Function at 0x140039930
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x658]
sub rsp, 0x758
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rbp + 0x640], rax
movsxd r14, dword [rbp + 0x6c8]
mov eax, ecx
mov rdi, qword [rbp + 0x6c0]
mov r12d, ecx
mov dword [rsp + 0x48], ecx
mov rbx, r8
shr rax, 0x10
mov ecx, 0x28
mov qword [rsp + 0x60], r9
mov r15, rdx
mov dword [rsp + 0x4c], r14d
cmp cx, ax
jbe 0x14003a0a3
xor esi, esi
lea rdx, [0x140076040]
cmp r12d, 0xffffffff
jle 0x1400399bb
movzx eax, ax
imul rcx, rax, 0x2c0
mov byte [rsp + 0x40], 1
cmp word [rcx + rdx + 0x48], si
jne 0x1400399c0
mov byte [rsp + 0x40], sil
mov r13d, r12d
sar r13d, 0x10
mov dword [rsp + 0x44], r13d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [rbp + 0x6d0]
mov ecx, 2
mov dword [rsp + 0x5c], eax
test rbx, rbx
je 0x140039a13
mov eax, esi
shr eax, 1
test al, 1
je 0x140039a13
mov r9d, dword [rbx]
xor eax, eax
cmp r13d, ecx
mov r8d, r14d
mov rdx, rdi
mov rcx, r15
sete al
mov dword [rsp + 0x20], eax
call fcn.140037478
test eax, eax
jne 0x140039d03
lea rax, [0x14004ad70]
mov edx, r12d
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rax
call fcn.140035dbc
mov rcx, qword [rsp + 0x70]
lea r8, [0x14005bdf0]
cmp rcx, r8
je 0x140039a47
test byte [rcx + 0x24], 4
je 0x140039f07
mov eax, esi
shr eax, 2
test al, 1
je 0x140039af2
xor r13d, r13d
test rbx, rbx
je 0x140039a65
mov ecx, dword [rbx]
call fcn.1400384ac
jmp 0x140039a68
mov eax, r13d
mov dword [rsp + 0x58], eax
test eax, eax
je 0x140039ab4
mov r9, qword [rsp + 0x60]
lea r8, [rsp + 0x58]
and esi, 0xfffffffb
mov rdx, r15
mov dword [rsp + 0x30], esi
mov ecx, r12d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
mov dword [rbp + 0x6d0], esi
call fcn.14003c678
test eax, eax
je 0x140039ab4
test rbx, rbx
je 0x140039d03
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
jmp 0x140039d03
mov dword [rsp + 0x50], 0xa
test rbx, rbx
je 0x140039ac6
mov r8d, dword [rbx]
jmp 0x140039ac9
mov r8d, r13d
mov r9d, r12d
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xe0]
call fcn.1400385b4
mov rcx, qword [rsp + 0x70]
lea r8, [0x14005bdf0]
mov r13d, dword [rsp + 0x50]
xor edx, edx
jmp 0x140039b08
xor edx, edx
mov r13d, edx
test rbx, rbx
je 0x140039b08
mov eax, dword [rbx]
lea r13d, [rdx + 1]
mov dword [rbp + 0xe0], eax
cmp byte [rsp + 0x40], dl
je 0x140039bf7
cmp rcx, r8
je 0x140039bf7
cmp dword [rcx], edx
je 0x140039bf7
mov r12d, 1
cmp r13d, r12d
jle 0x140039bf7
mov r9, qword [rsp + 0x60]
lea rdx, [rbp + 0xe0]
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x30], 0x10000
movsxd rax, r12d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rdi
lea rax, [rdx + rax*4]
mov rdx, r15
mov r8, rax
mov qword [rsp + 0x50], rax
call fcn.14003c678
xor edx, edx
test eax, eax
je 0x140039beb
test r15, r15
je 0x140039bca
mov rcx, rdi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1637]
mov rcx, rax
mov r10, rax
sub rcx, rdi
sar rcx, 1
js 0x14003a0c8
test r14d, r14d
js 0x14003a0c8
cmp r14, rcx
jb 0x14003a0c8
mov eax, r14d
sub eax, ecx
cmp eax, 0x7fffffff
ja 0x14003a0c8
test eax, eax
jle 0x140039bca
movsxd rdx, eax
or r9, 0xffffffffffffffff
mov r8, r15
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor edx, edx
test eax, eax
je 0x140039beb
test byte [rsp + 0x78], 0x10
je 0x140039cd7
inc r12d
cmp r12d, r13d
jl 0x140039b32
mov eax, esi
shr eax, 1
test al, 1
je 0x140039c53
mov esi, 1
cmp r13d, esi
jle 0x140039c4d
cmp dword [rsp + 0x44], 2
lea r12, [rbp + 0xe4]
mov eax, edx
sete al
mov dword [rsp + 0x50], eax
mov r9d, dword [r12]
