Function at 0x1400083b0
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get disk information
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x9b0
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, 2
lea r13, [0x14002ff70]
mov r14d, 0x142
mov r12d, eax
nop
bt r12d, ebx
jae 0x140008915
lea rcx, [rsp + 0x8a1]
xor edx, edx
mov r8d, 0x105
mov byte [rsp + 0x8a0], 0
call sub.msvcrt.dll_memset
cmp byte [0x14002ff70], 0
jne 0x140008434
mov edx, 0x104
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [0x140030078], eax
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rcx + r13]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x89f], al
jne 0x140008440
lea rcx, [rsp + 0x131]
xor edx, edx
mov r8d, 0x104
call sub.msvcrt.dll_memset
lea edx, [rbx + 0x41]
lea rcx, [rsp + 0x130]
mov byte [rsp + 0x130], dl
mov byte [rsp + 0x131], 0x3a
mov byte [rsp + 0x132], 0x5c
mov byte [rsp + 0x133], 0
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x1400084a7
cmp eax, 3
jne 0x140008915
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x130]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x130]
mov qword [rsp + 0x380], 0xffffffffffffffff
not rcx
mov byte [rsp + 0x388], 0
mov byte [rsp + 0x750], 0
sub rcx, 1
mov byte [rsp + 0x60c], 0
cmp ecx, 0x143
cmovge ecx, r14d
movsxd rdi, ecx
lea rcx, [rsp + 0x750]
mov r8, rdi
call sub.msvcrt.dll_memcpy
or rcx, 0xffffffffffffffff
mov byte [rsp + rdi + 0x750], 0
xor eax, eax
lea rdi, [rsp + 0x750]
repne scasb al, byte [rdi]
not rcx
add rcx, 3
cmp rcx, 0x143
jae 0x1400085af
lea rcx, [rsp + 0x750]
nop
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rcx - 0x3c9], al
jne 0x140008540
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x388]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x140008594
movsxd rax, ecx
cmp byte [rsp + rax + 0x387], 0x5c
je 0x140008594
xor eax, eax
lea rdi, [rsp + 0x388]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x388]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [0x140027f10]
mov dword [rdi - 1], eax
jmp 0x1400085b6
mov byte [rsp + 0x388], al
cmp qword [rsp + 0x380], 0xffffffffffffffff
lea rdx, [rsp + 0x4cc]
jne 0x140008607
lea rcx, [rsp + 0x388]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
xor esi, esi
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x380], rax
setne sil
test esi, esi
jne 0x14000861f
mov rax, qword [rsp + 0x380]
cmp rax, 0xffffffffffffffff
je 0x140008915
mov rcx, rax
jmp 0x14000890f
mov rcx, qword [rsp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov esi, eax
je 0x140008901
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x4f8]
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x750]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
not rcx
lea rax, [rdx + rcx]
cmp rax, 0x143
jae 0x1400086e2
lea rcx, [rsp + 0x750]
nop
movzx eax, byte [rcx]
add rcx, 1
test al, al
mov byte [rcx - 0x145], al
jne 0x140008660
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60c]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400086b4
movsxd rax, ecx
cmp byte [rsp + rax + 0x60b], 0x5c
je 0x1400086b4
xor eax, eax
lea rdi, [rsp + 0x60c]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x60c]
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [rsp + 0x4f8]
nop
movzx eax, byte [rdx + rcx]
add rcx, 1
test al, al
mov byte [rdi + rcx - 2], al
jne 0x1400086d0
jmp 0x1400086ea
mov byte [rsp + 0x60c], 0
test esi, esi
je 0x1400085ed
test byte [rsp + 0x4cc], 0x10
je 0x1400085b6
lea rsi, [rsp + 0x4f8]
lea rdi, [0x140027f84]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x1400085b6
lea rsi, [rsp + 0x4f8]
lea rdi, [0x140027f88]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x1400085b6
lea rdx, [rsp + 0x8a0]
lea rcx, [rsp + 0x60c]
call sub.msvcrt.dll__strcmpi
test eax, eax
je 0x1400085b6
lea rcx, [rsp + 0x21]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x20], 0
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60c]
repne scasb al, byte [rdi]
not rcx
add rcx, 0xf
cmp rcx, 0x104
jae 0x140008803
xor ecx, ecx
nop
movzx eax, byte [rsp + rcx + 0x60c]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x1f], al
jne 0x140008790
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x1400087de
movsxd rax, ecx
cmp byte [rsp + rax + 0x1f], 0x5c
je 0x1400087de
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x20]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.system32config]
mov qword [rdi - 1], rax
mov rax, qword [0x140029440]
mov qword [rdi + 7], rax
jmp 0x140008807
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400085b6
lea rcx, [rsp + 0x241]
xor edx, edx
mov r8d, 0x135
mov byte [rsp + 0x240], 0
call sub.msvcrt.dll_memset
xor edx, edx
nop
nop
movzx eax, byte [rsp + rdx + 0x60c]
add rdx, 1
test al, al
mov byte [rsp + rdx + 0x23f], al
jne 0x140008840
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x240]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x14000889a
movsxd rax, ecx
cmp byte [rsp + rax + 0x23f], 0x5c
je 0x14000889a
xor eax, eax
lea rdi, [rsp + 0x240]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x240]
repne scasb al, byte [rdi]
mov rax, qword [str.system32config_software]
lea rcx, [rsp + 0x240]
mov qword [rdi - 1], rax
mov rax, qword [0x140029420]
mov qword [rdi + 7], rax
mov rax, qword [0x140029428]
mov qword [rdi + 0xf], rax
movzx eax, byte [0x140029430]
mov byte [rdi + 0x17], al
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1400085b6
lea rdx, [rsp + 0x240]
mov rcx, rbp
call fcn.140006fd0
jmp 0x1400085b6
mov rcx, qword [rsp + 0x380]
cmp rcx, 0xffffffffffffffff
je 0x140008915
call qword [sym.imp.KERNEL32.dll_FindClose]
add ebx, 1
cmp ebx, 0x20
jb 0x1400083f0
lea r11, [rsp + 0x9b0]
xor eax, eax
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret