Function at 0x14002e930
Capabilities:
Enumerate files on windows
Move file
Write file on windows

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1540
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x1578], rbx
mov qword [rsp + 0x1580], rbp
mov qword [rsp + 0x1588], rsi
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x1530], rax
mov rsi, rdx
mov r12, rcx
call fcn.14009d5e8
mov rcx, rax
xor r14d, r14d
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x14002e9a3
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
lea rdx, str.epmcdlog.txt
or r13, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x14002e9ec
movzx edi, dx
mov ecx, edi
call fcn.1400a1868
test rax, rax
je 0x14002ea0d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.14000a990
mov rbx, qword [rsp + 0x58]
jmp 0x14002ea0d
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x58]
call fcn.140003940
mov rbx, qword [rsp + 0x58]
mov edx, 0x410
lea rcx, [rsp + 0xd10]
mov edi, r14d
lea rax, [rsp + 0xd10]
sub rsi, rax
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x14002ea54
movzx eax, word [rsi + rcx]
test ax, ax
je 0x14002ea54
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002ea30
jmp 0x14002ea59
test rdx, rdx
jne 0x14002ea62
sub rcx, 2
mov edi, 0x8007007a
mov word [rcx], 0
test edi, edi
jne 0x14002ecf5
mov r9d, 0x410
mov r8, rbx
lea rdx, [rsp + 0xd10]
mov rcx, qword [r12 + 8]
call fcn.140012f30
test eax, eax
je 0x14002ecf5
mov esi, 0x104
mov rdx, rsi
lea rcx, [rsp + 0x2c0]
mov r8d, r14d
lea rdi, [rsp + 0xd10]
lea rax, [rsp + 0x2c0]
sub rdi, rax
nop
nop
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14002eae4
movzx eax, word [rdi + rcx]
test ax, ax
je 0x14002eae4
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14002eac0
jmp 0x14002eae9
test rdx, rdx
jne 0x14002eaf3
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], 0
mov eax, r14d
test r8d, r8d
sete al
test eax, eax
je 0x14002ecf5
xor eax, eax
mov rcx, r13
lea rdi, [rsp + 0x2c0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [rsp + 0x2c0]
lea rcx, [r12 + 0x10]
call fcn.140003940
mov edi, r14d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
mov r15d, 1
cmp rax, 0xffffffffffffffff
je 0x14002ec7b
nop
nop
test byte [rsp + 0x70], 0x10
cmove edi, r15d
lea rdx, [rsp + 0x70]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002eb7f
test edi, edi
je 0x14002eb60
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x14002ec7b
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x8f0]
mov r8, rsi
lea rdx, [rsp + 0xb00]
lea rcx, [rsp + 0x2c0]
call fcn.1400cddd0
test eax, eax
jne 0x14002ec62
lea rax, str..bak
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8f0]
lea r8, [rsp + 0xb00]
mov rdx, rsi
lea rcx, [rsp + 0x6e0]
call fcn.1400ce8f0
test eax, eax
jne 0x14002ec62
lea rcx, [rsp + 0x2c0]
lea rdx, [rsp + 0x6e0]
lea rax, [rsp + 0x2c0]
sub rdx, rax
lea rax, [rsi + 0x7ffffefa]
test rax, rax
je 0x14002ec54
movzx eax, word [rdx + rcx]
test ax, ax
je 0x14002ec54
mov word [rcx], ax
add rcx, 2
sub rsi, r15
jne 0x14002ec31
jmp 0x14002ec59
test rsi, rsi
jne 0x14002ec5d
sub rcx, 2
mov word [rcx], 0
mov r8d, 9
lea rdx, [rsp + 0x2c0]
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rax, qword [r12 + 0x10]
cmp dword [rax - 8], r15d
jle 0x14002ec93
mov edx, dword [rax - 0x10]
lea rcx, [r12 + 0x10]
call fcn.140003570
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, r15d
mov edx, 0x40000000
mov rcx, qword [r12 + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
je 0x14002ecf5
mov word [rsp + 0x50], 0xfeff
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x60]
mov r8d, 2
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x14002ed11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x1530]
xor rcx, rsp
call fcn.1400cd6e0
lea r11, [rsp + 0x1540]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret