Function at 0x14000a620
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x4c8]
sub rsp, 0x5c8
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov rax, r9
mov qword [rbp - 0x50], rax
mov ebx, r8d
mov dword [rsp + 0x58], ebx
mov qword [rbp - 0x78], rdx
mov qword [rbp - 0x68], rcx
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0x510]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x520]
mov qword [rsp + 0x68], rax
mov rax, qword [rbp + 0x528]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp + 0x530]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp + 0x538]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x1d8], 7
xor edi, edi
mov qword [rbp + 0x1d0], rdi
mov word [rbp + 0x1c0], di
mov qword [rbp + 0x250], 7
mov qword [rbp + 0x248], rdi
mov word [rbp + 0x238], di
mov qword [rbp + 0x228], 7
mov qword [rbp + 0x220], rdi
mov word [rbp + 0x210], di
mov qword [rbp + 0x160], 7
mov qword [rbp + 0x158], rdi
mov word [rbp + 0x148], di
mov qword [rbp + 0xe8], 7
mov qword [rbp + 0xe0], rdi
mov word [rbp + 0xd0], di
mov qword [rbp + 0x200], 7
mov qword [rbp + 0x1f8], rdi
mov word [rbp + 0x1e8], di
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp + 0x1e8]
call fcn.140001780
nop
mov qword [rbp + 0x188], 7
mov qword [rbp + 0x180], rdi
mov word [rbp + 0x170], di
lea r8d, [rdi + 0x18]
lea rdx, str._WinDir__system32config
lea rcx, [rbp + 0x170]
call fcn.140001780
nop
call fcn.1400420e8
mov rdi, rax
mov qword [rbp - 0x20], rax
call fcn.140041f78
mov rsi, rax
xor edx, edx
lea rcx, [rbp - 0x60]
call fcn.140041dec
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
jae 0x14000a7b3
inc rcx
mov qword [rsi + 8], rcx
lea rcx, [rbp - 0x60]
call fcn.140041e1c
nop
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 0x2c0]
cmp rcx, 8
jb 0x14000a7d7
mov rdx, qword [rax + 0x2a8]
jmp 0x14000a7de
lea rdx, [rax + 0x2a8]
cmp rcx, 8
jb 0x14000a7ed
mov rcx, qword [rax + 0x2a8]
jmp 0x14000a7f4
lea rcx, [rax + 0x2a8]
mov rax, qword [rax + 0x2b8]
lea rax, [rcx + rax*2]
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp - 0x40], xmm0
mov qword [rsp + 0x70], rdi
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rax, qword [rdi + 8]
cmp rax, 0xffffffffffffffff
jae 0x14000a835
inc rax
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x50]
call fcn.140041e1c
lea r8, [rsp + 0x70]
lea rdx, str._WinDir_
lea rcx, [rbp - 0x10]
call fcn.14001aee0
lea r8, [rbp - 0x40]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.14001ada0
nop
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rax, qword [rdi + 8]
test rax, rax
je 0x14000a88a
cmp rax, 0xffffffffffffffff
jae 0x14000a88a
dec rax
mov qword [rdi + 8], rax
xor esi, esi
cmp qword [rdi + 8], rsi
cmove rsi, rdi
lea rcx, [rsp + 0x50]
call fcn.140041e1c
test rsi, rsi
je 0x14000a8b0
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
call fcn.1400420e8
mov rdi, rax
mov qword [rbp - 0x60], rax
call fcn.140041f78
mov rsi, rax
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140041dec
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
jae 0x14000a8e1
inc rcx
mov qword [rsi + 8], rcx
lea rcx, [rsp + 0x50]
call fcn.140041e1c
nop
lea r8, [rbp + 0x170]
mov rdx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x188]
cmp rax, 8
cmovae r8, rdx
lea rcx, [rbp + 0x170]
cmovae rcx, rdx
mov rax, qword [rbp + 0x180]
lea rsi, [rcx + rax*2]
cmp r8, rsi
je 0x14000a95d
mov rdi, r8
nop word [rax + rax]
movzx ebx, word [rdi]
lea rcx, [rbp - 0x60]
call fcn.140018410
mov r8, qword [rax]
movzx edx, bx
mov rcx, rax
call qword [r8 + 0x30]
