Function at 0x140208b10
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x918]
sub rsp, 0xa18
mov qword [rbp + 0x1f0], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp + 0x180]
call fcn.14007ba30
nop
xor r14d, r14d
mov qword [rsp + 0x48], r14
lea rcx, [rbp + 0x180]
call fcn.1400e0560
mov ebx, r14d
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x140208b91
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rsp + 0x48]
lea rdx, str.SELECT__FROM_sas_fileextensions_WHERE_extensionSAS_DEFAULT_AND_activeyes
call qword [rax]
mov ebx, eax
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x140209a19
mov r12d, r14d
mov qword [rbp - 0x20], r14
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rbp - 0x20]
lea r8, [0x140294f68]
xor edx, edx
call qword [rax + 0x40]
test eax, eax
je 0x1402099e4
lea r15, vtable.CSABString.0
lea rbx, vtable.CSASScanner::CFileObjectScanOptions::CFileExtension.0
lea rcx, vtable.CSASScanner::CDirectoryScanOptions.0
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r14
mov dword [rbp + 0xa0], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x98], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0xa4], 1
lea rcx, [rbp + 0xa8]
call fcn.140201e00
nop
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], r15
mov dword [rbp + 0x38], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov r13, rax
mov qword [rbp + 0x30], rax
xor eax, eax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov qword [rbp + 0x3c], 1
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x44], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x70], rax
mov dword [rbp + 0x78], r14d
mov qword [rsp + 0x70], r14
mov rdx, qword [rsi + 0x1560]
lea rcx, [rbp + 0xa8]
call fcn.1402020e0
mov rax, qword [rbp + 0xb0]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rbp + 0xb0]
mov qword [rax + 8], rax
mov qword [rbp + 0xb8], r14
cmp rdi, qword [rbp + 0xb0]
je 0x140208ce7
nop word [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov edx, WSACleanup
mov rcx, rdi
call fcn.140247060
mov rdi, rbx
cmp rbx, qword [rbp + 0xb0]
jne 0x140208cc0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x70]
lea r8, str.folder
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x140209977
mov rbx, qword [rsp + 0x70]
test rbx, rbx
je 0x140209977
mov qword [rsp + 0x40], r14
cmp dword [0x140337eb0], 0
je 0x140208f01
mov rax, qword [0x140337ec8]
mov qword [rsp + 0x78], rax
lea rdi, [rax + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov dword [rbp + 0x968], r14d
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x300]
call fcn.140249b10
mov rdx, qword [0x140337ea8]
test rdx, rdx
je 0x140208d85
mov rcx, qword [0x140337ed0]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x68]
cmp eax, 0x4000000
ja 0x140208ef3
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbp - 0x74]
movzx ecx, word [rbp - 0x76]
movzx edx, word [rbp - 0x78]
movzx r10d, word [rbp - 0x80]
movzx r9d, word [rbp - 0x7a]
movzx r8d, word [rbp - 0x7e]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._02d__02d__04d____02d:_02d:_02d
lea rcx, [rbp + 0x300]
call fcn.140006bc0
lea rax, [rbp + 0x300]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140208de0
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x968]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x300]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x200]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
lea rdx, str.__x_
lea rcx, [rbp + 0x200]
call fcn.140006bc0
lea rax, [rbp + 0x200]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140208e53
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x968]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x200]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
mov r9, 0xffffffffffffffff
nop
inc r9
cmp byte [rbx + r9], 0
jne 0x140208e90
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x968]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x968]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [0x140286114]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x70]
lea rax, vtable.CSABEnumFileObjectsFromEnvironmentExpandedRegExp.0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.14000b0b0
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], r14
mov dword [rbp - 0x28], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x30], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp - 0x24], 1
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x500]
call fcn.140249b10
lea rax, vtable.CSABEnvironmentStringsEx.0
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], r15
mov dword [rbp], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 8], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 4], 1
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], r14
mov dword [rbp + 0x18], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp + 0x10], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rbp + 0x1c], 1
mov r9d, 0x410
lea r8, [rbp + 0x500]
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.14003ced0
lea rcx, [rbp + 0x500]
call fcn.140250f2c
mov dword [rbp + 0x970], r14d
movzx eax, word [rbp + 0x500]
mov word [rbp + 0x970], ax
movzx eax, byte [rbp + 0x502]
mov byte [rbp + 0x972], al
lea rcx, [rbp + 0x970]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x14020902f
lea r8, [rbp + 0x970]
lea rdx, [rbp + 0x503]
lea rcx, [rbp - 0x50]
call fcn.14008c690
nop
cmp dword [rbp + 0x1c], 1
jne 0x140209043
