Function at 0x1400349f0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4c0
mov rax, qword [0x1405c7418]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
mov r12, r8
mov qword [rsp + 0x48], r8
movzx esi, dl
mov byte [rsp + 0x30], dl
mov r13, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], rcx
mov byte [rsp + 0x38], dl
mov qword [rsp + 0x80], r8
xor edi, edi
mov r14d, edi
mov dword [rsp + 0x34], edi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
lea ecx, [rdi + 0x30]
call fcn.1400ab188
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
lea ecx, [rdi + 0x30]
call fcn.1400ab188
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x68], rax
mov rdx, r13
lea rcx, [rsp + 0x1f0]
call fcn.14002d4d0
nop
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], di
lea r8d, [rdi + 3]
lea rdx, [0x1403ef3c8]
lea rcx, [rsp + 0x110]
call fcn.140008280
nop
lea r8, [rsp + 0x110]
mov rdx, r13
lea rcx, [rsp + 0x1b0]
call fcn.14002d800
nop
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.14002d4d0
nop
cmp qword [rax + 0x18], 8
jb 0x140034b12
mov rax, qword [rax]
lea rdx, [rsp + 0x260]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 8
jb 0x140034b73
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034b6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036033
call fcn.1400ab1c4
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], 7
mov word [rsp + 0x1d0], di
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 8
jb 0x140034bd7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036039
call fcn.1400ab1c4
mov qword [rsp + 0x1c0], rdi
mov qword [rsp + 0x1c8], 7
mov word [rsp + 0x1b0], di
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140034c3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034c36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003603f
call fcn.1400ab1c4
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], di
cmp rbx, 0xffffffffffffffff
jne 0x140034e8b
test sil, sil
je 0x140035219
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe8
je 0x140034cb9
cmp eax, 0x12
je 0x140034cb9
lea rcx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae rcx, qword [rsp + 0x1f0]
lea edx, [rbx + 2]
mov r8d, 0x10100
call fcn.1400704d0
mov rcx, r13
call fcn.1400266a0
and eax, 0xfffffffe
mov edx, eax
mov rcx, r13
call fcn.140026f20
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], di
mov r8d, 3
lea rdx, [0x1403ef538]
lea rcx, [rsp + 0xf0]
call fcn.140008280
nop
lea r8, [rsp + 0xf0]
mov rdx, r13
lea rcx, [rsp + 0x150]
call fcn.14002d800
nop
mov rdx, rax
lea rcx, [rsp + 0x190]
call fcn.14002d4d0
nop
cmp qword [rax + 0x18], 8
jb 0x140034d3c
mov rax, qword [rax]
lea rdx, [rsp + 0x260]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 8
jb 0x140034d9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034d98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036045
call fcn.1400ab1c4
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x1a8], 7
mov word [rsp + 0x190], di
mov rdx, qword [rsp + 0x168]
cmp rdx, 8
jb 0x140034e01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034dfc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003604b
call fcn.1400ab1c4
mov qword [rsp + 0x160], rdi
mov qword [rsp + 0x168], 7
mov word [rsp + 0x150], di
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x140034e65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034e60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036051
call fcn.1400ab1c4
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], di
cmp rbx, 0xffffffffffffffff
je 0x140035219
movabs r15, 0x555555555555555
nop word [rax + rax]
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], di
lea rax, [rsp + 0x28c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140034ee3
lea rdx, [rsp + 0x28c]
lea rcx, [rsp + 0x90]
call fcn.140008280
nop
lea r8, [rsp + 0x90]
mov rdx, r13
lea rcx, [rsp + 0xb0]
call fcn.14002d800
nop
mov rdx, qword [rsp + 0xa8]
cmp rdx, 8
jb 0x140034f65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034f60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036057
