Function at 0x140003870
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rdi
sub rsp, 0x530
mov rax, qword [0x14002e010]
xor rax, rsp
mov qword [rsp + 0x500], rax
lea rcx, str.crypt32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x30], rax
mov rdi, rax
test rax, rax
je 0x140003a67
mov qword [rsp + 0x540], rbx
lea rdx, str.CertCreateContext
mov rcx, rdi
mov qword [rsp + 0x550], rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertFreeCTLContext
mov rcx, rdi
mov rbx, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CertEnumSubjectInSortedCTL
mov rcx, rdi
mov rsi, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
test rbx, rbx
je 0x140003c93
test rsi, rsi
je 0x140003c93
test rax, rax
je 0x140003c93
xor edx, edx
mov qword [rsp + 0x518], r14
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x140003c83
mov rcx, 0xffffffffffffffff
lea rax, [rsp + 0x60]
mov rbx, rcx
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x140003960
lea rsi, [rbx + 0xa]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x140003c83
lea r8, [rsp + 0x60]
mov qword [rsp + 0x520], r13
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
cmp word [r14], 0
je 0x1400039c2
cmp word [r14 + rbx*2 - 2], 0x5c
je 0x1400039c2
mov dword [r14 + rbx*2], 0x5c
lea r8, str.CatRoot_
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, str.____________________________________
mov rdx, r14
call fcn.140003cb0
mov r13, rax
test rax, rax
jne 0x140003a02
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
jmp 0x140003a47
mov ecx, 0x20
mov qword [rsp + 0x510], r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x28], rax
mov r15, rax
test rax, rax
jne 0x140003a80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov r15, qword [rsp + 0x510]
mov r13, qword [rsp + 0x520]
mov r14, qword [rsp + 0x518]
mov rbx, qword [rsp + 0x540]
mov rsi, qword [rsp + 0x550]
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140009310
add rsp, 0x530
pop rdi
ret
xorps xmm0, xmm0
mov qword [rsp + 0x548], rbp
movups xmmword [rax], xmm0
lea rdx, [rsp + 0x2b0]
mov qword [rsp + 0x528], r12
mov rcx, r13
movups xmmword [rax + 0x10], xmm0
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x140003b9f
nop dword [rax + rax]
test byte [rsp + 0x2b0], 0x10
je 0x140003b78
lea r8, [rsp + 0x2dc]
mov rdx, r14
call fcn.140003cb0
mov rdi, rax
test rax, rax
je 0x140003b78
lea r8, str..cat
mov rdx, rax
call fcn.140003cb0
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003b66
test byte [rsp + 0x60], 0x10
jne 0x140003b4b
lea r8, [rsp + 0x8c]
mov rdx, rdi
call fcn.140003cb0
mov rbx, rax
test rax, rax
je 0x140003b4b
mov r9, rax
lea rdx, [rsp + 0x30]
mov r8, r15
call fcn.140003da0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140003b13
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [rsp + 0x2b0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140003ac0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [r15 + 0x14]
mov r15, qword [r15 + 0x18]
mov dword [rsp + 0x20], ebx
test ebx, ebx
je 0x140003c69
lea r8d, [rbx - 1]
xor edx, edx
mov rcx, r15
call fcn.1400053c0
mov r12d, 1
cmp ebx, r12d
jbe 0x140003c69
lea r13, [r15 + 0x10]
nop
movups xmm0, xmmword [r13]
mov ebx, r12d
mov esi, r12d
shl rbx, 4
movups xmmword [rsp + 0x50], xmm0
mov ebp, dword [rsp + 0x58]
add rbx, r15
movups xmmword [rsp + 0x30], xmm0
lea r14d, [rsi - 1]
mov edi, r14d
add rdi, rdi
cmp ebp, dword [r15 + rdi*8 + 8]
jb 0x140003c38
jne 0x140003c4c
mov rdx, qword [r15 + rdi*8]
mov r8, rbp
mov rcx, qword [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jns 0x140003c4c
movups xmm0, xmmword [r15 + rdi*8]
mov esi, r14d
movups xmmword [rbx], xmm0
sub rbx, 0x10
test r14d, r14d
jne 0x140003c10
movups xmm0, xmmword [rsp + 0x30]
mov eax, esi
inc r12d
add rax, rax
add r13, 0x10
movups xmmword [r15 + rax*8], xmm0
cmp r12d, dword [rsp + 0x20]
jb 0x140003bf0
mov rax, qword [rsp + 0x28]
mov r12, qword [rsp + 0x528]
mov rbp, qword [rsp + 0x548]
jmp 0x140003a3f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140003a4f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x140003a57