Function at 0x140003810
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x410]
sub rsp, 0x510
test byte [rcx + 0x40], 2
mov r14, rdx
mov rsi, rcx
je 0x14000383e
mov al, 1
add rsp, 0x510
pop r14
pop rsi
pop rbp
ret
mov qword [rsp + 0x500], r15
xor r15b, r15b
cmp r8d, 1
je 0x140003856
xor al, al
jmp 0x140003d2f
mov qword [rsp + 0x548], r12
mov qword [rsp + 0x508], r13
test rdx, rdx
jne 0x14000386f
lea r14, [rcx + 8]
xor r12d, r12d
lea r13, vtable.DumpFileSearch.0
xor edx, edx
mov qword [rbp - 0x70], r13
mov r8d, 0x100
mov qword [rbp - 0x58], r12
lea rcx, [rbp + 0xb0]
mov byte [rbp + 0x1b0], r12b
call fcn.140016dc0
movups xmm0, xmmword [r14]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x100
movups xmmword [rbp - 0x68], xmm0
call fcn.140016dc0
lea rax, [rbp + 0x430]
mov dword [rbp + 0x430], 0x100
mov qword [rsp + 0x28], rax
lea r9d, [r12 + 4]
lea rax, [rbp - 0x50]
mov rcx, 0xffffffff80000002
lea r8, str.MinidumpDir
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMCurrentControlSetControlCrashControl
call fcn.1400025e0
test eax, eax
jne 0x140003931
mov edx, dword [rbp + 0x430]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rcx, [rbp - 0x50]
dec rcx
nop
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x140003910
movsd xmm0, qword [str.Minidump]
movzx eax, word [0x140071d80]
movsd qword [rcx], xmm0
mov word [rcx + 8], ax
cmp byte [rbp - 0x50], r12b
je 0x1400039a7
lea rcx, [rbp + 0xb0]
dec rcx
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x140003941
lea r8, [rbp - 0x50]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140003960
lea rcx, [rbp + 0xb0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x140003980
movzx eax, word [0x140071da4]
mov word [rcx], ax
movzx eax, byte [0x140071da6]
mov byte [rcx + 2], al
mov byte [rbp + 0x1b0], 1
jmp 0x1400039b4
cmp byte [rbp + 0x1b0], r12b
je 0x140003d03
xor edx, edx
mov qword [rsp + 0x538], rbx
mov r8d, 0x100
lea rcx, [rbp + 0x1c0]
call fcn.140016dc0
mov qword [rsp + 0x540], rdi
nop dword [rax + rax]
xor edx, edx
lea rcx, [rbp + 0x2c0]
mov r8d, 0x140
call fcn.140016dc0
mov rcx, qword [rbp - 0x58]
test rcx, rcx
jne 0x140003a3a
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x58], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140003a3a
lea rdx, str..dmp
lea rcx, [rbp + 0x2ec]
call fcn.140017148
test rax, rax
jne 0x140003a9b
mov rcx, qword [rbp - 0x58]
cmp rcx, 0xffffffffffffffff
je 0x140003cda
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140003cd0
lea rdx, str..dmp
lea rcx, [rbp + 0x2ec]
call fcn.140017148
test rax, rax
jne 0x140003a9b
lea rdx, str..DMP
lea rcx, [rbp + 0x2ec]
call fcn.140017148
test rax, rax
jne 0x140003a9b
mov rcx, qword [rbp - 0x58]
jmp 0x140003a50
mov rcx, r12
nop
movzx eax, byte [rbp + rcx - 0x50]
mov byte [rbp + rcx + 0x1c0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003aa0
lea rcx, [rbp + 0x1c0]
dec rcx
nop
cmp byte [rcx + 1], r12b
lea rcx, [rcx + 1]
jne 0x140003ac0
movzx eax, word [0x140071db8]
mov word [rcx], ax
lea rax, [rbp + 0x1c0]
dec rax
nop
cmp byte [rax + 1], r12b
lea rax, [rax + 1]
jne 0x140003ae0
lea r8, [rbp + 0x2ec]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003b00
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x140003b48
mov rbx, qword [rcx + 8]
nop dword [rax]
mov r8d, 0x100
lea rdx, [rbp + 0x1c0]
call fcn.14000b330
test al, al
jne 0x1400039e0
mov rcx, rbx
test rbx, rbx
je 0x140003b48
mov rbx, qword [rbx + 8]
jmp 0x140003b20
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1c0]
movups xmmword [rsp + 0x30], xmm0
call fcn.14000b1f0
test al, al
je 0x1400039e0
lea rdi, [rsi + 0x44]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.14000b9d0
test al, al
je 0x1400039e0
cmp word [r14], r12w
je 0x140003b9d
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14000b9d0
test al, al
je 0x1400039e0
mov ecx, 0x128
call fcn.140015b40
test rax, rax
je 0x1400039e0
mov r8d, 0x100
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call fcn.14000ada0
mov rbx, rax
test rax, rax
je 0x1400039e0
xorps xmm0, xmm0
mov byte [rbp + 0x430], r12b
xor eax, eax
lea r9, [rbp + 0x430]
lea r8, [rsp + 0x40]
mov dword [rbp - 0x78], eax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rcx, rbx
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x40], xmm0
call fcn.14000af10
movzx r15d, al
test al, al
je 0x140003c98
cmp byte [rbp + 0x430], r12b
je 0x140003c98
cmp dword [rsi + 0x40], r12d
jne 0x140003c52
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14000a0c0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1400096b0
mov ecx, 3
call fcn.14000cb50
or dword [rsi + 0x40], 2
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14000b9d0
test al, al
je 0x140003c98
movups xmm0, xmmword [rsp + 0x30]
mov dword [rsp + 0x28], SQLPrepare
lea r8, str.Last_AmdlogSr_LastBsodWt
mov r9d, 1
mov qword [rsp + 0x20], rdi
lea rdx, str.SoftwareAMDLOG
mov rcx, 0xffffffff80000002
movups xmmword [rdi], xmm0
call fcn.140002a90
cmp qword [rsi + 0x30], r12
jne 0x140003cb3
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x30], rbx
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
inc dword [rsi + 0x38]
jmp 0x140003cd6
mov qword [rbx + 8], r12
mov rax, qword [rsi + 0x30]
mov qword [rbx + 0x10], rax
mov rax, qword [rsi + 0x30]
mov qword [rax + 8], rbx
inc dword [rsi + 0x38]
mov qword [rsi + 0x30], rbx
jmp 0x140003cd6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x58]
mov rdi, qword [rsp + 0x540]
lea rax, [rcx - 1]
mov rbx, qword [rsp + 0x538]
cmp rax, 0xfffffffffffffffd
ja 0x140003d07
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r12
mov qword [rbp - 0x58], rcx
jmp 0x140003d07
mov rcx, qword [rbp - 0x58]
mov r12, qword [rsp + 0x548]
lea rax, [rcx - 1]
mov qword [rbp - 0x70], r13
mov r13, qword [rsp + 0x508]
cmp rax, 0xfffffffffffffffd
ja 0x140003d2b
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, r15b
mov r15, qword [rsp + 0x500]
add rsp, 0x510
pop r14
pop rsi
pop rbp
ret