mov word [rdi], ax
add rdi, 2
cmp rdi, rsi
jne 0x14000a930
mov rdi, qword [rbp - 0x60]
mov ebx, dword [rsp + 0x58]
test rdi, rdi
je 0x14000a9aa
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140041dec
mov rax, qword [rdi + 8]
test rax, rax
je 0x14000a984
cmp rax, 0xffffffffffffffff
jae 0x14000a984
dec rax
mov qword [rdi + 8], rax
xor esi, esi
cmp qword [rdi + 8], rsi
cmove rsi, rdi
lea rcx, [rsp + 0x58]
call fcn.140041e1c
test rsi, rsi
je 0x14000a9aa
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
or rsi, 0xffffffffffffffff
mov r9, rsi
xor r8d, r8d
mov rdi, qword [rbp - 0x50]
mov rdx, rdi
lea rcx, [rbp + 0x238]
call fcn.1400015e0
mov r9, rsi
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x1c0]
call fcn.1400015e0
lea r8d, [rsi + 2]
lea rdx, [0x14008f27c]
lea rcx, [rbp + 0x1c0]
call fcn.140015a00
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rcx, qword [rbp + 0x1c0]
lea rdx, [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdx, rax
mov qword [rsp + 0x58], rax
jmp 0x14000aa24
mov rdx, rdi
cmp rdx, 0xffffffffffffffff
je 0x14000b615
lea rsi, [rbp + 0x28c]
lea rdi, [0x14008f280]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x14000b615
lea rsi, [rbp + 0x28c]
lea rdi, [0x14008f284]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x14000b615
or rsi, 0xffffffffffffffff
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x148]
call fcn.1400015e0
xor eax, eax
mov rcx, rsi
lea rdi, [rbp + 0x28c]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x28c]
lea rcx, [rbp + 0x148]
call fcn.140015a00
mov edx, dword [rbp + 0x260]
test dl, 0x10
je 0x14000b25e
xor r8d, r8d
bt edx, 0xa
lea rdx, [rbp + 0x148]
jae 0x14000b1aa
mov qword [rbp + 0xc0], 7
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
or r9, 0xffffffffffffffff
lea rcx, [rbp + 0xa8]
call fcn.1400015e0
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x120]
call fcn.14000b7d0
mov rdi, rax
lea rax, [rbp + 0xd0]
cmp rax, rdi
je 0x14000abaa
cmp qword [rbp + 0xe8], 8
jb 0x14000ab3d
mov rcx, qword [rbp + 0xd0]
call fcn.140063290
mov qword [rbp + 0xe8], 7
mov qword [rbp + 0xe0], rsi
mov word [rbp + 0xd0], si
cmp qword [rdi + 0x18], 8
jae 0x14000ab78
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.1400632b0
jmp 0x14000ab85
mov rax, qword [rdi]
mov qword [rbp + 0xd0], rax
mov qword [rdi], rsi
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0xe0], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0xe8], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
cmp qword [rbp + 0x138], 8
jb 0x14000abc0
mov rcx, qword [rbp + 0x120]
call fcn.140063290
mov r8, qword [rbp + 0xe0]
test r8, r8
jne 0x14000ac0f
or r9, 0xffffffffffffffff
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0xd0]
call fcn.1400015e0
mov r8, qword [rbp + 0xe0]
test r8, r8
jne 0x14000ac0f
mov r8d, 0x10
lea rdx, str._Unknown_Target_
lea rcx, [rbp + 0xd0]
call fcn.140001780
mov r8, qword [rbp + 0xe0]
lea rax, [0x14008db30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
lea rdi, [0x14008f760]
mov qword [rbp + 0xf8], rdi
lea r11, [0x14008f768]
mov qword [rbp + 0x100], r11
lea rax, [rbp + 0xd0]
mov r9, qword [rbp + 0xd0]
mov r10, qword [rbp + 0xe8]
cmp r10, 8
cmovae rax, r9
lea rcx, [rax + r8*2]
lea rdx, [rbp + 0xd0]
cmovae rdx, r9
cmp rdx, rcx
je 0x14000ad23
mov rax, rdx
mov rsi, rdi
cmp rsi, r11
je 0x14000aca1
movzx edi, word [rsi]
cmp word [rax], di
jne 0x14000ac8f
add rax, 2
add rsi, 2
cmp rax, rcx
jne 0x14000ac75
cmp rsi, r11
je 0x14000aca1
lea rdi, [0x14008f760]
add rdx, 2
jmp 0x14000ac66
cmp rdx, rax
