Function at 0x1400210c0
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x598]
sub rsp, 0x698
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rbp + 0x580], rax
mov qword [rsp + 0x50], r9
mov rbx, r8
mov r14, rdx
mov qword [rsp + 0x58], rdx
mov r15, rcx
mov qword [rsp + 0x60], rcx
mov rax, qword [rbp + 0x600]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x608]
mov qword [rsp + 0x48], rax
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.1400a3e30
nop
mov edx, 1
mov rcx, r15
call fcn.1400a4230
mov edx, 0x104
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0x360]
call fcn.1400c9bc0
xor r13d, r13d
mov ecx, r13d
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x360]
mov byte [rbp + rcx + 0x250], al
inc rcx
test al, al
jne 0x140021170
lea rdi, [rbp + 0x250]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [0x1401eefbc]
mov dword [rdi - 1], eax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x1400213a9
nop dword [rax]
test byte [rbp - 0x30], 0x10
je 0x14002138b
lea rsi, [rbp - 4]
lea rdi, [0x1401ee614]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x14002138b
lea rsi, [rbp - 4]
lea rdi, [0x1401eefb8]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x14002138b
mov edx, 0x104
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp + 0x360]
call fcn.1400c9bc0
lea rdi, [rbp + 0x360]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rbp - 4]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140021230
lea rcx, [rbp + 0x360]
call fcn.1400c9bc0
mov rdx, r13
nop
movzx eax, byte [rbp + rdx + 0x360]
mov byte [rbp + rdx + 0x250], al
inc rdx
test al, al
jne 0x140021250
lea rdi, [rbp + 0x250]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.microsoft..32.dll]
mov qword [rdi - 1], rax
mov rax, qword [0x1401eefa8]
mov qword [rdi + 7], rax
mov eax, dword [0x1401eefb0]
mov dword [rdi + 0xf], eax
movzx eax, byte [0x1401eefb4]
mov byte [rdi + 0x13], al
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x250]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14002138b
nop
test byte [rbp + 0x110], 0x10
jne 0x14002136a
cmp byte [rbp + 0x13c], 0x2e
je 0x14002136a
mov rcx, r13
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x360]
mov byte [rbp + rcx + 0x250], al
inc rcx
test al, al
jne 0x1400212e0
lea rdi, [rbp + 0x250]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rbp + 0x13c]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140021310
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x250]
repne scasb al, byte [rdi]
not rcx
call fcn.14010a204
mov rdi, rax
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x250]
sub rax, rcx
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
inc rdx
test cl, cl
jne 0x140021350
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400a3e60
lea rdx, [rbp + 0x110]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400212c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rbp - 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400211c0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov edx, 0x104
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rcx, [rbp + 0x360]
call fcn.1400c9bc0
test rbx, rbx
je 0x140021490
mov rdx, qword [rbx]
test rdx, rdx
je 0x140021490
nop dword [rax]
mov rcx, r13
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x360]
mov byte [rbp + rcx + 0x250], al
inc rcx
test al, al
jne 0x1400213f0
lea rdi, [rbp + 0x250]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x140021420
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x250]
repne scasb al, byte [rdi]
not rcx
call fcn.14010a204
mov rdi, rax
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x250]
sub rax, rcx
nop word [rax + rax]
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
inc rdx
test cl, cl
jne 0x140021460
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400a3e60
add rbx, 8
mov rdx, qword [rbx]
test rdx, rdx
jne 0x1400213e0
nop word [rax + rax]
lea rcx, [rsp + 0x68]
call fcn.1400a4180
test eax, eax
je 0x1400215c7
test r13d, r13d
jle 0x1400214b2
mov ecx, SafeArrayGetElement
call qword [sym.imp.KERNEL32.dll_Sleep]
inc r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rsp + 0x68]
call fcn.1400a41d0
mov rdi, rax
test rax, rax
je 0x1400215bd
xor r13d, r13d
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400a41e0
mov r12, rax
mov rcx, rdi
call fcn.1400a39b0
