Function at 0x140002ab0
Capabilities:
Copy file
Create directory
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2490]
mov eax, 0x2590
call fcn.140039450
sub rsp, rax
movaps xmmword [rsp + 0x2580], xmm6
movaps xmmword [rsp + 0x2570], xmm7
mov rax, qword [0x140052010]
xor rax, rsp
mov qword [rbp + 0x2460], rax
xor r15d, r15d
mov dword [rbp - 0x70], r15d
xor edx, edx
lea rcx, str.C:OneDriveTemp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempOneDriveTemp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempWindows
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempWindows_system32
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempWindows_system32DriverStore
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempWindows_system32DriverStoreFileRepository
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempWindowsWinSxS
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
lea rcx, str.C:OneDriveTempWindowsWinSxSManifests
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x10]
call fcn.140015780
lea r12, [0x140000000]
lea rax, [r12 + 0x4ae48]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xc8], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xd0], xmm0
mov r14d, 1
mov dword [rbp - 0x70], r14d
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x98], rax
mov dword [rbp + 0x94], 0x98
xor r8d, r8d
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x98]
call fcn.140008ed0
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
lea rcx, [rbp - 8]
call fcn.1400077f0
nop
lea edi, [r15 + 2]
cmp qword [rbp + 0x78], r15
jne 0x140002d14
lea r8d, [r15 + 0x40]
mov edx, edi
lea rcx, str.C:OneDriveTempOneDriveTempOneDriveTemp.MANIFEST
call fcn.140013924
test rax, rax
je 0x140002d14
mov r8d, r14d
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1400074f0
mov rax, qword [rbp + 0x58]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x38], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x30]
call fcn.140009770
mov rbx, rax
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
test al, al
je 0x140002c8c
mov qword [rbp + 0x60], r15
jmp 0x140002cd4
mov qword [rbp + 0x60], rbx
lea rax, [rbp]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 8]
mov qword [rbp + 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rbp + 0x38], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x48], rax
lea rax, [rbp + 0x44]
mov qword [rbp + 0x50], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0x28], r15
mov qword [rbp + 0x40], r15
mov qword [rbp], r15
mov qword [rbp + 0x20], r15
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002cf7
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140002cf7
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx - 0x10]
mov edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, r15d
jmp 0x140002d31
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx - 0x10]
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, edi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400025b0
lea rdx, [0x140052ba8]
cmp qword [0x140052bc0], 0x10
cmovae rdx, qword [0x140052ba8]
mov r8, qword [0x140052bb8]
lea rcx, [rbp - 0x10]
call fcn.140005a40
lea rcx, [rbp - 8]
call fcn.1400075f0
test rax, rax
jne 0x140002d95
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, edi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400025b0
mov qword [rsp + 0x70], r15
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
lea rdx, [rbp + 0x210]
lea rcx, str.C:WindowsSystem32DriverStoreFileRepositoryprnms003.inf_amd64_
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003471
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov r8d, 0x2f
lea rdx, str.C:WindowsSystem32DriverStoreFileRepository_
lea rcx, [rsp + 0x30]
call fcn.140007980
nop
lea rax, [rbp + 0x23c]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140002e25
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140002e7c
lea rdi, [rcx + rdx]
mov qword [rsp + 0x40], rdi
lea rbx, [rsp + 0x30]
cmp r8, 8
cmovae rbx, qword [rsp + 0x30]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x23c]
call fcn.140015970
mov word [rbx + rdi*2], r15w
lea rax, [rsp + 0x30]
jmp 0x140002e92
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x23c]
lea rcx, [rsp + 0x30]
call fcn.14000ac20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r14d, 4
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140002eee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ee9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e34
call fcn.140011d50
movups xmmword [rsp + 0x70], xmm6
movups xmmword [rbp - 0x80], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140002f39
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e3a
call fcn.140011d50
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov r8d, 0x3c
lea rdx, str.C:OneDriveTempWindows_system32DriverStoreFileRepository_
lea rcx, [rsp + 0x30]
call fcn.140007980
nop
lea rax, [rbp + 0x23c]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140002f80
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140002fd7
lea rdi, [rcx + rdx]
mov qword [rsp + 0x40], rdi
lea rbx, [rsp + 0x30]
cmp r8, 8
cmovae rbx, qword [rsp + 0x30]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x23c]
call fcn.140015970
mov word [rbx + rdi*2], r15w
lea rax, [rsp + 0x30]
jmp 0x140002fed
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x23c]
lea rcx, [rsp + 0x30]
call fcn.14000ac20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r14d, 8
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14000304a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003045
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e40
call fcn.140011d50
movups xmmword [rsp + 0x50], xmm6
movups xmmword [rsp + 0x60], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003096
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003091
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e46
call fcn.140011d50
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.Amd64
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140009200
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x140003145
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140003113
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000310e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e4c
call fcn.140011d50
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003187
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003182
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e4c
call fcn.140011d50
lea r8, str.Amd64
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140009200
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x140003221
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400031ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e52
call fcn.140011d50
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003263
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000325e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e52
call fcn.140011d50
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea r8, str.PrintConfig.dll
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140009200
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x140003312
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400032e0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e58
call fcn.140011d50
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003354
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000334f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e58
call fcn.140011d50
lea r8, str.PrintConfig.dll
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140009200
mov rbx, rax
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x1400033ee
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400033b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e5e
call fcn.140011d50
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003430
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000342b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e5e
call fcn.140011d50
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rdx, [rbp + 0x210]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jmp 0x140002de0
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x460]
call fcn.140015780
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x100]
call fcn.140015780
lea rax, [r12 + 0x4af80]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x1b8], r15
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], r15
or r14d, 0x10
mov dword [rbp - 0x70], r14d
lea r12, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x1b0], r12
mov dword [rbp + 0x1ac], 0x98
mov qword [rbp + 0x108], r15
xor r8d, r8d
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x1b0]
call fcn.140008ed0
nop
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x100], r13
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xfc], edx
lea rcx, [rbp + 0x110]
call fcn.1400077f0
nop
mov qword [rbp - 0x68], r15
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x38], r15
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
mov cl, 1
call fcn.1400132bc
mov qword [rbp - 0x18], rax
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.140012c2c
nop
mov rsi, qword [0x140054cf8]
mov qword [rbp - 0x40], rsi
mov rdi, qword [0x140054d18]
test rdi, rdi
jne 0x1400035d9
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.140012c2c
cmp qword [0x140054d18], rdi
jne 0x1400035c9
mov eax, dword [0x140053d78]
inc eax
mov dword [0x140053d78], eax
cdqe
mov qword [0x140054d18], rax
lea rcx, [rbp - 0x70]
call fcn.140012ca4
mov rdi, qword [0x140054d18]
mov rcx, qword [rbp - 0x18]
cmp rdi, qword [rcx + 0x18]
jae 0x1400035f2
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
jne 0x140003654
jmp 0x1400035f5
mov rbx, r15
cmp byte [rcx + 0x24], 0
je 0x14000360e
call fcn.1400132b4
cmp rdi, qword [rax + 0x18]
jae 0x140003613
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + rdi*8]
test rbx, rbx
jne 0x140003654
test rsi, rsi
je 0x14000361d
mov rbx, rsi
jmp 0x140003654
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.14000a2e0
cmp rax, 0xffffffffffffffff
je 0x140003e64
mov rbx, qword [rbp - 0x40]
mov qword [rbp - 0x40], rbx
mov rcx, rbx
call fcn.14001327c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov qword [0x140054cf8], rbx
lea rcx, [rbp - 0x48]
call fcn.140012ca4
mov qword [rbp - 0x30], rbx
lea rcx, [rbp - 0x20]
call fcn.140009060
mov qword [rbp - 0x28], rax
lea r8, [0x14004a687]
lea rcx, [rbp - 0x38]
call fcn.140009520
nop
lea rdx, [rbp + 0x210]
lea rcx, str.C:WindowsWinSxSManifests_amd64_microsoft.windows.common_controls_.manifest
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140003bf4
lea r12, [0x140052bc8]
nop word [rax + rax]
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp + 0x460]
call fcn.140015780
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov r8d, 0x1c
lea rdx, str.C:WindowsWinSxSManifests_
lea rcx, [rsp + 0x30]
call fcn.140007980
nop
lea rax, [rbp + 0x23c]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140003703
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14000375a
lea rdi, [rcx + rdx]
mov qword [rsp + 0x40], rdi
lea rbx, [rsp + 0x30]
cmp r8, 8
cmovae rbx, qword [rsp + 0x30]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x23c]
call fcn.140015970
mov word [rbx + rdi*2], r15w
lea rax, [rsp + 0x30]
jmp 0x140003770
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x23c]
lea rcx, [rsp + 0x30]
call fcn.14000ac20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r14d, 0x40
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400037cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e70
call fcn.140011d50
movups xmmword [rsp + 0x70], xmm6
movups xmmword [rbp - 0x80], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140003817
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003812
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e76
call fcn.140011d50
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov r8d, 0x29
lea rdx, str.C:OneDriveTempWindowsWinSxSManifests_
lea rcx, [rsp + 0x30]
call fcn.140007980
nop
lea rax, [rbp + 0x23c]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140003856
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x1400038ad
lea rdi, [rdx + rcx]
mov qword [rsp + 0x40], rdi
lea rbx, [rsp + 0x30]
cmp r8, 8
cmovae rbx, qword [rsp + 0x30]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x23c]
call fcn.140015970
mov word [rbx + rdi*2], r15w
lea rax, [rsp + 0x30]
jmp 0x1400038c3
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x23c]
lea rcx, [rsp + 0x30]
call fcn.14000ac20
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
bts r14d, 7
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140003921
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000391c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e7c
call fcn.140011d50
movups xmmword [rsp + 0x50], xmm6
movups xmmword [rsp + 0x60], xmm7
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14000396d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003968
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e82
call fcn.140011d50
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8d, 1
lea rcx, [rbp + 0x110]
call fcn.1400076e0
mov edi, 2
test rax, rax
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx + 0x100]
je 0x1400039bc
mov edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, r15d
jmp 0x1400039cc
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, edi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400025b0
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x100]
call fcn.140004a80
lea rcx, [rbp + 0x110]
call fcn.1400075f0
test rax, rax
jne 0x140003a25
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x100]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, edi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400025b0
lea rax, [rbp + 0x460]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140003a33
lea rdx, [rbp + 0x460]
lea rcx, [rbp - 0x68]
call fcn.140007c70
mov r9, r12
cmp qword [0x140052be0], 0x10
cmovae r9, qword [0x140052bc8]
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
lea r8, [rbp - 0x38]
lea rcx, [rsp + 0x30]
call fcn.140009380
mov rbx, rax
lea rax, [rbp - 0x68]
cmp rax, rbx
je 0x140003af1
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140003ac3
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003abe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e88
call fcn.140011d50
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x68], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x58], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140003b2e
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e88
call fcn.140011d50
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
mov r8d, edi
lea rcx, [rbp - 8]
call fcn.1400076e0
test rax, rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rcx, [rbp + rcx - 0x10]
je 0x140003b6d
mov edx, 4
cmp qword [rcx + 0x48], 0
cmovne edx, r15d
jmp 0x140003b7d
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, edi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400025b0
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
lea rcx, [rbp - 0x10]
call fcn.140005a40
lea rcx, [rbp - 8]
call fcn.1400075f0
test rax, rax
jne 0x140003bd5
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, edi
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.1400025b0
lea rdx, [rbp + 0x210]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400036b0
lea r12, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
lea rcx, [rbp - 0x38]
call fcn.140007380
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140003c20
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140003c20
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x140003c5b
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e6a
call fcn.140011d50
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x100], r13
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0xfc], edx
lea rcx, [rbp + 0x110]
call fcn.140005780
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x100], r12
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rbp + rcx + 0xfc], edx
lea rbx, vtable.std::ios_base.0
mov qword [rbp + 0x1b0], rbx
lea rcx, [rbp + 0x1b0]
call fcn.14001360c
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140003d27
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e8e
call fcn.140011d50
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r15w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140003d7c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003e2e
call fcn.140011d50
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
lea rcx, [rbp - 8]
call fcn.140005780
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x14], edx
mov qword [rbp + 0x98], rbx
lea rcx, [rbp + 0x98]
call fcn.14001360c
nop
mov rcx, qword [rbp + 0x2460]
xor rcx, rsp
call fcn.140011d30
lea r11, [rsp + 0x2590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001ec10
nop
call fcn.14001ec10
nop
call fcn.14001ec10
nop
call fcn.14001ec10
nop
call fcn.14001ec10
int3
call fcn.14001ec10
int3
call fcn.14001ec10
int3
call fcn.14001ec10
int3
call fcn.14001ec10
nop
call fcn.140002040
nop
call fcn.14001ec10
nop
call fcn.14001ec10
nop
call fcn.14001ec10
nop
call fcn.14001ec10
nop
call fcn.14001ec10
int3
call fcn.14001ec10
nop
call fcn.14001ec10
int3