call fcn.1400ab1c4
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], di
test byte [rsp + 0x260], 0x10
je 0x14003510c
lea rdx, [rsp + 0x28c]
lea rcx, [0x1403ed4f4]
call fcn.1400adfa4
test rax, rax
je 0x140034ff9
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x1400351d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034fef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003605d
call fcn.1400ab1c4
jmp 0x1400351d1
mov r13, qword [rsp + 0x68]
cmp qword [rsp + 0x70], r15
je 0x140036026
lea rax, [rsp + 0x68]
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xd8], rdi
mov ecx, gethostbyname
call fcn.1400ab188
mov rsi, rax
mov qword [rsp + 0xd8], rax
mov qword [rax + 0x10], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x88], rax
lea r12, [rsp + 0xb0]
cmp qword [rsp + 0xc8], 8
cmovae r12, qword [rsp + 0xb0]
cmp rax, 8
jae 0x140035088
movups xmm0, xmmword [r12]
movups xmmword [rsi + 0x10], xmm0
mov r15d, 7
jmp 0x1400350d4
mov r15, rax
or r15, 7
movabs rax, 0x7ffffffffffffffe
cmp r15, rax
cmova r15, rax
lea rdx, [r15 + 1]
lea rcx, [rsi + 0x10]
call fcn.140007f70
mov qword [rsi + 0x10], rax
mov r8, qword [rsp + 0x88]
lea r8, [r8*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1400ad430
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], r15
inc qword [rsp + 0x70]
mov rax, qword [r13 + 8]
mov qword [rsi], r13
mov qword [rsi + 8], rax
mov qword [rsp + 0xd8], rdi
mov qword [r13 + 8], rsi
mov qword [rax], rsi
mov r13, qword [rsp + 0x50]
movabs r15, 0x555555555555555
jmp 0x140035184
mov rsi, qword [rsp + 0x58]
cmp qword [rsp + 0x60], r15
je 0x140036026
lea rax, [rsp + 0x58]
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x178], rdi
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140031020
mov rbx, rax
mov qword [rsp + 0x178], rax
lea rcx, [rax + 0x10]
lea rdx, [rsp + 0xb0]
call fcn.1400053c0
nop
inc qword [rsp + 0x60]
mov rcx, qword [rsi + 8]
mov qword [rbx], rsi
mov qword [rbx + 8], rcx
mov qword [rsp + 0x178], rdi
mov qword [rsi + 8], rbx
mov qword [rcx], rbx
mov rdx, qword [rsp + 0xc8]
cmp rdx, 8
jb 0x1400351cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400351c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003605d
call fcn.1400ab1c4
mov rbx, qword [rsp + 0x40]
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], di
lea rdx, [rsp + 0x260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140034ea0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r12, qword [rsp + 0x48]
movzx esi, byte [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rax]
mov qword [rsp + 0x40], rbx
cmp rbx, rax
je 0x1400358c2
mov rax, rbx
cmp qword [r12 + 0x10], 0
jne 0x140035255
lea rdx, [rax + 0x10]
lea rcx, [rsp + 0x190]
call fcn.14002d4d0
nop
or r14d, 1
jmp 0x1400352fc
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], di
or r14d, 2
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], di
or r14d, 4
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x110]
lea r8, [rsp + 0xf0]
mov rdx, r12
lea rcx, [rsp + 0x150]
call fcn.14003dee0
nop
or r14d, 8
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
test r14b, 8
je 0x14003535c
and r14d, 0xfffffff7
mov dword [rsp + 0x34], r14d
lea rcx, [rsp + 0x150]
call fcn.140007ea0
nop
test r14b, 4
je 0x1400353cf
and r14d, 0xfffffffb
mov dword [rsp + 0x34], r14d
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x1400353b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400353ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036063
call fcn.1400ab1c4
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], di
test r14b, 2
je 0x140035442
and r14d, 0xfffffffd
mov dword [rsp + 0x34], r14d
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140035426
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035421
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036069
call fcn.1400ab1c4
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], di
test r14b, 1
je 0x14003545e
and r14d, 0xfffffffe
mov dword [rsp + 0x34], r14d
lea rcx, [rsp + 0x190]
call fcn.140007ea0
cmp qword [r12 + 0x10], 0
je 0x1400356f9
lea rsi, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rsi, qword [rsp + 0xd0]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x1b0]
call fcn.14002d4d0
nop
cmp qword [rax + 0x18], 8
jb 0x1400354a0
mov rax, qword [rax]
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
lea rcx, [rsp + 0x1b0]
call fcn.140007ea0
test esi, esi
jne 0x1400356f9
cmp byte [rsp + 0x30], sil
je 0x1400357c9
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x1d0]
call fcn.14002d4d0
nop
cmp qword [rax + 0x18], 8
jb 0x1400354ed
mov rax, qword [rax]
mov edx, 1
mov r8d, 0x10100
mov rcx, rax
call fcn.1400704d0
nop
lea rcx, [rsp + 0x1d0]
call fcn.140007ea0
lea rcx, [rbx + 0x10]
call fcn.1400266a0
and eax, 0xfffffffe
mov edx, eax
lea rcx, [rbx + 0x10]
call fcn.140026f20
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], di
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], di
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x90]
lea r8, [rsp + 0xb0]
mov rdx, r12
lea rcx, [rsp + 0x170]
call fcn.14003dee0
mov rsi, rax
lea rax, [rsp + 0xd0]
cmp rax, rsi
je 0x140035653
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x140035611
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003560c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003606f
call fcn.1400ab1c4
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], di
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 7
mov word [rsi], di
lea rcx, [rsp + 0x170]
call fcn.140007ea0
nop
mov r8, qword [rsp + 0xc8]
cmp r8, 8
jb 0x140035687
inc r8
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.1400095a0
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], di
mov r8, qword [rsp + 0xa8]
cmp r8, 8
jb 0x1400356c9
inc r8
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x90]
call fcn.1400095a0
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], di
xor r8d, r8d
lea rdx, [rsp + 0xd0]
lea rcx, [rbx + 0x10]
call fcn.140026880
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
movzx esi, byte [rsp + 0x30]
test eax, eax
jne 0x140035843
test sil, sil
je 0x140035800
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
lea edx, [rax + 1]
mov r8d, 0x10100
call fcn.1400704d0
lea rcx, [rsp + 0xd0]
call fcn.1400266a0
and eax, 0xfffffffe
mov edx, eax
lea rcx, [rsp + 0xd0]
call fcn.140026f20
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x140035800
mov r8, qword [rsp + 0xe8]
cmp r8, 8
jb 0x14003588b
inc r8
mov rdx, qword [rsp + 0xd0]
lea rcx, [rsp + 0xd0]
call fcn.1400095a0
jmp 0x14003588b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 0x20
jne 0x14003619c
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x170]
call fcn.14004e270
nop
cmp qword [rsp + 0x178], 0
je 0x14003618f
jmp 0x140036075
cmp qword [r12 + 0x10], 0
jne 0x140035843
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x20
jne 0x14003638b
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x170]
call fcn.14004e270
nop
cmp qword [rsp + 0x178], 0
je 0x14003637e
jmp 0x140036286
mov rdx, qword [rsp + 0xe8]
cmp rdx, 8
jb 0x14003588b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035886
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003643c
call fcn.1400ab1c4
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe8], 7
mov word [rsp + 0xd0], di
mov rax, qword [rbx]
mov rbx, rax
mov qword [rsp + 0x40], rax
cmp rax, qword [rsp + 0x58]
jne 0x140035232
mov r13, qword [rsp + 0x50]
mov rax, qword [rsp + 0x68]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400358ea
nop
lea rcx, [rbx + 0x10]
mov r8, r12
movzx edx, sil
call fcn.1400349f0
mov rbx, qword [rbx]
cmp rbx, qword [rsp + 0x68]
jne 0x1400358d0
mov rcx, r13
call fcn.1400266a0
and eax, 0xfffffffe
mov edx, eax
mov rcx, r13
call fcn.140026f20
cmp qword [r12 + 0x10], 0
jne 0x140035926
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x190]
call fcn.1400053c0
nop
or r14d, 0x10
jmp 0x1400359ce
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], di
or r14d, 0x20
mov dword [rsp + 0x34], r14d
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], di
or r14d, 0x40
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0xb0]
lea r8, [rsp + 0x110]
mov rdx, r12
lea rcx, [rsp + 0x150]
call fcn.14003dee0
nop
bts r14d, 7
mov dword [rsp + 0x34], r14d
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1400053c0
nop
test r14b, r14b
jns 0x140035a01
btr r14d, 7
mov dword [rsp + 0x34], r14d
lea rcx, [rsp + 0x150]
call fcn.140007ea0
nop
test r14b, 0x40
je 0x140035a74
and r14d, 0xffffffbf
mov dword [rsp + 0x34], r14d
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x140035a58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035a53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036442
call fcn.1400ab1c4
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], di
test r14b, 0x20
je 0x140035ac5
and r14d, 0xffffffdf
mov dword [rsp + 0x34], r14d
mov r8, qword [rsp + 0xc8]
cmp r8, 8
jb 0x140035aa9
inc r8
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0xb0]
call fcn.1400095a0
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc8], 7
mov word [rsp + 0xb0], di
test r14b, 0x10
je 0x140035ae1
and r14d, 0xffffffef
mov dword [rsp + 0x34], r14d
lea rcx, [rsp + 0x190]
call fcn.140007ea0
cmp qword [r12 + 0x10], 0
je 0x140035d5e
lea rdx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae rcx, qword [rsp + 0x1f0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140035d5e
test sil, sil
je 0x140035d28
lea rcx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 8
cmovae rcx, qword [rsp + 0x1f0]
lea edx, [rax + 1]
mov r8d, 0x10100
call fcn.1400704d0
mov rcx, r13
call fcn.1400266a0
and eax, 0xfffffffe
mov edx, eax
mov rcx, r13
call fcn.140026f20
mov ecx, 0x64
nop dword [rax]
mov eax, ecx
dec ecx
mov dword [rsp + 0x40], ecx
test eax, eax
jle 0x140035d5e
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], di
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], di
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0xf0]
lea r8, [rsp + 0x90]
mov rdx, r12
lea rcx, [rsp + 0x1b0]
call fcn.14003dee0
mov rbx, rax
lea rax, [rsp + 0x130]
cmp rax, rbx
je 0x140035c63
lea rcx, [rsp + 0x130]
call fcn.140007ea0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x130], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x140], xmm1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
lea rcx, [rsp + 0x1b0]
call fcn.140007ea0
nop
mov r8, qword [rsp + 0xa8]
cmp r8, 8
jb 0x140035c97
inc r8
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x90]
call fcn.1400095a0
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa8], 7
mov word [rsp + 0x90], di
mov r8, qword [rsp + 0x108]
cmp r8, 8
jb 0x140035cd9
inc r8
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0xf0]
call fcn.1400095a0
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x108], 7
mov word [rsp + 0xf0], di
xor r8d, r8d
lea rdx, [rsp + 0x130]
mov rcx, r13
call fcn.140026880
nop
jmp 0x140035d5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x20
jne 0x14003656a
mov rdx, r13
lea rcx, [rsp + 0x170]
call fcn.14004e270
nop
cmp qword [rsp + 0x178], 0
je 0x14003655d
jmp 0x140036448
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140035f46
test sil, sil
je 0x140035f03
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rcx, qword [rsp + 0x130]
lea edx, [rax + 1]
mov r8d, 0x10100
call fcn.1400704d0
lea rcx, [rsp + 0x130]
call fcn.1400266a0
and eax, 0xfffffffe
mov edx, eax
lea rcx, [rsp + 0x130]
call fcn.140026f20
lea rcx, [rsp + 0x130]
cmp qword [rsp + 0x148], 8
cmovae rcx, qword [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140035f03
mov r8, qword [rsp + 0x148]
cmp r8, 8
jb 0x140035e24
inc r8
mov rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x130]
call fcn.1400095a0
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
lea rcx, [rsp + 0x1f0]
call fcn.140007ea0
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rsi, qword [rcx]
test rsi, rsi
je 0x140035e83
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.140007ea0
mov edx, gethostbyname
mov rcx, rsi
call fcn.1400ab1c4
mov rsi, rbx
test rbx, rbx
jne 0x140035e62
mov edx, gethostbyname
mov rcx, qword [rsp + 0x68]
