Function at 0x69f728
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x880
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
mov al, byte [0x008669f2]
test al, al
jne 0x6a0243
mov rax, qword [rcx + 0x38]
sub rax, qword [rcx + 0x30]
sar rax, 6
mov qword [rsp + 0x68], rax
or qword [r11 - 0x278], 0xffffffffffffffff
mov edi, 0x250
mov r8, rdi
xor edx, edx
lea rcx, [r11 - 0x270]
call fcn.006aba40
nop
lea r8, [0x00798f30]
mov rdx, rbx
lea rcx, [rsp + 0x308]
call fcn.00402658
mov rbx, rax
or qword [rsp + 0x3c0], 0xffffffffffffffff
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x3c8]
call fcn.006aba40
mov rdx, rbx
lea rcx, [rsp + 0x368]
call fcn.00401f00
lea rdx, [rsp + 0x3c8]
mov rcx, qword [rax + 0x48]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x368]
mov rcx, qword [rsp + 0x3b0]
cmp rcx, rax
je 0x69f834
test rcx, rcx
je 0x69f834
mov rax, qword [rsp + 0x368]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov edi, 0x100
cmp rdx, rdi
jbe 0x69f82d
call fcn.006a4944
jmp 0x69f839
call fcn.006a3610
jmp 0x69f839
mov edi, 0x100
lea rax, [rsp + 0x308]
mov rcx, qword [rsp + 0x330]
cmp rcx, rax
je 0x69f86f
test rcx, rcx
je 0x69f86f
mov rdx, qword [rsp + 0x308]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69f86a
call fcn.006a4944
jmp 0x69f86f
call fcn.006a3610
mov rax, qword [rsp + 0x620]
cmp qword [rsp + 0x3c0], rax
je 0x6a00e6
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3c8]
call fcn.0069f478
nop
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x8b8], rcx
mov rdx, rcx
mov rbx, qword [rsp + 0x60]
sub rdx, rbx
cmp rdx, 1
jne 0x69f8c0
mov al, byte [rbx]
cmp al, byte [0x0079876c]
je 0x69f8d2
cmp rdx, 2
jne 0x69f910
mov ax, word [rbx]
cmp ax, word [0x007b3e84]
jne 0x69f910
lea rax, [rsp + 0x38]
cmp rbx, rax
je 0x6a00ac
test rbx, rbx
je 0x6a00ac
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
cmp rdx, rdi
jbe 0x69f903
mov rcx, rbx
call fcn.006a4944
jmp 0x6a00ac
mov rcx, rbx
call fcn.006a3610
jmp 0x6a00ac
mov rax, qword [rsi + 0x48]
mov rdx, qword [rax + 0x80]
cmp byte [rdx + 0x317d], 0
jne 0x69f944
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x69f944
mov edx, 0x385
mov rcx, rax
call fcn.0041024c
mov rcx, qword [rsp + 0x8b8]
jmp 0x69f94a
mov al, byte [rdx + 0x2d9e]
test al, al
jne 0x69f9a1
test byte [rsp + 0x3c8], 2
jne 0x69f963
cmp word [rsp + 0x3f4], 0x2e
jne 0x69f9a1
lea rax, [rsp + 0x38]
cmp rbx, rax
je 0x6a00ac
test rbx, rbx
je 0x6a00ac
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
cmp rdx, rdi
jbe 0x69f994
mov rcx, rbx
call fcn.006a4944
jmp 0x6a00ac
mov rcx, rbx
call fcn.006a3610
jmp 0x6a00ac
mov rax, qword [rsi + 0x58]
cmp qword [rsi + 0x50], rax
je 0x69fc38
mov rax, qword [rsi + 0x50]
mov qword [rsp + 0x8b8], rax
cmp rax, qword [rsi + 0x58]
je 0x69fc38
mov r8b, 1
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.00652b58
test al, al
jne 0x69fa02
mov rax, qword [rsp + 0x8b8]
add rax, 0x30
mov qword [rsp + 0x8b8], rax
cmp rax, qword [rsi + 0x58]
jne 0x69f9c5
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
jmp 0x69fc38
mov edx, dword [rsp + 0x3e4]
shl rdx, 0x20
mov eax, dword [rsp + 0x3e8]
or rdx, rax
lea rcx, [rsp + 0x218]
call fcn.0058a0c8
mov rbx, rax
mov r8, qword [rsp + 0x8a8]
lea rdx, str.User_has_choosen_not_to_share_file:
lea rcx, [rsp + 0x2d8]
call fcn.0040fe34
nop
lea r8, [rsp + 0x38]
mov rdx, rax
lea rcx, [rsp + 0x1b8]
call fcn.00402448
nop
lea r8, [0x00798774]
mov rdx, rax
lea rcx, [rsp + 0xf8]
call fcn.00402658
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.00402448
nop
lea r8, [0x00798770]
mov rdx, rax
lea rcx, [rsp + 0x2a8]
call fcn.00402658
nop
xor r8d, r8d
mov rdx, rax
mov rcx, qword [0x00862cd0]
call fcn.00415954
nop
lea rax, [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2d0]
cmp rcx, rax
je 0x69fae8
test rcx, rcx
je 0x69fae8
mov rdx, qword [rsp + 0x2a8]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fae2
call fcn.006a4944
jmp 0x69fae8
call fcn.006a3610
nop
lea rax, [rsp + 0x158]
mov rcx, qword [rsp + 0x180]
cmp rcx, rax
je 0x69fb1f
test rcx, rcx
je 0x69fb1f
mov rdx, qword [rsp + 0x158]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fb19
call fcn.006a4944
jmp 0x69fb1f
call fcn.006a3610
nop
lea rax, [rsp + 0xf8]
mov rcx, qword [rsp + 0x120]
cmp rcx, rax
je 0x69fb56
test rcx, rcx
je 0x69fb56
mov rdx, qword [rsp + 0xf8]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fb50
call fcn.006a4944
jmp 0x69fb56
call fcn.006a3610
nop
lea rax, [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1e0]
cmp rcx, rax
je 0x69fb8d
test rcx, rcx
je 0x69fb8d
mov rdx, qword [rsp + 0x1b8]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fb87
call fcn.006a4944
jmp 0x69fb8d
call fcn.006a3610
nop
lea rax, [rsp + 0x2d8]
mov rcx, qword [rsp + 0x300]
cmp rcx, rax
je 0x69fbc4
test rcx, rcx
je 0x69fbc4
mov rdx, qword [rsp + 0x2d8]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fbbe
call fcn.006a4944
jmp 0x69fbc4
call fcn.006a3610
nop
lea rax, [rsp + 0x218]
mov rcx, qword [rsp + 0x240]
cmp rcx, rax
je 0x69fbfb
test rcx, rcx
je 0x69fbfb
mov rdx, qword [rsp + 0x218]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fbf5
call fcn.006a4944
jmp 0x69fbfb
call fcn.006a3610
nop
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x6a00ac
test rcx, rcx
je 0x6a00ac
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fc2e
call fcn.006a4944
jmp 0x6a00ac
call fcn.006a3610
jmp 0x6a00ac
mov eax, dword [rsp + 0x3c8]
shr eax, 4
test al, 1
je 0x69fd83
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x8a8]
lea rcx, [rsp + 0x278]
call fcn.00402448
nop
mov r8b, 0x5c
mov rdx, rax
lea rcx, [rsp + 0x338]
call fcn.004211f0
mov rcx, rax
mov qword [rsp + 0x70], rax
mov rax, qword [rsi + 0x48]
add rax, 0x1f0
mov qword [rsp + 0x8b8], rax
mov rbx, qword [rax + 0x18]
cmp rbx, qword [rax + 0x20]
je 0x69fcca
mov rdx, qword [rbx + 0x28]
mov rcx, qword [rcx + 0x28]
call fcn.006a525c
test eax, eax
je 0x69fcc6
add rbx, 0x30
mov rax, qword [rsp + 0x8b8]
cmp rbx, qword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
jne 0x69fc9c
jmp 0x69fcca
xor al, al
jmp 0x69fccc
mov al, 1
test al, al
sete bl
lea rax, [rsp + 0x338]
mov rcx, qword [rsp + 0x360]
cmp rcx, rax
je 0x69fd08
test rcx, rcx
je 0x69fd08
mov rdx, qword [rsp + 0x338]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fd02
call fcn.006a4944
jmp 0x69fd08
call fcn.006a3610
nop
lea rax, [rsp + 0x278]
mov rcx, qword [rsp + 0x2a0]
cmp rcx, rax
je 0x69fd3e
test rcx, rcx
je 0x69fd3e
mov rdx, qword [rsp + 0x278]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fd39
call fcn.006a4944
jmp 0x69fd3e
call fcn.006a3610
test bl, bl
je 0x69fdde
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x6a00ac
test rcx, rcx
je 0x6a00ac
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fd79
call fcn.006a4944
jmp 0x6a00ac
call fcn.006a3610
jmp 0x6a00ac
sub rcx, rbx
cmp rcx, 6
jbe 0x69fde3
lea rcx, [rcx + rbx - 6]
lea rdx, str..dctmp
call fcn.006a525c
test eax, eax
jne 0x69fdde
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x6a00ac
test rcx, rcx
je 0x6a00ac
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69fdd4
call fcn.006a4944
jmp 0x6a00ac
call fcn.006a3610
jmp 0x6a00ac
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x8b0]
mov qword [rsp + 0xa0], rax
mov rcx, qword [0x00862df0]
add rcx, 0x278
mov r8, rbx
lea rdx, [rsp + 0xf0]
call fcn.0044fc90
mov rcx, qword [rax]
mov qword [rsp + 0xa8], rcx
mov rax, qword [rsp + 0x3dc]
movabs rcx, 0xfe624e212ac18000
add rcx, rax
movabs rbx, 0xd6bf94d5e57a42bd
mov rax, rbx
mul rcx
shr rdx, 0x17
mov eax, edx
mov qword [rsp + 0xb0], rax
mov ecx, dword [rsp + 0x3e4]
shl rcx, 0x20
mov eax, dword [rsp + 0x3e8]
or rcx, rax
mov qword [rsp + 0xb8], rcx
mov eax, dword [rsp + 0x3c8]
mov dword [rsp + 0xc0], eax
bt eax, 0xa
jae 0x6a002b
cmp dword [rsp + 0x3ec], 0xa000000c
jne 0x6a002b
shr eax, 4
test al, 1
jne 0x6a002b
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x8a8]
lea rcx, [rsp + 0x128]
call fcn.00402448
nop
mov r9d, 1
mov r8d, 0x80000000
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.005944d4
nop
lea rax, [rsp + 0x128]
mov rcx, qword [rsp + 0x150]
cmp rcx, rax
je 0x69ff0e
test rcx, rcx
je 0x69ff0e
mov rdx, qword [rsp + 0x128]
sub rdx, rcx
cmp rdx, rdi
jbe 0x69ff09
call fcn.006a4944
jmp 0x69ff0e
call fcn.006a3610
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x69ff37
or edx, eax
lea rcx, [rsp + 0x30]
call fcn.00594950
mov r11, rax
jmp 0x69ff45
mov r11d, dword [rsp + 0x30]
shl r11, 0x20
mov eax, eax
or r11, rax
mov qword [rsp + 0xb8], r11
lea r9, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
neg eax
sbb rcx, rcx
and rcx, qword [rsp + 0x78]
movabs rax, 0xfe624e212ac18000
add rcx, rax
mov rax, rbx
mul rcx
shr rdx, 0x17
mov eax, edx
mov qword [rsp + 0xb0], rax
lea rax, [0x007955b8]
mov qword [rsp + 0x80], rax
lea rax, [0x007955c8]
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x80]
call fcn.0059492c
jmp 0x6a002b
mov rdx, qword [rsi + 0x38]
cmp rdx, qword [rsi + 0x40]
je 0x6a0057
test rdx, rdx
je 0x6a0050
mov rcx, rdx
lea rdx, [rsp + 0xa0]
mov r8d, 0x40
call fcn.006a4bf0
add qword [rsi + 0x38], 0x40
jmp 0x6a007f
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x20], 1
lea r9, [rsp + 0x8b8]
lea r8, [rsp + 0xa0]
lea rcx, [rsi + 0x30]
call fcn.006a0250
nop
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
cmp rcx, rax
je 0x6a00ac
test rcx, rcx
je 0x6a00ac
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
cmp rdx, rdi
jbe 0x6a00a7
call fcn.006a4944
jmp 0x6a00ac
call fcn.006a3610
lea rdx, [rsp + 0x3c8]
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x69f86f
mov rcx, qword [rsp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_FindClose]
or qword [rsp + 0x3c0], 0xffffffffffffffff
jmp 0x69f86f
mov rcx, qword [rsp + 0x3c0]
cmp rcx, 0xffffffffffffffff
je 0x6a00fa
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsi + 0x38]
sub rbx, qword [rsi + 0x30]
sar rbx, 6
mov qword [rsp + 0x8b8], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp rax, rbx
jae 0x6a022f
mov rbx, rax
shl rbx, 6
mov rcx, qword [rsp + 0x8b8]
mov r8, qword [rsi + 0x30]
mov eax, dword [r8 + rbx + 0x20]
shr eax, 4
test al, 1
je 0x6a0215
mov r8, qword [rbx + r8 + 8]
mov rdx, qword [rsp + 0x8a8]
lea rcx, [rsp + 0x248]
call fcn.00402658
nop
mov r8b, 0x5c
mov rdx, rax
lea rcx, [rsp + 0x1e8]
call fcn.004211f0
nop
mov r8, qword [rsp + 0x30]
mov rdx, rax
mov rcx, rsi
call fcn.0069f728
nop
lea rax, [rsp + 0x1e8]
mov rcx, qword [rsp + 0x210]
cmp rcx, rax
je 0x6a01bb
test rcx, rcx
je 0x6a01bb
mov rdx, qword [rsp + 0x1e8]
sub rdx, rcx
cmp rdx, rdi
jbe 0x6a01b5
call fcn.006a4944
jmp 0x6a01bb
call fcn.006a3610
nop
lea rax, [rsp + 0x248]
mov rcx, qword [rsp + 0x270]
cmp rcx, rax
je 0x6a020d
test rcx, rcx
je 0x6a0203
mov rdx, qword [rsp + 0x248]
sub rdx, rcx
cmp rdx, rdi
jbe 0x6a01f4
call fcn.006a4944
mov rcx, qword [rsp + 0x8b8]
jmp 0x6a0215
call fcn.006a3610
mov rcx, qword [rsp + 0x8b8]
jmp 0x6a0215
mov rcx, qword [rsp + 0x8b8]
jmp 0x6a0215
mov rcx, qword [rsp + 0x8b8]
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
add rbx, 0x40
cmp rax, rcx
jb 0x6a0130
mov rcx, qword [rsp + 0x620]
cmp rcx, 0xffffffffffffffff
je 0x6a0243
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x880
pop rdi
pop rsi
pop rbx
ret