je 0x14000ad23
movaps xmm1, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x40], xmm1
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x90], xmm1
movups xmm0, xmmword [rbp + 0xf8]
movaps xmmword [rbp + 0x70], xmm0
movsd xmm1, qword [rbp + 0x108]
movsd qword [rbp + 0x80], xmm1
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xd0]
call fcn.14001c530
mov r10, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xe0]
mov r9, qword [rbp + 0xd0]
lea rax, [0x14008db30]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
lea rdi, [0x14008f770]
mov qword [rbp + 0xf8], rdi
lea r11, [0x14008f776]
mov qword [rbp + 0x100], r11
lea rax, [rbp + 0xd0]
cmp r10, 8
cmovae rax, r9
lea rcx, [rax + r8*2]
lea rdx, [rbp + 0xd0]
cmovae rdx, r9
cmp rdx, rcx
je 0x14000ae1e
mov rax, rdx
mov rsi, rdi
nop dword [rax + rax]
cmp rsi, r11
je 0x14000adac
movzx edi, word [rsi]
cmp word [rax], di
jne 0x14000ad9a
add rax, 2
add rsi, 2
cmp rax, rcx
jne 0x14000ad80
cmp rsi, r11
je 0x14000adac
lea rdi, [0x14008f770]
add rdx, 2
jmp 0x14000ad6c
cmp rdx, rax
je 0x14000ae1e
movaps xmm1, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x60], xmm1
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x50], xmm1
movups xmm0, xmmword [rbp + 0xf8]
movaps xmmword [rbp - 0x10], xmm0
movsd xmm1, qword [rbp + 0x108]
movsd qword [rbp], xmm1
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x20]
lea r8, [rbp + 0x50]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xd0]
call fcn.14001c530
mov r10, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xe0]
mov r9, qword [rbp + 0xd0]
cmp dword [rbp + 0x518], 0
jne 0x14000b063
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 8
cmovae rdx, qword [rbp + 0x170]
lea rcx, [rbp + 0xd0]
cmp r10, 8
cmovae rcx, r9
mov rsi, qword [rbp + 0x180]
mov rdi, rsi
cmp r8, rsi
cmovb rdi, r8
test rdi, rdi
je 0x14000ae94
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14000ae7e
add rcx, 2
add rdx, 2
dec rdi
jne 0x14000ae67
jmp 0x14000ae94
mov edi, 1
cmp word [rcx], ax
mov rax, 0xffffffffffffffff
cmovb edi, eax
xor ecx, ecx
jmp 0x14000ae98
xor ecx, ecx
mov edi, ecx
movsxd rax, edi
test edi, edi
jne 0x14000aea9
cmp r8, rsi
jb 0x14000aeb1
mov eax, ecx
setne al
test eax, eax
je 0x14000b063
lea rcx, [rbp + 0x148]
cmp qword [rbp + 0x160], 8
cmovae rcx, qword [rbp + 0x148]
lea rdx, str.windows_defender
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14000b063
mov qword [rbp + 0xc0], 7
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xa8]
call fcn.1400015e0
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0xa8]
call fcn.14002b3b0
test eax, eax
je 0x14000af37
mov rax, qword [rbp - 0x80]
cmp dword [rax + 0x4ac], esi
je 0x14000b1a3
mov rdi, qword [rbp - 0x78]
cmp dword [rdi], esi
jne 0x14000af56
mov r8d, 0x40
lea rdx, str._r_n__Reparse_Point_Junctions_Found__Most_likely_legitimate___r_n_r_n
mov rcx, qword [rsp + 0x60]
call fcn.140015a00
mov dword [rdi], 1
lea r8, [rbp + 0x148]
lea rdx, [0x14008f218]
lea rcx, [rbp + 0x198]
call fcn.140018b90
nop
lea r8, [0x14008f830]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140018c70
nop
lea r8, [rbp + 0xd0]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140018ed0
nop
lea r8, str.__Dir__r_n
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.1400158d0
nop
cmp qword [rbp + 0x110], 8
jb 0x14000afe7
mov rcx, qword [rbp + 0xf8]
call fcn.140063290
mov qword [rbp + 0x110], 7
mov qword [rbp + 0x108], rsi
mov word [rbp + 0xf8], si
cmp qword [rbp + 0x138], 8
jb 0x14000b016
mov rcx, qword [rbp + 0x120]
