Function at 0x1400108e0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140072040]
xor rax, rsp
mov qword [rbp + 0x410], rax
movzx ebx, cl
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x40], r13d
lea rcx, [rbp + 0x160]
call fcn.140046cc0
test al, al
jne 0x14001095e
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ad40
lea rdx, [0x14000d160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140011813
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r13
mov qword [rbp + 0xb8], r13
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0xa0]
call fcn.1400066a0
nop
lea r8, [0x140051570]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x180]
call fcn.140007f80
cmp qword [rax + 0x18], 7
jbe 0x1400109b4
mov rax, qword [rax]
lea rdx, ds:[rbp + 0x1c0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x180]
call fcn.1400058e0
nop word [rax + rax]
cmp rsi, 0xffffffffffffffff
jne 0x140010a0e
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ad40
lea rdx, [0x14000d160]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140011807
test bl, bl
jne 0x140010a7e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_renamed_and_deleted_Prefetch_folders..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_Prefetch_bypasses..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400080c0
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
nop
call fcn.1400080c0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x40]
call fcn.140007ae0
nop
lea r14, str..EXE
mov rsi, qword [rbp + 0xb0]
mov rbx, qword [rsp + 0x48]
nop dword [rax + rax]
cmp dword [rbp + 0x1c0], 0x10
je 0x1400117db
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
lea rax, [rbp + 0x1ec]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140010ad0
lea rdx, [rbp + 0x1ec]
lea rcx, [rbp + 0x20]
call fcn.1400066a0
nop
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rcx, qword [rbp + 0x20]
mov qword [rsp + 0x20], 4
mov r9, r14
xor r8d, r8d
mov rdx, qword [rbp + 0x30]
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
jne 0x140010b74
mov rdx, qword ds:[rbp + 0x38]
cmp rdx, 7
jbe 0x1400117db
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011875
call fcn.140049760
jmp 0x1400117db
mov r12, qword [rbp + 0x30]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r12
jb 0x140011886
lea r13, ds:[rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova r13, qword [rbp + 0xa0]
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rax, qword [rbp + 0x20]
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xor eax, eax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
lea r15, [r12 + rsi]
mov ebx, 7
lea r14, [rbp + 0x60]
cmp r15, rbx
jbe 0x140010c46
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x140010c02
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x140010c29
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001188c
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rbp + 0x60], rax
mov rsi, qword [rbp + 0xb0]
mov edi, dword [rsp + 0x40]
mov qword ds:[rbp + 0x70], r15
mov qword [rbp + 0x78], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, qword [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memcpy
xor r13d, r13d
mov word [r14 + r15*2], r13w
or edi, 0x20
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax]
cmp eax, 0xffffffff
je 0x140010cf5
test al, 1
je 0x140010cf5
lea rdx, str.____Prefetch_file_is_marked_as_read_only:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
mov rcx, rax
call fcn.140008ee0
lea rdx, str.._This_is_bannable.
