Function at 0x1400011c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov r13, rdx
mov qword [rsp + 0x58], rdx
mov r15, rcx
mov rsi, qword [rcx + 0x10]
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
sub rax, rsi
cmp rax, 4
jb 0x140001a5e
mov r12, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140001226
mov r12, qword [rcx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
lea r14, [rsi + 4]
mov ebx, 0xf
lea rdi, [rbp - 0x60]
movabs rax, 0x8000000000000000
lea ecx, [rbx + 7]
cmp r14, rbx
jbe 0x1400012be
mov rbx, r14
or rbx, 0xf
cmp rbx, rdx
jbe 0x140001286
mov rbx, rdx
add rax, 0x27
mov rcx, rax
call fcn.140002270
test rax, rax
je 0x1400015d2
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400012ba
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400012a9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a52
jmp 0x140001267
test rcx, rcx
je 0x1400012b8
call fcn.140002270
mov rdi, rax
jmp 0x1400012ba
xor edi, edi
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], rbx
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + rsi], 0x2a2e2a5c
mov byte [rdi + r14], 0
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0x10
cmovae rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x140001592
mov r12, 0xffffffffffffffff
mov rbx, rax
test byte [rbp - 0x20], 0x10
je 0x1400015d9
movzx edx, byte [rbp + 0xc]
movzx ecx, byte [rbp + 0xd]
cmp dl, 0x2e
jne 0x140001342
test cl, cl
je 0x140001574
cmp dl, dl
jne 0x140001342
cmp cl, dl
jne 0x140001342
cmp byte [rbp + 0xe], 0
je 0x140001574
mov rsi, qword [r15 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x140001a4c
mov r13, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14000136d
mov r13, qword [r15]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea r14, [rsi + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x38]
cmp r14, rbx
jbe 0x14000140b
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400013b3
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400013da
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400013f9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a6a
mov rcx, rax
call fcn.140002270
test rax, rax
je 0x1400016ef
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001406
test rcx, rcx
je 0x140001403
call fcn.140002270
mov rdi, rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rbx
mov r8, rsi
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0x5c
mov byte [rdi + r14], 0
lea rax, [rbp + 0xc]
mov rdi, r12
inc rdi
cmp byte [rax + rdi], 0
jne 0x140001433
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x140001486
lea rax, [rcx + rdi]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8, rdi
lea rdx, [rbp + 0xc]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x38]
jmp 0x14000149c
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0xc]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140001e80
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xor ebx, ebx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140001507
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400016f6
call fcn.1400022b4
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov r13, qword [rsp + 0x58]
mov rdx, r13
lea rcx, [rbp - 0x40]
call fcn.1400011c0
nop
mov rdx, qword [rbp - 0x28]
test al, al
jne 0x1400016fd
cmp rdx, 0x10
jb 0x14000156f
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000156a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000172f
call fcn.1400022b4
mov rbx, qword [rsp + 0x30]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001311
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor bl, bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140001a1f
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rax, [rbp + 0xc]
mov r8, r13
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400015f6
inc rax
test ecx, ecx
jne 0x1400015e3
test edx, edx
jne 0x140001574
lea rdx, str.Blacklisted_Program_Found_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Please_Uninstall_the_following_file_to_use_this_loader:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
mov qword [rsp + 0x58], rax
mov r14, qword [r15 + 0x10]
movabs rdx, 0x7fffffffffffffff
mov rcx, rdx
sub rcx, r14
cmp rcx, 1
jb 0x140001a64
cmp qword [r15 + 0x18], 0x10
jb 0x140001684
mov r15, qword [r15]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x60]
cmp rsi, rbx
jbe 0x140001784
mov rbx, rsi
or rbx, 0xf
cmp rbx, rdx
jbe 0x140001742
mov rbx, rdx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002270
test rax, rax
je 0x1400018ef
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000177f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp rdx, 0x10
jb 0x140001a13
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001736
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001736
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022b4
mov bl, 1
jmp 0x140001594
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000176e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a58
jmp 0x1400016cd
test rcx, rcx
je 0x14000177d
call fcn.140002270
mov rdi, rax
jmp 0x14000177f
xor edi, edi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
mov r8, r14
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0x5c
mov byte [rdi + rsi], 0
inc r12
cmp byte [r12 + r13], 0
jne 0x1400017a5
mov rcx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov rax, r8
sub rax, rcx
cmp r12, rax
ja 0x1400017f9
lea rax, [rcx + r12]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp r8, 0x10
cmovae rbx, qword [rsp + 0x60]
add rbx, rcx
mov r8, r12
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r12], 0
lea rax, [rsp + 0x60]
jmp 0x14000180e
mov qword [rsp + 0x20], r12
mov r9, r13
mov rdx, r12
lea rcx, [rsp + 0x60]
call fcn.140001e80
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
mov rcx, qword [rsp + 0x58]
call fcn.140002080
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400018aa
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022b4
movdqa xmm0, xmmword [0x140004490]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400018fb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400022b4
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Imperc_Permanent_Spoofer_V2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400043d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001c70
lea rdx, [0x140001e40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov bl, 1
jmp 0x140001594
call fcn.1400022b4
movzx eax, bl
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140002250
mov rbx, qword [rsp + 0x280]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
nop
call fcn.1400011a0
int3
call fcn.140001100
int3