Function at 0x140027698
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f8]
sub rsp, 0x2f8
mov rax, qword [0x1400a1df8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov r13, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
and qword [rsp + 0x68], 0
lea r8, [0x14007ce78]
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.1400133b8
nop
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.1400135d4
lea rsi, [rax + 0x18]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp - 0x70]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140027982
xor eax, eax
mov qword [rbp - 0x80], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
and qword [rbp - 0x80], rax
test byte [rbp - 0x70], 0x10
je 0x140027772
lea rdx, [0x14007ce80]
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400278c1
lea rdx, [0x14007ce84]
lea rcx, [rbp - 0x44]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400278c1
lea r8, [0x14007ce60]
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.1400133b8
nop
lea r8, [rbp - 0x44]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400133b8
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140013330
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400277d1
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140078a80]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400277fa
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140078a80]
lea rdx, [rbp - 0x44]
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.1400539f8
test eax, eax
jne 0x140027881
cmp dword [0x1400a61f8], 2
jge 0x140027881
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx - 0x10]
test edx, edx
js 0x140027a43
lea r8d, [rax + 1]
sub r8d, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edx
or eax, r8d
jge 0x140027851
lfence
lea rcx, [rsp + 0x68]
call fcn.14000ee50
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x140027881
movsxd rdx, dword [0x1400a61f8]
lea rcx, [r12 + rdx*8]
inc edx
mov dword [0x1400a61f8], edx
lea rdx, [rsp + 0x68]
call fcn.140013330
cmp dword [0x1400a61f8], 2
je 0x1400278d6
test byte [rbp - 0x70], 0x10
je 0x1400278c1
mov rbx, qword [rsp + 0x78]
cmp rbx, qword [rbp - 0x80]
je 0x1400278af
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
call fcn.1400135d4
add rax, 0x18
mov qword [rbx], rax
add qword [rsp + 0x78], 8
jmp 0x1400278c1
lea r8, [rsp + 0x68]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140018a50
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002773a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
cmp rbx, rdi
je 0x14002794a
lea rax, [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.1400135d4
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.1400135d4
add rax, 0x18
mov qword [rsp + 0x30], rax
mov r9, r12
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140027698
add rbx, 8
cmp rbx, rdi
jne 0x1400278ee
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x140027982
lea r8, [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.1400189fc
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
call fcn.140013b38
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
and qword [rbp - 0x80], 0
lea rdx, [rsi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400279a7
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140078a80]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400279d1
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140078a80]
nop
mov rdx, qword [r14]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400279f9
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140078a80]
nop
mov rdx, qword [r15]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027a20
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x140078a80]
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140037490
add rsp, 0x2f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.140009b24
int3