Function at 0x140027770
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
lea rbp, [rsp - 0x670]
sub rsp, 0x770
xor r12d, r12d
mov r13, 0xffffffffffffffff
mov dword [rbp - 0x50], r12d
inc r13
cmp byte [rcx + r13], r12b
jne 0x1400277a6
cmp r13, 0x203
jb 0x1400277d9
mov r8, rcx
lea rdx, str.Path_too_long:__s
mov ecx, 2
call fcn.140013ae0
add rsp, 0x770
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x768], rbx
mov rdx, rcx
mov qword [rsp + 0x760], rsi
lea rcx, [rbp - 0x20]
mov r8, r13
mov qword [rsp + 0x748], r15
call fcn.14004dd10
movzx eax, word [0x14008b404]
mov word [rbp + r13 - 0x20], ax
movzx eax, byte [0x14008b406]
mov byte [rbp + r13 - 0x1e], al
mov rax, r12
nop dword [rax]
movzx ecx, byte [rbp + rax - 0x20]
cmp cl, 0x2f
jne 0x140027831
mov byte [rbp + rax - 0x20], 0x5c
jmp 0x140027835
test cl, cl
je 0x140027840
inc rax
cmp rax, 0x200
jl 0x140027820
lea rax, [rbp - 0x20]
mov r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], r12b
jne 0x140027850
mov dword [rsp + 0x28], r12d
lea r8, [rbp - 0x20]
xor edx, edx
mov qword [rsp + 0x20], r12
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movabs r15, 0x7ffffffffffffffe
mov qword [rsp + 0x60], r12
movsxd rsi, eax
xorps xmm0, xmm0
mov rbx, rsi
movups xmmword [rsp + 0x50], xmm0
cmp rsi, r15
ja 0x140028455
mov qword [rsp + 0x758], rdi
mov qword [rsp + 0x750], r14
mov qword [rsp + 0x68], 7
cmp rbx, 8
jae 0x1400278d9
mov qword [rsp + 0x60], rbx
test eax, eax
je 0x1400278d1
movzx eax, r12w
lea rdi, [rsp + 0x50]
mov rcx, rbx
rep stosw word [rdi], ax
mov word [rsp + rsi*2 + 0x50], r12w
jmp 0x140027939
mov rdi, rbx
lea rcx, [rsp + 0x50]
or rdi, 7
cmp rdi, r15
jbe 0x140027900
movabs rdx, 0x7fffffffffffffff
call fcn.140014bd0
mov qword [rsp + 0x68], r15
jmp 0x14002791a
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
call fcn.140014bd0
mov qword [rsp + 0x68], rdi
mov rdx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
mov rdi, rdx
movzx eax, r12w
mov rcx, rbx
rep stosw word [rdi], ax
mov word [rdx + rsi*2], r12w
test esi, esi
je 0x140027983
cmp qword [rsp + 0x68], 8
lea rax, [rsp + 0x50]
lea rdx, [rbp - 0x20]
mov r9, 0xffffffffffffffff
cmovae rax, qword [rsp + 0x50]
nop dword [rax]
inc r9
cmp byte [rdx + r9], r12b
jne 0x140027960
mov dword [rsp + 0x28], esi
lea r8, [rbp - 0x20]
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r11, qword [rsp + 0x60]
lea rbx, str._UNC_
mov r8, qword [rsp + 0x68]
mov esi, 2
mov rdi, qword [rsp + 0x50]
lea r14d, [rsi + 2]
test r11, r11
je 0x140027c10
cmp r11, r14
lea r9, [rsp + 0x50]
mov r10d, r14d
lea rcx, str.._
cmovb r10, r11
cmp r8, 8
mov rdx, r10
cmovae r9, rdi
cmp r10, r14
cmova rdx, r14
test rdx, rdx
je 0x1400279f3
sub r9, rcx
nop dword [rax + rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x1400279fc
add rcx, rsi
sub rdx, 1
jne 0x1400279e0
cmp r10, r14
je 0x140027a99
cmp r11, r14
lea r9, [rsp + 0x50]
mov r10, r14
lea rcx, str.__
cmovb r10, r11
cmp r8, 8
mov rdx, r10
cmovae r9, rdi
cmp r10, r14
cmova rdx, r14
test rdx, rdx
je 0x140027a43
sub r9, rcx
nop dword [rax]
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x140027a48
add rcx, rsi
sub rdx, 1
jne 0x140027a30
cmp r10, r14
je 0x140027a99
mov eax, 8
lea r9, [rsp + 0x50]
cmp r11, rax
mov r10d, eax
mov rcx, rbx
cmovb r10, r11
cmp r8, rax
mov rdx, r10
cmovae r9, rdi
cmp r10, rax
cmova rdx, rax
test rdx, rdx
je 0x140027a93
sub r9, rbx
nop dword [rax + rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x140027acd
add rcx, rsi
sub rdx, 1
jne 0x140027a80
cmp r10, 8
jne 0x140027acd
test r11, r11
je 0x140027c10
cmp r8, 8
lea rcx, [rsp + 0x50]
lea r8, [rbp - 0x48]
cmovae rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140027c06
mov r8, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x50]
cmp r8, 8
lea rcx, [rsp + 0x50]
lea r8, [rbp + 0x430]
mov edx, 0x104
cmovae rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x140027c06
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
mov qword [rsp + 0x48], 7
movups xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x30], r12w
cmp eax, 0xf8
jae 0x140027b50
lea rax, [rbp + 0x430]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140027b30
lea rdx, [rbp + 0x430]
lea rcx, [rsp + 0x30]
call fcn.140014aa0
jmp 0x140027f91
mov edx, eax
add rdx, 8
cmp rdx, 7
ja 0x140027b78
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x30]
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rsp + rdx*2 + 0x30], r12w
jmp 0x140027b8b
mov r9, rdx
mov word [rsp + 0x20], r12w
lea rcx, [rsp + 0x30]
call fcn.140014d40
cmp qword [rsp + 0x48], 8
lea r8, [rsp + 0x30]
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
cmovae r8, qword [rsp + 0x30]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ebx, eax
test eax, eax
jne 0x140027cc3
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140027c06
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140027c01
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028461
mov rcx, rdi
call fcn.14004ba4c
mov rdi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x68]
cmp r8, 8
lea rcx, [rsp + 0x50]
lea rdx, [rbp + 0x1e0]
cmovae rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1400280e6
mov r8, qword [rbp + 0x690]
lea rdx, str.FindFirstFile___failed:__s
mov ecx, esi
call fcn.140013ae0
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140027c8e
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140027c89
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002844f
mov rcx, rdi
call fcn.14004ba4c
mov r14, qword [rsp + 0x750]
mov rdi, qword [rsp + 0x758]
mov rsi, qword [rsp + 0x760]
mov rbx, qword [rsp + 0x768]
mov r15, qword [rsp + 0x748]
add rsp, 0x770
pop r13
pop r12
pop rbp
ret
mov ecx, 2
mov qword [rbp - 0x80], r14
cmp qword [rsp + 0x40], rcx
lea r9, [rsp + 0x30]
mov r10d, ecx
xorps xmm0, xmm0
cmovb r10, qword [rsp + 0x40]
mov r11d, 7
cmp qword [rsp + 0x48], 8
mov rdi, r10
movups xmmword [rsp + 0x70], xmm0
cmovae r9, qword [rsp + 0x30]
movabs rsi, 0x5c003f005c005c
cmp r10, rcx
mov qword [rbp - 0x78], r11
mov qword [rsp + 0x70], rsi
cmova rdi, rcx
mov word [rsp + 0x78], r12w
lea rcx, [0x14008a044]
test rdi, rdi
je 0x140027d44
sub r9, rcx
nop dword [rax + rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x140027daa
add rcx, 2
sub rdi, 1
jne 0x140027d30
cmp r10, 2
jne 0x140027daa
lea r8d, [r10 + 6]
lea rdx, str._UNC_
lea rcx, [rsp + 0x70]
call fcn.140014aa0
mov rdi, qword [rsp + 0x40]
lea rcx, [rsp + 0x30]
mov eax, 2
cmp rdi, rax
cmovb rax, rdi
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
sub rdi, rax
lea r8, [rdi*2 + 2]
lea rdx, [rcx + rax*2]
call fcn.14004dd10
mov r11, qword [rbp - 0x78]
add ebx, 0xfffffffe
mov r14, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x40], rdi
cmp r11, 8
lea r8, [rsp + 0x70]
mov r9, r14
lea rcx, [rsp + 0x30]
cmovae r8, rsi
call fcn.1400148c0
mov r8, qword [rsp + 0x40]
mov ecx, ebx
add rcx, qword [rbp - 0x80]
cmp rcx, r8
ja 0x140027df1
cmp qword [rsp + 0x48], 8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x40], rcx
cmovae rax, qword [rsp + 0x30]
mov word [rax + rcx*2], r12w
jmp 0x140027e4c
mov rdi, qword [rsp + 0x48]
mov rdx, rcx
mov rax, rdi
sub rdx, r8
sub rax, r8
cmp rdx, rax
ja 0x140027e39
cmp rdi, 8
mov qword [rsp + 0x40], rcx
lea r9, [rsp + 0x30]
cmovae r9, qword [rsp + 0x30]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140027e2e
movzx eax, r12w
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], r12w
jmp 0x140027e4c
mov r9, rdx
mov word [rsp + 0x20], r12w
lea rcx, [rsp + 0x30]
call fcn.140014d40
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rax, 8
jb 0x140027f50
cmp rbx, 8
jae 0x140027ec4
mov rdi, qword [rsp + 0x30]
lea r8, [rbx*2 + 2]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14004dd10
mov rax, qword [rsp + 0x48]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140027eb2
mov rcx, qword [rdi - 8]
add rdx, 0x27
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x140028461
mov rdi, rcx
mov rcx, rdi
call fcn.14004ba4c
mov eax, 7
jmp 0x140027f46
mov rdi, rbx
or rdi, 7
cmp rdi, r15
cmova rdi, r15
cmp rdi, rax
jae 0x140027f50
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x30]
call fcn.140014bd0
mov r8, qword [rsp + 0x40]
mov rcx, rax
mov rdx, qword [rsp + 0x30]
mov rbx, rax
lea r8, [r8*2 + 2]
call fcn.14004dd10
mov rcx, qword [rsp + 0x48]
lea rdx, [rcx*2 + 2]
mov rcx, qword [rsp + 0x30]
cmp rdx, 0x1000
jb 0x140027f39
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028461
mov rcx, r8
call fcn.14004ba4c
mov rax, rdi
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140027f9b
mov rcx, qword [rsp + 0x70]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140027f8c
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028461
mov rcx, rdi
call fcn.14004ba4c
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x68]
lea r14, [rsp + 0x30]
cmp rax, 8
cmovae r14, qword [rsp + 0x30]
cmp rbx, rsi
ja 0x140027fe6
cmp rsi, 8
mov qword [rsp + 0x60], rbx
lea rdi, [rsp + 0x50]
mov rdx, r14
cmovae rdi, qword [rsp + 0x50]
lea r8, [rbx + rbx]
mov rcx, rdi
call fcn.14004dd10
mov word [rdi + rbx*2], r12w
mov rdi, qword [rsp + 0x50]
jmp 0x140028090
cmp rbx, r15
ja 0x14002845b
mov rdx, rbx
or rdx, 7
cmp rdx, r15
ja 0x14002801f
mov rcx, rsi
mov rax, r15
shr rcx, 1
sub rax, rcx
cmp rsi, rax
ja 0x14002801f
mov rax, rsi
mov r15, rdx
shr rax, 1
add rax, rsi
cmp rdx, rax
cmovb r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsp + 0x50]
call fcn.140014bd0
lea r8, [rbx + rbx]
mov qword [rsp + 0x60], rbx
mov rdx, r14
mov qword [rsp + 0x68], r15
mov rcx, rax
mov rdi, rax
call fcn.14004dd10
mov word [rdi + rbx*2], r12w
cmp rsi, 8
jb 0x14002808b
mov rcx, qword [rsp + 0x50]
lea rdx, [rsi*2 + 2]
cmp rdx, 0x1000
jb 0x140028086
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028461
mov rcx, r8
call fcn.14004ba4c
mov qword [rsp + 0x50], rdi
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400280dc
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400280cd
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028461
mov rcx, rdi
call fcn.14004ba4c
mov esi, 2
jmp 0x140027c06
mov esi, 2
jmp 0x140027c0b
mov rsi, qword [rbp + 0x6b0]
mov r15, qword [rbp + 0x690]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x20c]
lea rcx, [rbp - 0x70]
call fcn.140013e70
mov r8, qword [rbp - 0x58]
lea rax, [rbp - 0x70]
mov rdi, qword [rbp - 0x70]
cmp r8, 0x10
mov rcx, 0xffffffffffffffff
cmovae rax, rdi
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140028130
cmp r8, 0x10
lea rdx, [rbp - 0x70]
cmovae rdx, rdi
cmp rcx, 1
jne 0x140028150
cmp byte [rdx], 0x2e
jmp 0x1400281ad
cmp rcx, 2
jne 0x140028166
cmp byte [rdx], 0x2e
jne 0x1400281a8
cmp byte [rdx + 1], 0x2e
jne 0x1400281a8
jmp 0x1400283d9
cmp rcx, 4
jb 0x14002817f
cmp byte [rdx], 0x2e
jne 0x14002817f
cmp dword [rdx + rcx - 4], 0x7077732e
je 0x1400283d9
cmp rcx, 9
jb 0x1400281a2
mov rax, qword [rdx]
cmp rax, qword [str..tundra2.]
jne 0x1400281a8
movzx eax, byte [rdx + 8]
cmp al, byte [0x14008b510]
jne 0x1400281a8
jmp 0x1400283d9
cmp rcx, 1
jbe 0x1400281b3
cmp byte [rdx + rcx - 1], 0x7e
je 0x1400283d9
mov rax, qword [rbp + 0x698]
test rax, rax
je 0x1400281f9
mov rdx, rax
lea rcx, [rbp - 0x48]
or r12d, 1
call fcn.140013d00
cmp qword [rax + 0x18], 8
jb 0x1400281d9
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x20c]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecW]
mov r8, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x70]
test eax, eax
jne 0x1400281f9
xor bl, bl
jmp 0x1400281fb
mov bl, 1
test r12b, 1
je 0x14002824d
mov rdx, qword [rbp - 0x30]
and r12d, 0xfffffffe
cmp rdx, 8
jb 0x14002824d
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140028240
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028436
mov rcx, rdi
call fcn.14004ba4c
mov r8, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x70]
test bl, bl
jne 0x14002825d
cmp byte [rbp + 0x6a0], bl
je 0x1400283d9
cmp r8, 0x10
lea rcx, [rbp - 0x70]
mov rax, 0xffffffffffffffff
cmovae rcx, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140028270
add rax, 2
add rax, r13
cmp rax, 0x200
jbe 0x1400282e3
lea r9, [rbp + 0x20c]
mov r8, r15
lea rdx, str.Path_too_long:__s__s
mov ecx, 2
call fcn.140013ae0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14002840c
mov rcx, qword [rbp - 0x70]
inc rdx
cmp rdx, 0x1000
jb 0x140028407
mov rdi, qword [rcx - 8]
add rdx, 0x27
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14002843c
jmp 0x140028404
mov eax, dword [rbp + 0x200]
mov ecx, dword [rbp + 0x1fc]
shl rcx, 0x20
or rcx, rax
mov eax, dword [rbp + 0x1f4]
mov qword [rsp + 0x78], rcx
mov ecx, dword [rbp + 0x1f8]
shl rcx, 0x20
or rcx, rax
movabs rax, 0x19db1ded53e8000
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
test byte [rbp + 0x1e0], 0x10
mov qword [rbp - 0x80], rdx
je 0x140028349
mov r9d, 9
mov qword [rbp - 0x80], 1
jmp 0x14002834f
mov r9d, 5
cmp r8, 0x10
mov dword [rsp + 0x70], r9d
lea rcx, [rbp - 0x70]
cmovae rcx, rdi
lea rdx, [rbp - 0x1f]
sub rdx, rcx
add rdx, r13
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140028370
test bl, bl
mov rbx, qword [rbp + 0x6a8]
je 0x1400283a4
lea r8, [rbp - 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x70]
call rsi
mov r8, qword [rbp - 0x58]
mov r9d, dword [rsp + 0x70]
mov rdi, qword [rbp - 0x70]
movzx eax, byte [rbp + 0x6a0]
test al, al
je 0x1400283d9
test r9b, 8
je 0x1400283d9
mov rdx, qword [rbp + 0x698]
lea rcx, [rbp - 0x20]
mov r9, rbx
mov qword [rsp + 0x20], rsi
movzx r8d, al
call fcn.140027770
mov r8, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x70]
cmp r8, 0x10
jb 0x14002840c
lea rdx, [r8 + 1]
cmp rdx, 0x1000
jb 0x140028404
mov rcx, qword [rdi - 8]
add rdx, 0x27
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x14002843c
mov rdi, rcx
mov rcx, rdi
call fcn.14004ba4c
lea rdx, [rbp + 0x1e0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140028100
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x140028442
jmp 0x140027c4c
call fcn.14005689c
int3
call fcn.14005689c
int3
lea rcx, str.couldnt_close_FindFile_handle
call fcn.140013a60
int3
call fcn.14005689c
int3
call fcn.1400138f0
int3
call fcn.1400138f0
int3
call fcn.14005689c
int3