Function at 0x140006730
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x140017048]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rsi, r8
mov qword [rsp + 0x50], r8
mov r12, rdx
mov qword [rsp + 0x58], rdx
mov r15, rcx
mov qword [rsp + 0x48], rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r8
xor r14d, r14d
mov rdi, qword [rcx + 0x18]
cmp rdi, 0x10
jb 0x140006790
mov rcx, qword [rcx]
mov rbx, qword [r15 + 0x10]
cmp rbx, 3
jne 0x140007000
mov r8, rbx
lea rdx, [0x140011aec]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007000
lea r8d, [rbx + 2]
lea rdx, str.Users
mov rcx, r15
call fcn.14000b180
mov rcx, qword [r15 + 0x10]
movabs r12, 0x7fffffffffffffff
mov rax, r12
sub rax, rcx
cmp rax, 2
jb 0x14000793f
mov r9, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400067f3
mov r9, qword [r15]
mov qword [rsp + 0x30], 2
lea rax, [0x140011adc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x70]
call fcn.14000dd30
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
lea rdx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov qword [rbp - 0x78], rax
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140006876
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006871
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
cmp r13, 0xffffffffffffffff
jne 0x14000694e
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x1400068cb
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x1400068c6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ff2
mov rcx, r8
call fcn.14000eda0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140006915
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140006910
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ff9
mov rcx, r8
call fcn.14000eda0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14000ed80
mov rbx, qword [rsp + 0x368]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, [0x1400118dc]
test byte [rbp + 0xc0], 0x10
je 0x140006f59
movzx ecx, byte [rbp + 0xec]
movzx eax, byte [rbp + 0xed]
cmp cl, 0x2e
jne 0x140006992
test al, al
je 0x140006f59
cmp cl, cl
jne 0x140006992
cmp al, cl
jne 0x140006992
cmp byte [rbp + 0xee], 0
je 0x140006f59
mov rcx, qword [r15 + 0x10]
mov rax, r12
sub rax, rcx
cmp rax, 1
jb 0x140007963
mov r9, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400069b3
mov r9, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.14000dd30
nop
lea rdx, [rbp + 0xec]
lea rcx, [rbp - 0x20]
call fcn.14000b0f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140006a48
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fc1
call fcn.14000eda0
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
mov rax, qword [rsp + 0x58]
mov rbx, qword [rax]
mov r14, qword [rax + 8]
mov rsi, qword [rbp + 0x78]
mov r15, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x60]
cmp rbx, r14
je 0x140006ab2
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140006a82
mov r9, qword [rbx]
lea rcx, [rbp + 0x60]
cmp rsi, 0x10
cmovae rcx, rdi
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov rdx, r15
call fcn.14000cb30
cmp rax, 0xffffffffffffffff
jne 0x140006f1a
add rbx, 0x20
cmp rbx, r14
jne 0x140006a75
mov rax, r12
sub rax, r15
cmp rax, 0xa
jb 0x14000795d
lea r9, [rbp + 0x60]
cmp rsi, 0x10
cmovae r9, rdi
mov qword [rsp + 0x30], 0xa
lea rax, str._Downloads
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea rcx, [rbp + 0x80]
call fcn.14000dd30
nop
mov rax, r12
mov rcx, qword [rbp + 0x70]
sub rax, rcx
cmp rax, 0xa
jb 0x140007957
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x30], 0xa
lea rax, str._Documents
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x40]
call fcn.14000dd30
nop
mov rax, r12
mov rcx, qword [rbp + 0x70]
sub rax, rcx
cmp rax, 8
jb 0x140007951
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0x10
cmovae r9, qword [rbp + 0x60]
mov qword [rsp + 0x30], 8
lea rax, str._Desktop
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xa0]
call fcn.14000dd30
nop
xor edi, edi
mov ebx, edi
mov dword [rsp + 0x44], ebx
mov r15, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x80]
mov qword [rsp + 0x70], rdx
mov r12, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x40]
mov qword [rsp + 0x68], rcx
mov r13, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x60], rax
jmp 0x140006bd2
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
