Function at 0x140044770
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rbp + 0x400], rax
movzx r15d, cl
xor r13d, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rbp + 0x190]
call fcn.1400471a0
test al, al
jne 0x14000df7c
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b980
lea rdx, [0x1400107c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000f3ac
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0x10]
call fcn.140006ca0
nop
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
mov r12, qword [rbp + 0x20]
sub rax, r12
cmp rax, 1
jb 0x14000f3ec
lea r14, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r14, qword [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
lea rsi, [r12 + 1]
mov ebx, 7
lea rdi, [rbp + 0x130]
movabs rax, 0x7fffffffffffffff
lea ecx, [rbx + 3]
cmp rsi, rbx
jbe 0x14000e048
mov rbx, rsi
or rbx, 7
cmp rbx, rdx
jbe 0x14000e0f2
mov rbx, rdx
mov rcx, rax
lfence
add rcx, rcx
call fcn.140006f80
mov rdi, rax
mov qword [rbp + 0x130], rax
mov r12, qword [rbp + 0x20]
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word ds:[rbx + rdi], 0x2a
mov word [rdi + rsi*2], r13w
mov edi, 0x40
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova rcx, qword [rbp + 0x130]
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rbp + 0x148]
cmp rdx, 7
jbe 0x14000e113
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e10e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e10e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000f3e6
jmp 0x14000e02f
call fcn.1400499d0
movdqa xmm0, xmmword [0x14005d490]
movdqu xmmword [rbp + 0x140], xmm0
mov word [rbp + 0x130], r13w
cmp rbx, 0xffffffffffffffff
jne 0x14000e15a
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
nop
call fcn.14000b980
lea rdx, [0x1400107c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000f366
test r15b, r15b
jne 0x14000e1b6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_renamed_and_deleted_Prefetch_folders..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400088a0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_Prefetch_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400088a0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400088a0
call fcn.140048320
lea rcx, [rbp - 0x60]
call fcn.1400084a0
nop
lea r14, str..EXE
nop word [rax + rax]
xor r15d, r15d
cmp dword [rbp + 0x1b0], 0x10
je 0x14000e822
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r15
lea rax, [rbp + 0x1dc]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x14000e210
lea rdx, [rbp + 0x1dc]
lea rcx, [rbp + 0x70]
call fcn.140006ca0
nop
lea r11, [rbp + 0x70]
mov rax, qword [rbp + 0x88]
cmp rax, 7
seta sil
mov r13, qword [rbp + 0x70]
cmova r11, r13
mov r10, qword [rbp + 0x80]
cmp r10, 4
jb 0x14000f29d
lea rbx, [r10 - 3]
lea rbx, [r11 + rbx*2]
mov rax, r11
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov rdx, r15
je 0x14000e28c
cmp word [rax], 0x2e
je 0x14000e289
cmp rcx, 1
je 0x14000e28c
dec rcx
add rax, 2
cmp word [rax], 0x2e
jne 0x14000e276
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000f291
mov r8d, 4
mov rdx, r14
mov r9, rax
sub r9, r14
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14000e34c
add rdx, 2
sub r8, 1
jne 0x14000e2b0
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000f291
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, r10
jb 0x14000f3dc
lea r15, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r15, qword [rbp + 0x10]
lea r12, [rbp + 0x70]
test sil, sil
cmovne r12, r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x20]
lea r14, [rax + r10]
mov ebx, 7
lea rsi, [rbp + 0x30]
cmp r14, rbx
jbe 0x14000e398
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14000e355
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x14000e379
add rax, 2
jmp 0x14000e262
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000f3f2
lfence
add rcx, rcx
call fcn.140006f80
mov rsi, rax
mov qword [rbp + 0x30], rax
mov r13, qword [rbp + 0x70]
mov edi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rbx
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov rbx, qword [rbp + 0x80]
lea r8, [rbx + rbx]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
xor r15d, r15d
mov word [rsi + r14*2], r15w
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000e446
test al, 1
je 0x14000e446
lea rdx, str.____Prefetch_file_is_marked_as_read_only:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006aa0
lea rdx, ds:[rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rax
call fcn.1400095a0
lea rdx, str.._This_is_bannable.
mov rcx, rax
call fcn.140006aa0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x1c4]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x14000f1e0
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
mov rcx, qword [rbp + 0x20]
sub rax, rcx
cmp rax, rbx
jb 0x14000f418
lea r15, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r15, qword [rbp + 0x10]
lea r12, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova r12, r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
lea r14, [rcx + rbx]
mov ebx, 7
lea rsi, [rbp + 0x50]
cmp r14, rbx
jbe 0x14000e54d
mov rbx, r14
or rbx, 7
cmp rbx, rdx
jbe 0x14000e50b
mov rbx, rdx
movabs rcx, 0x7fffffffffffffff
jmp 0x14000e52f
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000f3f8
lfence
add rcx, rcx
call fcn.140006f80
mov rsi, rax
mov qword [rbp + 0x50], rax
mov r13, qword [rbp + 0x70]
mov edi, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x20]
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], rbx
lea rbx, [rcx + rcx]
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, qword [rbp + 0x80]
add r8, r8
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
xor r15d, r15d
mov word [rsi + r14*2], r15w
bts edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r15 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.140010420
nop
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rcx, qword [rbp + 0xf0]
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r15 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.14000cbe0
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x58]
jne 0x14000e897
test rcx, rcx
je 0x14000e69e
mov rdx, qword ds:[rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e68a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f327
call fcn.1400499d0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x14000e6ef
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e6ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f32e
call fcn.1400499d0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000e74f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e74a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f335
call fcn.1400499d0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000e7af
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e7aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f2df
call fcn.1400499d0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r15w
mov rax, qword [rbp + 0x88]
cmp rax, 7
jbe 0x14000e812
lea rdx, ds:[rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000e80a
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f2e7
mov rcx, r13
call fcn.1400499d0
lea r14, str..EXE
mov rbx, qword [rsp + 0x48]
mov r12, qword [rbp + 0x20]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000e1d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000f358
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f347
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f347
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000d300
nop
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
cmp r14, r12
je 0x14000f069
lea r13, str..EXE
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
lea rax, [rbp + 0x1dc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000e8f0
lea rdx, [rbp + 0x1dc]
lea rcx, [rbp + 0xd0]
call fcn.140006ca0
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
seta r10b
mov r9, qword [rbp + 0xd0]
cmova rdx, r9
mov rsi, qword [rbp + 0xe0]
test rsi, rsi
je 0x14000e96d
mov rax, rsi
mov rcx, rdx
mov r8, r15
cmp word [rdx], 0x2d
je 0x14000e95b
cmp rax, 1
je 0x14000e95e
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x14000e948
mov r8, rcx
nop
test r8, r8
je 0x14000e96d
sub r8, rdx
sar r8, 1
jmp 0x14000e974
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x14000e9c6
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0xd0]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0x90]
call fcn.140006ca0
bts edi, 7
lea rax, [rbp + 0x90]
or edi, 1
jmp 0x14000eaad
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
lea r15, [rbp + 0xd0]
test r10b, r10b
cmovne r15, r9
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x14000f412
nop dword [rax]
cmp rsi, 7
ja 0x14000ea25
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], 7
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0xb0], xmm0
jmp 0x14000eaa0
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x14000ea42
mov rbx, rax
movabs rcx, 0x7fffffffffffffff
jmp 0x14000ea69
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000f40c
lfence
add rcx, rcx
call fcn.140006f80
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rbx
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0xb0]
or edi, 2
xor r15d, r15d
mov edx, edi
mov ecx, edi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
test cl, 2
je 0x14000eb49
and edi, 0xfffffffd
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x14000eb2f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f2ee
call fcn.1400499d0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r15w
test dil, 1
je 0x14000ebb2
and edi, 0xfffffffe
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000eb98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f307
call fcn.1400499d0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r15w
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
mov rax, qword [r14 + 0x10]
cmp rax, 0x23
jb 0x14000f406
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000ebf7
mov rdx, qword [r14]
add rdx, 0x46
lea rcx, [rbp + 0x90]
call fcn.140006ca0
or edi, 0x10
mov rdx, r14
lea rcx, [rbp + 0x170]
call fcn.14000d5a0
nop
lea r9, [rbp + 0x90]
mov r8, rax
lea rcx, [rbp - 0x10]
call fcn.140010b60
or edi, 8
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x188]
cmp rdx, 7
