Function at 0x14001edd0
Capabilities:
Enumerate files on windows
Get file attributes
Move file

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x208]
sub rsp, 0x308
mov rdi, rdx
mov rbx, rcx
mov r10, qword [rcx + 0x10]
test r10, r10
jne 0x14001ee23
call fcn.14000c530
nop
mov rcx, rdi
call fcn.14000c530
xor eax, eax
jmp 0x14001f53c
mov rdx, rbx
mov r8, qword [rcx + 0x18]
cmp r8, 8
jb 0x14001ee33
mov rdx, qword [rcx]
mov r9d, 1
mov qword [rsp + 0x40], r9
test r10, r10
je 0x14001ee63
mov rcx, r10
mov rax, rdx
nop dword [rax]
cmp word [rax], 0x2f
je 0x14001ef47
add rax, 2
sub rcx, r9
jne 0x14001ee50
mov rdx, rbx
cmp r8, 8
jb 0x14001ee6f
mov rdx, qword [rbx]
dec r10
mov rax, 0xffffffffffffffff
cmp r10, rax
cmovb rax, r10
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x5c
je 0x14001eea3
nop word [rax + rax]
cmp rcx, rdx
je 0x14001efb3
sub rcx, 2
cmp word [rcx], 0x5c
jne 0x14001ee90
sub rcx, rdx
sar rcx, 1
cmp rcx, r10
je 0x14001eec0
lea rdx, [0x14004df38]
mov r8, r9
mov rcx, rbx
call fcn.14000e560
mov rsi, qword [rbx + 0x10]
mov r14, qword [rdi + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r14
jb 0x14001f556
mov r13, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001eeee
mov r13, qword [rbx]
mov r12, rdi
cmp qword [rdi + 0x18], 8
jb 0x14001eefb
mov r12, qword [rdi]
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
lea r15, [r14 + rsi]
mov ebx, 7
lea rdi, [rsp + 0x20]
lea edx, [rax + 0xa]
movabs r8, 0x7fffffffffffffff
cmp r15, rbx
jbe 0x14001f01d
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14001efbf
mov rbx, rcx
lea rcx, [rax - 2]
jmp 0x14001efdf
sub rax, rdx
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14001ee63
mov rdx, rbx
cmp r8, 8
jb 0x14001ef63
mov rdx, qword [rbx]
dec r10
mov rax, 0xffffffffffffffff
cmp r10, rax
cmovb rax, r10
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x14001ef8f
nop
cmp rcx, rdx
je 0x14001efaa
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x14001ef80
sub rcx, rdx
sar rcx, 1
cmp rcx, r10
je 0x14001eec0
lea rdx, [0x140044cb8]
jmp 0x14001eeb5
mov rcx, 0xffffffffffffffff
jmp 0x14001ef95
mov rcx, 0xffffffffffffffff
jmp 0x14001eea9
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, r8
ja 0x14001f562
add rcx, rcx
cmp rcx, 0x1000
jb 0x14001f00b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001f562
mov rcx, rax
call fcn.1400243ec
test rax, rax
je 0x14001f550
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14001f018
test rcx, rcx
je 0x14001f015
call fcn.1400243ec
mov rdi, rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.1400266b0
lea rcx, [rbx + rdi]
lea r8, [r14 + r14]
mov rdx, r12
call fcn.1400266b0
xor r13d, r13d
mov word [rdi + r15*2], r13w
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov ebx, r13d
mov rdi, qword [rbp + 0x268]
lea r15d, [r13 + 1]
test rdi, rdi
je 0x14001f180
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
mov r8d, r15d
lea rdx, [0x14004f034]
lea rcx, [rsp + 0x48]
call fcn.14000cfd0
nop
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x14001f0c0
mov rdx, rdi
lea rcx, [rbp - 0x80]
call fcn.14000cfd0
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.140003ee0
mov ebx, eax
mov rdx, qword [rbp - 0x68]
cmp rdx, 8
jb 0x14001f12d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f128
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f55c
call fcn.1400243b8
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r13w
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14001f180
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f17b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f568
call fcn.1400243b8
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp - 0x58], rax
mov rsi, qword [rsp + 0x68]
mov r12, qword [rbp + 0x250]
cmp rax, 0xffffffffffffffff
je 0x14001f427
movsxd rcx, ebx
mov qword [rbp - 0x60], rcx
nop dword [rax]
mov r13, qword [r12 + 0x10]
lea rax, [rbp - 0x24]
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14001f1d0
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r13
cmp rax, rdi
jb 0x14001f580
mov r15, r12
cmp qword [r12 + 0x18], 8
jb 0x14001f202
mov r15, qword [r12]
lea r14, [rdi + r13]
mov ebx, 7
lea rsi, [rsp + 0x48]
cmp r14, rbx
jbe 0x14001f2a3
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14001f231
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x14001f261
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001f574
add rcx, rcx
cmp rcx, 0x1000
jb 0x14001f28d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001f574
mov rcx, rax
call fcn.1400243ec
test rax, rax
je 0x14001f57a
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14001f29e
test rcx, rcx
je 0x14001f299
call fcn.1400243ec
jmp 0x14001f29b
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rbx
lea rbx, [r13*2]
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call fcn.1400266b0
lea rcx, [rbx + rsi]
lea r8, [rdi + rdi]
lea rdx, [rbp - 0x24]
call fcn.1400266b0
xor r13d, r13d
mov word [rsi + r14*2], r13w
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001f31e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f319
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f57a
call fcn.1400243b8
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x20]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 8
cmovae rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x14001f3fb
mov rsi, qword [rbp - 0x60]
test rsi, rsi
je 0x14001f396
mov rdi, r13
jle 0x14001f396
mov rbx, qword [rsp + 0x68]
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14001f37d
mov rdx, qword [rbx]
lea rcx, [rbp - 0x24]
call fcn.1400308ec
test eax, eax
je 0x14001f3fb
inc rdi
add rbx, 0x20
cmp rdi, rsi
jl 0x14001f370
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
mov edx, 0x80
call fcn.14003206c
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call fcn.140032108
test eax, eax
je 0x14001f3fb
cmp dword [rbp + 0x260], r13d
je 0x14001f3f1
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov r15d, r13d
mov qword [rsp + 0x40], r15
jmp 0x14001f400
mov r15, qword [rsp + 0x40]
lea rdx, [rbp - 0x50]
mov r14, qword [rbp - 0x58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14001f1c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x14001f4d2
mov rbx, rsi
mov rdi, qword [rsp + 0x70]
cmp rsi, rdi
je 0x14001f498
nop dword [rax]
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14001f47f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001f47a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001f56e
mov rcx, r8
call fcn.1400243b8
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
add rbx, 0x20
cmp rbx, rdi
jne 0x14001f440
mov rdx, qword [rsp + 0x78]
sub rdx, rsi
and rdx, 0xffffffffffffffe0
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001f4c9
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f56e
mov rcx, rsi
call fcn.1400243b8
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14001f510
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f50b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001f550
call fcn.1400243b8
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], r13w
mov rcx, r12
call fcn.14000c530
nop
mov rcx, qword [rbp + 0x258]
call fcn.14000c530
mov eax, r15d
add rsp, 0x308
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400303f4
nop
call fcn.140003e20
nop
call fcn.1400303f4
nop
call fcn.140001e20
nop
call fcn.1400303f4
nop
call fcn.1400303f4
nop
call fcn.140001e20
int3
call fcn.1400303f4
int3
call fcn.140003e20
int3