call fcn.140063290
mov qword [rbp + 0x138], 7
mov qword [rbp + 0x130], rsi
mov word [rbp + 0x120], si
cmp qword [rbp + 0xc0], 8
jb 0x14000b045
mov rcx, qword [rbp + 0xa8]
call fcn.140063290
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
jmp 0x14000b18d
mov rdi, qword [rbp - 0x68]
cmp dword [rdi], 0
jne 0x14000b083
mov r8d, 0x38
lea rdx, str._r_n__ALERT:_ZEROACCESS_Reparse_Point_Junction_found__r_n_r_n
mov rcx, qword [rsp + 0x68]
call fcn.140015a00
mov dword [rdi], 1
lea r8, [rbp + 0x148]
lea rdx, [0x14008f218]
lea rcx, [rbp + 0x198]
call fcn.140018b90
nop
lea r8, [0x14008f830]
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140018c70
nop
lea r8, [rbp + 0xd0]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140018ed0
nop
lea r8, [0x14008f818]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400158d0
nop
cmp qword [rbp + 0xc0], 8
jb 0x14000b114
mov rcx, qword [rbp + 0xa8]
call fcn.140063290
mov qword [rbp + 0xc0], 7
xor edi, edi
mov qword [rbp + 0xb8], rdi
mov word [rbp + 0xa8], di
cmp qword [rbp + 0x138], 8
jb 0x14000b145
mov rcx, qword [rbp + 0x120]
call fcn.140063290
mov qword [rbp + 0x138], 7
mov qword [rbp + 0x130], rdi
mov word [rbp + 0x120], di
cmp qword [rbp + 0x110], 8
jb 0x14000b174
mov rcx, qword [rbp + 0xf8]
call fcn.140063290
mov qword [rbp + 0x110], 7
mov qword [rbp + 0x108], rdi
mov word [rbp + 0xf8], di
cmp qword [rbp + 0x1b0], 8
jb 0x14000b1a3
mov rcx, qword [rbp + 0x198]
call fcn.140063290
inc ebx
jmp 0x14000b615
mov r9, rsi
lea rcx, [rbp + 0x210]
call fcn.1400015e0
mov r8d, 1
lea rdx, [0x14008ef9c]
lea rcx, [rbp + 0x210]
call fcn.140015a00
mov qword [rbp + 0xc0], 7
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0xa8]
call fcn.1400015e0
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x518]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xa8]
mov r8d, ebx
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp - 0x68]
call fcn.14000a620
add ebx, eax
jmp 0x14000b617
bt edx, 0xa
jae 0x14000b615
mov qword [rbp + 0xc0], 7
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
or rdi, 0xffffffffffffffff
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xa8]
call fcn.1400015e0
lea r8, [rbp + 0x1e8]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x198]
call fcn.14000b7d0
nop
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140001540
nop
cmp qword [rbp + 0x1b0], 8
jb 0x14000b2e1
mov rcx, qword [rbp + 0x198]
call fcn.140063290
cmp qword [rbp + 0xe0], 0
jne 0x14000b327
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x1e8]
lea rcx, [rbp + 0xd0]
call fcn.1400015e0
cmp qword [rbp + 0xe0], 0
jne 0x14000b327
mov r8d, 0x10
lea rdx, str._Unknown_Target_
lea rcx, [rbp + 0xd0]
call fcn.140001780
cmp dword [rbp + 0x518], 0
jne 0x14000b4d3
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0xd0]
call fcn.140011860
test eax, eax
je 0x14000b4d3
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x148]
lea rcx, [rbp + 0xa8]
call fcn.1400015e0
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0xa8]
call fcn.14002b3b0
test eax, eax
je 0x14000b3a6
mov rax, qword [rbp - 0x80]
cmp dword [rax + 0x4ac], 0
je 0x14000b611
mov rdi, qword [rbp - 0x78]
cmp dword [rdi], 0
jne 0x14000b3c6
mov r8d, 0x41
lea rdx, str._r_n__Reparse_Point_Junctions_Found__These_may_be_legitimate___r_n_r_n
mov rcx, qword [rsp + 0x60]
call fcn.140015a00
mov dword [rdi], 1
lea r8, [rbp + 0x148]
lea rdx, [0x14008f218]
lea rcx, [rbp + 0x198]
call fcn.140018b90
nop
lea r8, [0x14008f830]
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140018c70
nop