call fcn.1400ab1c4
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rdi, qword [rcx]
test rdi, rdi
je 0x140035ed1
nop word [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140007ea0
mov edx, gethostbyname
mov rcx, rdi
call fcn.1400ab1c4
mov rdi, rbx
test rbx, rbx
jne 0x140035eb0
mov edx, gethostbyname
mov rcx, qword [rsp + 0x58]
call fcn.1400ab1c4
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1400ab7b0
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp qword [r12 + 0x10], 0
jne 0x140035f46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x20
jne 0x140036752
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x170]
call fcn.14004e270
nop
cmp qword [rsp + 0x178], 0
je 0x140036745
jmp 0x140036647
mov r8, qword [rsp + 0x148]
cmp r8, 8
jb 0x140035f6c
inc r8
mov rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x130]
call fcn.1400095a0
mov qword [rsp + 0x140], rdi
mov qword [rsp + 0x148], 7
mov word [rsp + 0x130], di
lea rcx, [rsp + 0x1f0]
call fcn.140007ea0
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rsi, qword [rcx]
test rsi, rsi
je 0x140035fd1
nop word [rax + rax]
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.140007ea0
mov edx, gethostbyname
mov rcx, rsi
call fcn.1400ab1c4
mov rsi, rbx
test rbx, rbx
jne 0x140035fb0
mov edx, gethostbyname
mov rcx, qword [rsp + 0x68]
call fcn.1400ab1c4
nop
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rdi, qword [rcx]
test rdi, rdi
je 0x140035ed1
nop dword [rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140007ea0
mov edx, gethostbyname
mov rcx, rdi
call fcn.1400ab1c4
mov rdi, rbx
test rbx, rbx
jne 0x140036000
jmp 0x140035ed1
lea rcx, str.list_too_long
call fcn.14009bfbc
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
lea rdx, [0x1403efc38]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
mov r9d, 0x10e
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rdi, rax
lea rdx, [0x1403ed1a4]
lea rcx, [rsp + 0x190]
call fcn.140005460
nop
lea r9d, [rsi - 0x21]
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1d0]
call fcn.140025ea0
nop
mov rcx, rax
call fcn.1400083b0
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xd0]
call fcn.1400083b0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x40]
call fcn.140006930
mov rcx, rax
call fcn.1400083b0
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x88]
lea rdx, [0x1403efca0]
lea rcx, [rsp + 0xb0]
call fcn.140025fc0
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.140005740
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400033e0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14001f0f0
nop
lea rcx, [rsp + 0x170]
call fcn.140026260
lea rdx, [0x1403efcf0]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x190]
call fcn.140005740
nop
mov r9d, 0x111
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rdi, rax
lea rcx, [rsp + 0x40]
call fcn.140006930
mov rbx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
lea r8, [0x1403ef598]
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.1400034a0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140003420
nop
lea r8, [0x1403ef618]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400034a0
nop
lea r8, [rsp + 0xd0]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140003420
nop
lea r8, [0x1403ed3a4]
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.1400034a0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rdi
mov edx, esi
mov rcx, rax
call fcn.14001f0f0
nop
lea rdx, [0x1403efd00]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
mov r9d, 0x122
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rdi, rax
lea rdx, [0x1403ed3f4]
lea rcx, [rsp + 0x190]
call fcn.140005460
nop
mov r9d, 0xffffffff
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1d0]
call fcn.140025ea0
nop
mov rcx, rax
call fcn.1400083b0
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xd0]
call fcn.1400083b0
mov qword [rsp + 0x50], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.Delete_file__s._Processes:__s
lea rcx, [rsp + 0xb0]
call fcn.140004c40
