Function at 0x140002f90
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r12, rdx
mov r14, rcx
mov qword [rbp - 0x60], rdx
mov rcx, qword [rcx + 0x10]
movabs rsi, 0x7ffffffffffffffe
mov rax, rsi
sub rax, rcx
cmp rax, 2
jb 0x140003b39
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x140002ff5
mov r9, qword [r14]
mov qword [rsp + 0x30], 2
lea rax, [0x140020c10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x38]
call fcn.14000a400
nop
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rcx, qword [rbp - 0x38]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
mov qword [rbp - 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x140003112
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140003082
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000307d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8d
call fcn.14000a830
xor ebx, ebx
mov word [rbp - 0x38], bx
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], rbx
mov rdx, qword [r12 + 0x18]
cmp rdx, 8
jb 0x1400030d5
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x1400030d0
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b93
mov rcx, r8
call fcn.14000a830
mov qword [r12 + 0x10], rbx
mov qword [r12 + 0x18], 7
mov word [r12], bx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14000a810
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ebx, ebx
lea r15, [rbx - 1]
lea rdi, [0x140020c18]
mov rcx, qword [r14 + 0x10]
mov rax, rsi
sub rax, rcx
cmp rax, 1
jb 0x140003b33
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x140003140
mov r9, qword [r14]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.14000a400
nop
lea rax, [rbp + 0x1c]
mov rdx, r15
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140003165
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400031c9
lea rsi, [rcx + rdx]
mov qword [rsp + 0x70], rsi
lea rdi, [rsp + 0x60]
cmp r8, 8
cmovae rdi, qword [rsp + 0x60]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x1c]
call fcn.14000ea00
mov word [rdi + rsi*2], bx
lea rax, [rsp + 0x60]
movabs rsi, 0x7ffffffffffffffe
lea rdi, [0x140020c18]
jmp 0x1400031dc
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1c]
lea rcx, [rsp + 0x60]
call fcn.14000a540
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call fcn.140001400
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003254
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000324f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b3f
call fcn.14000a830
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400032a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b45
call fcn.14000a830
mov rcx, qword [r14 + 0x10]
mov rax, rsi
sub rax, rcx
cmp rax, 1
jb 0x140003b27
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x1400032ca
mov r9, qword [r14]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.14000a400
nop
lea rax, [rbp + 0x1c]
mov rdx, r15
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1400032f0
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140003354
lea rsi, [rdx + rcx]
mov qword [rsp + 0x50], rsi
lea rdi, [rsp + 0x40]
cmp r8, 8
cmovae rdi, qword [rsp + 0x40]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x1c]
call fcn.14000ea00
mov word [rdi + rsi*2], bx
lea rax, [rsp + 0x40]
movabs rsi, 0x7ffffffffffffffe
lea rdi, [0x140020c18]
jmp 0x140003367
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1c]
lea rcx, [rsp + 0x40]
call fcn.14000a540
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
call fcn.140001520
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x1400033e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b4b
call fcn.14000a830
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], bx
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003437
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b51
call fcn.14000a830
test byte [rbp - 0x10], 0x10
je 0x1400036cb
cmp word [rbp + 0x1c], 0x2e
je 0x140003ab8
lea rax, [rsp + 0x40]
mov qword [rbp - 0x68], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov rsi, qword [r12 + 0x10]
mov r15, r12
cmp qword [r12 + 0x18], 8
jb 0x140003478
mov r15, qword [r12]
cmp rsi, 8
jae 0x140003495
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 7
jmp 0x14000352b
mov rdi, rsi
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140003b63
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400034ff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b63
mov rcx, rax
call fcn.14000a838
mov rcx, rax
test rax, rax
je 0x140003b2d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000350e
test rcx, rcx
je 0x14000350b
call fcn.14000a838
jmp 0x14000350e
mov rax, rbx
mov qword [rsp + 0x40], rax
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.14000ea00
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rsi
mov rcx, qword [r14 + 0x10]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
cmp rax, 1
jb 0x140003b5d
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x140003558
mov r9, qword [r14]
mov qword [rsp + 0x30], 1
lea rax, [0x140020c18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x58]
call fcn.14000a400
nop
lea rax, [rbp + 0x1c]
