Function at 0x140013f50
Capabilities:
Delete file
Delete registry value
Enumerate files on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x140106010]
xor rax, rsp
mov qword [rbp + 0x520], rax
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rbp + 0x220], r12
mov qword [rbp + 0x230], r12
mov qword [rbp + 0x238], 0xf
mov byte [rbp + 0x220], r12b
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x198], xmm1
mov qword [rbp + 0x1a8], r12
movdqu xmmword [rbp + 0x1b0], xmm1
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], r12w
lea r8d, [r12 + 6]
lea rdx, [0x1400dfef0]
lea rcx, [rbp + 0x70]
call fcn.140009140
nop
lea r8, [rbp + 0x70]
lea rdx, [0x140107630]
lea rcx, [rbp + 0x1f0]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x14001405d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001512b
call fcn.140091bc0
mov word [rbp + 0x70], r12w
lea rcx, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 8
cmovae rcx, qword [rbp + 0x1f0]
lea rdx, [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x14001509e
movabs r13, 0x7ffffffffffffffe
nop dword [rax]
test byte [rbp + 0x2d0], 0x10
jne 0x140014f1c
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r12w
lea rax, [rbp + 0x2fc]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400140d0
lea rdx, [rbp + 0x2fc]
lea rcx, [rbp + 0x50]
call fcn.140009140
nop
lea r8, [rbp + 0x50]
lea rdx, [0x140107630]
lea rcx, [rbp + 0x140]
call fcn.1400853e0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x140014144
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001413f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015131
call fcn.140091bc0
mov word [rbp + 0x50], r12w
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
call fcn.14007f3e0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140014169
lock inc dword [rcx + 8]
mov rcx, qword [rax + 8]
mov rax, qword [rax]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], rcx
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x140]
call fcn.1400154a0
test al, al
jne 0x1400142d1
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
lea rcx, str.Invalid_file:__s
call fcn.14007de10
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xf0]
call fcn.140085940
cmp qword [rax + 0x18], 8
jb 0x1400141d5
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x140014224
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001421f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015137
call fcn.140091bc0
mov word [rbp + 0xf0], r12w
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x140014282
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140014282
mov rbx, qword [rbp + 0x168]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140014282
mov rcx, qword [rbp + 0x168]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14007fe1f.0]
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x140014f1c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400142c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001513d
call fcn.140091bc0
jmp 0x140014f1c
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov r8d, 7
lea rdx, str.command
lea rcx, [rbp + 0x20]
call fcn.140009300
nop
mov r14, qword [rbp + 0x160]
mov rax, qword [r14]
lea rdx, [rbp + 0x20]
mov rcx, r14
mov rax, qword [rax + 0x48]
call qword [case.0x14007fe1f.0]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14007fe1f.0]
mov rdi, rax
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140014365
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014360
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015143
call fcn.140091bc0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140014382
mov rcx, qword [rdi]
lea rdx, str.clean_threat
call fcn.14009b2d8
test eax, eax
jne 0x140014e3f
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], al
lea r8d, [rax + 0xc]
lea rdx, str.reference_id
lea rcx, [rbp]
call fcn.140009300
nop
mov rax, qword [r14]
lea rdx, [rbp]
mov rcx, r14
mov rax, qword [rax + 0x48]
call qword [case.0x14007fe1f.0]
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rax, qword [rax + 0x38]
call qword [case.0x14007fe1f.0]
mov rsi, rax
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x140014420
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001441b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015149
call fcn.140091bc0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rcx, rsi
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x140014440
mov rcx, qword [rsi]
mov rbx, qword [rsi + 0x10]
add rbx, rcx
cmp rdx, 0x10
jb 0x140014450
mov rsi, qword [rsi]
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x188], r12
mov qword [rbp + 0x190], 7
mov word [rbp + 0x178], r12w
mov rdx, rbx
sub rdx, rsi
lea rcx, [rbp + 0x178]
call fcn.140015ae0
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp + 0x178]
call fcn.1400162f0
nop
mov dword [rbp + 0x1c8], r12d
mov dword [rbp + 0x170], r12d
mov dword [rbp + 0x1cc], 4
xor bl, bl
mov qword [rbp + 0x110], r12
xor r9d, r9d
lea r8, [rbp + 0x120]
mov esi, 1
mov edx, esi
lea rcx, str.D:_A_OICI_FA___SY__A_OICI_FA___BA_
call qword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x140014603
mov dword [rbp + 0x128], 0x18
mov dword [rbp + 0x138], esi
mov rax, qword [rbp + 0x120]
mov qword [rbp + 0x130], rax
lea rdx, [0x1401082c8]
cmp qword [0x1401082e0], 8
cmovae rdx, qword [0x1401082c8]
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x110]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20107
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140014603
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rdx, qword [rbp + 0x178]
lea rax, [rbp + 0x1cc]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1c8]
xor r8d, r8d
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, 0xfffffffd
jne 0x1400145f6
inc dword [rbp + 0x170]
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rdx, qword [rbp + 0x178]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x170]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 3]
xor r8d, r8d
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, bl
cmp dword [rbp + 0x170], 4
cmove ebx, esi
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x140014ae7
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x40], xmm0
mov rsi, qword [rbp + 0x168]
test rsi, rsi
je 0x140014631
lock inc dword [rsi + 8]
mov rsi, qword [rbp + 0x168]
mov r14, qword [rbp + 0x160]
movaps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x178]
lea rcx, [rbp + 0x40]
call fcn.140013dc0
nop
mov qword [rbp + 0x1d0], r12
mov qword [rbp + 0x1e0], r12
mov qword [rbp + 0x1e8], 0xf
mov byte [rbp + 0x1d0], 0
or dword [rsp + 0x50], 1
mov rax, qword [r14]
lea rdx, [rbp + 0x1d0]
mov rcx, r14
mov rax, qword [rax + 0x18]
call qword [case.0x14007fe1f.0]
lea r9, [rbp + 0x1d0]
cmp qword [rbp + 0x1e8], 0x10
cmovae r9, qword [rbp + 0x1d0]
cmp qword [rdi + 0x18], 0x10
jb 0x1400146ab
mov rdi, qword [rdi]
lea r8, str.failed:_reached_maxiumum_attempts_allowed._Request
mov rdx, rdi
lea rcx, str.Command__S____s:__S
call fcn.14007de10
mov qword [rbp + 0x118], r12
lea rdx, [0x1401082c8]
cmp qword [0x1401082e0], 8
cmovae rdx, qword [0x1401082c8]
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014736
lea rdx, [rbp + 0x178]
cmp qword [rbp + 0x190], 8
cmovae rdx, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rbp + 0x150]
cmp rdi, 2
jae 0x1400147f2
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae r14, qword [rbp + 0x140]
cmp rdi, 8
jae 0x14001478b
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
mov ebx, 7
mov qword [rsp + 0x68], rdi
jmp 0x140014a31
mov qword [rbp + 0x90], r13
mov rbx, rdi
or rbx, 7
mov qword [rbp + 0x98], rbx
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14001514f
lfence
add rcx, rcx
call fcn.140009ca0
mov qword [rsp + 0x58], rax
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140096e20
mov rsi, qword [rbp + 0x168]
mov qword [rsp + 0x68], rdi
jmp 0x140014a31
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
setae r8b
mov rdx, qword [rbp + 0x140]
cmovae rcx, rdx
cmp word [rcx], 0x5c
jne 0x14001486c
lea rax, [rbp + 0x140]
test r8b, r8b
cmovne rax, rdx
cmp word [rax + 2], 0x5c
jne 0x14001486c
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov rbx, rdi
lea r14, [rbp + 0x140]
test r8b, r8b
cmovne r14, rdx
cmp rdi, 8
jb 0x140014773
mov qword [rbp + 0xa0], r13
or rbx, 7
mov qword [rbp + 0xa8], rbx
jmp 0x1400147a0
lea rax, [rbp + 0x140]
test r8b, r8b
cmovne rax, rdx
movzx ecx, word [rax]
call fcn.1400a5d14
mov rcx, qword [rbp + 0x158]
mov rdx, qword [rbp + 0x140]
test eax, eax
je 0x140014995
lea rax, [rbp + 0x140]
cmp rcx, 8
cmovae rax, rdx
cmp word [rax + 2], 0x3a
jne 0x140014995
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov r8d, 4
lea rdx, [0x1400e1620]
lea rcx, [rbp - 0x20]
call fcn.140009140
nop
lea rdx, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rdx, qword [rbp + 0x140]
mov r8, qword [rbp + 0x150]
lea rcx, [rbp - 0x20]
call fcn.14000fa80
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
or dword [rsp + 0x50], 6
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x14001497a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014975
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015155
call fcn.140091bc0
mov qword [rbp - 0x10], r12
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r12w
mov rbx, qword [rsp + 0x70]
jmp 0x140014a3b
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov r14, qword [rbp + 0x150]
mov rbx, r14
lea rdi, [rbp + 0x140]
cmp rcx, 8
cmovae rdi, rdx
cmp r14, 8
jae 0x1400149d2
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x58], xmm0
mov ebx, 7
jmp 0x140014a2c
mov qword [rbp + 0xb0], r13
or rbx, 7
mov qword [rbp + 0xb8], rbx
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140015167
lfence
add rcx, rcx
call fcn.140009ca0
mov qword [rsp + 0x58], rax
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.140096e20
mov rsi, qword [rbp + 0x168]
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rbx
or dword [rsp + 0x50], 2
lea rcx, [rsp + 0x58]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140014a92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014a8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001515b
call fcn.140091bc0
mov word [rsp + 0x58], r12w
and dword [rsp + 0x50], 0xfffffffe
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0x10
jb 0x140014e13
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014add
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015161
call fcn.140091bc0
jmp 0x140014e13
lea rcx, [rbp + 0x160]
call fcn.140015330
lea r9, [rbp + 0x140]
test al, al
je 0x140014cae
cmp qword [rbp + 0x158], 8
cmovae r9, qword [rbp + 0x140]
cmp qword [rdi + 0x18], 0x10
jb 0x140014b1c
mov rdi, qword [rdi]
lea r8, str.SystemClean
mov rdx, rdi
lea rcx, str.Command__S____s:__s
call fcn.14007de10
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r12
mov rdi, qword [rbp + 0x150]
lea rsi, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rsi, qword [rbp + 0x140]
cmp rdi, 8
jae 0x140014b73
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x68], 7
jmp 0x140014bcc
mov qword [rbp + 0xc0], r13
mov rbx, rdi
or rbx, 7
mov qword [rbp + 0xc8], rbx
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140015125
lfence
add rcx, rcx
call fcn.140009ca0
mov qword [rbp - 0x80], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140096e20
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rdi
mov rsi, qword [rbp + 0x168]
test rsi, rsi
je 0x140014be7
lock inc dword [rsi + 8]
mov rsi, qword [rbp + 0x168]
mov rax, qword [rbp + 0x160]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rsi
mov rdx, qword [rbp + 0x1a0]
cmp rdx, qword [rbp + 0x1a8]
je 0x140014c40
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r12w
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
add qword [rbp + 0x1a0], 0x30
jmp 0x140014c51
lea r8, [rbp - 0x80]
lea rcx, [rbp + 0x198]
call fcn.140016020
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140014ca5
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140014c9e
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14007fe1f.0]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140014c9e
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14007fe1f.0]
nop
mov rsi, qword [rbp + 0x168]
lea rcx, [rbp - 0x80]
jmp 0x140014e0d
cmp qword [rbp + 0x158], 8
cmovae r9, qword [rbp + 0x140]
cmp qword [rdi + 0x18], 0x10
jb 0x140014cc8
mov rdi, qword [rdi]
lea r8, str.TargetClean
mov rdx, rdi
lea rcx, str.Command__S____s:__s
call fcn.14007de10
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r12
mov rdi, qword [rbp + 0x150]
lea rsi, [rbp + 0x140]
cmp qword [rbp + 0x158], 8
cmovae rsi, qword [rbp + 0x140]
cmp rdi, 8
jae 0x140014d1f
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x38], 7
jmp 0x140014d76
mov qword [rbp + 0xd0], r13
mov rbx, rdi
or rbx, 7
mov qword [rsp + 0x78], rbx
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140015125
lfence
add rcx, rcx
call fcn.140009ca0
mov qword [rbp - 0x50], rax
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140096e20
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x40], rdi
mov rsi, qword [rbp + 0x168]
test rsi, rsi
je 0x140014d91
lock inc dword [rsi + 8]
mov rsi, qword [rbp + 0x168]
mov rax, qword [rbp + 0x160]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rsi
mov rdx, qword [rbp + 0x1b8]
cmp rdx, qword [rbp + 0x1c0]
je 0x140014dea
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp - 0x40]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r12w
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
add qword [rbp + 0x1b8], 0x30
jmp 0x140014dfb
lea r8, [rbp - 0x50]
lea rcx, [rbp + 0x1b0]
call fcn.140016020
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140014e09
call fcn.140002870
lea rcx, [rbp - 0x50]
call fcn.1400090d0
nop
mov r8, qword [rbp + 0x190]
cmp r8, 8
jb 0x140014eeb
inc r8
mov rdx, qword [rbp + 0x178]
lea rcx, [rbp + 0x178]
call fcn.140009640
jmp 0x140014eeb
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140014e4c
mov rcx, qword [rdi]
lea rdx, str.rescan_quarantine
call fcn.14009b2d8
lea r9, [rbp + 0x140]
test eax, eax
jne 0x140014ea8
cmp qword [rbp + 0x158], 8
cmovae r9, qword [rbp + 0x140]
cmp qword [rdi + 0x18], 0x10
jb 0x140014e7d
mov rdi, qword [rdi]
lea r8, str.Verify_now
mov rdx, rdi
lea rcx, str.Command__S____s:__s
call fcn.14007de10
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x140]
call fcn.140003950
jmp 0x140014ee4
cmp qword [rbp + 0x158], 8
cmovae r9, qword [rbp + 0x140]
cmp qword [rdi + 0x18], 0x10
jb 0x140014ec2
mov rdi, qword [rdi]
lea r8, str.Not_supported
mov rdx, rdi
lea rcx, str.Command__S____s:__s
call fcn.14007de10
lea rcx, [rbp + 0x140]
call fcn.14007c850
mov rsi, qword [rbp + 0x168]
test rsi, rsi
je 0x140014ef9
mov rcx, rsi
call fcn.140002870
nop
mov r8, qword [rbp + 0x158]
cmp r8, 8
jb 0x140014f1c
inc r8
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x140]
call fcn.140009640
lea rdx, [rbp + 0x2d0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400140a0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r14, qword [rbp + 0x1b8]
mov rcx, r14
mov rdi, qword [rbp + 0x1b0]
sub rcx, rdi
movabs r15, 0x2aaaaaaaaaaaaaab
mov rax, r15
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140015065
mov rbx, r12
cmp rdi, r14
je 0x14001505d
mov r13d, 1
nop word [rax + rax]
lea rdx, [rdi + 0x20]
lea rcx, [rbp + 0x240]
call fcn.140033510
nop
test rbx, rbx
jne 0x140015009
lea rcx, [rbp + 0x210]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x140014fbc
mov rbx, r12
jmp 0x140015009
mov ecx, 0xa8
call fcn.140091bc8
mov rbx, rax
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0xa8
mov rcx, rax
call fcn.140096c20
movaps xmm0, xmmword [rbp + 0x210]
movdqa xmmword [rbp + 0xe0], xmm0
mov r8d, r13d
lea rdx, [rbp + 0xe0]
mov rcx, rbx
call fcn.1400318a0
mov rbx, rax
mov dword [rax + 0x24], 4
lea r9, [rdi + 0x20]
lea r8, [rbp + 0x240]
mov rdx, rdi
mov rcx, rbx
call fcn.140031ac0
nop
lea rcx, [rbp + 0x2a8]
call fcn.1400090d0
lea rcx, [rbp + 0x288]
call fcn.1400090d0
lea rcx, [rbp + 0x268]
call fcn.1400090d0
lea rcx, [rbp + 0x248]
call fcn.1400090d0
add rdi, 0x30
cmp rdi, r14
jne 0x140014f90
mov rcx, rbx
call fcn.140015170
mov rcx, qword [rbp + 0x1a0]
sub rcx, qword [rbp + 0x198]
mov rax, r15
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14001509e
lea rcx, [rbp + 0x198]
call fcn.140011ba0
mov rcx, rax
call fcn.140015170
nop
mov r8, qword [rbp + 0x208]
cmp r8, 8
jb 0x1400150c1
inc r8
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1f0]
call fcn.140009640
mov qword [rbp + 0x200], r12
mov qword [rbp + 0x208], 7
mov word [rbp + 0x1f0], r12w
lea rcx, [rbp + 0x1b0]
call fcn.140015940
nop
lea rcx, [rbp + 0x198]
call fcn.140015940
nop
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.140091ba0
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400026e0
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.14009b188
int3
call fcn.14009b188
nop
call fcn.1400026e0
int3
call fcn.14009b188
int3
call fcn.14009b188
nop
call fcn.14009b188
nop
call fcn.1400026e0
int3