Function at 0x14000da60
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x14006c040]
xor rax, rsp
mov qword [rbp + 0x400], rax
movzx r15d, cl
xor r13d, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rbp + 0x190]
call fcn.140046bc0
test al, al
jne 0x14000dadc
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000b4e0
lea rdx, [0x140010340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000ef2c
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], r13
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0x10]
call fcn.140006c60
nop
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
mov r12, qword [rbp + 0x20]
sub rax, r12
cmp rax, 1
jb 0x14000ef6c
lea r14, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r14, qword [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
lea rsi, [r12 + 1]
mov ebx, 7
lea rdi, [rbp + 0x130]
movabs rax, 0x7fffffffffffffff
lea ecx, [rbx + 3]
cmp rsi, rbx
jbe 0x14000dba8
mov rbx, rsi
or rbx, 7
cmp rbx, rdx
jbe 0x14000dc52
mov rbx, rdx
mov rcx, rax
lfence
add rcx, rcx
call fcn.140006ec0
mov rdi, rax
mov qword [rbp + 0x130], rax
mov r12, qword [rbp + 0x20]
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rbx
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word ds:[rbx + rdi], 0x2a
mov word [rdi + rsi*2], r13w
mov edi, 0x40
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova rcx, qword [rbp + 0x130]
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rdx, qword [rbp + 0x148]
cmp rdx, 7
jbe 0x14000dc73
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dc6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dc6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000ef66
jmp 0x14000db8f
call fcn.1400493f0
movdqa xmm0, xmmword [0x14005d4a0]
movdqu xmmword [rbp + 0x140], xmm0
mov word [rbp + 0x130], r13w
cmp rbx, 0xffffffffffffffff
jne 0x14000dcba
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
nop
call fcn.14000b4e0
lea rdx, [0x140010340]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000eee6
test r15b, r15b
jne 0x14000dd16
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_renamed_and_deleted_Prefetch_folders..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400088e0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_Prefetch_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400088e0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400088e0
call fcn.140047d40
lea rcx, [rbp - 0x60]
call fcn.1400084e0
nop
lea r14, str..EXE
nop word [rax + rax]
xor r15d, r15d
cmp dword [rbp + 0x1b0], 0x10
je 0x14000e382
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r15
lea rax, [rbp + 0x1dc]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x14000dd70
lea rdx, [rbp + 0x1dc]
lea rcx, [rbp + 0x70]
call fcn.140006c60
nop
lea r11, [rbp + 0x70]
mov rax, qword [rbp + 0x88]
cmp rax, 7
seta sil
mov r13, qword [rbp + 0x70]
cmova r11, r13
mov r10, qword [rbp + 0x80]
cmp r10, 4
jb 0x14000ee1d
lea rbx, [r10 - 3]
lea rbx, [r11 + rbx*2]
mov rax, r11
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov rdx, r15
je 0x14000ddec
cmp word [rax], 0x2e
je 0x14000dde9
cmp rcx, 1
je 0x14000ddec
dec rcx
add rax, 2
cmp word [rax], 0x2e
jne 0x14000ddd6
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000ee11
mov r8d, 4
mov rdx, r14
mov r9, rax
sub r9, r14
nop word [rax + rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14000deac
add rdx, 2
sub r8, 1
jne 0x14000de10
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000ee11
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, r10
jb 0x14000ef5c
lea r15, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r15, qword [rbp + 0x10]
lea r12, [rbp + 0x70]
test sil, sil
cmovne r12, r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x20]
lea r14, [rax + r10]
mov ebx, 7
lea rsi, [rbp + 0x30]
cmp r14, rbx
jbe 0x14000def8
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x14000deb5
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x14000ded9
add rax, 2
jmp 0x14000ddc2
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000ef72
lfence
add rcx, rcx
call fcn.140006ec0
mov rsi, rax
mov qword [rbp + 0x30], rax
mov r13, qword [rbp + 0x70]
mov edi, dword [rsp + 0x40]
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], rbx
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov rbx, qword [rbp + 0x80]
lea r8, [rbx + rbx]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
xor r15d, r15d
mov word [rsi + r14*2], r15w
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000dfa6
test al, 1
je 0x14000dfa6
lea rdx, str.____Prefetch_file_is_marked_as_read_only:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140006a60
lea rdx, ds:[rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rax
call fcn.140009240
lea rdx, str.._This_is_bannable.