mov rcx, rax
call fcn.1400064a0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x1d4]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
nop dword [rax + rax]
test eax, eax
jle 0x14001177b
mov r12, qword ds:[rbp + 0x30]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, r12
jb 0x14001187c
lea r13, ds:[rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova r13, qword [rbp + 0xa0]
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rax, qword [rbp + 0x20]
mov qword [rbp + 0xc0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xor eax, eax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
lea r15, [rsi + r12]
mov ebx, 7
lea r14, [rbp + 0x80]
cmp r15, rbx
jbe 0x140010e29
mov rbx, r15
or rbx, 7
cmp rbx, rcx
jbe 0x140010de2
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
jmp 0x140010e09
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140011892
lfence
add rcx, rcx
call fcn.1400069a0
mov r14, rax
mov qword [rbp + 0x80], rax
mov rsi, qword [rbp + 0xb0]
mov edi, dword [rsp + 0x40]
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, qword [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memcpy
xor r13d, r13d
mov word [r14 + r15*2], r13w
bts edi, 7
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova r8, qword [rbp + 0x80]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r13 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r13
movabs r15, 0x7fffffffffffffff
cmp r14, r15
ja 0x1400118b2
lfence
cmp r14, 0xf
ja 0x140010ef8
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 0xf
mov r8, r14
xor edx, edx
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + r14 + 0x40], r13b
jmp 0x140010f4a
mov rdi, r14
or rdi, 0xf
cmp rdi, r15
jbe 0x140010f0a
mov rdi, r15
jmp 0x140010f17
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, ds:[rdi + 1]
call fcn.1400069a0
mov rbx, rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], rdi
mov r8, r14
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov byte [r14 + rbx], 0
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rax, qword [rbp + 0x40]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova r8, qword [rbp + 0x80]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, ds:[rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14000fc80
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, qword [rsp + 0x58]
jne 0x14001115f
test rcx, rcx
je 0x140010ffe
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010fea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001186e
call fcn.140049760
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140011039
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011034
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011846
call fcn.140049760
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x14001108f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001108a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001184d
call fcn.140049760
mov qword [rbp + 0x90], r13
mov qword [rbp + 0x98], 7
mov word [rbp + 0x80], r13w
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x1400110ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400110ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011854
call fcn.140049760
mov qword [rbp + 0x70], r13
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r13w
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14001114f
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001114a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001185b
call fcn.140049760
mov rsi, qword [rbp + 0xb0]
mov edi, dword [rsp + 0x40]
jmp 0x1400117cf
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x50]
call fcn.140010180
nop
mov r15, qword [rbp - 0x70]
mov r12, qword [rbp - 0x68]
mov edi, dword [rsp + 0x40]
cmp r15, r12
je 0x140011709
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r13
mov qword [rbp + 0x118], r13
lea rax, [rbp + 0x1ec]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400111c0
lea rdx, [rbp + 0x1ec]
lea rcx, [rbp + 0x100]
call fcn.1400066a0
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
seta r10b
mov r9, qword [rbp + 0x100]
cmova rdx, r9
mov rsi, qword [rbp + 0x110]
test rsi, rsi
je 0x14001123b
mov rax, rsi
mov rcx, rdx
mov r8, r13
cmp word [rdx], 0x2d
je 0x14001122b
cmp rax, 1
je 0x14001122e
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x140011218
mov r8, rcx
test r8, r8
je 0x14001123b
sub r8, rdx
sar r8, 1
jmp 0x140011242
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x140011297
movups xmmword ds:[rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rbp + 0x100]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0xe0]
call fcn.1400066a0
or edi, 0x40
lea rcx, [rbp + 0xe0]
or edi, 1
jmp 0x14001137b
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], r13
lea r14, [rbp + 0x100]
test r10b, r10b
cmovne r14, r9
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x1400118ac
cmp rsi, 7
ja 0x1400112f5
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0xc0], xmm0
jmp 0x140011371
mov rbx, rsi
or rbx, 7
cmp rbx, rax
jbe 0x140011314
mov rbx, rax
movabs rcx, 0x7fffffffffffffff
jmp 0x140011338
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400118a6
lfence
add rcx, rcx
call fcn.1400069a0
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edi, dword [rsp + 0x40]
lea rcx, [rbp + 0xc0]
or edi, 2
mov r8d, edi
mov edx, edi
mov r9d, edi
mov eax, edi
movups xmm0, xmmword [rcx]
movups xmmword [rbp + 0x140], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp + 0x150], xmm1
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 7
mov word [rcx], r13w
test al, 2
je 0x1400113c2
and edi, 0xfffffffd
lea rcx, [rbp + 0xc0]
call fcn.1400058e0
mov edx, edi
mov r8d, edi
test dl, 1
je 0x14001142d
mov edi, r8d
and edi, 0xfffffffe
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x140011413
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001140e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011867
call fcn.140049760
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], 7
mov word [rbp + 0xe0], r13w
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], r13
mov rax, qword [r15 + 0x10]
cmp rax, 0x23
jb 0x14001189e
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r15
cmp qword [r15 + 0x18], 7
jbe 0x140011472
mov rdx, qword [r15]
add rdx, 0x46
lea rcx, [rbp + 0xe0]
call fcn.1400066a0
or edi, 0x10
mov rdx, r15
lea rcx, [rbp + 0x1a0]
call fcn.1400103c0
nop
lea r9, [rbp + 0xe0]
mov r8, rax
lea rcx, [rbp]
call fcn.140011bc0
or edi, 8
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x1a0]
call fcn.1400058e0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400058e0
lea r9, [rbp + 0x140]
cmp qword [rbp + 0x158], 7
cmova r9, qword [rbp + 0x140]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
mov rax, qword [rbp + 0x150]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
je 0x1400116d5
lea rax, ds:[rbp]
cmp qword [rbp + 0x18], 7
cmova rax, qword [rbp]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp + 0xc0], xmm0
lea rcx, [rbp + 0xc0]
call fcn.140004d80
test al, al
jne 0x14001161c
mov rdx, qword [rbp + 0x10]
cmp rdx, 4
jb 0x140011620
lea rcx, ds:[rdx - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r13
cmp rdx, rcx
jb 0x140011898
lfence
mov rax, qword [rbp + 0x10]
sub rax, rcx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rax, [rbp]
cmp qword [rbp + 0x18], 7
cmova rax, qword [rbp]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x120]
call fcn.1400066a0
mov edi, dword [rsp + 0x40]
or edi, 0x104
mov dword [rsp + 0x40], edi
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 7
cmova r8, qword [rbp + 0x120]
cmp qword [rbp + 0x130], 4
jne 0x14001161c
mov edx, 4
lea rcx, str..EXE
mov rax, rcx
sub r8, rcx
movzx ecx, word [rax + r8]
cmp cx, word [rax]
jne 0x14001161c
add rax, 2
sub rdx, 1
jne 0x140011600
mov bl, 1
mov rdx, qword [rbp + 0x10]
jmp 0x140011622
mov rdx, qword [rbp + 0x10]
xor bl, bl
test dil, 4
je 0x14001163f
and edi, 0xfffffffb
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x120]
call fcn.1400058e0
mov rdx, qword [rbp + 0x10]
nop
test bl, bl
je 0x1400116d5
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
mov qword [rsp + 0x20], 0xb
lea r9, str.UnknownDisk
xor r8d, r8d
call fcn.1400087c0
cmp rax, 0xffffffffffffffff
je 0x14001167d
lea rdx, [0x140051680]
jmp 0x140011691
lea rdx, [rbp]
call fcn.140047980
test al, al
jne 0x1400116c7
lea rdx, [0x140051dc8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400064a0
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
mov r8, qword [rbp + 0x10]
cmova rdx, qword [rbp]
mov rcx, rax
call fcn.140008ee0
lea rdx, [0x140008380]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp]
lea rdx, [rbp - 0x58]
call fcn.140006140
nop
lea rcx, [rbp]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x140]
call fcn.1400058e0
nop
lea rcx, [rbp + 0x100]
call fcn.1400058e0
add r15, 0x20
cmp r15, r12
jne 0x140011190
lea rcx, [rbp - 0x70]
call fcn.14000a480
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001175e
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001174a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001186e
call fcn.140049760
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
lea rcx, [rbp + 0x40]
call fcn.140005960
nop
lea rcx, [rbp + 0x80]
call fcn.1400058e0
mov rsi, qword [rbp + 0xb0]
lea rcx, ds:[rbp + 0x60]
call fcn.1400058e0
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x1400117cf
lea rdx, ds:[rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400117ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011875
call fcn.140049760
lea r14, str..EXE
mov rbx, qword [rsp + 0x48]
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140010aa0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rbp - 0x40]
call fcn.140007a60
nop
lea rcx, [rbp + 0xa0]
call fcn.1400058e0
mov rcx, qword ds:[rbp + 0x410]
xor rcx, rsp
call fcn.140049740
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop dword [rax]
call fcn.140003f80
nop
call fcn.140003f80
int3
call fcn.140003ed0
nop
call fcn.140003ed0
nop
call fcn.140007f60
nop
nop
call fcn.140007f60
nop
call fcn.140003ed0
int3
call fcn.140003f80
nop
call fcn.140003f80
int3
movzx ecx, dl
jmp 0x1400108e0