lea r8, [rbp + 0xd0]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140018ed0
nop
lea r8, str.__File__r_n
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call fcn.1400158d0
nop
cmp qword [rbp + 0xc0], 8
jb 0x14000b457
mov rcx, qword [rbp + 0xa8]
call fcn.140063290
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
cmp qword [rbp + 0x138], 8
jb 0x14000b486
mov rcx, qword [rbp + 0x120]
call fcn.140063290
mov qword [rbp + 0x138], 7
mov qword [rbp + 0x130], rsi
mov word [rbp + 0x120], si
cmp qword [rbp + 0x110], 8
jb 0x14000b4b5
mov rcx, qword [rbp + 0xf8]
call fcn.140063290
mov qword [rbp + 0x110], 7
mov qword [rbp + 0x108], rsi
mov word [rbp + 0xf8], si
jmp 0x14000b5fb
mov rdi, qword [rbp - 0x68]
cmp dword [rdi], 0
jne 0x14000b4f3
mov r8d, 0x38
lea rdx, str._r_n__ALERT:_ZEROACCESS_Reparse_Point_Junction_found__r_n_r_n
mov rcx, qword [rsp + 0x68]
call fcn.140015a00
mov dword [rdi], 1
lea r8, [rbp + 0x148]
lea rdx, [0x14008f218]
lea rcx, [rbp + 0x198]
call fcn.140018b90
nop
lea r8, [0x14008f830]
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.140018c70
nop
lea r8, [rbp + 0xd0]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140018ed0
nop
lea r8, str.__File__r_n
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1400158d0
nop
cmp qword [rbp + 0xc0], 8
jb 0x14000b584
mov rcx, qword [rbp + 0xa8]
call fcn.140063290
mov qword [rbp + 0xc0], 7
mov qword [rbp + 0xb8], rsi
mov word [rbp + 0xa8], si
cmp qword [rbp + 0x138], 8
jb 0x14000b5b3
mov rcx, qword [rbp + 0x120]
call fcn.140063290
mov qword [rbp + 0x138], 7
mov qword [rbp + 0x130], rsi
mov word [rbp + 0x120], si
cmp qword [rbp + 0x110], 8
jb 0x14000b5e2
mov rcx, qword [rbp + 0xf8]
call fcn.140063290
mov qword [rbp + 0x110], 7
mov qword [rbp + 0x108], rsi
mov word [rbp + 0xf8], si
cmp qword [rbp + 0x1b0], 8
jb 0x14000b611
mov rcx, qword [rbp + 0x198]
call fcn.140063290
inc ebx
jmp 0x14000b617
xor esi, esi
lea rdx, [rbp + 0x260]
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000aa21
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
cmp qword [rbp + 0x188], 8
jb 0x14000b654
mov rcx, qword [rbp + 0x170]
call fcn.140063290
mov qword [rbp + 0x188], 7
mov qword [rbp + 0x180], rsi
mov word [rbp + 0x170], si
cmp qword [rbp + 0x200], 8
jb 0x14000b683
mov rcx, qword [rbp + 0x1e8]
call fcn.140063290
mov qword [rbp + 0x200], 7
mov qword [rbp + 0x1f8], rsi
mov word [rbp + 0x1e8], si
cmp qword [rbp + 0xe8], 8
jb 0x14000b6b2
mov rcx, qword [rbp + 0xd0]
call fcn.140063290
mov qword [rbp + 0xe8], 7
mov qword [rbp + 0xe0], rsi
mov word [rbp + 0xd0], si
cmp qword [rbp + 0x160], 8
jb 0x14000b6e1
mov rcx, qword [rbp + 0x148]
call fcn.140063290
mov qword [rbp + 0x160], 7
mov qword [rbp + 0x158], rsi
mov word [rbp + 0x148], si
cmp qword [rbp + 0x228], 8
jb 0x14000b710
mov rcx, qword [rbp + 0x210]
call fcn.140063290
mov qword [rbp + 0x228], 7
mov qword [rbp + 0x220], rsi
mov word [rbp + 0x210], si
cmp qword [rbp + 0x250], 8
jb 0x14000b73f
mov rcx, qword [rbp + 0x238]
call fcn.140063290
mov qword [rbp + 0x250], 7
mov qword [rbp + 0x248], rsi
mov word [rbp + 0x238], si
cmp qword [rbp + 0x1d8], 8
jb 0x14000b76e
mov rcx, qword [rbp + 0x1c0]
call fcn.140063290
mov qword [rbp + 0x1d8], 7
mov qword [rbp + 0x1d0], rsi
mov word [rbp + 0x1c0], si
mov rdi, qword [rbp - 0x50]
cmp qword [rdi + 0x18], 8
jb 0x14000b79a
mov rcx, qword [rdi]
call fcn.140063290
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov eax, ebx
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.140063080
add rsp, 0x5c8
pop rdi
pop rsi
pop rbx
pop rbp
ret