Function at 0x140013530
Capabilities:
Enumerate files on windows
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x910]
sub rsp, 0xa10
mov rax, qword [0x14009c020]
xor rax, rsp
mov qword [rbp + 0x900], rax
movzx edi, r9b
mov r12d, r8d
mov r13, rdx
mov r15, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x6b0]
call fcn.14004b2f0
nop
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rax, [0x14009cc90]
mov qword [rbp - 0x58], rax
mov word [rbp - 0x38], 0
mov dword [rbp - 0x30], 0xabcd
mov dword [rbp - 0x24], 0xabcd
lea rax, [rbp - 0x58]
mov qword [rbp - 0x2c], rax
mov dword [rbp + 0x1ea], 0xabcd
lea rax, [rbp - 0x20]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x48], 0x104
mov qword [rbp - 0x40], 0x104
xor esi, esi
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x20], si
lea rax, [rbp - 0x20]
mov qword [rbp - 0x68], rax
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.140007410
nop
mov r14d, esi
mov dword [rsp + 0x34], esi
lea rcx, [rbp - 0x70]
call fcn.140006480
mov rbx, r13
test r13, r13
je 0x140013686
cmp word [r13], r14w
je 0x140013686
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140013665
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x140013665
mov r8, qword [rdx + 8]
test r8, r8
je 0x140013665
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x140013f87
cmp word [rcx + rax*2], 0x5c
je 0x140013665
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x140013f87
cmp word [rcx + rax*2], 0x2f
je 0x140013665
lea edx, [rsi + 0x5c]
lea rcx, [rbp - 0x70]
call fcn.140006fb0
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140013674
cmp ax, 0x2f
jne 0x14001367a
add rbx, 2
jmp 0x140013665
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140007130
lea rbx, str..gpx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400136e4
mov r8, qword [rcx - 0xc]
test r8, r8
je 0x1400136e4
mov r9, qword [r8 + 8]
test r9, r9
je 0x1400136e4
movsxd rax, r9d
dec rax
cmp rax, qword [r8 + 0x10]
ja 0x140013f87
cmp word [rcx + rax*2], 0x5c
je 0x1400136e4
movsxd rax, r9d
dec rax
cmp rax, qword [r8 + 0x10]
ja 0x140013f87
cmp word [rcx + rax*2], 0x2f
je 0x1400136e4
mov edx, 0x5c
lea rcx, [rbp - 0x70]
call fcn.140006fb0
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x1400136f3
cmp ax, 0x2f
jne 0x1400136f9
add rbx, 2
jmp 0x1400136e4
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140007130
lea rcx, [0x14008d480]
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
jne 0x140013740
lea edx, [rcx + 0x40]
lea rcx, [rbp - 0x70]
call fcn.140007630
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, rsi
mov rcx, qword [rbp - 0x70]
cmp word [rcx], si
je 0x14001375c
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140013752
test rcx, rcx
je 0x140013770
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x140013770
mov r8, qword [rdx + 0x10]
jmp 0x140013773
mov r8, rsi
cmp rax, r8
ja 0x140013f87
test rcx, rcx
je 0x140013787
mov rdx, qword [rcx - 0xc]
jmp 0x14001378a
mov rdx, rsi
mov qword [rdx + 8], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400137cc
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x1400137cc
cmp dword [rcx - 0x10], 0xabcd
jne 0x140013f87
cmp dword [rcx - 4], 0xabcd
jne 0x140013f87
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140013f87
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov ecx, 0x280
call fcn.140048438
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x48], rax
cmp rbx, 0xffffffffffffffff
je 0x1400139eb
nop
test byte [rbp + 0x6b0], 0x10
jne 0x1400139c5
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x6dc]
mov rdx, r13
mov rcx, r15
call fcn.14000ef70
test al, al
jne 0x1400139c5
test dil, dil
je 0x140013840
cmp byte [rsp + 0x30], al
je 0x1400139c5
lea rax, [rbp + 0x210]
mov qword [rbp + 0x200], rax
lea rax, [0x14009cc90]
mov qword [rbp + 0x208], rax
mov word [rbp + 0x228], 0
mov dword [rbp + 0x230], 0xabcd
mov dword [rbp + 0x23c], 0xabcd
lea rax, [rbp + 0x208]
mov qword [rbp + 0x234], rax
mov dword [rbp + 0x44a], 0xabcd
lea rax, [rbp + 0x240]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x218], 0x104
mov qword [rbp + 0x220], 0x104
mov qword [rbp + 0x210], rsi
mov word [rbp + 0x240], si
lea rax, [rbp + 0x240]
mov qword [rbp + 0x1f8], rax
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0x6dc]
lea rcx, [rbp + 0x1f0]
call fcn.140007510
test al, al
je 0x140013f91
mov rcx, qword [rbp + 0x1f0]
test rcx, rcx
je 0x140013934
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140013934
cmp dword [rcx - 0x10], 0xabcd
jne 0x140013f91
cmp dword [rcx - 4], 0xabcd
jne 0x140013f91
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140013f91
test rcx, rcx
je 0x140013981
call fcn.140056b9c
mov rdx, qword [rbp + 0x1f0]
test rdx, rdx
je 0x140013981
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x140013988
cmp dword [rdx - 0x10], 0xabcd
jne 0x140013f7d
cmp dword [rdx - 4], 0xabcd
jne 0x140013f7d
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x140013f7d
jmp 0x140013988
lea rdx, [0x14008d480]
lea rcx, [rbp + 0x450]
call fcn.140006700
nop
lea r8, [rbp + 0x450]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.140015bf0
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
nop
lea rcx, [rbp + 0x1f0]
call fcn.140006d00
lea rdx, [rbp + 0x6b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140013800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [rsp + 0x48]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140013f36
nop word [rax + rax]
mov rax, qword [rbx + 0x20]
lea rdi, [0x14008d480]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
lea rcx, str.run_script__s
call fcn.14000b8f0
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
mov rax, qword [rbx + 0x20]
mov rdx, rdi
test rax, rax
cmovne rdx, rax
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x140013a81
lea rcx, [rsp + 0x70]
call fcn.14000b2e0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140015d80
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140013ae8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140013ae3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013f9b
call fcn.140048430
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140013d29
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140013d29
cmp qword [rax + 8], 0
jbe 0x140013d29
lea rdx, str..timeout.
call fcn.14004a854
mov r14, rax
test rax, rax
je 0x140013d24
mov rcx, qword [rbx + 0x20]
mov rax, rdi
test rcx, rcx
cmovne rax, rcx
sub r14, rax
sar r14, 1
cmp r14, 0xffffffffffffffff
je 0x140013d24
add r14, 9
test rcx, rcx
je 0x140013d24
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140013d24
cmp r14, qword [rax + 8]
jae 0x140013d24
lea rcx, [rcx + r14*2]
lea rdx, [0x14008eafc]
call fcn.14004a854
mov rsi, rax
test rax, rax
je 0x140013d24
mov rcx, qword [rbx + 0x20]
mov rax, rdi
test rcx, rcx
cmovne rax, rcx
sub rsi, rax
sar rsi, 1
cmp rsi, 0xffffffffffffffff
je 0x140013d24
mov rax, rdi
test rcx, rcx
cmovne rax, rcx
lea rdx, [rax + r14*2]
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
test rdx, rdx
jne 0x140013bdf
call fcn.140007410
mov rdi, qword [rsp + 0x38]
jmp 0x140013c32
mov r8, 0xffffffffffffffff
call fcn.140007510
test al, al
je 0x140013fb5
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140013c32
mov rax, qword [rdi - 0xc]
test rax, rax
je 0x140013c32
cmp dword [rdi - 0x10], 0xabcd
jne 0x140013fb5
cmp dword [rdi - 4], 0xabcd
jne 0x140013fb5
mov rax, qword [rax + 0x10]