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.140005740
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400033e0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rdi
mov edx, 0x20
mov rcx, rax
call fcn.14001f0f0
nop
lea rcx, [rsp + 0x170]
call fcn.140026260
lea rdx, [0x1403efd50]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x190]
call fcn.140005740
nop
mov r9d, 0x125
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rbx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
lea r8, str.Delete_file_
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.1400034a0
nop
lea r8, [rsp + 0xd0]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140003420
nop
lea r8, [0x1403ed46c]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400034a0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.14001f0f0
nop
call fcn.1400b1d8c
nop
call fcn.1400b1d8c
nop
lea rdx, [0x1403efd60]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
mov r9d, 0x14a
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rdi, rax
lea rdx, [0x1403ed49c]
lea rcx, [rsp + 0x190]
call fcn.140005460
nop
mov r9d, 0xffffffff
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1d0]
call fcn.140025ea0
nop
mov rcx, rax
call fcn.1400083b0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x130]
call fcn.1400083b0
mov qword [rsp + 0x78], rax
mov rcx, r13
call fcn.1400083b0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x48]
lea rdx, str.Move_file__s_to__s._Processes:__s
lea rcx, [rsp + 0xb0]
call fcn.140025fc0
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.140005740
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400033e0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rdi
mov edx, 0x20
mov rcx, rax
call fcn.14001f0f0
nop
lea rcx, [rsp + 0x170]
call fcn.140026260
lea rdx, [0x1403efdc0]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x190]
call fcn.140005740
nop
mov r9d, 0x14d
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rbx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
lea r8, [0x1403ef628]
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.1400034a0
nop
mov r8, r13
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140003420
nop
lea r8, [0x1403ef6a8]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400034a0
nop
lea r8, [rsp + 0x130]
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.140003420
nop
lea r8, [0x1403ed4fc]
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.1400034a0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.14001f0f0
nop
lea rdx, [0x1403efdd0]
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
mov r9d, 0x15e
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rdi, rax
lea rdx, [0x1403ed51c]
lea rcx, [rsp + 0x190]
call fcn.140005460
nop
mov r9d, 0xffffffff
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x170]
lea rcx, [rsp + 0x1d0]
call fcn.140025ea0
nop
mov rcx, rax
call fcn.1400083b0
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x130]
call fcn.1400083b0
mov qword [rsp + 0x78], rax
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x78]
lea rdx, str.Delete_directory__s._Processes:__s
lea rcx, [rsp + 0xb0]
call fcn.140004c40
mov rbx, rax
lea rcx, [rsp + 0x90]
call fcn.140005740
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.1400033e0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rdi
mov edx, 0x20
mov rcx, rax
call fcn.14001f0f0
nop
lea rcx, [rsp + 0x170]
call fcn.140026260
lea rdx, str.removeDir
lea rcx, [rsp + 0x150]
call fcn.140005380
nop
lea rcx, [rsp + 0x190]
call fcn.140005740
nop
mov r9d, 0x161
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0x210]
call fcn.1400057f0
mov rbx, rax
lea rcx, [rsp + 0x1b0]
call fcn.140005740
nop
lea r8, str.Delete_directory_
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.1400034a0
nop
lea r8, [rsp + 0x130]
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140003420
nop
lea r8, [0x1403ed54c]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400034a0
nop
mov rcx, rax
call fcn.1400083b0
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.14001f0f0
int3