Function at 0x14004a870
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x480]
sub rsp, 0x580
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rbp + 0x470], rax
movzx ebx, cl
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rbp + 0x1d8]
call fcn.14004e4c0
test al, al
jne 0x1400134be
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140014928
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r13
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0x100]
call fcn.1400066a0
nop
lea r8, [0x140059610]
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x1f8]
call fcn.140007f80
cmp qword [rax + 0x18], 7
jbe 0x140013514
mov rax, qword [rax]
lea rdx, ds:[rbp + 0x220]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x1f8]
call fcn.1400058e0
nop word [rax + rax]
cmp rsi, 0xffffffffffffffff
jne 0x14001356e
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001491c
test bl, bl
jne 0x1400135ca
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_Prefetch_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x20]
call fcn.140007ae0
nop
lea r14, str..EXE
mov rsi, qword [rbp + 0x110]
mov rbx, qword [rsp + 0x48]
nop word [rax + rax]
cmp dword [rbp + 0x220], 0x10
je 0x1400143bb
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], r13
lea rax, [rbp + 0x24c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140013623
lea rdx, ds:[rbp + 0x24c]
lea rcx, [rbp + 0x80]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rcx, qword [rbp + 0x80]
mov qword [rsp + 0x20], 4
mov r9, r14
xor r8d, r8d
mov rdx, qword [rbp + 0x90]
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
jne 0x1400136d4
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x1400143bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400136ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014475
call fcn.140050f60
jmp 0x1400143bb
mov r12, qword [rbp + 0x90]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r12
jb 0x140014958
lea r13, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r13, qword [rbp + 0x100]
lea rax, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rax, qword [rbp + 0x80]
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xor eax, eax
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
lea r15, [rsi + r12]
mov ebx, 7
lea r14, [rbp + 0xe0]
cmp r15, rbx
jbe 0x1400137ba
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x140013774
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x140013798
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001495e
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rbp + 0xe0], rax
mov rsi, qword [rbp + 0x110]
mov edi, dword [rsp + 0x40]
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + rbx]
lea r8, [r12 + r12]
mov rdx, qword [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memcpy
xor r13d, r13d
mov word [r14 + r15*2], r13w
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rcx, qword [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001386d
nop
test al, 1
je 0x14001386d
lea rdx, str.Prefetch_file_is_marked_as_read_only:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x234]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x1e8]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, ds:[rsp + 0x70]
lea rcx, [rbp + 0x1d8]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x14001435b
mov r12, qword [rbp + 0x90]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r12
jb 0x14001498c
lea r13, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
cmova r13, qword [rbp + 0x100]
lea rax, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rax, qword [rbp + 0x80]
mov qword [rbp + 0xa0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor eax, eax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
lea r15, [rsi + r12]
mov ebx, 7
lea r14, [rbp + 0x20]
cmp r15, rbx
jbe 0x140013997
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x140013954
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x140013978
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140014966
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rbp + 0x20], rax
mov rsi, qword [rbp + 0x110]
mov edi, dword [rsp + 0x40]
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r14 + rbx]
lea r8, [r12 + r12]
mov rdx, qword [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memcpy
xor r13d, r13d
mov word [r14 + r15*2], r13w
bts edi, 7
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r8, qword [rbp + 0x20]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r13 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
movabs r15, 0x7fffffffffffffff
cmp r14, r15
ja 0x140014986
lfence
cmp r14, 0xf
ja 0x140013a6f
mov qword ds:[rbp + 0xd0], r14
mov qword [rbp + 0xd8], 0xf
mov r8, r14
xor edx, edx
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + r14 + 0xc0], r13b
jmp 0x140013ac2
mov rdi, r14
or rdi, 0xf
cmp rdi, r15
jbe 0x140013a82
mov rdi, r15
jmp 0x140013a8f
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
call fcn.1400069a0
mov rbx, rax
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], rdi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + r14], 0
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rax, qword [rbp + 0xc0]
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r8, qword [rbp + 0x20]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.14000fe00
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x58]
jne 0x140013cff
test rcx, rcx
je 0x140013b7e
mov rdx, qword ds:[rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001446e
call fcn.140050f60
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140013bcf
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013bca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001443c
call fcn.140050f60
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140013c2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013c2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014447
call fcn.140050f60
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r13w
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x140013c8f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013c8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001444e
call fcn.140050f60
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r13w
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x140013cef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014455
call fcn.140050f60
mov rsi, qword [rbp + 0x110]
mov edi, dword [rsp + 0x40]
jmp 0x1400143af
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.140010300
nop
mov r15, qword [rbp + 0x120]
mov r12, qword [rbp + 0x128]
mov edi, dword [rsp + 0x40]
cmp r15, r12
je 0x1400142d6
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], r13
lea rax, [rbp + 0x24c]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013d60
lea rdx, [rbp + 0x24c]
lea rcx, [rbp + 0x158]
call fcn.1400066a0
nop
lea rdx, [rbp + 0x158]
cmp qword [rbp + 0x170], 7
seta r10b
mov r9, qword [rbp + 0x158]
cmova rdx, r9
mov rsi, qword [rbp + 0x168]
test rsi, rsi
je 0x140013ddb
mov rax, rsi
mov rcx, rdx
mov r8, r13
cmp word [rdx], 0x2d
je 0x140013dcb
cmp rax, 1
je 0x140013dce
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x140013db8
mov r8, rcx
test r8, r8
je 0x140013ddb
sub r8, rdx
sar r8, 1
jmp 0x140013de2
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x140013e25
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0x158]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0x40]
call fcn.1400066a0
or edi, 0x40
lea rax, [rbp + 0x40]
or edi, 1
jmp 0x140013f0a
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
lea r14, [rbp + 0x158]
test r10b, r10b
cmovne r14, r9
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x14001497e
nop dword [rax + rax]
cmp rsi, 7
ja 0x140013e85
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xa0], xmm0
jmp 0x140013f00
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x140013ea2
mov rbx, rax
movabs rcx, 0x7fffffffffffffff
jmp 0x140013ec9
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140014978
lfence
add rcx, rcx
call fcn.1400069a0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x40]
lea rax, [rbp + 0xa0]
or edi, 2
mov edx, edi
mov ecx, edi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x138], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x148], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
test cl, 2
je 0x140013fa9
and edi, 0xfffffffd
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x140013f8f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013f8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001445c
call fcn.140050f60
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r13w
test dil, 1
je 0x140014003
and edi, 0xfffffffe
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140013ff2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013fed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014467
call fcn.140050f60
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r13w
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
mov rax, qword [r15 + 0x10]
cmp rax, 0x23
jb 0x140014972
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x140014049
mov rdx, qword [r15]
add rdx, 0x46
lea rcx, [rbp + 0x40]
call fcn.1400066a0
or edi, 8
mov rdx, r15
lea rcx, [rbp + 0x198]
call fcn.140012f20
nop
lea r9, [rbp + 0x40]
mov r8, rax
lea rcx, [rbp + 0x60]
call fcn.140015400
or edi, 0x10
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x198]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x40]
call fcn.1400058e0
lea r9, [rbp + 0x138]
cmp qword [rbp + 0x150], 7
cmova r9, qword [rbp + 0x138]
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rcx, qword [rbp + 0x60]
mov rax, qword [rbp + 0x148]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x70]
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
je 0x1400142a6
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rax, qword [rbp + 0x60]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x70]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0xa0], xmm0
lea rcx, [rbp + 0xa0]
call fcn.140004d80
test al, al
jne 0x1400141e2
mov rdx, qword ds:[rbp + 0x70]
cmp rdx, 4
jb 0x1400141e6
lea rcx, [rdx - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], r13
cmp rdx, rcx
jb 0x14001496c
lfence
mov rax, qword [rbp + 0x70]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rax, qword [rbp + 0x60]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x178]
call fcn.1400066a0
mov edi, dword [rsp + 0x40]
or edi, 0x104
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x178]
cmp qword [rbp + 0x190], 7
cmova r8, qword [rbp + 0x178]
cmp qword [rbp + 0x188], 4
jne 0x1400141e2
mov edx, 4
lea rcx, str..EXE
mov rax, rcx
sub r8, rcx
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1400141e2
add rax, 2
sub rdx, 1
jne 0x1400141c6
mov bl, 1
mov rdx, qword [rbp + 0x70]
jmp 0x1400141e8
mov rdx, qword [rbp + 0x70]
xor bl, bl
test dil, 4
je 0x140014209
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x178]
call fcn.1400058e0
mov rdx, qword [rbp + 0x70]
test bl, bl
je 0x1400142a6
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rcx, qword [rbp + 0x60]
mov qword [rsp + 0x20], 0xb
lea r9, str.UnknownDisk
xor r8d, r8d
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
je 0x140014246
lea rdx, [0x140059720]
jmp 0x14001425a
lea rdx, [rbp + 0x60]
call fcn.14004f180
test al, al
jne 0x140014295
lea rdx, [0x14005a338]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, ds:[rbp + 0x60]
cmp qword [rbp + 0x78], 7
mov r8, qword [rbp + 0x70]
cmova rdx, qword [rbp + 0x60]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, ds:[rbp + 0x60]
lea rdx, [rbp - 0x30]
call fcn.140006140
nop
lea rcx, [rbp + 0x60]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x138]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x158]
call fcn.1400058e0
add r15, 0x20
cmp r15, r12
jne 0x140013d30
lea rcx, ds:[rbp + 0x120]
call fcn.14000a480
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001433e
mov rdx, qword ds:[rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001432a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001446e
call fcn.140050f60
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
lea rcx, [rbp + 0xc0]
call fcn.140005960
nop
lea rcx, [rbp + 0x20]
call fcn.1400058e0
mov rsi, qword [rbp + 0x110]
lea rcx, [rbp + 0xe0]
call fcn.1400058e0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x1400143af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400143aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140014475
call fcn.140050f60
lea r14, str..EXE
mov rbx, qword [rsp + 0x48]
lea rdx, [rbp + 0x220]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400135f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, str..c:
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001447c
lea rdx, str.Failed_to_open_volume
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000d280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140014912
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xorps xmm0, xmm0
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm0
movups xmmword [rbp + 0x1b8], xmm0
movups xmmword [rbp + 0x1c8], xmm0
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x40
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900f4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movups xmm0, xmmword [rbp + 0x198]
movaps xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rbp + 0x1a8]
movaps xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rbp + 0x1b8]
movaps xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp + 0x1c8]
movaps xmmword [rbp - 0x40], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, 0x13
lea rdx, str.C:WindowsPrefetch
lea rcx, [rbp + 0x40]
call fcn.1400066a0
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rcx, qword [rbp + 0x40]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea r9d, [rax + 0x18]
lea r8, [rbp + 0x120]
lea edx, [rax + 0x12]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x1400145cc
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400145c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400145c7
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
mov r8, qword [rbp + 0x128]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.140015cc0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8d, 0xa
lea rdx, str.C:Windows
lea rcx, [rbp + 0x40]
call fcn.1400066a0
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rcx, qword [rbp + 0x40]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea r9d, [rax + 0x18]
lea r8, [rbp + 0x120]
lea edx, [rax + 0x12]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x1400146b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400146ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400146ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
mov r8, qword [rbp + 0x128]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.140018660
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8d, 0x13
lea rdx, str.C:WindowsPrefetch
lea rcx, [rbp + 0x20]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140014750
test al, 2
je 0x140014750
lea rdx, str.Prefetch_folder_is_marked_as_hidden:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.1400064a0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x140014793
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001478e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001478e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8d, 0x13
lea rdx, str.C:WindowsPrefetch
lea rcx, [rbp + 0x20]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140014816
test al, 4
je 0x140014816
lea rdx, str.Prefetch_folder_is_marked_as_system:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, ds:[rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword ds:[rbp + 0x38]
cmp rdx, 7
jbe 0x14001485f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001485a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001485a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
nop
call fcn.140010a20
call fcn.140010d20
call fcn.140011020
call fcn.140011be0
xorps xmm0, xmm0
movups xmmword [rbp + 0x138], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x148], xmm1
mov r8d, 7
lea rdx, [0x14005a3a8]
lea rcx, [rbp + 0x138]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x138]
call fcn.1400128e0
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 7
jbe 0x14001490c
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword ds:[rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014907
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014907
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140050f60
call fcn.140012cc0
nop
lea rcx, [rbp - 0x20]
call fcn.140007a60
nop
lea rcx, [rbp + 0x100]
call fcn.1400058e0
mov rcx, qword [rbp + 0x470]
xor rcx, rsp
call fcn.140050f40
lea r11, [rsp + 0x580]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003f80
nop
nop
call fcn.140003ed0
nop
call fcn.140003ed0
nop
call fcn.140007f60
nop
call fcn.140007f60
nop
call fcn.140003ed0
int3
nop
call fcn.140003f80
nop
call fcn.140003f80
nop
call fcn.140003f80
int3
movzx ecx, dl
jmp 0x140013440