Function at 0x1400036f0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x410]
sub rsp, 0x510
test byte [rcx + 0x40], 2
mov rdi, rdx
mov rsi, rcx
je 0x14000371c
mov al, 1
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x508], r14
xor r14b, r14b
cmp r8d, 1
je 0x140003734
xor al, al
jmp 0x140003c07
mov qword [rsp + 0x540], r12
mov qword [rsp + 0x500], r15
test rdx, rdx
jne 0x14000374d
lea rdi, [rcx + 8]
lea r12, vtable.DumpFileSearch.0
mov byte [rbp + 0x1b0], r14b
xor r15d, r15d
mov qword [rbp - 0x70], r12
xor edx, edx
mov qword [rbp - 0x58], r15
mov r8d, 0x100
lea rcx, [rbp + 0xb0]
call fcn.140013e20
movups xmm0, xmmword [rdi]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x100
movups xmmword [rbp - 0x68], xmm0
call fcn.140013e20
lea rax, [rbp + 0x430]
mov dword [rbp + 0x430], 0x100
mov qword [rsp + 0x28], rax
lea r9d, [r15 + 4]
lea rax, [rbp - 0x50]
mov rcx, 0xffffffff80000002
lea r8, str.MinidumpDir
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
call fcn.140002300
test eax, eax
jne 0x140003811
mov edx, dword [rbp + 0x430]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp - 0x50]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400037f0
movsd xmm0, qword [str.Minidump]
movzx eax, word [0x140060b68]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
cmp byte [rbp - 0x50], r14b
je 0x140003887
lea rcx, [rbp + 0xb0]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003821
lea r8, [rbp - 0x50]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003840
lea rcx, [rbp + 0xb0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003860
movzx eax, word [0x140060b8c]
mov word [rcx], ax
movzx eax, byte [0x140060b8e]
mov byte [rcx + 2], al
mov byte [rbp + 0x1b0], 1
jmp 0x140003894
cmp byte [rbp + 0x1b0], r14b
je 0x140003bdb
xor edx, edx
mov qword [rsp + 0x538], rbx
mov r8d, 0x100
lea rcx, [rbp + 0x1c0]
call fcn.140013e20
xor edx, edx
lea rcx, [rbp + 0x2c0]
mov r8d, 0x140
call fcn.140013e20
mov rcx, qword [rbp - 0x58]
test rcx, rcx
jne 0x14000390e
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x58], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140003bba
lea rdx, str..dmp
lea rcx, [rbp + 0x2ec]
call fcn.140013fb0
test rax, rax
jne 0x14000396b
mov rcx, qword [rbp - 0x58]
cmp rcx, 0xffffffffffffffff
je 0x140003bba
nop dword [rax + rax]
lea rdx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140003bb0
lea rdx, str..dmp
lea rcx, [rbp + 0x2ec]
call fcn.140013fb0
test rax, rax
jne 0x14000396b
lea rdx, str..DMP
lea rcx, [rbp + 0x2ec]
call fcn.140013fb0
test rax, rax
jne 0x14000396b
mov rcx, qword [rbp - 0x58]
jmp 0x140003920
mov rcx, r15
nop
movzx eax, byte [rbp + rcx - 0x50]
mov byte [rbp + rcx + 0x1c0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003970
lea rcx, [rbp + 0x1c0]
dec rcx
nop
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003990
movzx eax, word [0x140060ba0]
mov word [rcx], ax
lea rcx, [rbp + 0x1c0]
dec rcx
nop
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x1400039b0
lea r8, [rbp + 0x2ec]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400039d0
mov rax, qword [rsi + 0x28]
test rax, rax
je 0x140003a23
mov rbx, qword [rax + 8]
nop dword [rax]
mov r8d, 0x100
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call fcn.140009460
test al, al
jne 0x1400038b0
mov rax, rbx
test rbx, rbx
jne 0x140003a1a
mov rbx, r15
jmp 0x140003a1e
mov rbx, qword [rbx + 8]
test rax, rax
jne 0x1400039f0
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1c0]
movups xmmword [rsp + 0x30], xmm0
call fcn.140009340
test al, al
je 0x1400038b0
lea rcx, [rsi + 0x44]
lea rdx, [rsp + 0x30]
call fcn.140009bf0
test al, al
je 0x1400038b0
cmp word [rdi], r15w
je 0x140003a75
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140009bf0
test al, al
je 0x1400038b0
mov ecx, 0x128
call fcn.140012d48
test rax, rax
je 0x1400038b0
mov r8d, 0x100
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call fcn.140008eb0
mov rbx, rax
test rax, rax
je 0x1400038b0
xorps xmm0, xmm0
mov byte [rbp + 0x430], r14b
xor eax, eax
lea r9, [rbp + 0x430]
lea r8, [rsp + 0x40]
mov dword [rbp - 0x78], eax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rcx, rbx
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.140009060
movzx r14d, al
test al, al
je 0x140003b78
cmp byte [rbp + 0x430], r15b
je 0x140003b78
cmp dword [rsi + 0x40], r15d
jne 0x140003b2e
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400082d0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400078f0
mov ecx, 3
call fcn.14000acc0
or dword [rsi + 0x40], 2
lea rdi, [rsi + 0x44]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.140009bf0
test al, al
je 0x140003b78
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], SQLPrepare
lea r8, str.Last_AmdlogSr_LastBsodWt
mov r9d, 1
mov qword [rsp + 0x20], rdi
lea rdx, str.SoftwareAMDLOG
mov rcx, 0xffffffff80000002
movups xmmword [rdi], xmm0
call fcn.1400027b0
cmp qword [rsi + 0x30], r15
jne 0x140003b93
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x30], rbx
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
inc dword [rsi + 0x38]
jmp 0x140003bb6
mov qword [rbx + 8], r15
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rbx
inc dword [rsi + 0x38]
mov qword [rsi + 0x30], rbx
jmp 0x140003bb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x58]
mov rbx, qword [rsp + 0x538]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140003bdf
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r15
mov qword [rbp - 0x58], rcx
jmp 0x140003bdf
mov rcx, qword [rbp - 0x58]
mov r15, qword [rsp + 0x500]
lea rax, [rcx - 1]
mov qword [rbp - 0x70], r12
mov r12, qword [rsp + 0x540]
cmp rax, 0xfffffffffffffffd
ja 0x140003c03
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, r14b
mov r14, qword [rsp + 0x508]
add rsp, 0x510
pop rdi
pop rsi
pop rbp
ret