mov rcx, rax
call fcn.140006a60
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x1c4]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x14000ed60
movabs rdx, 0x7ffffffffffffffe
mov rax, rdx
mov rcx, qword [rbp + 0x20]
sub rax, rcx
cmp rax, rbx
jb 0x14000ef98
lea r15, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova r15, qword [rbp + 0x10]
lea r12, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova r12, r13
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
lea r14, [rcx + rbx]
mov ebx, 7
lea rsi, [rbp + 0x50]
cmp r14, rbx
jbe 0x14000e0ad
mov rbx, r14
or rbx, 7
cmp rbx, rdx
jbe 0x14000e06b
mov rbx, rdx
movabs rcx, 0x7fffffffffffffff
jmp 0x14000e08f
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000ef78
lfence
add rcx, rcx
call fcn.140006ec0
mov rsi, rax
mov qword [rbp + 0x50], rax
mov r13, qword [rbp + 0x70]
mov edi, dword [rsp + 0x40]
mov rcx, qword [rbp + 0x20]
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], rbx
lea rbx, [rcx + rcx]
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + rbx]
mov r8, qword [rbp + 0x80]
add r8, r8
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
xor r15d, r15d
mov word [rsi + r14*2], r15w
bts edi, 8
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r15 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.14000ffa0
nop
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0xf
cmova rcx, qword [rbp + 0xf0]
lea r8, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova r8, qword [rbp + 0x50]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r15 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.14000c740
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x58]
jne 0x14000e3f7
test rcx, rcx
je 0x14000e1fe
mov rdx, qword ds:[rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e1ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eea7
call fcn.1400493f0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x14000e24f
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e24a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eeae
call fcn.1400493f0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000e2af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e2aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eeb5
call fcn.1400493f0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000e30f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e30a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee5f
call fcn.1400493f0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r15w
mov rax, qword [rbp + 0x88]
cmp rax, 7
jbe 0x14000e372
lea rdx, ds:[rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000e36a
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee67
mov rcx, r13
call fcn.1400493f0
lea r14, str..EXE
mov rbx, qword [rsp + 0x48]
mov r12, qword [rbp + 0x20]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000dd30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000eed8
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eec7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000eec7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000ce60
nop
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
cmp r14, r12
je 0x14000ebe4
lea r13, str..EXE
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
lea rax, [rbp + 0x1dc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000e450
lea rdx, [rbp + 0x1dc]
lea rcx, [rbp + 0xd0]
call fcn.140006c60
nop
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
seta r10b
mov r9, qword [rbp + 0xd0]
cmova rdx, r9
mov rsi, qword [rbp + 0xe0]
test rsi, rsi
je 0x14000e4cd
mov rax, rsi
mov rcx, rdx
mov r8, r15
cmp word [rdx], 0x2d
je 0x14000e4bb
cmp rax, 1
je 0x14000e4be
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x14000e4a8
mov r8, rcx
nop
test r8, r8
je 0x14000e4cd
sub r8, rdx
sar r8, 1
jmp 0x14000e4d4
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x14000e526
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0xd0]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0x90]
call fcn.140006c60
bts edi, 7
lea rax, [rbp + 0x90]
or edi, 1
jmp 0x14000e60d
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], r15
lea r15, [rbp + 0xd0]
test r10b, r10b
cmovne r15, r9
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x14000ef92
nop dword [rax]
cmp rsi, 7
ja 0x14000e585
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], 7
movups xmm0, xmmword [r15]
movups xmmword [rbp + 0xb0], xmm0
jmp 0x14000e600
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x14000e5a2
mov rbx, rax
movabs rcx, 0x7fffffffffffffff
jmp 0x14000e5c9
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000ef8c
lfence
add rcx, rcx
call fcn.140006ec0
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rbx
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0xb0]
or edi, 2
xor r15d, r15d
mov edx, edi
mov ecx, edi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
test cl, 2
je 0x14000e6a9
and edi, 0xfffffffd
mov rdx, qword [rbp + 0xc8]
cmp rdx, 7
jbe 0x14000e68f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e68a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee6e
call fcn.1400493f0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r15w
test dil, 1
je 0x14000e712
and edi, 0xfffffffe
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000e6f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e6f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee87
call fcn.1400493f0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r15w
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
mov rax, qword [r14 + 0x10]
cmp rax, 0x23
jb 0x14000ef86
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000e757
mov rdx, qword [r14]
add rdx, 0x46
lea rcx, [rbp + 0x90]
call fcn.140006c60
or edi, 0x10
mov rdx, r14
lea rcx, [rbp + 0x170]
call fcn.14000d100
nop
lea r9, [rbp + 0x90]
mov r8, rax
lea rcx, [rbp - 0x10]
call fcn.1400106e0
or edi, 8
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp + 0x188]
cmp rdx, 7
jbe 0x14000e7ef
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e7ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee75
