Function at 0x140003810
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x410]
sub rsp, 0x510
test byte [rcx + 0x40], 2
mov rdi, rdx
mov rsi, rcx
je 0x14000383c
mov al, 1
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x508], r14
xor r14b, r14b
cmp r8d, 1
je 0x140003854
xor al, al
jmp 0x140003d1c
mov qword [rsp + 0x540], r12
mov qword [rsp + 0x500], r15
test rdx, rdx
jne 0x14000386d
lea rdi, [rcx + 8]
lea r12, vtable.DumpFileSearch.0
mov byte [rbp + 0x1b0], r14b
xor r15d, r15d
mov qword [rbp - 0x70], r12
xor edx, edx
mov qword [rbp - 0x58], r15
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0xb0]
call fcn.140016d00
movups xmm0, xmmword [rdi]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, pe_nt_image_headers64
movups xmmword [rbp - 0x68], xmm0
call fcn.140016d00
lea rax, [rbp + 0x430]
mov dword [rbp + 0x430], pe_nt_image_headers64
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 4]
lea rax, [rbp - 0x50]
mov rcx, 0xffffffff80000002
lea r8, str.MinidumpDir
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
call fcn.1400025e0
test eax, eax
jne 0x140003931
mov edx, dword [rbp + 0x430]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp - 0x50]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003910
movsd xmm0, qword [str.Minidump]
movzx eax, word [0x140071d70]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
cmp byte [rbp - 0x50], r14b
je 0x1400039a7
lea rcx, [rbp + 0xb0]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003941
lea r8, [rbp - 0x50]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003960
lea rcx, [rbp + 0xb0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003980
movzx eax, word [0x140071d94]
mov word [rcx], ax
movzx eax, byte [0x140071d96]
mov byte [rcx + 2], al
mov byte [rbp + 0x1b0], 1
jmp 0x1400039b4
cmp byte [rbp + 0x1b0], r14b
je 0x140003cf0
xor edx, edx
mov qword [rsp + 0x538], rbx
mov r8d, pe_nt_image_headers64
lea rcx, [rbp + 0x1c0]
call fcn.140016d00
xor edx, edx
lea rcx, [rbp + 0x2c0]
mov r8d, 0x140
call fcn.140016d00
mov rcx, qword [rbp - 0x58]
test rcx, rcx
jne 0x140003a2e
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x58], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140003ccf
lea rdx, str..dmp
lea rcx, [rbp + 0x2ec]
call fcn.140016e90
test rax, rax
jne 0x140003a8b
mov rcx, qword [rbp - 0x58]
cmp rcx, 0xffffffffffffffff
je 0x140003ccf
nop dword [rax + rax]
lea rdx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140003cc5
lea rdx, str..dmp
lea rcx, [rbp + 0x2ec]
call fcn.140016e90
test rax, rax
jne 0x140003a8b
lea rdx, str..DMP
lea rcx, [rbp + 0x2ec]
call fcn.140016e90
test rax, rax
jne 0x140003a8b
mov rcx, qword [rbp - 0x58]
jmp 0x140003a40
mov rcx, r15
nop
movzx eax, byte [rbp + rcx - 0x50]
mov byte [rbp + rcx + 0x1c0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003a90
lea rcx, [rbp + 0x1c0]
dec rcx
nop
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003ab0
movzx eax, word [0x140071da8]
mov word [rcx], ax
lea rax, [rbp + 0x1c0]
dec rax
nop
cmp byte [rax + 1], r14b
lea rax, [rax + 1]
jne 0x140003ad0
lea r8, [rbp + 0x2ec]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003af0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140003b38
mov rbx, qword [rcx + 8]
nop dword [rax]
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x1c0]
call fcn.14000b270
test al, al
jne 0x1400039d0
mov rcx, rbx
test rbx, rbx
je 0x140003b38
mov rbx, qword [rbx + 8]
jmp 0x140003b10
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1c0]
movups xmmword [rsp + 0x30], xmm0
call fcn.14000b130
test al, al
je 0x1400039d0
lea rcx, [rsi + 0x44]
lea rdx, [rsp + 0x30]
call fcn.14000b930
test al, al
je 0x1400039d0
cmp word [rdi], r15w
je 0x140003b8a
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000b930
test al, al
je 0x1400039d0
mov ecx, 0x128
call fcn.140015aa0
test rax, rax
je 0x1400039d0
mov r8d, pe_nt_image_headers64
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call fcn.14000ace0
mov rbx, rax
test rax, rax
je 0x1400039d0
xorps xmm0, xmm0
mov byte [rbp + 0x430], r14b
xor eax, eax
lea r9, [rbp + 0x430]
lea r8, [rsp + 0x40]
mov dword [rbp - 0x78], eax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rcx, rbx
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.14000ae50
movzx r14d, al
test al, al
je 0x140003c8d
cmp byte [rbp + 0x430], r15b
je 0x140003c8d
cmp dword [rsi + 0x40], r15d
jne 0x140003c43
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14000a020
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140009600
mov ecx, 3
call fcn.14000cab0
or dword [rsi + 0x40], 2
lea rdi, [rsi + 0x44]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.14000b930
test al, al
je 0x140003c8d
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], SQLPrepare
lea r8, str.Last_AmdlogSr_LastBsodWt
mov r9d, 1
mov qword [rsp + 0x20], rdi
lea rdx, str.SoftwareAMDLOG
mov rcx, 0xffffffff80000002
movups xmmword [rdi], xmm0
call fcn.140002a90
cmp qword [rsi + 0x30], r15
jne 0x140003ca8
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x30], rbx
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
inc dword [rsi + 0x38]
jmp 0x140003ccb
mov qword [rbx + 8], r15
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rbx
inc dword [rsi + 0x38]
mov qword [rsi + 0x30], rbx
jmp 0x140003ccb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x58]
mov rbx, qword [rsp + 0x538]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003cf4
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r15
mov qword [rbp - 0x58], rcx
jmp 0x140003cf4
mov rcx, qword [rbp - 0x58]
mov r15, qword [rsp + 0x500]
lea rax, [rcx - 1]
mov qword [rbp - 0x70], r12
mov r12, qword [rsp + 0x540]
cmp rax, 0xfffffffffffffffd
ja 0x140003d18
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, r14b
mov r14, qword [rsp + 0x508]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret