Function at 0x140041b90
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140071040]
xor rax, rsp
mov qword [rbp + 0x410], rax
movzx ebx, cl
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rbp + 0x160]
call fcn.140045860
test al, al
jne 0x14000f15e
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ad40
lea rdx, [0x14000dc80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140010013
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0xa0]
call fcn.1400066a0
nop
lea r8, [0x140050998]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x180]
call fcn.140007f80
cmp qword [rax + 0x18], 7
jbe 0x14000f1b4
mov rax, qword [rax]
lea rdx, ds:[rbp + 0x1c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x180]
call fcn.1400058e0
nop word [rax + rax]
cmp rsi, 0xffffffffffffffff
jne 0x14000f20e
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ad40
lea rdx, [0x14000dc80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140010007
test bl, bl
jne 0x14000f27e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_renamed_and_deleted_Prefetch_folders..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_Prefetch_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.1400080c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x40]
call fcn.140007ae0
nop
lea r14, str..EXE
mov rsi, qword [rbp + 0xb0]
mov rbx, qword [rsp + 0x48]
nop dword [rax + rax]
cmp dword [rbp + 0x1c0], 0x10
je 0x14000ffdb
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea rax, [rbp + 0x1ec]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000f2d0
lea rdx, [rbp + 0x1ec]
lea rcx, [rbp + 0x20]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
mov qword [rsp + 0x20], 4
mov r9, r14
xor r8d, r8d
mov rdx, qword [rbp + 0x30]
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
jne 0x14000f374
mov rdx, qword ds:[rbp + 0x38]
cmp rdx, 7
jbe 0x14000ffdb
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f36a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010075
call fcn.140048300
jmp 0x14000ffdb
mov r12, qword [rbp + 0x30]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r12
jb 0x140010086
lea r13, ds:[rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova r13, qword [rbp + 0xa0]
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rax, qword [rbp + 0x20]
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
lea r15, [r12 + rsi]
mov ebx, 7
lea r14, [rbp + 0x60]
cmp r15, rbx
jbe 0x14000f446
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14000f402
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x14000f429
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001008c
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rbp + 0x60], rax
mov rsi, qword [rbp + 0xb0]
mov edi, dword [rsp + 0x40]
mov qword ds:[rbp + 0x70], r15
mov qword [rbp + 0x78], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, qword [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memcpy
xor r13d, r13d
mov word [r14 + r15*2], r13w
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax]
cmp eax, 0xffffffff
je 0x14000f4f5
test al, 1
je 0x14000f4f5
lea rdx, str.____Prefetch_file_is_marked_as_read_only:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
mov rcx, rax
call fcn.140008ee0
lea rdx, str.._This_is_bannable.
mov rcx, rax
call fcn.1400064a0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x1d4]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
nop dword [rax + rax]
test eax, eax
jle 0x14000ff7b
mov r12, qword ds:[rbp + 0x30]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r12
jb 0x14001007c
lea r13, ds:[rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova r13, qword [rbp + 0xa0]
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rax, qword [rbp + 0x20]
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xor eax, eax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea r15, [rsi + r12]
mov ebx, 7
lea r14, [rbp + 0x80]
cmp r15, rbx
jbe 0x14000f629
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x14000f5e2
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x14000f609
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140010092
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rbp + 0x80], rax
mov rsi, qword [rbp + 0xb0]
mov edi, dword [rsp + 0x40]
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, qword [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memcpy
xor r13d, r13d
mov word [r14 + r15*2], r13w
bts edi, 7
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova r8, qword [rbp + 0x80]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r13 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
movabs r15, 0x7fffffffffffffff
cmp r14, r15
ja 0x1400100b2
lfence
cmp r14, 0xf
ja 0x14000f6f8
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 0xf
mov r8, r14
xor edx, edx
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + r14 + 0x40], r13b
jmp 0x14000f74a
mov rdi, r14
or rdi, 0xf
cmp rdi, r15
jbe 0x14000f70a
mov rdi, r15
jmp 0x14000f717
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, ds:[rdi + 1]
call fcn.1400069a0
mov rbx, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], rdi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov byte [r14 + rbx], 0
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rax, qword [rbp + 0x40]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova r8, qword [rbp + 0x80]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, ds:[rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14000e480
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x58]
jne 0x14000f95f
test rcx, rcx
je 0x14000f7fe
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f7ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001006e
call fcn.140048300
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000f839
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f834
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010046
call fcn.140048300
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x14000f88f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f88a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001004d
call fcn.140048300
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r13w
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14000f8ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f8ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010054
call fcn.140048300
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14000f94f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f94a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001005b
call fcn.140048300
mov rsi, qword [rbp + 0xb0]
mov edi, dword [rsp + 0x40]
jmp 0x14000ffcf
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000e980
nop
mov r15, qword [rbp - 0x70]
mov r12, qword [rbp - 0x68]
mov edi, dword [rsp + 0x40]
cmp r15, r12
je 0x14000ff09
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r13
lea rax, [rbp + 0x1ec]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000f9c0
lea rdx, [rbp + 0x1ec]
lea rcx, [rbp + 0x100]
call fcn.1400066a0
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
seta r10b
mov r9, qword [rbp + 0x100]
cmova rdx, r9
mov rsi, qword [rbp + 0x110]
test rsi, rsi
je 0x14000fa3b
mov rax, rsi
mov rcx, rdx
mov r8, r13
cmp word [rdx], 0x2d
je 0x14000fa2b
cmp rax, 1
je 0x14000fa2e
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x14000fa18
mov r8, rcx
test r8, r8
je 0x14000fa3b
sub r8, rdx
sar r8, 1
jmp 0x14000fa42
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x14000fa97
movups xmmword ds:[rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0x100]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0xe0]
call fcn.1400066a0
or edi, 0x40
lea rcx, [rbp + 0xe0]
or edi, 1
jmp 0x14000fb7b
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
lea r14, [rbp + 0x100]
test r10b, r10b
cmovne r14, r9
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x1400100ac
cmp rsi, 7
ja 0x14000faf5
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x14000fb71
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x14000fb14
mov rbx, rax
movabs rcx, 0x7fffffffffffffff
jmp 0x14000fb38
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400100a6
lfence
add rcx, rcx
call fcn.1400069a0
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x40]
lea rcx, [rbp + 0xc0]
or edi, 2
mov r8d, edi
mov edx, edi
mov r9d, edi
mov eax, edi
movups xmm0, xmmword [rcx]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
test al, 2
je 0x14000fbc2
and edi, 0xfffffffd
lea rcx, [rbp + 0xc0]
call fcn.1400058e0
mov edx, edi
mov r8d, edi
test dl, 1
je 0x14000fc2d
mov edi, r8d
and edi, 0xfffffffe
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x14000fc13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010067
call fcn.140048300
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r13w
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov rax, qword [r15 + 0x10]
cmp rax, 0x23
jb 0x14001009e
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x14000fc72
mov rdx, qword [r15]
add rdx, 0x46
lea rcx, [rbp + 0xe0]
call fcn.1400066a0
or edi, 0x10
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.14000ebc0
nop
lea r9, [rbp + 0xe0]
mov r8, rax
lea rcx, [rbp]
call fcn.140010540
or edi, 8
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x1a0]
call fcn.1400058e0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400058e0
lea r9, [rbp + 0x140]
cmp qword [rbp + 0x158], 7
cmova r9, qword [rbp + 0x140]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
mov rax, qword [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
je 0x14000fed5
lea rax, ds:[rbp]
cmp qword [rbp + 0x18], 7
cmova rax, qword [rbp]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0xc0], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140004d80
test al, al
jne 0x14000fe1c
mov rdx, qword [rbp + 0x10]
cmp rdx, 4
jb 0x14000fe20
lea rcx, ds:[rdx - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r13
cmp rdx, rcx
jb 0x140010098
lfence
mov rax, qword [rbp + 0x10]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp]
cmp qword [rbp + 0x18], 7
cmova rax, qword [rbp]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x120]
call fcn.1400066a0
mov edi, dword [rsp + 0x40]
or edi, 0x104
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 7
cmova r8, qword [rbp + 0x120]
cmp qword [rbp + 0x130], 4
jne 0x14000fe1c
mov edx, 4
lea rcx, str..EXE
mov rax, rcx
sub r8, rcx
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x14000fe1c
add rax, 2
sub rdx, 1
jne 0x14000fe00
mov bl, 1
mov rdx, qword [rbp + 0x10]
jmp 0x14000fe22
mov rdx, qword [rbp + 0x10]
xor bl, bl
test dil, 4
je 0x14000fe3f
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x120]
call fcn.1400058e0
mov rdx, qword [rbp + 0x10]
nop
test bl, bl
je 0x14000fed5
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
mov qword [rsp + 0x20], 0xb
lea r9, str.UnknownDisk
xor r8d, r8d
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
je 0x14000fe7d
lea rdx, str.___Executed_file:
jmp 0x14000fe91
lea rdx, [rbp]
call fcn.140046520
test al, al
jne 0x14000fec7
lea rdx, [0x140050cc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
mov r8, qword [rbp + 0x10]
cmova rdx, qword [rbp]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp]
lea rdx, [rbp - 0x58]
call fcn.140006140
nop
lea rcx, [rbp]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x140]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x100]
call fcn.1400058e0
add r15, 0x20
cmp r15, r12
jne 0x14000f990
lea rcx, [rbp - 0x70]
call fcn.14000a480
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000ff5e
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001006e
call fcn.140048300
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
lea rcx, [rbp + 0x40]
call fcn.140005960
nop
lea rcx, [rbp + 0x80]
call fcn.1400058e0
mov rsi, qword [rbp + 0xb0]
lea rcx, ds:[rbp + 0x60]
call fcn.1400058e0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14000ffcf
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010075
call fcn.140048300
lea r14, str..EXE
mov rbx, qword [rsp + 0x48]
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000f2a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp - 0x40]
call fcn.140007a60
nop
lea rcx, [rbp + 0xa0]
call fcn.1400058e0
mov rcx, qword ds:[rbp + 0x410]
xor rcx, rsp
call fcn.1400482e0
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call fcn.140003f80
nop
call fcn.140003f80
int3
call fcn.140003ed0
nop
call fcn.140003ed0
nop
call fcn.140007f60
nop
nop
call fcn.140007f60
nop
call fcn.140003ed0
int3
call fcn.140003f80
nop
call fcn.140003f80
int3
movzx ecx, dl
jmp 0x14000f0e0