call fcn.1400493f0
mov qword [rbp + 0x180], r15
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000e84f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e84a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee7c
call fcn.1400493f0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], r15w
lea r9, [rbp + 0x150]
cmp qword [rbp + 0x168], 7
cmova r9, qword [rbp + 0x150]
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov rax, qword [rbp + 0x160]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp]
call fcn.140008f80
cmp rax, 0xffffffffffffffff
je 0x14000eaa6
lea rax, ds:[rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rax, qword [rbp - 0x10]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp]
mov qword [rbp - 0x68], rax
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0xb0]
call fcn.140004f80
test al, al
jne 0x14000e9b8
mov rax, qword [rbp]
cmp rax, 4
jb 0x14000e9b8
lea rcx, ds:[rax - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
cmp rax, rcx
jb 0x14000ef7e
lfence
mov rax, qword [rbp]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rax, qword [rbp - 0x10]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x110]
call fcn.140006c60
mov edi, dword [rsp + 0x40]
or edi, 0x204
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x110]
mov r9, qword [rbp + 0x128]
cmp r9, 7
cmova r8, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x120]
cmp rdx, 4
jne 0x14000e9bf
mov rcx, r13
test rdx, rdx
je 0x14000e9b4
sub r8, r13
nop
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000e9bf
add rcx, 2
sub rdx, 1
jne 0x14000e9a0
mov bl, 1
jmp 0x14000e9c1
mov r9, qword [rbp + 0x128]
xor bl, bl
test dil, 4
je 0x14000e9ff
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
cmp r9, 7
jbe 0x14000e9e5
mov r8, r9
mov rdx, qword [rbp + 0x110]
call fcn.1400064c0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], r15w
nop
test bl, bl
je 0x14000eaa6
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rcx, qword [rbp - 0x10]
mov qword [rsp + 0x20], 0xb
lea r9, str.UnknownDisk
xor r8d, r8d
mov rdx, qword [rbp]
call fcn.140008f80
cmp rax, 0xffffffffffffffff
je 0x14000ea42
lea rdx, str.___Executed_file:
nop
jmp 0x14000ea56
lea rdx, [rbp - 0x10]
call fcn.1400477e0
test al, al
jne 0x14000ea8f
lea rdx, [0x1400533c0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop dword [rax]
call fcn.140006a60
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
mov r8, qword [rbp]
cmova rdx, qword [rbp - 0x10]
mov rcx, rax
call fcn.140009240
lea rdx, [0x140008ba0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, ds:[rbp - 0x10]
lea rdx, [rbp - 0x20]
lea rcx, [0x14006f8f0]
call fcn.1400067e0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000eaef
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eaea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee87
call fcn.1400493f0
mov qword [rbp], r15
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r15w
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x14000eb4f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eb4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee8e
call fcn.1400493f0
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], r15w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x14000ebaf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ebaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee95
call fcn.1400493f0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
add r14, 0x20
cmp r14, r12
jne 0x14000e421
mov r13, qword [rbp + 0x70]
mov r12, qword [rsp + 0x78]
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x14000ec5f
cmp r14, r12
je 0x14000ec0a
mov rcx, r14
call fcn.140005dc0
add r14, 0x20
cmp r14, r12
jne 0x14000ebf2
mov r14, qword [rsp + 0x70]
mov rdx, qword ds:[rbp - 0x80]
sub rdx, r14
and rdx, 0xffffffffffffffe0
mov rax, r14
cmp rdx, 0x1000
jb 0x14000ec4a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee9c
mov rcx, r14
call fcn.1400493f0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000ecaa
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eea7
call fcn.1400493f0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x14000ecef
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ecea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eeae
call fcn.1400493f0
mov qword [rbp + 0x100], r15
mov qword [rbp + 0x108], 0xf
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000ed4f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ed4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eeb5
call fcn.1400493f0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000edaf
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000edaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000eebc
call fcn.1400493f0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r15w
mov rax, qword [rbp + 0x88]
cmp rax, 7
jbe 0x14000e372
lea rdx, ds:[rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000e36a
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000e36a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, qword [rsp + 0x48]
mov rax, qword [rbp + 0x88]
nop dword [rax]
test sil, sil
je 0x14000e382
lea rdx, [rax*2 + 2]
mov rax, r13
cmp rdx, 0x1000
jb 0x14000ee52
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ee0a
mov rcx, r13
call fcn.1400493f0
jmp 0x14000e382
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400493f0
mov qword [rbp - 0x48], r15
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, ds:[rbp - 0x58]
call fcn.140008660
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x14000ef2c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ef27
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400493f0
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.1400493d0
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
nop dword [rax]
call fcn.140003ea0
nop
call fcn.140003df0
int3
call fcn.140003ea0
nop
call fcn.140003df0
nop
call fcn.140003df0
nop
nop
call fcn.1400088c0
nop
call fcn.1400088c0
nop
call fcn.140003df0
int3
call fcn.140003ea0
nop
call fcn.140003ea0
int3
movzx ecx, dl
jmp 0x14000da60