062d0
mov r8d, 0x208
lea rdx, [rbp + 0x6d0]
mov rcx, r15
call fcn.140005510
test eax, eax
jne 0x1400048a8
lea rcx, str.CQueryCancelAutoPlay::AllowAutoPlay_____GetDeviceHardwareIDForDiskDrive___failed
call fcn.1400062d0
xor eax, eax
jmp 0x140004a2f
lea rcx, [rbp + 0x6d0]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400048b6
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140004933
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400048e1
mov rcx, rdi
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14000a160
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140004933
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], rsi
xor edx, edx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x6d0]
mov r9d, 0xffffffff
mov byte [rbx], 0
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, rsi
jmp 0x140004936
mov rbx, rsi
mov rdx, rbx
lea rcx, str.CQueryCancelAutoPlay::AllowAutoPlay_____Device_hardware_ID_is__s
call fcn.1400062d0
lea rax, str.usbstordiskapple
mov ebx, esi
mov qword [rbp + 0x4a0], rax
lea rdi, [rbp + 0x4a0]
lea rax, str.1394_apple
mov qword [rbp + 0x4a8], rax
lea rax, str.sbp2_apple
mov qword [rbp + 0x4b0], rax
nop dword [rax + rax]
mov r9, 0xffffffffffffffff
lea r8, [rbp + 0x6d0]
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140010f90
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.14001146c
mov rcx, qword [rdi]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x1400049c0
lea rdx, [rbp + 0x4c0]
call fcn.14001108c
test eax, eax
je 0x1400049ef
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x140004980
lea rcx, str.CQueryCancelAutoPlay::AllowAutoPlay_____allowing_autoplay
jmp 0x140004a28
test r14d, 0x280
je 0x140004a1c
mov r13d, esi
test r15, r15
jne 0x140004a64
xor r9d, r9d
lea rdx, str.D:BWA52C09D6F_33CD_0iTunesWin_1200.12.13.0.9_srcrootiTunesiPodSupport_Win32_iTunesHelperQueryCancelAutoPlay.cpp
mov r8d, 0xbb
lea rcx, str.pszVolumePath___NULL
call fcn.140005f60
mov esi, 1
lea rcx, str.CQueryCancelAutoPlay::AllowAutoPlay_____disabling_autoplay
call fcn.1400062d0
mov eax, esi
mov rcx, qword [rbp + 0xaf0]
xor rcx, rbp
call fcn.14000a0a0
mov rbx, qword [rbp + 0xb30]
mov rsi, qword [rbp + 0xb40]
mov rdi, qword [rbp + 0xb48]
lea rsp, [rbp + 0xb00]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov r9, r15
lea r8, str._sDCIM
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140004f50
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140004bdf
mov ecx, dword [rbp + 0x250]
and cl, 0x12
cmp cl, 0x10
jne 0x140004bb7
cmp word [rbp + 0x27c], 0x2e
je 0x140004bb7
lea rax, [rbp + 0x27c]
mov r9, r15
lea r8, str._sDCIM_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140004f50
lea r9, [rbp + 0x4c0]
mov edx, 0x104
lea r8, [0x14002fc60]
mov r14d, esi
lea rcx, [rbp + 0x8e0]
call fcn.140004f50
lea rdx, [rbp]
lea rcx, [rbp + 0x8e0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140004bb7
test byte [rbp], 0x10
jne 0x140004b80
mov edx, 0x2e
lea rcx, [rbp + 0x2c]
call fcn.14000c510
mov rbx, rax
test rax, rax
je 0x140004b80
add rbx, 2
lea rdx, [0x14002fc70]
mov rcx, rbx
call fcn.1400110f8
test eax, eax
je 0x140004b93
lea rdx, [0x14002fc78]
mov rcx, rbx
call fcn.1400110f8
test eax, eax
je 0x140004b93
lea rdx, [0x14002fc80]
mov rcx, rbx
call fcn.1400110f8
test eax, eax
je 0x140004b93
lea rdx, [rbp]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140004ba9
jmp 0x140004b27
lea rdx, [rbp + 0x2c]
lea rcx, str.CQueryCancelAutoPlay::DirectoryHasPhotos_____found_photo_file___S_
call fcn.1400062d0
mov r14d, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test r14d, r14d
jne 0x140004bd0
lea rdx, [rbp + 0x250]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140004bd6
jmp 0x140004aa0
mov r13d, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
test r13d, r13d
je 0x140004a1c
lea rcx, str.CQueryCancelAutoPlay::AllowAutoPlay_____allowing_autoplay_due_to_photos_video
jmp 0x140004a28