Function at 0x140081f90
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push rdi
push r12
push r13
mov eax, 0x1500
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1528], rbx
mov qword [rsp + 0x1530], rbp
mov qword [rsp + 0x1538], rsi
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x14f0], rax
mov rsi, rcx
mov rbx, qword [rcx + 0x178]
xor r13d, r13d
test rbx, rbx
je 0x140082088
mov rax, qword [rbx]
cmp dword [rax + 0x174], 4
jl 0x140082088
call fcn.14009d5e8
mov r11, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x14008201c
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rax, [0x1400fb278]
mov qword [rsp + 0x20], rax
lea r9, str.ReleaseMyApp
lea r8, str.CSetupApp
lea rdx, str.private__s::_s__s_
lea rcx, [rsp + 0x40]
call fcn.14000a800
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14002f200
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140082088
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsi + 0x168]
test rcx, rcx
je 0x1400820a7
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rsi + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsi + 0x170], 0
jne 0x1400823b2
mov rax, qword [rsi + 0x148]
mov r8, qword [rax + 0xf8]
cmp dword [r8 - 0x10], 0
cmove r8, r13
mov ebx, 0x410
mov rdx, rbx
lea rcx, [rsp + 0x4b0]
mov r9d, r13d
lea rax, [rsp + 0x4b0]
sub r8, rax
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140082115
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140082115
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400820f0
jmp 0x14008211a
test rdx, rdx
jne 0x140082124
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], 0
test r9d, r9d
jne 0x140082273
mov rdx, rbx
lea rcx, [rsp + 0xcd0]
mov r9d, r13d
lea r8, [rsp + 0x4b0]
lea rax, [rsp + 0xcd0]
sub r8, rax
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140082178
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140082178
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140082153
jmp 0x14008217d
test rdx, rdx
jne 0x140082187
sub rcx, 2
mov r9d, 0x8007007a
mov word [rcx], 0
test r9d, r9d
jne 0x140082273
lea rdx, str.hwnd.tmp
lea rcx, [rsp + 0xcd0]
call fcn.14002ae40
lea rcx, [rsp + 0x4b0]
mov r8d, r13d
lea rdx, [rsp + 0xcd0]
lea rax, [rsp + 0x4b0]
sub rdx, rax
nop
nop
nop
lea rax, [rbx + 0x7ffffbee]
test rax, rax
je 0x1400821f4
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400821f4
mov word [rcx], ax
add rcx, 2
sub rbx, 1
jne 0x1400821d0
jmp 0x1400821f9
test rbx, rbx
jne 0x140082203
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], 0
mov eax, r13d
test r8d, r8d
sete al
test eax, eax
je 0x140082273
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
lea r8, [rsp + 0x4b0]
lea rax, [rsp + 0x2a0]
sub r8, rax
nop
nop
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140082265
movzx eax, word [rcx + r8]
test ax, ax
je 0x140082265
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140082240
jmp 0x14008226a
test rdx, rdx
jne 0x14008226e
sub rcx, 2
mov word [rcx], 0
mov ebx, r13d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400823b2
mov r12d, 1
nop
test byte [rsp + 0x50], 0x10
cmove ebx, r12d
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1400822bf
test ebx, ebx
je 0x1400822a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
je 0x1400823b2
mov rbp, qword [rsi + 0x140]
mov ebx, r13d
nop
nop
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r12d
mov edx, 0x10000
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp rsi, 0xffffffffffffffff
jne 0x14008237a
cmp eax, 5
jne 0x140082335
lea ecx, [rax + 0x5f]
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, r12d
cmp ebx, 0xa
jl 0x1400822e0
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, [0x1400fc430]
lea r8, str.FileRemoveEx
lea rdx, str.CCmnFunc
mov rcx, qword [rbp + 8]
call fcn.140080a70
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x1400823b2
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
lea r9, [0x1400fc3e0]
lea r8, str.FileRemoveEx
lea rdx, str.CCmnFunc
mov rcx, qword [rbp + 8]
call fcn.140081070
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x14f0]
xor rcx, rsp
call fcn.1400cd6e0
lea r11, [rsp + 0x1500]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret