Function at 0x140004d20
Capabilities:
Enumerate files on windows
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x1401b89e8]
xor rax, rsp
mov qword [rbp + 0x760], rax
lea rax, str..dv.tmp
xor edx, edx
mov qword [rbp + 0x300], rax
lea rcx, [rbp + 0x430]
lea rax, str..dv.temp
mov r8d, 0x104
mov qword [rbp + 0x308], rax
xor r13d, r13d
lea rax, str..dvx.tmp
mov qword [rbp + 0x310], rax
lea rax, str..dvx.temp
mov qword [rbp + 0x318], rax
call fcn.14008b040
xor edx, edx
lea rcx, [rbp + 0x540]
mov r8d, 0x104
call fcn.14008b040
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov edx, 0x104
lea r8d, [r13 + 2]
lea rcx, [rbp + 0x430]
call fcn.140011e00
lea rcx, [rbp + 0x430]
call fcn.140005360
mov esi, r13d
lea r14, [rbp + 0x300]
lea rbx, [0x1400f8380]
lea r15, str.Recover_Temp_REPO__s__result_d__n
lea r12, str.Rollback_Temp_REPO__s__result_d__n
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x104
call fcn.14008b040
mov r9, qword [r14]
lea r8, [0x1400f83cc]
lea rdx, [rbp + 0x540]
mov ecx, 0x104
call fcn.140005530
lea rax, [rbp + 0x540]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x430]
lea r8, [0x1400f8384]
mov qword [rsp + 0x20], rbx
lea rdx, [rbp + 0x650]
call fcn.140005530
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x650]
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005028
lea r8, [rbp + 0x1ec]
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov edx, 0x104
call fcn.140096ba0
xor edx, edx
lea rcx, [rbp + 0x50]
mov r8d, 0x104
call fcn.14008b040
xor edx, edx
lea rcx, [rbp + 0x320]
mov r8d, 0x104
call fcn.14008b040
cmp dword [0x1401bb094], r13d
jne 0x14000506a
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r13
mov edx, 0x104
lea rcx, [rbp + 0x50]
mov r8d, 2
call fcn.140011e00
or r9, 0xffffffffffffffff
lea r8, [rbp + 0x50]
mov edx, 0x104
lea rcx, [rbp + 0x320]
call fcn.140096ba0
mov edx, 0x2e
lea rcx, [rbp + 0x320]
call fcn.14008b708
mov rbx, rax
test rax, rax
je 0x140004ffe
mov edx, 0x2e
lea rcx, [rsp + 0x40]
call fcn.14008b708
test rax, rax
je 0x140004ffe
lea rdx, str..temp
mov byte [rbx], r13b
mov rcx, rax
call fcn.1400af838
test eax, eax
jne 0x140004fa8
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x320]
call fcn.1400b2ef8
test eax, eax
je 0x140004fa8
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x50]
call fcn.140097280
cmp dword [0x1401b83f0], 3
jl 0x140004ffe
test dword [0x1401b8454], 0x400000
je 0x140004ffe
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x1b1
jmp 0x140004fe1
lea rcx, [rbp + 0x50]
call fcn.1400973a4
cmp dword [0x1401b83f0], 3
jl 0x140004ffe
test dword [0x1401b8454], 0x400000
je 0x140004ffe
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x1b6
lea r9, str.........ESIF_LIBSourcesesif_lib_databank.c
mov edx, 3
lea r8, str.DataBank_RollbackRepos
mov ecx, 0x400000
call fcn.140067120
lea rdx, [rbp + 0x50]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindNextFileA]
test eax, eax
je 0x140005018
lea r8, [rbp + 0x7c]
jmp 0x140004e88
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
lea rbx, [0x1400f8380]
inc esi
add r14, 8
cmp esi, 4
jb 0x140004e03
mov eax, r13d
mov rcx, qword [rbp + 0x760]
xor rcx, rsp
call fcn.1400897c0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_FindClose]
cmp dword [0x1401b83f0], 3
jl 0x1400050b9
test dword [0x1401b8454], 0x400000
je 0x1400050b9
lea rax, str.Pausing_DV_loading_n
mov edx, 3
mov qword [rsp + 0x28], rax
lea r9, str.........ESIF_LIBSourcesesif_lib_databank.c
lea r8, str.DataBank_RollbackRepos
mov dword [rsp + 0x20], 0x1a3
mov ecx, 0x400000
call fcn.140067120
mov eax, 0x68
jmp 0x14000503a