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140209043
call fcn.140247060
cmp dword [rbp + 4], 1
jne 0x140209058
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140209058
call fcn.140247060
nop
mov r15, qword [rbp - 0x48]
mov rbx, qword [r15]
cmp rbx, r15
je 0x1402094e6
lea r13, vtable.CSABString.0
nop
mov qword [rsp + 0x58], r13
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x6c], 1
mov rcx, qword [rbx + 0x10]
mov rsi, qword [rcx + 0x18]
test rax, rax
je 0x1402090af
mov rcx, rax
call fcn.140247060
mov qword [rsp + 0x60], r14
test rsi, rsi
je 0x14020952c
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rsi + rax], 0
jne 0x1402090c0
mov dword [rsp + 0x68], eax
lea ecx, [rax + 1]
mov r14d, ecx
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1402090f3
mov r8d, r14d
mov rdx, rsi
mov rcx, rax
call fcn.1402496a0
xor r14d, r14d
cmp dword [0x140337eb0], 0
je 0x1402094ac
mov rax, qword [0x140337ec8]
mov qword [rsp + 0x78], rax
lea rsi, [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov dword [rbp + 0x978], r14d
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x300]
call fcn.140249b10
mov rdx, qword [0x140337ea8]
test rdx, rdx
je 0x14020915f
mov rcx, qword [0x140337ed0]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x68]
cmp eax, 0x4000000
ja 0x1402092d3
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbp - 0x64]
movzx ecx, word [rbp - 0x66]
movzx edx, word [rbp - 0x68]
movzx r10d, word [rbp - 0x70]
movzx r9d, word [rbp - 0x6a]
movzx r8d, word [rbp - 0x6e]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._02d__02d__04d____02d:_02d:_02d
lea rcx, [rbp + 0x300]
call fcn.140006bc0
lea rax, [rbp + 0x300]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x1402091b6
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x978]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x300]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x200]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
lea rdx, str.__x_
lea rcx, [rbp + 0x200]
call fcn.140006bc0
lea rax, [rbp + 0x200]
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rax + r9], 0
jne 0x140209230
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x978]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x200]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [rdi + r9], 0
jne 0x140209270
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x978]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x978]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [0x140286114]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x140337eb0], 0
je 0x1402094ac
mov rax, qword [0x140337ec8]
mov qword [rsp + 0x78], rax
lea rsi, [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov dword [rsp + 0x50], r14d
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x300]
call fcn.140249b10
mov rdx, qword [0x140337ea8]
test rdx, rdx
je 0x140209343
mov rcx, qword [0x140337ed0]
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x68]
cmp eax, 0x4000000
ja 0x1402094a3
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [rbp - 0x54]
movzx ecx, word [rbp - 0x56]
movzx edx, word [rbp - 0x58]
movzx r10d, word [rbp - 0x60]
movzx r9d, word [rbp - 0x5a]
movzx r8d, word [rbp - 0x5e]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._02d__02d__04d____02d:_02d:_02d
lea rcx, [rbp + 0x300]
call fcn.140006bc0
lea rax, [rbp + 0x300]
mov r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp byte [rax + r9], 0
jne 0x1402093a0
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x300]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x200]
call fcn.140249b10
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, eax
lea rdx, str.__x_
lea rcx, [rbp + 0x200]
call fcn.140006bc0
lea rax, [rbp + 0x200]
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140209411
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x200]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, reloc.OLEAUT32.dll_VariantCopyInd
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, [0x140286114]
mov rdx, qword [0x140337ea8]
lea rcx, vtable.CSASApplicationLogManager.0
call fcn.140006950
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdx, rdi
lea rcx, [rbp + 0x90]
call fcn.140004820
mov dword [rbp + 0x88], r14d
mov rbx, qword [rbx]
test rdi, rdi
je 0x1402094d2
mov rcx, rdi
call fcn.140247060
cmp rbx, r15
jne 0x140209070
mov r13, qword [rbp + 0x30]
mov rsi, qword [rbp + 0x960]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.forcescan_extension
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x140209551
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140209551
lea rdx, [0x1402b3c20]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ecx, r14d
test rax, rax
setne cl
mov dword [rbp + 0xf8], ecx
jmp 0x140209558
mov dword [rsp + 0x68], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
jmp 0x1402090f6
mov dword [rbp + 0xf8], r14d
mov rax, qword [rsi + 0x1560]
mov ecx, dword [rax + 0x40]
mov eax, dword [rax + 0x3c]
mov dword [rbp + 0xe4], eax
mov dword [rbp + 0xe8], ecx
mov eax, r14d
test ecx, ecx
setne al
mov dword [rbp + 0xe0], eax
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.scan_minsize
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x140209689
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140209689
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.140251de0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
mov r10, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.scan_maxsize