mov r8d, r14d
mov rdx, rdi
mov dword [rsp + 0x20], eax
mov rcx, r15
call fcn.140037478
xor edx, edx
test eax, eax
jne 0x140039d0d
mov eax, dword [rsp + 0x50]
inc esi
add r12, 4
cmp esi, r13d
jl 0x140039c1e
mov esi, dword [rbp + 0x6d0]
cmp byte [rsp + 0x40], dl
je 0x140039d4b
mov rax, qword [rsp + 0x70]
lea rcx, [0x14005bdf0]
cmp rax, rcx
je 0x140039ccd
cmp dword [rax], edx
je 0x140039ccd
test sil, 0x41
je 0x140039ccd
mov r14d, 1
cmp r13d, r14d
jle 0x140039cc8
and esi, 0xfffffff9
bts esi, 0x10
mov eax, dword [rsp + 0x4c]
lea r8, [rbp + 0xe0]
mov r9, qword [rsp + 0x60]
mov rdx, r15
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
movsxd r12, r14d
mov qword [rsp + 0x20], rdi
lea r8, [r8 + r12*4]
call fcn.14003c678
xor edx, edx
test eax, eax
jne 0x140039d2d
inc r14d
cmp r14d, r13d
jl 0x140039c8a
mov r14d, dword [rsp + 0x4c]
mov r13d, dword [rsp + 0x44]
jmp 0x140039f09
test rbx, rbx
je 0x140039ce5
mov rcx, qword [rsp + 0x50]
mov ecx, dword [rcx]
mov dword [rbx], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str._T_d__s:_darwin_already_installed__s.
mov edx, eax
lea r8, str.FGimmeResiliencyEx
mov r9, rdi
call fcn.140035fec
mov eax, 1
jmp 0x14003a0a5
test rbx, rbx
je 0x140039d1e
movsxd rax, esi
mov ecx, dword [rbp + rax*4 + 0xe0]
mov dword [rbx], ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str._T_d__s:_file_search_found__s.
jmp 0x140039cf2
test rbx, rbx
je 0x140039d3c
mov eax, dword [rbp + r12*4 + 0xe0]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str._T_d__s:_darwin_demand_installed__s.
jmp 0x140039cf2
mov eax, esi
and eax, 6
cmp al, 6
jne 0x140039ccd
mov eax, dword [reloc.AppVIsvSubsystems64.dll_Ordinal_1]
lea rdx, [rbp + 0x430]
or rsi, 0xffffffffffffffff
mov r8d, 0x104
lea ecx, [rsi + 3]
cmp dword [rsp + 0x44], ecx
cmove eax, ecx
imul rcx, rax, 0x2c0
lea rax, [0x140076040]
add rcx, rax
call fcn.140036f18
mov r13d, dword [rsp + 0x5c]
xor edx, edx
mov r12b, dl
cmp rsi, 0xffffffffffffffff
jne 0x140039e23
mov esi, 0x104
lea rdx, [rbp + 0x110]
mov r8d, esi
lea rcx, [rbp + 0x430]
xor r9d, r9d
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_67]
lea rcx, [rbp + 0x110]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140039dcd
cdqe
lea rdx, [0x14005d870]
lea rcx, [0x14005d874]
mov r8d, esi
cmp byte [rbp + rax + 0x10f], 0x5c
cmovne rcx, rdx
lea rdx, [rbp + 0x110]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1778]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
xor edx, edx
cmp rsi, 0xffffffffffffffff
mov eax, edx
setne al
jmp 0x140039e32
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
xor edx, edx
test eax, eax
je 0x140039e7f
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x34]
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_1291]
test byte [rbp - 0x60], 0x10
je 0x140039e74
lea ecx, [rax - 4]
cmp ecx, 1
ja 0x140039e74
or rcx, 0xffffffffffffffff
lea r8, [rbp - 0x34]
xor edx, edx
inc rcx
cmp byte [r8 + rcx], dl
jne 0x140039e5d
cmp ecx, eax
jne 0x140039e76
mov r13d, dword [rsp + 0x48]
mov r12b, 1
jmp 0x140039e76
xor edx, edx
test r12b, r12b
je 0x140039d99
test r12b, r12b
je 0x140039eef
mov eax, edx
mov ecx, 2
cmp dword [rsp + 0x44], ecx
mov r9d, r13d
mov r8d, r14d
mov rdx, rdi
sete al
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140037478
xor edx, edx
test eax, eax
je 0x140039d96
test rbx, rbx
je 0x140039eb9
mov dword [rbx], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9, rdi
lea r8, str.FGimmeResiliencyEx
mov edx, eax
lea rcx, str._T_d__s:__All_localized__search_found__s.
call fcn.140035fec
cmp rsi, 0xffffffffffffffff
je 0x140039d03
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x140039d03
cmp rsi, 0xffffffffffffffff
je 0x140039ccd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r13d, dword [rsp + 0x44]
xor edx, edx
mov eax, dword [rbp + 0x6d0]
mov ebx, 1
shr eax, 1
lea esi, [rbx + 1]
test bl, al
je 0x140039f65
mov eax, edx
cmp r13d, esi
mov r8d, r14d
mov rdx, rdi
sete al
mov rcx, r15
xor r9d, r9d
mov dword [rsp + 0x20], eax
call fcn.140037478
xor edx, edx
test eax, eax
je 0x140039f65
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str._T_d__s:_file_search_found__s.
mov edx, eax
lea r8, str.FGimmeResiliencyEx
mov r9, rdi
call fcn.140035fec
mov eax, ebx
jmp 0x14003a0a5
test r15, r15
je 0x140039fcb
mov r8d, r14d
lea rcx, str._WINDIR_
mov rdx, rdi
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_1344]
mov r8d, r14d
lea rcx, str.system32
mov rdx, rdi
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1436_1]
mov r8d, r14d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1436_1]
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
xor edx, edx
test eax, eax
je 0x140039fcb
test byte [rsp + 0x78], 0x10
jne 0x140039fcb
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str._T_d__s:_found_in_system_directory__s.
jmp 0x140039f4d
cmp r13d, esi
jne 0x14003a058
movaps xmm0, xmmword [str.....CommonMSSharedVBAVBA7_]
movaps xmm1, xmmword [0x14005fce0]
movaps xmmword [rbp + 0x220], xmm0
movaps xmm0, xmmword [0x14005fcf0]
movaps xmmword [rbp + 0x230], xmm1
movaps xmm1, xmmword [0x14005fd00]
movaps xmmword [rbp + 0x240], xmm0
movaps xmmword [rbp + 0x250], xmm1
test r15, r15
je 0x14003a029
mov r8d, 0x104
lea rdx, [rbp + 0x220]
mov rcx, r15
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1043]
xor edx, edx
mov dword [rsp + 0x20], edx
lea rcx, [rbp + 0x220]
mov rdx, rdi
xor r9d, r9d
mov r8d, r14d
call fcn.140037478
test eax, eax
je 0x14003a058
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rcx, str._T_d__s:_backdoor_search_found_VBA_path__s.
jmp 0x140039f4d
test r14d, r14d
jle 0x14003a07b
test r15, r15
movsxd rdx, r14d
lea r8, [0x14004cfb8]
mov rcx, rdi
cmovne r8, r15
or r9, 0xffffffffffffffff
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9, rdi
lea r8, str.FGimmeResiliencyEx
mov edx, eax
lea rcx, str._T_d__s:_could_not_find__s.
call fcn.140035fec
mov ecx, dword [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.1400443a0
add rsp, 0x758
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000d138
int3