cmp dword [rdi + rax*2 + 2], 0xabcd
jne 0x140013fb5
sub rsi, r14
test rdi, rdi
je 0x140013c52
mov rcx, qword [rdi - 0xc]
test rcx, rcx
je 0x140013c52
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x140013c78
jmp 0x140013c59
mov edx, 0x40
xor ecx, ecx
mov rax, rcx
neg rax
cmp rax, rdx
cmovae rdx, rax
add rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140007630
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x140013c8e
mov rax, qword [rdi - 0xc]
test rax, rax
je 0x140013c8e
mov rcx, qword [rax + 0x10]
xor eax, eax
jmp 0x140013c92
xor eax, eax
mov ecx, eax
cmp rsi, rcx
ja 0x140013fab
mov word [rdi + rsi*2], ax
test rdi, rdi
je 0x140013cc6
mov rax, qword [rdi - 0xc]
test rax, rax
je 0x140013cc1
cmp qword [rax + 8], rsi
jbe 0x140013cc1
cmp rsi, qword [rax + 0x10]
ja 0x140013fab
mov qword [rax + 8], rsi
mov rcx, rdi
jmp 0x140013ccd
lea rcx, [0x14008d480]
call fcn.140055b34
test eax, eax
cmovne r12d, eax
test rdi, rdi
je 0x140013d12
mov rax, qword [rdi - 0xc]
test rax, rax
je 0x140013d12
cmp dword [rdi - 0x10], 0xabcd
jne 0x140013fa1
cmp dword [rdi - 4], 0xabcd
jne 0x140013fa1
mov rax, qword [rax + 0x10]
cmp dword [rdi + rax*2 + 2], 0xabcd
jne 0x140013fa1
lea rcx, [rsp + 0x38]
call fcn.14000c390
nop
lea rdi, [0x14008d480]
mov r14d, dword [rsp + 0x34]
mov rax, qword [rbx + 0x20]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
mov r8d, r12d
call fcn.14000f580
mov esi, eax
lea rcx, [rbp + 0x450]
call fcn.140006d00
mov rax, qword [rbx + 0x20]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
mov r8d, esi
lea rcx, str.run_script__s____0x_x
call fcn.14000b8f0
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140013e1a
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140013e1a
cmp qword [rax + 8], 0
jbe 0x140013e1a
lea rdx, str..check.
call fcn.14004a854
mov rdx, rax
mov rcx, qword [rbx + 0x20]
test rax, rax
je 0x140013e1a
mov rax, rdi
test rcx, rcx
cmovne rax, rcx
sub rdx, rax
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140013e1a
cmp esi, 0x5bb
je 0x140013f0d
xor eax, eax
mov edi, eax
test esi, esi
sete dil
add r14d, edi
mov dword [rsp + 0x34], r14d
lea r8, [0x14008d480]
test rcx, rcx
cmovne r8, rcx
mov byte [rsp + 0x20], al
mov r9d, esi
mov rdx, r13
mov rcx, r15
call fcn.14000f210
inc dword [r15 + 0x4bc]
add dword [r15 + 0x4c0], edi
mov rdi, qword [rsp + 0x58]
test rdi, rdi
je 0x140013eaa
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.140016440
mov rdx, qword [rsp + 0x68]
sub rdx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rdi
cmp rdx, 0x1000
jb 0x140013ea2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013f77
mov rcx, rdi
call fcn.140048430
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140013ed8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140013ed3
nop
cmp rbx, qword [rax + 0x10]
jne 0x140013ed3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140013ec0
mov rbx, rax
jmp 0x140013eff
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140013eff
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140013ef0
cmp rbx, qword [rsp + 0x48]
je 0x140013f36
xor esi, esi
jmp 0x140013a00
mov rcx, r15
call fcn.1400101d0
xor r9d, r9d
mov edx, 0xfffff825
lea r8d, [r9 + 4]
lea rcx, str.Installation_end__d__d__d_n
call fcn.14000bc30
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x48]
call fcn.140014c00
nop
lea rcx, [rbp - 0x70]
call fcn.140006d00
mov eax, r14d
mov rcx, qword [rbp + 0x900]
xor rcx, rsp
call fcn.140048410
mov rbx, qword [rsp + 0xa68]
add rsp, 0xa10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140054034
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
call fcn.140054034
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
int3