Function at 0x140018660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov qword [rbp - 0x50], r8
mov rbx, rdx
mov r14, rcx
mov qword [rbp - 0x38], rcx
xor r12d, r12d
mov dword [rsp + 0x50], r12d
lea rcx, [rbp + 0x220]
call fcn.14004e4c0
test al, al
jne 0x1400186de
lea rdx, str.Failed_to_retrieve_logon_time
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.1400064a0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140019645
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x220]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x1400186fc
lea rdx, str.Failed_to_convert_logon_time_to_FILETIME
jmp 0x1400186bd
mov qword [rbp + 0x1f8], r12
mov dword [rbp + 0x200], 0xffffffff
mov dword [rbp + 0x204], r12d
mov qword [rbp + 0x208], r12
mov qword [rbp + 0x210], r12
mov rax, qword [rbx]
mov qword [rbp + 0x218], rax
mov ecx, 0x10000
call fcn.140050fac
mov rbx, rax
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x50]
call fcn.140007ae0
nop
lea rcx, [rbp + 0x120]
call fcn.140017040
nop
lea rcx, [rbp + 0x10]
call fcn.140016ea0
nop
lea rcx, [rbp - 0x30]
call fcn.140016ea0
nop
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x80], r12
mov ecx, 0x20
call fcn.140050f68
mov rsi, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x78], r12
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x58], 8
mov dword [rsp + 0x70], 0x3f800000
mov ecx, 0x80
call fcn.140050f68
mov rdi, rax
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x78]
sub rax, rcx
sar rax, 3
test rax, rax
je 0x140018814
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001880f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001880f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
mov qword [rbp - 0x78], rdi
lea rax, [rdi + 0x80]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
cmp rdi, rax
je 0x14001883c
nop dword [rax]
mov qword [rdi], rsi
add rdi, 8
cmp rdi, rax
jne 0x140018830
mov edi, r12d
mov dword [rsp + 0x40], r12d
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10000
mov qword [rsp + 0x20], rbx
mov r9d, 0x28
lea r8, [rbp + 0x1f8]
mov edx, 0x900bb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop dword [rax + rax]
test eax, eax
je 0x1400194b0
nop dword [rax + rax]
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x1400194b0
add eax, 0xfffffff8
mov dword [rsp + 0x54], eax
lea r15, [rbx + 8]
je 0x140019459
nop dword [rax]
movzx r8d, word ds:[r15 + 0x38]
shr r8, 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], r12
lea rdx, [r15 + 0x3c]
lea rcx, [rbp + 0x180]
call fcn.1400066a0
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r13, qword [rbp + 0x190]
sub rax, r13
cmp rax, 0xb
jb 0x140019676
lea r12, [rbp + 0x180]
mov rdi, qword [rbp + 0x180]
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x48], rax
cmp rax, 7
cmova r12, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xor eax, eax
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], rax
lea r14, [r13 + 0xb]
mov ebx, 7
lea rsi, [rbp + 0x1a0]
cmp r14, rbx
jbe 0x1400189d8
mov rbx, r14
or rbx, 7
mov qword [rsp + 0x60], rbx
cmp rbx, rcx
jbe 0x14001897b
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x1400189a9
mov eax, 0xa
mov qword [rsp + 0x60], rax
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001967c
lfence
add rcx, rcx
call fcn.1400069a0
mov rsi, rax
mov qword [rbp + 0x1a0], rax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x48], rax
mov r13, qword [rbp + 0x190]
mov rdi, qword [rbp + 0x180]
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1b8], rbx
movups xmm0, xmmword [str.C:Windows_]
movups xmmword [rsi], xmm0
mov eax, dword [0x14005a5d8]
mov dword [rsi + 0x10], eax
movzx eax, word [0x14005a5dc]
mov word [rsi + 0x14], ax
lea rcx, [rsi + 0x16]
lea r8, [r13*2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
xor r12d, r12d
mov word [rsi + r14*2], r12w
mov r14d, dword [rsp + 0x50]
or r14d, 1
mov dword [rsp + 0x50], r14d
mov rax, qword [rbp - 0x50]
cmp qword [r15 + 0x10], rax
jne 0x14001941b
mov eax, dword ds:[r15 + 0x20]
mov dword [rsp + 0x68], eax
mov eax, dword [r15 + 0x24]
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
js 0x14001941b
lea rdx, ds:[rbp + 0x1c0]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word ds:[rbp + 0x1c0]
sub eax, 0x76c
mov dword [rbp + 0x1e4], eax
movzx eax, word [rbp + 0x1c2]
dec eax
mov dword [rbp + 0x1e0], eax
movzx eax, word [rbp + 0x1c6]
mov dword [rbp + 0x1dc], eax
movzx eax, word [rbp + 0x1c8]
mov dword [rbp + 0x1d8], eax
movzx eax, word [rbp + 0x1ca]
mov dword [rbp + 0x1d4], eax
movzx eax, word [rbp + 0x1cc]
mov dword [rbp + 0x1d0], eax
mov dword [rbp + 0x1f0], 0xffffffff
lea r9, [rbp + 0x1d0]
lea r8, str._Y__m__d__H:_M:_S
lea edx, [r12 + 0x50]
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140018b30
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x160]
call fcn.1400066a0
or r14d, 2
mov dword [rsp + 0x50], r14d
mov eax, dword [r15 + 0x28]
and eax, 0x80008000
cmp eax, 0x80008000
jne 0x140018c35
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x120]
call fcn.140017b20
mov rcx, qword [rax]
inc dword [rcx + 0x30]
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x120]
call fcn.140017b20
mov rcx, qword [rax]
cmp dword [rcx + 0x30], 2
jne 0x140018c35
lea rdx, str.Attribute_Bypass_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, qword [rbp + 0x1b0]
mov rcx, rax
call fcn.140008ee0
lea rdx, str._at
mov rcx, rax
call fcn.1400064a0
lea rdx, ds:[rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rsi, qword [rsp + 0x48]
test dword [r15 + 0x28], 0x1000
je 0x140018d34
lea r8, ds:[rbp + 0x180]
cmp rsi, 7
seta bl
cmova r8, rdi
cmp r13, 8
jne 0x140018d34
mov rdx, r13
lea rax, str.Prefetch
mov rcx, rax
test r13, r13
je 0x140018c98
sub r8, rax
nop
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140018d34
add rcx, 2
sub rdx, 1
jne 0x140018c80
lea r8, [r15 + 8]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x10]
call fcn.1400177c0
mov rcx, qword [rax]
add rcx, 0x18
lea rax, [rbp + 0x180]
cmp rcx, rax
je 0x140018cee
lea rdx, [rbp + 0x180]
test bl, bl
cmovne rdx, rdi
mov r8, r13
call fcn.140007ce0
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x48], rax
mov r13, qword [rbp + 0x190]
mov rdi, qword [rbp + 0x180]
mov rcx, qword [r15 + 0x20]
movabs rax, 0x19db1ded53e8000
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
mul rcx
mov rbx, rdx
shr rbx, 0x17
lea r8, [r15 + 8]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x70]
call fcn.1400197c0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
mov rsi, qword [rsp + 0x48]
test dword ds:[r15 + 0x28], 0x2000
je 0x140018f05
lea r8, [r15 + 8]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp - 0x30]
call fcn.1400177c0
mov rcx, qword [rax]
add rcx, 0x18
lea rax, [rbp + 0x180]
cmp rcx, rax
je 0x140018d9f
lea rdx, ds:[rbp + 0x180]
cmp rsi, 7
cmova rdx, rdi
mov r8, r13
call fcn.140007ce0
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x48], rax
mov r13, qword [rbp + 0x190]
mov rdi, qword [rbp + 0x180]
movzx r8d, byte [r15 + 8]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [r15 + 9]
xor r8, rax
imul r8, rcx
movzx eax, byte [r15 + 0xa]
xor r8, rax
imul r8, rcx
movzx eax, byte [r15 + 0xb]
xor r8, rax
imul r8, rcx
movzx eax, byte [r15 + 0xc]
xor r8, rax
imul r8, rcx
movzx eax, byte [r15 + 0xd]
xor r8, rax
imul r8, rcx
movzx eax, byte [r15 + 0xe]
xor r8, rax
imul r8, rcx
movzx eax, byte [r15 + 0xf]
xor r8, rax
imul r8, rcx
mov r10, r8
mov r14, qword [rbp - 0x60]
and r10, r14
mov rax, r10
add rax, rax
mov rsi, qword [rbp - 0x78]
mov rcx, qword [rsi + rax*8 + 8]
mov rdx, rcx
mov r11, qword [rsp + 0x78]
cmp rcx, r11
je 0x140018e62
mov rax, r10
add rax, rax
mov r9, qword [rsi + rax*8]
mov rax, qword [r15 + 8]
cmp rax, qword [rcx + 0x10]
je 0x140018e65
nop dword [rax]
cmp rdx, r9
je 0x140018e62
mov rdx, qword [rdx + 8]
cmp rax, qword [rdx + 0x10]
jne 0x140018e50
nop
jmp 0x140018e65
mov rdx, r12
mov rax, r11
test rdx, rdx
cmovne rax, rdx
cmp rax, r11
je 0x140018f05
cmp rcx, r11
je 0x140018ea2
add r10, r10
mov rdx, qword [rsi + r10*8]
mov rax, qword [r15 + 8]
cmp rax, qword [rcx + 0x10]
je 0x140018ea5
nop
cmp rcx, rdx
je 0x140018ea2
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140018e90
nop
jmp 0x140018ea5
mov rcx, r12
test rcx, rcx
je 0x140018f05
and r8, r14
add r8, r8
lea rax, [rsi + r8*8]
mov rdx, qword [rsi + r8*8]
cmp qword [rax + 8], rcx
jne 0x140018ed9
nop
cmp rdx, rcx
jne 0x140018ecf
mov qword [rsi + r8*8], r11
mov qword [rax + 8], r11
jmp 0x140018ee5
mov r11, qword [rcx + 8]
mov qword [rax + 8], r11
jmp 0x140018ee5
cmp rdx, rcx
jne 0x140018ee5
mov rax, qword [rcx]
mov qword [rsi + r8*8], rax
mov rdx, qword [rcx]
dec qword [rbp - 0x80]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.140050f60
movzx ecx, byte [r15 + 8]
movabs r14, 0xcbf29ce484222325
xor rcx, r14
movabs rsi, 0x100000001b3
imul rcx, rsi
movzx eax, byte [r15 + 9]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [r15 + 0xa]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [r15 + 0xb]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [r15 + 0xc]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [r15 + 0xd]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [r15 + 0xe]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [r15 + 0xf]
xor rcx, rax
imul rcx, rsi
mov rdx, qword [rbp + 0x40]
and rdx, rcx
mov rax, rdx
add rax, rax
mov r8, qword [rbp + 0x28]
mov rcx, qword [r8 + rax*8 + 8]
mov r9, qword [rbp + 0x18]
cmp rcx, r9
je 0x140018fc2
add rdx, rdx
mov rdx, qword [r8 + rdx*8]
mov rax, qword [r15 + 8]
cmp rax, qword [rcx + 0x10]
je 0x140018fc5
nop dword [rax]
cmp rcx, rdx
je 0x140018fc2
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140018fb0
nop
jmp 0x140018fc5
mov rcx, r12
mov rax, r9
test rcx, rcx
cmovne rax, rcx
cmp rax, r9
je 0x1400191c5
movzx edx, byte [r15 + 8]
xor rdx, r14
imul rdx, rsi
movzx eax, byte [r15 + 9]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [r15 + 0xa]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [r15 + 0xb]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [r15 + 0xc]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [r15 + 0xd]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [r15 + 0xe]
xor rdx, rax
imul rdx, rsi
movzx eax, byte [r15 + 0xf]
xor rdx, rax
imul rdx, rsi
and rdx, qword [rbp]
mov rax, rdx
add rax, rax
mov r8, qword [rbp - 0x18]
mov rcx, qword [r8 + rax*8 + 8]
mov r9, qword [rbp - 0x28]
cmp rcx, r9
je 0x140019077
add rdx, rdx
mov r8, qword [r8 + rdx*8]
mov rax, qword [r15 + 8]
cmp rax, qword [rcx + 0x10]
je 0x14001907a
cmp rcx, r8
je 0x140019077
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140019066
jmp 0x14001907a
mov rcx, r12
mov rax, r9
test rcx, rcx
cmovne rax, rcx
cmp rax, r9
je 0x1400191c5
lea r8, ds:[r15 + 8]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x30]
call fcn.1400177c0
mov rbx, qword ds:[rax]
add rbx, 0x18
lea r8, [r15 + 8]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x10]
call fcn.1400177c0
mov rdx, qword [rax]
add rdx, 0x18
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x1400190da
mov rbx, qword [rbx]
mov rcx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x1400190e8
mov rdx, qword [rdx]
cmp rcx, rax
jne 0x140019118
test rcx, rcx
je 0x1400191c5
sub rdx, rbx
nop dword [rax]
movzx eax, word [rdx + rbx]
cmp ax, word [rbx]
jne 0x140019118
add rbx, 2
sub rcx, 1
jne 0x140019100
jmp 0x1400191c5
lea rdx, str.Prefetch_folder_renamed_to
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
mov rbx, rax
lea r8, [r15 + 8]
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x30]
call fcn.1400177c0
mov rdx, qword [rax]
add rdx, 0x18
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x14001915a
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.140008ee0
lea rdx, str._at
mov rcx, rax
call fcn.1400064a0
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [r15 + 8]
lea rcx, [rbp + 0x10]
call fcn.140017320
lea rdx, ds:[r15 + 8]
lea rcx, [rbp - 0x30]
call fcn.140017320
mov rbx, qword [rsp + 0x48]
test dword [r15 + 0x28], 0x200
je 0x14001925f
lea r8, [rbp + 0x180]
cmp rbx, 7
cmova r8, rdi
cmp r13, 8
jne 0x14001925f
mov rdx, r13
lea rax, str.Prefetch
mov rcx, rax
test r13, r13
je 0x140019216
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14001925f
add rcx, 2
sub rdx, 1
jne 0x140019202
lea rdx, str.Prefetch_folder_deleted_at:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp + 0x180]
cmp rbx, 7
jbe 0x140019274
mov rax, rdi
mov rcx, rdi
jmp 0x14001927e
mov rdi, rcx
lea rax, [rbp + 0x180]
lea rax, [rax + r13*2]
cmp rcx, rax
je 0x14001940f
nop dword [rax + rax]
cmp word [rdi], 0x7f
ja 0x1400192a5
add rdi, 2
cmp rdi, rax
jne 0x140019290
nop
jmp 0x14001940f
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
cmova rdx, qword [rbp + 0x1a0]
mov r8, r14
mov rax, qword [rbp + 0x1b0]
lea r9, [rax + rax]
mov rcx, r12
test r9, r9
je 0x1400192e5
movzx eax, byte [rcx + rdx]
xor r8, rax
imul r8, rsi
inc rcx
cmp rcx, r9
jb 0x1400192d2
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x50]
call fcn.140008e20
cmp rax, qword [rbp + 0x58]
jne 0x14001940f
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x50]
call fcn.140014a40
lea rdx, str.Unicode_characters_found_in_folder:_C:Windows_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rsi, rax
lea rbx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 7
jbe 0x140019354
mov rbx, qword [rbp + 0x1a0]
mov rcx, rbx
jmp 0x14001935b
lea rcx, [rbp + 0x1a0]
mov rdx, rbx
mov rax, qword [rbp + 0x1b0]
lea r14, [rcx + rax*2]
cmp rbx, r14
je 0x1400193c5
nop
movzx edi, word [rbx]
lfence
cmp di, 0x7f
jbe 0x1400193a9
mov edx, 0xc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx edx, di
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001b860
mov edx, 7
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x1400193b8
movzx edx, di
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14001b860
add rbx, 2
cmp rbx, r14
jne 0x140019370
lea rdx, str._at
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x160]
call fcn.1400058e0
mov eax, dword [r15]
mov edi, dword [rsp + 0x54]
sub edi, eax
mov dword [rsp + 0x54], edi
add r15, rax
lea rcx, [rbp + 0x1a0]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x180]
call fcn.1400058e0
test edi, edi
jne 0x1400188b0
mov rbx, qword [rbp - 0x40]
mov edi, dword [rsp + 0x40]
mov r14, qword [rbp - 0x38]
mov rax, qword [rbx]
mov qword [rbp + 0x1f8], rax
inc edi
mov dword [rsp + 0x40], edi
cmp edi, 0x1388
jge 0x1400194b0
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x10000
mov qword [rsp + 0x20], rbx
mov r9d, 0x28
lea r8, [rbp + 0x1f8]
mov edx, 0x900bb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140018890
mov rsi, qword ds:[rsp + 0x78]
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400195fe
nop dword [rax]
lea rdx, ds:[rdi + 0x18]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp + 0x1d0]
lea r8, str._Y__m__d__H:_M:_S
mov edx, 0x50
lea rcx, [rbp + 0x230]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_wcsftime]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
lea rax, [rbp + 0x230]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140019530
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x160]
call fcn.1400066a0
nop
lea rdx, str.Prefetch_folder_moved_at
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 7
cmova rdx, qword [rbp + 0x160]
mov r8, qword [rbp + 0x170]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x1400195ef
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400195ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001966f
call fcn.140050f60
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
jne 0x1400194d0
lea rcx, [rsp + 0x70]
call fcn.1400196a0
nop
lea rcx, [rbp - 0x30]
call fcn.140016d20
nop
lea rcx, [rbp + 0x10]
call fcn.140016d20
nop
lea rcx, [rbp + 0x120]
call fcn.140016ca0
nop
lea rcx, [rbp + 0x50]
call fcn.140007a60
nop
test rbx, rbx
je 0x140019645
mov rcx, rbx
call fcn.140050f60
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.140050f40
mov rbx, qword [rsp + 0x430]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140003f80
int3
nop dword [rax]
call fcn.140003ed0
int3