mov edx, r12d
call qword [r10 + 0x40]
lea r15, vtable.CSABString.0
test eax, eax
je 0x140209690
cmp qword [rsp + 0x40], 0
je 0x140209690
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x6c], 1
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x180]
call fcn.1400e0b40
xor edx, edx
lea r8d, [rdx + 0xa]
test eax, eax
mov rcx, qword [rsp + 0x60]
jne 0x14020964b
mov rcx, qword [rsp + 0x40]
call fcn.140251de0
mov ecx, eax
mov dword [rbp + 0xe4], ebx
mov dword [rbp + 0xe8], eax
mov eax, r14d
test ecx, ecx
setne al
mov dword [rbp + 0xe0], eax
mov qword [rsp + 0x58], r15
add dword [rsp + 0x6c], 0xffffffff
jne 0x140209690
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140209690
call fcn.140247060
jmp 0x140209690
lea r15, vtable.CSABString.0
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.forcescan_filesizevalid
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x1402096d6
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1402096d6
lea rdx, [0x1402b3c20]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ecx, r14d
test rax, rax
setne cl
mov dword [rbp + 0xfc], ecx
jmp 0x1402096dd
mov dword [rbp + 0xfc], r14d
mov dword [rbp + 0xf0], r14d
mov dword [rbp + 0xf4], 0xffffffff
mov dword [rbp + 0xec], 1
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.forcescan_mz_minsize
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x1402097f9
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1402097f9
xor edx, edx
lea r8d, [rdx + 0xa]
call fcn.140251de0
mov ebx, eax
mov rcx, qword [rsp + 0x48]
mov r10, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.forcescan_mz_maxsize
mov edx, r12d
call qword [r10 + 0x40]
test eax, eax
je 0x1402097f9
cmp qword [rsp + 0x40], 0
je 0x1402097f9
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x6c], 1
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
lea rcx, [rbp + 0x180]
call fcn.1400e0b40
xor edx, edx
lea r8d, [rdx + 0xa]
test eax, eax
mov rcx, qword [rsp + 0x60]
jne 0x1402097bd
mov rcx, qword [rsp + 0x40]
call fcn.140251de0
mov ecx, eax
mov dword [rbp + 0xf0], ebx
mov dword [rbp + 0xf4], eax
mov eax, r14d
test ecx, ecx
setne al
mov dword [rbp + 0xec], eax
mov qword [rsp + 0x58], r15
add dword [rsp + 0x6c], 0xffffffff
jne 0x1402097f9
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1402097f9
call fcn.140247060
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.scannonexecutables
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x14020983f
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14020983f
lea rdx, [0x1402b3c20]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
mov ecx, r14d
test rax, rax
setne cl
mov dword [rbp + 0x100], ecx
jmp 0x140209846
mov dword [rbp + 0x100], r14d
cmp dword [0x140350880], 0
je 0x140209875
mov eax, dword [0x140350888]
movabs rcx, 0xc92a69c000
imul rax, rcx
mov dword [rbp + 0x114], eax
shr rax, 0x20
mov dword [rbp + 0x118], eax
jmp 0x1402098c9
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
lea r8, str.days_lastwritten
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
je 0x1402098c9
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1402098c9
call fcn.1402520ac
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
je 0x1402098c9
movabs rax, 0xc92a69c000
imul rcx, rax
mov dword [rbp + 0x114], ecx
shr rcx, 0x20
mov dword [rbp + 0x118], ecx
lea rbx, [rsi + 0x1568]
mov rdi, qword [rbx]
mov rsi, qword [rdi + 8]
lea r9, [rbp + 0x80]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.1402015d0
mov rdx, qword [rbx + 8]
movabs rcx, 0xf83e0f83e0f83d
sub rcx, rdx
cmp rcx, 1
jb 0x140209a9f
lea rcx, [rdx + 1]
mov qword [rbx + 8], rcx
mov qword [rdi + 8], rax
mov qword [rsi], rax
lea rax, vtable.CSABEnumFileObjectsFromEnvironmentExpandedRegExp.0
mov qword [rbp - 0x50], rax
mov rax, qword [rbp - 0x48]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14020994f
nop dword [rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140209947
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rax, qword [rbp - 0x48]
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x140209930
mov qword [rbp - 0x38], r15
add dword [rbp - 0x24], 0xffffffff
jne 0x140209967
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x140209967
call fcn.140247060
lea rcx, [rbp - 0x48]
call fcn.140009af0
mov rsi, qword [rbp + 0x960]
inc r12d
test r13, r13
je 0x140209988
mov rcx, r13
call fcn.140247060
nop
lea rax, vtable.CSASScanner::CDirectoryScanOptions.0
mov qword [rbp + 0x80], rax
lea rcx, [rbp + 0xa8]
call fcn.140201f90
mov qword [rbp + 0x90], r15
add dword [rbp + 0xa4], 0xffffffff
jne 0x1402099c3
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1402099c3
call fcn.140247060
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
lea r9, [rbp - 0x20]
lea r8, [0x140294f68]
mov edx, r12d
call qword [rax + 0x40]
test eax, eax
jne 0x140208bd4
mov rbx, qword [rsp + 0x48]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x140209a0b
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rax, vtable.CSABSQL.0
mov qword [rbp + 0x180], rax
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x140209a52
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x40]
mov qword [rbp + 0x1b0], r14
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea rax, vtable.CSABByteString.0
mov qword [rbp + 0x188], rax
mov edx, 1
mov rcx, qword [rbp + 0x190]
call fcn.140247060
add rsp, 0xa18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3