Function at 0x14002e210
Capabilities:
Enumerate files on windows
Move file

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xd10
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0xd00], rax
mov rbp, rcx
mov qword [rsp + 0x50], rcx
mov rax, qword [rcx]
cmp dword [rax + 0x174], 0xffffffff
jg 0x14002e4d5
mov r8, qword [rcx + 0x10]
mov ebx, 0x104
mov rdx, rbx
lea rcx, [r11 - 0xa88]
lea rax, [r11 - 0xa88]
sub r8, rax
nop
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14002e2a5
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14002e2a5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002e280
jmp 0x14002e2aa
test rdx, rdx
jne 0x14002e2ae
sub rcx, 2
mov word [rcx], 0
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xaf0]
mov r8, rbx
lea rdx, [rsp + 0x8e0]
lea rcx, [rsp + 0x2b0]
call fcn.1400cddd0
test eax, eax
jne 0x14002e391
lea rax, str..bak
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xaf0]
lea r8, [rsp + 0x8e0]
mov rdx, rbx
lea rcx, [rsp + 0x6d0]
call fcn.1400ce8f0
test eax, eax
jne 0x14002e391
lea rcx, [rsp + 0x2b0]
lea rdx, [rsp + 0x6d0]
lea rax, [rsp + 0x2b0]
sub rdx, rax
nop
nop
nop
lea rax, [rbx + 0x7ffffefa]
test rax, rax
je 0x14002e384
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14002e384
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x14002e360
jmp 0x14002e389
test rbx, rbx
jne 0x14002e38d
sub rcx, 2
mov word [rcx], r14w
mov ebx, r14d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002e4d5
mov r13d, 1
nop
nop
test byte [rsp + 0x60], 0x10
cmove ebx, r13d
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002e3df
test ebx, ebx
je 0x14002e3c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x14002e4d5
mov r12, qword [rbp + 8]
mov ebx, r14d
nop
nop
nop
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r13d
mov edx, 0x10000
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rsi, 0xffffffffffffffff
jne 0x14002e49b
cmp eax, 5
jne 0x14002e455
lea ecx, [rax + 0x5f]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r13d
cmp ebx, 0xa
jl 0x14002e400
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fc430]
lea r8, str.FileRemoveEx
lea rdx, str.CCmnFunc
mov rcx, qword [r12 + 8]
call fcn.140080a70
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x14002e4d5
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fc3e0]
lea r8, str.FileRemoveEx
lea rdx, str.CCmnFunc
mov rcx, qword [r12 + 8]
call fcn.140081070
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x10]
sub rdx, 0x18
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14002e4f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0xd00]
xor rcx, rsp
call fcn.1400cd6e0
lea r11, [rsp + 0xd10]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret