Function at 0x140002360
Capabilities:
Enumerate files on windows
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x670]
sub rsp, 0x770
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rbp + 0x660], rax
xor edi, edi
mov r15d, edi
mov dword [rsp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_AllocConsole]
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x140006a30]
lea rdx, str.CONOUT_
lea rcx, [rbp - 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
lea rdx, str.Checking_for_suspicious_files..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003010
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov dword [rsp + 0x44], eax
mov r13b, 0x41
movabs rsi, 0x7ffffffffffffffe
lea r12, [0x140006a88]
lea rbx, [0x140006a90]
nop word [rax + rax]
movsx eax, r13b
sub eax, 0x41
movzx ecx, al
bt r14d, ecx
jae 0x1400027d2
lea rdx, [0x140006a84]
lea rcx, [rbp - 0x70]
call fcn.140002ec0
nop
movsx r9d, r13b
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
cmp rcx, rdx
jae 0x140002467
lea rax, [rcx + 1]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x70]
cmp rdx, 8
cmovae rax, qword [rbp - 0x70]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], di
jmp 0x140002470
lea rcx, [rbp - 0x70]
call fcn.1400032f0
mov rax, rsi
mov rcx, qword [rbp - 0x60]
sub rax, rcx
cmp rax, 2
jb 0x140002e3e
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r9, qword [rbp - 0x70]
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x50]
call fcn.1400037b0
or r15d, 0x20
mov rax, rsi
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, 1
jb 0x140002e38
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r9, qword [rbp - 0x50]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.1400037b0
or r15d, 0x10
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x14000255a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002555
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002867
call fcn.14000405c
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
cmp r12, 0xffffffffffffffff
je 0x14000274a
nop word [rax + rax]
lea rdx, [rbp + 0x1c]
lea rcx, [rbp - 0x30]
call fcn.140002ec0
nop
mov rbx, qword [0x1400096e0]
mov r14, qword [0x1400096e8]
cmp rbx, r14
je 0x1400026cc
mov rsi, qword [rbp - 0x18]
mov r15, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x30]
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400025be
mov r9, qword [rbx]
lea rcx, [rbp - 0x30]
cmp rsi, 8
cmovae rcx, rdi
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov rdx, r15
call fcn.140003230
cmp rax, 0xffffffffffffffff
jne 0x1400025ef
add rbx, 0x20
cmp rbx, r14
jne 0x1400025b1
jmp 0x1400026d4
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, r15
jb 0x140002e32
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r9, qword [rbp - 0x50]
lea rax, [rbp - 0x30]
cmp rsi, 8
cmovae rax, rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.1400037b0
mov r15d, dword [rsp + 0x40]
or r15d, 8
mov dword [rsp + 0x40], r15d
lea rdx, str.Suspicious_file_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003010
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov rcx, rax
call fcn.140003920
mov rcx, rax
lea rdx, [0x1400031f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400026cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000286e
call fcn.14000405c
mov rdi, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x18]
cmp rsi, 8
jb 0x14000270f
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002707
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002875
mov rcx, rdi
call fcn.14000405c
lea rdx, [rbp - 0x10]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002580
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14d, dword [rsp + 0x44]
mov r15d, dword [rsp + 0x40]
movabs rsi, 0x7ffffffffffffffe
xor edi, edi
lea rbx, [0x140006a90]
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14000278b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002785
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000287c
call fcn.14000405c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400027cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002883
call fcn.14000405c
lea r12, [0x140006a88]
inc r13b
cmp r13b, 0x5a
jle 0x140002410
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14000298c
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], rdi
lea rax, [rbp + 0x240]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002822
cmp rbx, rsi
ja 0x140002e2c
mov qword [rbp - 0x58], 7
cmp rbx, 8
jae 0x14000288a
mov qword [rbp - 0x60], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbp + rbx - 0x70], di
jmp 0x140002946
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdi, rbx
or rdi, 7
cmp rdi, rsi
jbe 0x1400028a9
mov rdi, rsi
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400028d8
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140002e44