jbe 0x14000ec8f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f2f5
call fcn.1400499d0
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000ecef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f2fc
call fcn.1400499d0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r15w
lea r9, [rbp + 0x150]
cmp qword [rbp + 0x168], 7
cmova r9, qword [rbp + 0x150]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x160]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp]
call fcn.140008f40
cmp rax, 0xffffffffffffffff
je 0x14000ef3d
lea rax, ds:[rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rax, qword [rbp - 0x10]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp]
mov qword [rbp - 0x68], rax
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0xb0]
call fcn.140005060
test al, al
jne 0x14000ee58
mov rax, qword [rbp]
cmp rax, 4
jb 0x14000ee58
lea rcx, ds:[rax - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
cmp rax, rcx
jb 0x14000f3fe
lfence
mov rax, qword [rbp]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rax, qword [rbp - 0x10]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x110]
call fcn.140006ca0
mov edi, dword [rsp + 0x40]
or edi, 0x204
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x110]
mov r9, qword [rbp + 0x128]
cmp r9, 7
cmova r8, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x120]
cmp rdx, 4
jne 0x14000ee5f
mov rcx, r13
test rdx, rdx
je 0x14000ee54
sub r8, r13
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000ee5f
add rcx, 2
sub rdx, 1
jne 0x14000ee40
mov bl, 1
jmp 0x14000ee61
mov r9, qword [rbp + 0x128]
xor bl, bl
test dil, 4
je 0x14000ee9f
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
cmp r9, 7
jbe 0x14000ee85
mov r8, r9
mov rdx, qword [rbp + 0x110]
call fcn.140006500
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], r15w
nop
test bl, bl
je 0x14000ef3d
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0xb
lea r9, str.UnknownDisk
xor r8d, r8d
mov rdx, qword [rbp]
call fcn.140008f40
cmp rax, 0xffffffffffffffff
je 0x14000eee2
lea rdx, str.___Executed_file:
nop
jmp 0x14000eef6
lea rdx, [rbp - 0x10]
call fcn.140047dc0
test al, al
jne 0x14000ef2f
lea rdx, [0x1400533c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006aa0
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
mov r8, qword [rbp]
cmova rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.1400095a0
lea rdx, [0x140008b60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
call fcn.140006820
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000ef7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f307
call fcn.1400499d0
mov qword [rbp], r15
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r15w
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x14000efd4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000efcf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f30e
call fcn.1400499d0
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], r15w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x14000f034
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f02f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f315
call fcn.1400499d0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
add r14, 0x20
cmp r14, r12
jne 0x14000e8c1
mov r13, qword [rbp + 0x70]
mov r12, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x14000f0df
cmp r14, r12
je 0x14000f08a
mov rcx, r14
call fcn.140005e20
add r14, 0x20
cmp r14, r12
jne 0x14000f073
mov r14, qword [rsp + 0x70]
mov rdx, qword ds:[rbp - 0x80]
sub rdx, r14
and rdx, 0xffffffffffffffe0
mov rax, r14
cmp rdx, 0x1000
jb 0x14000f0ca
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f31c
mov rcx, r14
call fcn.1400499d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000f12a
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f116
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f327
call fcn.1400499d0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x14000f16f
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f16a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f32e
call fcn.1400499d0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000f1cf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f1ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f335
call fcn.1400499d0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000f22f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f22a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f33c
call fcn.1400499d0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r15w
mov rax, qword [rbp + 0x88]
cmp rax, 7
jbe 0x14000e812
lea rdx, ds:[rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000e80a
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e80a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbp + 0x88]
nop dword [rax]
test sil, sil
je 0x14000e822
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000f2d2
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f28a
mov rcx, r13
call fcn.1400499d0
jmp 0x14000e822
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400499d0
mov qword [rbp - 0x48], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, ds:[rbp - 0x58]
call fcn.140008620
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000f3ac
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f3a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000f3a7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400499d0
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400499b0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
nop dword [rax]
call fcn.140003f80
nop
call fcn.140003ed0
int3
call fcn.140003f80
nop
call fcn.140003ed0
nop
call fcn.140003ed0
nop
nop
call fcn.140008880
nop
call fcn.140008880
nop
call fcn.140003ed0
int3
call fcn.140003f80
nop
call fcn.140003f80
int3
movzx ecx, dl
jmp 0x14000df00