test ebx, ebx
jne 0x140006c43
lea r9, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae r9, rdx
lea rcx, [rbp + 0x20]
cmp r15, 0xf
ja 0x140006c23
mov qword [rbp + 0x30], r15
mov r8, r15
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r15 + 0x20], bl
jmp 0x140006cdc
mov rdx, r15
call fcn.14000d640
mov r15, qword [rbp + 0x90]
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x70], rax
jmp 0x140006cdc
cmp ebx, 1
jne 0x140006c8d
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae r9, rcx
lea rcx, [rbp + 0x20]
cmp r12, 0xf
ja 0x140006c76
mov qword [rbp + 0x30], r12
mov r8, r12
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r12 + 0x20], 0
jmp 0x140006cdc
mov rdx, r12
call fcn.14000d640
mov r12, qword [rbp + 0x50]
mov rax, qword [rbp + 0x40]
mov qword [rsp + 0x68], rax
jmp 0x140006cdc
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0x10
cmovae r9, rax
lea rcx, [rbp + 0x20]
cmp r13, 0xf
ja 0x140006cc1
mov qword [rbp + 0x30], r13
mov r8, r13
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r13 + 0x20], 0
jmp 0x140006cdc
mov rdx, r13
call fcn.14000d640
mov r13, qword [rbp + 0xb0]
mov rax, qword [rbp + 0xa0]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x80], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.14000b290
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
lea r14, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
setae byte [rsp + 0x40]
mov rsi, qword [rbp + 0x20]
cmovae r14, rsi
mov rdi, qword [rbp + 0x30]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14000794b
mov qword [rbp - 8], 0xf
cmp rdi, 0x10
jae 0x140006d52
mov qword [rbp - 0x10], rdi
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x20], xmm0
jmp 0x140006de7
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140006d71
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140006d98
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006dba
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007945
mov rcx, rax
call fcn.14000ef24
mov rcx, rax
test rax, rax
je 0x140006fc8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006dc8
test rcx, rcx
je 0x140006dc6
call fcn.14000ef24
jmp 0x140006dc8
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
lea r8, [rdi + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [rsp + 0x44]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp - 0x20]
call fcn.140006730
nop
cmp byte [rsp + 0x40], 0
je 0x140006e36
mov rdx, qword [rbp + 0x38]
inc rdx
mov rax, rsi
cmp rdx, 0x1000
jb 0x140006e2e
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fcf
mov rcx, rsi
call fcn.14000eda0
inc ebx
mov dword [rsp + 0x44], ebx
cmp ebx, 3
jl 0x140006bc1
mov rax, qword [rbp + 0xb8]
cmp rax, 0x10
jb 0x140006e86
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fd6
call fcn.14000eda0
nop
mov rax, qword [rbp + 0x58]
cmp rax, 0x10
jb 0x140006ec4
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ebe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fdd
call fcn.14000eda0
nop
mov rax, qword [rbp + 0x98]
cmp rax, 0x10
jb 0x140006f04
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006eff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006fe4
call fcn.14000eda0
mov r13, qword [rbp - 0x78]
movabs r12, 0x7fffffffffffffff
mov rdi, qword [rbp + 0x60]
mov rsi, qword [rbp + 0x78]
cmp rsi, 0x10
jb 0x140006f51
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140006f49
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006feb
mov rcx, rdi
call fcn.14000eda0
xor r14d, r14d
mov r15, qword [rsp + 0x48]
lea rdx, [rbp + 0xc0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000694e
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x140006fa7
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140006fa2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ff2
mov rcx, r8
call fcn.14000eda0
mov qword [r15 + 0x10], r14
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rsi, qword [rsp + 0x50]
jmp 0x1400068db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rbx
cmp rax, 2
jb 0x140007969
mov r9, r15
cmp rdi, 0x10
jb 0x140007026
mov r9, qword [r15]
mov qword [rsp + 0x30], 2
lea rax, [0x140011adc]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea rcx, [rbp + 0x80]
call fcn.14000dd30
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0x10
cmovae rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r13, rax
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1400070b7
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400070b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000eda0
movdqa xmm0, xmmword [0x140011de0]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
cmp r13, 0xffffffffffffffff
jne 0x14000716c
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14000710e
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140007109
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000715e
mov rcx, r8
call fcn.14000eda0
xor ebx, ebx
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 0xf
mov byte [r15], bl
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140007155
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140007150
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007165
mov rcx, r8
call fcn.14000eda0
mov qword [rsi + 0x10], rbx
jmp 0x140006919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [0x1400118dc]
test byte [rbp + 0xc0], 0x10
je 0x14000734a
movzx ecx, byte [rbp + 0xec]
movzx eax, byte [rbp + 0xed]
cmp cl, 0x2e
jne 0x1400071b0
test al, al
je 0x1400076b5
cmp cl, cl
jne 0x1400071b0
cmp al, cl
jne 0x1400071b0
cmp byte [rbp + 0xee], 0
je 0x1400076b5
mov rcx, qword [r15 + 0x10]
mov rax, r14
sub rax, rcx
cmp rax, 1
jb 0x14000796f
mov r9, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400071d1
mov r9, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x40]
call fcn.14000dd30
nop
lea rdx, [rbp + 0xec]
lea rcx, [rbp + 0x40]
call fcn.14000b0f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor ebx, ebx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140007267
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007262
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007854
call fcn.14000eda0
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rbx, qword [r12]
mov r14, qword [r12 + 8]
cmp rbx, r14
je 0x1400072cf
mov rsi, qword [rbp - 8]
mov r15, qword [rbp - 0x10]
mov rdi, qword [rbp - 0x20]
mov r9, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14000729e
mov r9, qword [rbx]
lea rcx, [rbp - 0x20]
cmp rsi, 0x10
cmovae rcx, rdi
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov rdx, r15
call fcn.14000cb30
cmp rax, 0xffffffffffffffff
jne 0x14000730a
add rbx, 0x20
cmp rbx, r14
jne 0x140007291
mov rsi, qword [rsp + 0x50]
lea rax, [rbp - 0x50]
mov qword [rbp - 0x80], rax
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.14000b290
mov rbx, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14000b290
nop
mov r8, rbx
mov rdx, r12
mov rcx, rax
call fcn.140006730
mov rsi, qword [rbp - 8]
mov rdi, qword [rbp - 0x20]
cmp rsi, 0x10
jb 0x1400076b0
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000733d
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000785b
mov rcx, rdi
call fcn.14000eda0
jmp 0x1400076b0
mov rcx, qword [r15 + 0x10]
mov rax, r14
sub rax, rcx
cmp rax, 1
jb 0x140007939
mov r9, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14000736b
mov r9, qword [r15]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xa0]
call fcn.14000dd30
nop
lea rdx, [rbp + 0xec]
lea rcx, [rbp + 0xa0]
call fcn.14000b0f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor esi, esi
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
lea r8d, [rsi + 1]
lea rdx, [0x140011b24]
lea rcx, [rbp + 0x20]
call fcn.14000b180
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140007449
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007444
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007862
call fcn.14000eda0
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14000749a
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007869
call fcn.14000eda0
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
lea rdi, [rbp]
cmp qword [rbp + 0x18], 0x10
setae cl
mov r9, qword [rbp]
cmovae rdi, r9
mov rax, qword [rbp + 0x10]
add rdi, rax
lea rdx, [rbp]
test cl, cl
je 0x1400074dc
lea rbx, [rax + r9]
jmp 0x1400074e4
lea rbx, [rax + rdx]
lea r9, [rbp]
mov r8b, 0xa
mov rdx, rbx
mov rcx, r9
call fcn.14000e920
mov r10, rax
cmp rax, rbx
je 0x140007518
inc rax
cmp rax, rbx
je 0x140007518
movzx ecx, byte [rax]
cmp cl, 0xa
je 0x140007510
mov byte [r10], cl
inc r10
inc rax
cmp rax, rbx
jne 0x140007502
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
setae r8b
cmovae rcx, qword [rbp]
mov r9, r10
sub r9, rcx
sub rdi, r10
mov rbx, qword [rbp + 0x10]
mov rax, rbx
sub rax, r9
cmp rax, rdi
cmovb rdi, rax
lea rcx, [rbp]
test r8b, r8b
cmovne rcx, qword [rbp]
add rcx, r9
sub rbx, rdi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rdi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x10], rbx
lea rdx, [0x14001187c]
lea rcx, [rbp]
call fcn.14000aff0
cmp rax, 0xffffffffffffffff
je 0x140007670
lea rcx, [rax + 1]
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], rsi
cmp rbx, rcx
jb 0x140007933
sub rbx, rcx
mov r8, 0xffffffffffffffff
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
add rdx, rcx
lea rcx, [rbp + 0x40]
call fcn.14000cd80
mov rbx, qword [0x140017e30]
mov r14, qword [0x140017e38]
mov rsi, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x40]
cmp rbx, r14
je 0x140007638
cmp rsi, 0x10
setae r12b
mov r15, qword [rbp + 0x50]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x40]
cmp rsi, 0x10
cmovae rdx, rdi
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140007619
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, r15
jne 0x14000762f
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400076e1
add rbx, 0x20
cmp rbx, r14
jne 0x140007600
cmp rsi, 0x10
jb 0x140007670
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140007667
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007877
mov rcx, rdi
call fcn.14000eda0
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400076ab
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400076a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000787e
call fcn.14000eda0
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x48]
lea rdx, [rbp + 0xc0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140007885
movabs r14, 0x7fffffffffffffff
mov rsi, qword [rsp + 0x50]
jmp 0x14000716c
test r12b, r12b
je 0x140007717
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000770f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007877
mov rcx, rdi
call fcn.14000eda0
lea rdx, [rbp]
call fcn.1400028b0
test al, al
jne 0x140007670
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
lea rcx, [0x140017d10]
call fcn.14000e010
mov rcx, rax
call fcn.14000c690
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xor edx, edx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rdx
lea rsi, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rsi, qword [rbp]
mov rdi, qword [rbp + 0x10]
movabs r14, 0x7fffffffffffffff
cmp rdi, r14
ja 0x14000797b
mov qword [rbp - 8], 0xf
cmp rdi, 0x10
jae 0x1400077a2
mov qword [rbp - 0x10], rdi
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x20], xmm0
jmp 0x140007830
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400077c1
mov rbx, r14
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400077e8
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140007806
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140007975
mov rcx, rax
call fcn.14000ef24
mov rcx, rax
test rax, rax
je 0x140007870
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140007815
test rcx, rcx
je 0x140007812
call fcn.14000ef24
jmp 0x140007815
mov rax, rdx
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x20]
call fcn.140005250
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.14000b290
mov rcx, rax
call fcn.140005a90
jmp 0x140007670
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x1400078c5
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x1400078c0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007925
mov rcx, r8
call fcn.14000eda0
xor edi, edi
mov qword [r15 + 0x10], rdi
mov qword [r15 + 0x18], 0xf
mov byte [r15], dil
mov rbx, qword [rsp + 0x50]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140007911
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000790c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000792c
mov rcx, r8
call fcn.14000eda0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x140006924
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000c400
nop
call fcn.1400016f0
int3
call fcn.1400016f0
nop
call fcn.140001650
int3
call fcn.1400016f0
nop
call fcn.1400016f0
nop
call fcn.1400016f0
nop
call fcn.1400016f0
nop
call fcn.1400016f0
int3
call fcn.1400016f0
int3
call fcn.1400016f0
nop
call fcn.140001650
int3
call fcn.1400016f0
int3