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002904
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e44
mov rcx, rax
call fcn.140003d00
test rax, rax
je 0x140002a03
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002915
test rcx, rcx
je 0x140002913
call fcn.140003d00
mov rsi, rax
jmp 0x140002915
xor esi, esi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rdi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x240]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
xor edi, edi
mov word [rsi + rbx], di
movabs rsi, 0x7ffffffffffffffe
lea rcx, [rbp - 0x70]
call fcn.140001da0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14000298c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002987
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002a03
call fcn.14000405c
lea rax, [rbp + 0x450]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140002a0f
lea rdx, [rbp + 0x450]
lea rcx, [rsp + 0x68]
call fcn.140002ec0
nop
lea rcx, [rsp + 0x68]
call fcn.140001da0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140002a0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000405c
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, eax
not r14d
and edx, r14d
mov dword [rsp + 0x44], edx
mov r13b, 0x41
nop dword [rax]
nop dword [rax + rax]
movsx ecx, r13b
sub ecx, 0x41
movzx eax, cl
bt edx, eax
jae 0x140002d92
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x58], 7
movsx eax, r13b
mov qword [rbp - 0x60], 1
mov word [rbp - 0x70], ax
mov word [rbp - 0x6e], di
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 1
lea r9, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.1400037b0
or r15d, 2
mov rax, rsi
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, 1
jb 0x140002e26
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r9, qword [rbp - 0x50]
mov qword [rsp + 0x30], 1
lea rax, [0x140006a90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x48]
call fcn.1400037b0
or r15d, 4
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x140002b3d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002da7
call fcn.14000405c
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
cmp r12, 0xffffffffffffffff
je 0x140002d15
nop word [rax + rax]
lea rdx, [rbp + 0x1c]
lea rcx, [rbp - 0x30]
call fcn.140002ec0
nop
mov rbx, qword [0x1400096e0]
mov r14, qword [0x1400096e8]
cmp rbx, r14
je 0x140002ca3
mov rsi, qword [rbp - 0x18]
mov r15, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x30]
mov r9, rbx
cmp qword [rbx + 0x18], 8
jb 0x140002b9e
mov r9, qword [rbx]
lea rcx, [rbp - 0x30]
cmp rsi, 8
cmovae rcx, rdi
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov rdx, r15
call fcn.140003230
cmp rax, 0xffffffffffffffff
jne 0x140002bcf
add rbx, 0x20
cmp rbx, r14
jne 0x140002b91
jmp 0x140002cab
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, r15
jb 0x140002e4a
lea r9, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae r9, qword [rbp - 0x50]
lea rax, [rbp - 0x30]
cmp rsi, 8
cmovae rax, rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x68]
call fcn.1400037b0
or dword [rsp + 0x40], 1
lea rdx, str.Suspicious_file_found_on_network_drive:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003010
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
mov rcx, rax
call fcn.140003920
mov rcx, rax
lea rdx, [0x1400031f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140002ca3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dae
call fcn.14000405c
mov rdi, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x18]
cmp rsi, 8
jb 0x140002ce6
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140002cde
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002db5
mov rcx, rdi
call fcn.14000405c
lea rdx, [rbp - 0x10]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140002b60
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15d, dword [rsp + 0x40]
movabs rsi, 0x7ffffffffffffffe
xor edi, edi
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140002d52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dbc
call fcn.14000405c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x140002d8e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002dc3
call fcn.14000405c
mov edx, dword [rsp + 0x44]
inc r13b
cmp r13b, 0x5a
jg 0x140002dca
lea r12, [0x140006a88]
jmp 0x140002a30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.Suspicious_file_check_completed._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003010
lea rdx, str.Hidden_files_configs_found__Can_Include:_lua__scripts__js__recoil__xim__macros__ring__portable__usbs__DMAs..._._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140003010
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [rbp + 0x660]
xor rcx, rsp
call fcn.140003ce0
lea r11, [rsp + 0x770]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.140001540
nop
call fcn.1400015e0
int3