Function at 0x14002c030
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x3b8], rbx
mov rax, qword [0x1400cfdf0]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov rax, r8
mov qword [rsp + 0x60], rax
mov r12, rdx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rax
xor edi, edi
mov dword [rsp + 0x30], edi
xor eax, eax
mov qword [rsp + 0x68], rax
lea edx, [rdi + 0x5c]
mov rcx, qword [r12]
call fcn.140054470
mov rsi, qword [r12]
lea r14, [rdi - 1]
test rax, rax
jne 0x14002c0ae
mov eax, r14d
jmp 0x14002c0b4
sub rax, rsi
sar rax, 1
mov ebx, edi
test eax, eax
cmovns ebx, eax
cmp ebx, dword [rsi - 0x10]
jl 0x14002c0d4
lea rcx, [rsi - 0x18]
call fcn.14001e050
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
jmp 0x14002c0f4
mov rcx, r12
call fcn.140020870
mov r9, rax
mov r8d, ebx
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140025d80
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov qword [rsp + 0x58], rax
mov rcx, qword [r12]
mov r15d, dword [rcx - 0x10]
lea edx, [rax + 0x5c]
call fcn.140054470
mov rsi, qword [r12]
test rax, rax
jne 0x14002c119
mov eax, r14d
jmp 0x14002c11f
sub rax, rsi
sar rax, 1
sub r15d, eax
lea eax, [r15 - 1]
test eax, eax
cmovns edi, eax
movsxd r15, dword [rsi - 0x10]
cmp edi, r15d
jl 0x14002c148
lea rcx, [rsi - 0x18]
call fcn.14001e050
add rax, 0x18
mov qword [rsp + 0x58], rax
jmp 0x14002c16d
mov rcx, r12
call fcn.140020870
movsxd rcx, edi
mov rdx, r15
sub rdx, rcx
lea rdx, [rsi + rdx*2]
mov r9, rax
mov r8d, edi
lea rcx, [rsp + 0x58]
call fcn.140025d80
mov r15d, 3
mov dword [rsp + 0x30], r15d
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rsp + 0x40], rax
lea r13, [rbx - 0x18]
mov qword [rbp - 0x50], r13
mov rsi, qword [r13]
test rsi, rsi
je 0x14002c1b1
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.14000dba0]
mov rcx, rsi
call rdi
mov rsi, rax
test rax, rax
jne 0x14002c1d1
call fcn.140015220
mov rsi, rax
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x20]
mov rcx, rdi
call qword [fcn.14000dba0]
mov rcx, rsi
call rdi
mov rsi, rax
test rsi, rsi
je 0x14002c91c
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.14000dba0]
mov rcx, rsi
call rdi
add rax, 0x18
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 7
lea rcx, [0x14009a8f8]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002c210
mov dword [rsp + 0x20], eax
mov r9, rcx
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14001e110
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.140026200
nop
lea r8, [rsp + 0x58]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140026200
nop
mov rsi, qword [rbp - 0x78]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c287
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rsp + 0x40]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c2b6
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov rdx, qword [rbp - 0x20]
mov rcx, qword [r12]
call fcn.14006b68c
mov rdx, qword [rbp - 0x20]
lea rcx, [rdx - 0x18]
mov rdi, qword [r12]
sub rdi, 0x18
cmp rcx, rdi
je 0x14002c30c
cmp dword [rdi + 0x10], 0
jl 0x14002c300
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14002c300
call fcn.14001e050
mov rbx, rax
mov rcx, rdi
call fcn.14001a8a0
lea rax, [rbx + 0x18]
mov qword [r12], rax
jmp 0x14002c30c
mov r8d, dword [rdx - 0x10]
mov rcx, r12
call fcn.14001b050
lea r8, [0x14009a910]
mov rdx, r12
lea rcx, [rbp - 0x70]
call fcn.1400262f0
lea rdx, [rbp]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rbp - 0x80], rax
mov rsi, qword [rbp - 0x70]
mov ecx, r14d
lock xadd dword [rsi - 8], ecx
sub ecx, 1
jg 0x14002c365
mov rdi, qword [rsi - 0x18]
mov r8, qword [rdi]
mov rbx, qword [r8 + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
mov rbx, qword [rbp - 0x80]
cmp rbx, 0xffffffffffffffff
je 0x14002c806
mov dword [rsp + 0x30], r15d
mov r13d, r15d
call fcn.140015220
mov rdi, rax
test rax, rax
je 0x14002c948
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x2c]
cmp rax, 0x10000
jae 0x14002c3c5
lea rax, [rbp + 0x2c]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.1400167e0
jmp 0x14002c3ec
lea rcx, [rbp + 0x2c]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002c3d0
mov r8d, eax
lea rdx, [rbp + 0x2c]
lea rcx, [rsp + 0x38]
call fcn.14001b050
nop
test byte [rbp], 0x10
je 0x14002c484
lea rdx, [0x14009a918]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.140068814
test eax, eax
je 0x14002c484
lea rdx, [0x14009a91c]
mov rcx, rbx
call fcn.140068814
test eax, eax
je 0x14002c484
lea rax, [rsp + 0x78]
mov qword [rbp - 0x30], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.14001e050
add rax, 0x18
mov qword [rsp + 0x78], rax
lea r8, [0x14009a8f8]
mov rdx, r12
lea rcx, [rbp - 0x58]
call fcn.1400262f0
nop
lea r8, [rbp + 0x2c]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.1400262f0
nop
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, qword [rbp - 0x60]
call fcn.14002c030
nop
mov rsi, qword [rbp - 0x58]
jmp 0x14002c780
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rsp + 0x48], rax
mov rax, qword [r12]
mov rdi, qword [rax - 0x18]
test rdi, rdi
je 0x14002c4b9
mov rax, qword [rdi]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
mov rdi, rax
test rax, rax
jne 0x14002c4d9
call fcn.140015220
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
mov rdi, rax
test rdi, rdi
je 0x14002c93d
mov rcx, qword [rdi]
mov rbx, qword [rcx + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
add rax, 0x18
mov qword [rsp + 0x48], rax
or r15d, 0x10
mov dword [rsp + 0x30], r15d
mov rdx, qword [r12]
mov dword [rsp + 0x20], 1
lea r9, [0x14009a8f8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.14001e110
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x10]
call fcn.140026200
nop
and r13d, 0xffffffef
mov dword [rsp + 0x30], r13d
mov rsi, qword [rsp + 0x48]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c576
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
xor eax, eax
mov qword [rbp - 0x18], rax
mov qword [rsp + 0x70], rax
mov rax, qword [r12]
mov rdi, qword [rax - 0x18]
test rdi, rdi
je 0x14002c5ab
mov rax, qword [rdi]
mov rbx, qword [rax + 0x20]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
mov rdi, rax
test rax, rax
jne 0x14002c5cb
call fcn.140015220
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x20]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
mov rdi, rax
test rdi, rdi
je 0x14002c932
mov rcx, qword [rdi]
mov rbx, qword [rcx + 0x18]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rcx, rdi
call rbx
add rax, 0x18
mov qword [rsp + 0x70], rax
or dword [rsp + 0x30], 0x40
mov rdx, qword [r12]
mov dword [rsp + 0x20], 1
lea r9, [0x14009a8f8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.14001e110
nop
xor eax, eax
mov qword [rsp + 0x50], rax
mov rbx, qword [rsp + 0x70]
lea r15, [rbx - 0x18]
mov rsi, qword [r15]
test rsi, rsi
je 0x14002c64e
mov rax, qword [rsi]
mov rdi, qword [rax + 0x20]
mov rcx, rdi
call qword [fcn.14000dba0]
mov rcx, rsi
call rdi
mov rsi, rax
test rax, rax
jne 0x14002c66e
call fcn.140015220
mov rsi, rax
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x20]
mov rcx, rdi
call qword [fcn.14000dba0]
mov rcx, rsi
call rdi
mov rsi, rax
test rsi, rsi
je 0x14002c927
mov rcx, qword [rsi]
mov rdi, qword [rcx + 0x18]
mov rcx, rdi
call qword [fcn.14000dba0]
mov rcx, rsi
call rdi
add rax, 0x18
mov qword [rsp + 0x50], rax
or r13d, 0xc0
mov dword [rsp + 0x30], r13d
mov rax, qword [rsp + 0x60]
mov r9, qword [rax]
mov eax, dword [r9 - 0x10]
mov dword [rsp + 0x20], eax
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14001e110
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x18]
call fcn.140026200
btr r13d, 7
mov dword [rsp + 0x30], r13d
mov rsi, qword [rsp + 0x50]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c70e
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
and r13d, 0xffffffbf
mov dword [rsp + 0x30], r13d
mov eax, r14d
lock xadd dword [r15 + 0x10], eax
sub eax, 1
jg 0x14002c740
mov rdi, qword [r15]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rdx, r15
mov rcx, rdi
call rbx
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
call fcn.14006b68c
mov rsi, qword [rbp - 0x18]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c77c
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rbp - 0x10]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c7ab
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rsp + 0x38]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c7da
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
lea rdx, [rbp]
mov rbx, qword [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002c7f9
mov r15d, dword [rsp + 0x30]
jmp 0x14002c374
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r13, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x20]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c835
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rsi, qword [rsp + 0x58]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c865
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov eax, r14d
lock xadd dword [r13 + 0x10], eax
sub eax, 1
jg 0x14002c890
mov rdi, qword [r13]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
mov rdx, r13
mov rcx, rdi
call rbx
nop
mov rsi, qword [r12]
mov eax, r14d
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x14002c8bf
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
nop
mov rax, qword [rsp + 0x60]
mov rsi, qword [rax]
lock xadd dword [rsi - 8], r14d
sub r14d, 1
jg 0x14002c8f0
mov rdi, qword [rsi - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.14000dba0]
lea rdx, [rsi - 0x18]
mov rcx, rdi
call rbx
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.14004e4a0
mov rbx, qword [rsp + 0x3b8]
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
nop
mov ecx, 0x80004005
call fcn.140012af0
int3