mov r15, 0xffffffffffffffff
mov rdx, r15
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140003590
mov rcx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x40]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400035dd
lea rsi, [rdx + rcx]
mov qword [rbp - 0x48], rsi
lea rdi, [rbp - 0x58]
cmp r8, 8
cmovae rdi, qword [rbp - 0x58]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x1c]
call fcn.14000ea00
mov word [rdi + rsi*2], bx
lea rax, [rbp - 0x58]
jmp 0x1400035ef
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1c]
lea rcx, [rbp - 0x58]
call fcn.14000a540
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140002f90
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140003670
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000366b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b57
call fcn.14000a830
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140003ab8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ab3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b2d
jmp 0x140003ab3
mov rcx, qword [r14 + 0x10]
mov rax, rsi
sub rax, rcx
cmp rax, 1
jb 0x140003b99
mov r9, r14
cmp qword [r14 + 0x18], 8
jb 0x1400036ec
mov r9, qword [r14]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.14000a400
nop
lea rax, [rbp + 0x1c]
mov rdx, r15
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140003711
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14000376e
lea rsi, [rdx + rcx]
mov qword [rsp + 0x70], rsi
lea rdi, [rsp + 0x60]
cmp r8, 8
cmovae rdi, qword [rsp + 0x60]
lea rcx, [rdi + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x1c]
call fcn.14000ea00
mov word [rdi + rsi*2], bx
lea rax, [rsp + 0x60]
movabs rsi, 0x7ffffffffffffffe
jmp 0x140003781
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1c]
lea rcx, [rsp + 0x60]
call fcn.14000a540
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400037ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b69
call fcn.14000a830
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], bx
mov rdi, r12
cmp qword [r12 + 0x18], 8
jb 0x14000380f
mov rdi, qword [r12]
lea rcx, [rbp + 0x1c]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rcx, rax
mov rdx, rdi
call fcn.14000f108
test eax, eax
je 0x140003a78
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
mov r8, r15
inc r8
cmp word [rdx + r8*2], 0
jne 0x140003855
lea rcx, [rsp + 0x40]
call fcn.14000a280
nop
lea rcx, [rsp + 0x40]
call fcn.140001f30
movzx edi, al
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400038ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b6f
call fcn.14000a830
test dil, dil
je 0x140003a78
mov r13, qword [rbp - 0x48]
mov rcx, qword [r12 + 0x10]
mov qword [rbp - 0x68], rcx
mov rax, rsi
sub rax, r13
cmp rax, rcx
jb 0x140003b81
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rdx, qword [rbp - 0x58]
mov qword [rbp - 0x80], rdx
mov qword [rbp - 0x78], r12
cmp qword [r12 + 0x18], 8
jb 0x140003905
mov rax, qword [r12]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r15, [rcx + r13]
mov edi, 7
lea rsi, [rsp + 0x40]
cmp r15, rdi
jbe 0x1400039d0
mov rdi, r15
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
jbe 0x140003946
mov rdi, rax
jmp 0x140003953
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
mov rax, rdi
add rax, 1
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140003b75
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x1400039b5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b75
mov rcx, rax
call fcn.14000a838
test rax, rax
je 0x140003b7b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rdx, qword [rbp - 0x80]
jmp 0x1400039cb
test rcx, rcx
je 0x1400039c8
call fcn.14000a838
mov rsi, rax
mov rdx, qword [rbp - 0x80]
jmp 0x1400039cb
mov rsi, rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rdi
lea rdi, [r13*2]
mov r8, rdi
mov rcx, rsi
call fcn.14000ea00
lea rcx, [rdi + rsi]
mov r8, qword [rbp - 0x68]
add r8, r8
mov rdx, qword [rbp - 0x78]
call fcn.14000ea00
mov word [rsi + r15*2], bx
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140003a6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b7b
call fcn.14000a830
mov r15, 0xffffffffffffffff
mov r13, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x140003ab8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ab3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b87
call fcn.14000a830
lea rdx, [rbp - 0x10]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140003ad8
movabs rsi, 0x7ffffffffffffffe
jmp 0x140003118
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140003084
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8d
call fcn.14000a830
jmp 0x140003084
call fcn.1400011a0
int3
call fcn.14000f900
int3
call fcn.1400011a0
nop
call fcn.1400011a0
nop
call fcn.14000f900
nop
call fcn.14000f900
nop
call fcn.14000f900
nop
call fcn.14000f900
nop
call fcn.14000f900
nop
call fcn.1400011a0
nop
call fcn.140001100
nop
call fcn.14000f900
int3
call fcn.14000f900
int3
call fcn.140001100
int3
call fcn.14000f900
int3
call fcn.1400011a0
nop
call fcn.14000f900
nop
call fcn.14000f900
nop
call fcn.14000f900
nop
call fcn.1400011a0
int3