Function at 0x140027b4c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a8
mov rax, qword [0x14003d0f8]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov r12, qword [rsp + 0x310]
xor ebx, ebx
mov qword [rsp + 0x38], r8
mov r13, rdx
movzx r8d, bx
mov dword [rsp + 0x30], r9d
or rdx, 0xffffffffffffffff
mov r15, rcx
inc rdx
cmp word [rcx + rdx*2], bx
jne 0x140027b94
mov rcx, r12
cmp word [r12], bx
je 0x140027ed0
mov r9, rcx
movzx eax, word [rcx]
add rcx, 2
test ax, ax
jne 0x140027bae
mov rax, rcx
sub rax, r9
sar rax, 1
add ax, dx
add r8w, ax
cmp word [rcx], bx
jne 0x140027bab
cmp bx, r8w
je 0x140027ed0
inc r8w
movzx r14d, r8w
lea ecx, [r14 + r14]
call fcn.14000cd90
mov rbp, rax
test rax, rax
je 0x140027ec9
mov rsi, r12
mov rdi, rax
cmp word [r12], bx
je 0x140027c63
mov eax, r14d
mov rcx, rdi
sub rcx, rbp
mov r8, r15
sar rcx, 1
sub eax, ecx
mov rcx, rdi
movsxd rbx, eax
mov rdx, rbx
call fcn.1400113e0
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call fcn.140011300
or rcx, 0xffffffffffffffff
mov rax, rcx
xor ebx, ebx
inc rax
cmp word [rsi + rax*2], bx
jne 0x140027c39
lea rsi, [rsi + rax*2]
mov rax, rcx
add rsi, 2
inc rax
cmp word [rdi + rax*2], bx
jne 0x140027c4d
lea rdi, [rdi + rax*2]
add rdi, 2
cmp word [rsi], bx
jne 0x140027c03
mov r8d, dword [rsp + 0x30]
mov r9, rbp
mov rdx, qword [rsp + 0x38]
mov rcx, r13
mov word [rdi], bx
call fcn.1400081d4
mov rcx, rbp
mov r14d, eax
call fcn.14000ff70
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r15 + rsi*2], bx
jne 0x140027c8a
add esi, 2
lea ecx, [rsi + rsi]
call fcn.14000cd90
mov rdi, rax
test rax, rax
je 0x140027ec9
movsxd rbx, esi
mov r8, r15
mov rdx, rbx
mov rcx, rax
call fcn.1400113e0
mov rcx, rdi
call fcn.140012378
lea r8, [0x1400341ac]
mov rdx, rbx
mov rcx, rdi
lea r15, [rax + 2]
call fcn.140011300
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileW]
nop dword [rax + rax]
xor ebx, ebx
mov rbp, rax
mov word [r15], bx
cmp rax, 0xffffffffffffffff
je 0x140027ebc
test byte [rsp + 0x40], 0x10
mov edx, 0x2e
je 0x140027e8a
movzx ecx, word [rsp + 0x6c]
movzx eax, dx
sub ecx, eax
jne 0x140027d27
movzx ecx, word [rsp + 0x6e]
movzx eax, bx
sub ecx, eax
test ecx, ecx
je 0x140027e8a
movzx ecx, word [rsp + 0x6c]
movzx eax, dx
sub ecx, eax
jne 0x140027d51
movzx ecx, word [rsp + 0x6e]
movzx eax, dx
sub ecx, eax
jne 0x140027d51
movzx ecx, word [rsp + 0x70]
movzx eax, bx
sub ecx, eax
test ecx, ecx
je 0x140027e8a
or rcx, 0xffffffffffffffff
xor r14d, r14d
inc rcx
cmp word [rdi + rcx*2], r14w
jne 0x140027d60
lea rdx, [rsp + 0x6c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r14w
jne 0x140027d73
lea ebx, [rax + 2]
add ebx, ecx
cmp ebx, esi
jle 0x140027dae
movsxd rdx, ebx
mov rcx, rdi
add rdx, rdx
call fcn.14000b6b0
test rax, rax
je 0x140027ea7
mov rcx, rax
mov rdi, rax
mov esi, ebx
call fcn.140012378
lea r15, [rax + 2]
movsxd rbx, esi
lea r8, [rsp + 0x6c]
mov rdx, rbx
mov rcx, rdi
call fcn.140011300
lea rax, [rbx - 1]
mov ecx, r14d
cmp rax, 0x7ffffffe
mov edx, 0x80070057
cmova ecx, edx
test ecx, ecx
js 0x140027e0d
mov r8, rbx
mov rax, rdi
test esi, esi
je 0x140027df4
cmp word [rax], r14w
je 0x140027df4
add rax, 2
sub r8, 1
jne 0x140027de4
mov rax, r8
neg rax
sbb ecx, ecx
not ecx
and ecx, edx
test r8, r8
je 0x140027e0d
mov rdx, rbx
sub rdx, r8
jmp 0x140027e10
mov rdx, r14
test ecx, ecx
js 0x140027e67
mov r8, rbx
lea rcx, [rdi + rdx*2]
sub r8, rdx
je 0x140027e58
lea r9, [rdx + 0x7ffffffe]
mov rax, r8
sub rax, rbx
lea rdx, [0x140034540]
add r9, rax
sub rdx, rcx
test r9, r9
je 0x140027e58
movzx eax, word [rdx + rcx]
test ax, ax
je 0x140027e58
mov word [rcx], ax
dec r9
add rcx, 2
sub r8, 1
jne 0x140027e3a
test r8, r8
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r14w
mov r9d, dword [rsp + 0x30]
mov rdx, r13
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov qword [rsp + 0x20], r12
call fcn.140027b4c
xor ebx, ebx
mov r14d, eax
mov word [r15], bx
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileW]
nop dword [rax + rax]
test eax, eax
je 0x140027ead
jmp 0x140027d01
mov r14d, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
nop dword [rax + rax]
mov rcx, rdi
call fcn.14000ff70
mov eax, r14d
jmp 0x140027ed2
mov eax, 1
jmp 0x140027ed2
xor eax, eax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140018f80
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret