Function at 0x140027770
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x178
mov rsi, qword [rdx]
xor ecx, ecx
mov edx, 0x80
xor ebp, ebp
mov rbx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r15, rax
test rax, rax
je 0x1400277c5
test rbx, rbx
je 0x1400277db
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [r15], rax
mov ebp, 1
test rax, rax
jne 0x1400277de
xor eax, eax
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rax], rbp
mov edi, 1
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rsi + 8]
add rsi, 8
mov qword [rsp + 0x20], rsi
test rbx, rbx
je 0x140027b64
movzx eax, byte [rbx]
mov rcx, rbx
test al, al
je 0x140027b0e
movzx edx, al
cmp dl, 0x2a
je 0x140027840
movzx eax, dl
cmp dl, 0x3f
je 0x140027832
movzx eax, byte [rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x140027817
test al, al
je 0x140027b0e
nop word [rax + rax]
inc rcx
cmp byte [rcx], 0
jne 0x140027840
sub rcx, rbx
add rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x1400277c5
mov rdx, qword [rsi]
mov rcx, rax
movzx r8d, byte [rdx]
cmp r8b, 0x2f
je 0x140027877
cmp r8b, 0x5c
jne 0x140027890
cmp byte [rdx + 1], 0
lea r8, [rdx + 1]
je 0x140027890
cmp byte [rdx + 2], 0x3a
cmove rdx, r8
nop dword [rax]
movzx eax, byte [rdx]
cmp al, 0x2f
jne 0x1400278a2
mov byte [rcx], 0x5c
inc rcx
inc rdx
jmp 0x140027890
mov byte [rcx], al
inc rcx
test al, al
je 0x1400278b0
inc rdx
jmp 0x140027890
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x1d8], rax
cmp rax, 0xffffffffffffffff
je 0x140027af8
cmp byte [r14], 0
mov rbx, r14
je 0x1400278fd
nop dword [rax]
inc rbx
cmp byte [rbx], 0
jne 0x1400278e0
cmp rbx, r14
jbe 0x1400278fd
nop dword [rax]
cmp byte [rbx], 0x5c
je 0x140027902
dec rbx
cmp rbx, r14
ja 0x1400278f0
cmp byte [rbx], 0x5c
jne 0x140027905
inc rbx
mov r13, rbx
lea rcx, [rsp + 0x5c]
sub r13, r14
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140027920
lea rcx, [rax + 1]
add rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140027ae3
mov rcx, rax
cmp r14, rbx
jae 0x140027960
mov rdx, r14
nop
movzx eax, byte [rdx]
inc rdx
mov byte [rcx], al
inc rcx
cmp rdx, rbx
jb 0x140027950
lea rdx, [rsp + 0x5c]
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140027970
mov eax, ebp
and eax, 0x8000000f
jge 0x140027991
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
je 0x14002799a
mov rdi, r15
jmp 0x1400279b0
lea eax, [rbp + 0x10]
mov rcx, r15
movsxd rdx, eax
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rdi, rax
test rdi, rdi
je 0x1400279d9
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
mov r15, rdi
movsxd rax, ebp
inc ebp
mov qword [rdi + rax*8], rcx
test rcx, rcx
je 0x1400279d9
mov edi, 1
jmp 0x1400279db
xor edi, edi
test edi, edi
je 0x140027ae5
movsxd rax, ebp
lea r12, [rax*8]
nop
mov rcx, qword [rsp + 0x1d8]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140027ae5
lea rcx, [rsp + 0x5c]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140027a20
lea rcx, [rax + 1]
add rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140027ae3
cmp r14, rbx
jae 0x140027a60
mov rdx, r14
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
mov byte [rax], cl
inc rax
cmp rdx, rbx
jb 0x140027a50
lea rdx, [rsp + 0x5c]
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140027a70
mov eax, ebp
and eax, 0x8000000f
jge 0x140027a91
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
je 0x140027a9a
mov rdi, r15
jmp 0x140027ab0
lea eax, [rbp + 0x10]
mov rcx, r15
movsxd rdx, eax
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rdi, rax
test rdi, rdi
je 0x140027ad7
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [r12 + rdi], rax
inc ebp
add r12, 8
mov r15, rdi
test rax, rax
je 0x140027ad7
mov edi, 1
jmp 0x140027ad9
xor edi, edi
test edi, edi
jne 0x1400279f0
jmp 0x140027ae5
xor edi, edi
mov rcx, qword [rsp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x20]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test edi, edi
jne 0x1400277f0
jmp 0x1400277c5
mov eax, ebp
and eax, 0x8000000f
jge 0x140027b1e
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140027b38
lea eax, [rbp + 0x10]
mov rcx, r15
movsxd rdx, eax
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r15, rax
test r15, r15
je 0x1400277c5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov rcx, rax
movsxd rax, ebp
inc ebp
mov qword [r15 + rax*8], rcx
test rcx, rcx
je 0x1400277c5
jmp 0x1400277de
test edi, edi
je 0x1400277c5
mov eax, ebp
and eax, 0x8000000f
jge 0x140027b7c
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140027b96
lea eax, [rbp + 0x10]
mov rcx, r15
movsxd rdx, eax
shl rdx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r15, rax
test r15, r15
je 0x1400277c5
mov rcx, qword [rsp + 0x1c0]
movsxd rax, ebp
mov qword [r15 + rax*8], 0
mov eax, 1
mov dword [rcx], ebp
mov rcx, qword [rsp + 0x1c8]
mov qword [rcx], r15
jmp 0x1400277c7