Function at 0x140008730
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10340]
mov eax, 0x10440
call fcn.140018d20
sub rsp, rax
mov rax, qword [0x140027010]
xor rax, rsp
mov qword [rbp + 0x10330], rax
xor r13d, r13d
xor edx, edx
mov r8d, 0x10000
lea rcx, [rbp + 0x330]
call fcn.14000b6e0
mov r8d, 0x8000
lea rdx, [rbp + 0x330]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x7ffe
ja 0x140008d97
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], r13
lea rax, [rbp + 0x330]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r13w
jne 0x1400087d0
movabs r14, 0x7ffffffffffffffe
cmp rbx, r14
ja 0x140008db4
mov eax, 0xa
mov qword [rsp + 0x70], 7
cmp rbx, 8
jae 0x140008825
mov qword [rsp + 0x68], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x58]
call fcn.14000f200
mov word [rsp + rbx + 0x58], r13w
jmp 0x140008879
mov rsi, rbx
or rsi, 7
cmp rsi, r14
jbe 0x140008836
mov rsi, r14
jmp 0x14000883d
cmp rsi, rax
cmovb rsi, rax
lea rdx, [rsi + 1]
call fcn.140008160
mov rdi, rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x330]
mov rcx, rax
call fcn.14000f200
mov word [rbx + rdi], r13w
mov rdi, 0xffffffffffffffff
lea rdx, [rsp + 0x58]
mov r9, qword [rsp + 0x58]
mov r10, qword [rsp + 0x70]
cmp r10, 8
cmovae rdx, r9
mov r8, qword [rsp + 0x68]
test r8, r8
je 0x1400088ca
lea rcx, [r8 - 1]
mov rax, rdi
cmp rcx, 0xffffffffffffffff
cmovb rax, rcx
lea rbx, [rdx + rax*2]
cmp word [rbx], 0x5c
je 0x1400088c2
cmp rbx, rdx
je 0x1400088ca
sub rbx, 2
cmp word [rbx], 0x5c
jne 0x1400088b3
sub rbx, rdx
sar rbx, 1
jmp 0x1400088cd
mov rbx, rdi
lea rdx, [rsp + 0x58]
cmp r10, 8
cmovae rdx, r9
test r8, r8
je 0x14000890f
lea rcx, [r8 - 1]
mov rax, rdi
cmp rcx, 0xffffffffffffffff
cmovb rax, rcx
lea rcx, [rdx + rax*2]
cmp word [rcx], 0x2f
je 0x140008907
cmp rcx, rdx
je 0x14000890f
sub rcx, 2
cmp word [rcx], 0x2f
jne 0x1400088f8
sub rcx, rdx
sar rcx, 1
jmp 0x140008912
mov rcx, rdi
cmp rcx, 0xffffffffffffffff
cmove ecx, edi
cmp rbx, 0xffffffffffffffff
cmove ebx, edi
cmp ebx, ecx
cmovl ebx, ecx
test ebx, ebx
js 0x140008dba
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
movsxd r12, ebx
inc r12
mov rdi, r12
cmp r8, r12
cmovb rdi, r8
lea r15, [rsp + 0x58]
cmp r10, 8
cmovae r15, r9
cmp rdi, r14
ja 0x140008dd7
mov qword [rsp + 0x50], 7
cmp rdi, 8
jae 0x140008994
mov qword [rsp + 0x48], rdi
add rdi, rdi
mov r8, rdi
mov rdx, r15
lea rcx, [rsp + 0x38]
call fcn.14000f200
mov word [rsp + rdi + 0x38], r13w
jmp 0x1400089e1
mov rax, rdi
or rax, 7
cmp rax, r14
ja 0x1400089b0
mov r14, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r14, rax
lea rdx, [r14 + 1]
call fcn.140008160
mov rsi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
add rdi, rdi
mov r8, rdi
mov rdx, r15
mov rcx, rax
call fcn.14000f200
mov word [rsi + rdi], r13w
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
sub rax, rsi
cmp rax, 5
jb 0x140008a32
lea rax, [rsi + 5]
mov qword [rsp + 0x48], rax
lea rdi, [rsp + 0x38]
cmp rcx, 8
cmovae rdi, qword [rsp + 0x38]
lea rcx, [rdi + rsi*2]
mov r8d, 0xa
lea rdx, str..dll
call fcn.14000f200
mov word [rdi + rsi*2 + 0xa], r13w
lea rax, [rsp + 0x38]
jmp 0x140008a51
mov qword [rsp + 0x20], 5
lea r9, str..dll
mov edx, 5
lea rcx, [rsp + 0x38]
call fcn.140007c60
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140008ac3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008abe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008ddd
call fcn.140009ae0
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r13w
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0xe0]
call fcn.14000b6e0
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
lea rdx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140008bf0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 2
jne 0x140008de3
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140008b67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e00
call fcn.140009ae0
movdqa xmm0, xmmword [0x140023670]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140008bbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d91
call fcn.140009ae0
mov rcx, qword [rbp + 0x10330]
xor rcx, rsp
call fcn.140009590
lea r11, [rsp + 0x10440]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
test byte [rbp + 0xe0], 0x10
je 0x140008caf
lea rdx, [rbp + 0xe0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140008bf0
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140008c52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008e00
call fcn.140009ae0
movdqa xmm0, xmmword [0x140023670]
movdqu xmmword [rbp - 0x78], xmm0
mov word [rsp + 0x78], r13w
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140008bbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008bb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008d91
jmp 0x140008bb7
mov r9, 0xffffffffffffffff
mov r8, r12
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.140007200
nop
movsxd r9, ebx
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.140007200
mov rbx, rax
lea rdx, [rbp + 0x10c]
lea rcx, [rbp - 0x48]
call fcn.140007380
nop
mov r8, rax
lea rcx, [rbp - 0x28]
call fcn.140008ec0
nop
lea r8, str.__found_in_the_directory_with
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1400078d0
nop
lea r8, [rbp - 0x68]
mov rdx, rax
lea rcx, [rbp + 0x18]
call fcn.1400079b0
nop
lea r8, str.._n_nThis_may_be_a_virus_or_a_malicious_program.__n_nPlease_remove_all_DLL_libraries_from_this_directory:_n_n
mov rdx, rax
lea rcx, [rbp + 0x38]
call fcn.1400078d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.140008ea0
nop
lea r8, str._n_nAlternatively__you_can_move
mov rdx, rax
lea rcx, [rbp + 0x78]
call fcn.1400078d0
nop
lea r8, [rbp - 0x68]
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.1400079b0
nop
lea r8, str._to_a_new_directory.
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.1400078d0
nop
xor edx, edx
mov rcx, rax
call fcn.140008610
nop
call fcn.14000ff34
int3
lea rdx, str.Could_not_get_executable_path_
lea rcx, [rbp - 0x68]
call fcn.140007380
nop
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140008610
nop
call fcn.140001200
nop
lea rdx, str.Could_not_get_executable_directory_
lea rcx, [rbp - 0x68]
call fcn.140007380
nop
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.140008610
nop
call fcn.140001200
nop
call fcn.14000ff34
int3
lea rdx, str.Could_not_enumerate_executable_path_
lea rcx, [rbp - 0x68]
call fcn.140007380
nop
mov edx, ebx
lea rcx, [rbp - 0x68]
call fcn.140008610
nop
call fcn.14000ff34
int3