mov rsi, rax
test rax, rax
je 0x14002159c
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400215ac
mov byte [rbp + 0x250], r13b
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x70]
mov r8d, 0x104
lea rdx, [rbp + 0x250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [rbp + 0x250], 0x4d
jne 0x14002156c
cmp byte [rbp + 0x251], 0x5a
je 0x140021594
mov byte [rbp + 0x353], r13b
mov rdx, r14
lea rcx, [rbp + 0x250]
call fcn.14010d30c
test rax, rax
je 0x140021594
mov rdx, rsi
mov rcx, r15
call fcn.1400a3e60
jmp 0x14002159c
mov rcx, rsi
call fcn.14010d304
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.1400a40a0
mov rdi, r12
test r12, r12
jne 0x1400214d3
mov r13d, dword [rsp + 0x40]
cmp r13d, 0x32
jl 0x140021490
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.1400a4230
mov r13, qword [rsp + 0x50]
test r13, r13
je 0x140021923
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140021923
mov rcx, r15
call fcn.1400a4180
cmp eax, 1
jbe 0x140021923
mov rcx, r15
call fcn.1400a41d0
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140021923
nop dword [rax]
mov rdx, rbx
mov rcx, r15
call fcn.1400a41e0
mov r12, rax
mov qword [rbp - 0x68], rax
mov rcx, rbx
call fcn.1400a39b0
mov rsi, rax
mov qword [rbp - 0x58], rax
test rax, rax
je 0x14002190d
mov byte [rbp + 0x470], 0
mov ecx, 0x148
call fcn.1400854f0
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14002167e
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.1400994e0
mov rdi, rax
xor ecx, ecx
jmp 0x140021682
xor ecx, ecx
mov edi, ecx
test rdi, rdi
je 0x140021710
mov rax, qword [rdi]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp + 0x470]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8, r13
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x10]
cmp byte [rbp + 0x470], 0
jne 0x140021703
mov rax, qword [rdi]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp + 0x470]
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8, qword [rbp - 0x60]
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x10]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp byte [rbp + 0x470], 0
je 0x1400218f2
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14002174a
lea rcx, [rbp - 0x48]
call rax
nop
xor edi, edi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
lea rcx, [rbp + 0x470]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400218b3
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x8000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r13, rax
test rax, rax
je 0x14002189c
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
test rax, rax
je 0x140021885
lea edx, [rdi + 0x5c]
mov rcx, rsi
call fcn.14010db4c
mov rbx, rax
test rax, rax
je 0x1400217e7
inc rbx
jmp 0x1400217ea
mov rbx, rsi
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
mov r12, rcx
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
sub rsi, r12
mov rdi, r15
je 0x140021855
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.14010fbe0
test eax, eax
jne 0x14002184d
cmp rsi, 0x104
jbe 0x14002184d
add rdi, 0x20
sub rsi, 0x20
cmp byte [rdi], al
jne 0x14002184d
lea rdx, [rdi + 1]
mov r8d, 0x80
mov rcx, rdi
call fcn.14010fbe0
test eax, eax
je 0x140021855
inc rdi
dec rsi
jne 0x140021810
movzx eax, byte [rbp + 0x470]
test rsi, rsi
mov ecx, 0
cmove eax, ecx
mov byte [rbp + 0x470], al
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rsi, qword [rbp - 0x58]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rbp - 0x68]
jmp 0x14002188c
mov byte [rbp + 0x470], dil
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x60]
jmp 0x1400218a3
mov byte [rbp + 0x470], dil
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rsp + 0x50]
jmp 0x1400218ba
mov byte [rbp + 0x470], dil
cmp qword [rbp - 0x50], 0
je 0x1400218e9
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400218e9
mov rcx, qword [rbp - 0x48]
call rax
cmp byte [rbp + 0x470], 0
jne 0x140021908
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call fcn.1400a40a0
mov rcx, rsi
call fcn.14010d304
mov rdi, qword [rsp + 0x48]
mov rbx, r12
mov qword [rsp + 0x40], rbx
test r12, r12
mov r14, qword [rsp + 0x58]
jne 0x140021620
mov rcx, r15
call fcn.1400a4180
mov edi, eax
lea rcx, [rsp + 0x68]
call fcn.1400a4630
mov eax, edi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14010d170
add rsp, 0x698
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret