Function at 0x14000c160
Capabilities:
Encode data using xor
Enumerate files on windows
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x458]
sub rsp, 0x530
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14004c040]
xor rax, rsp
mov qword [rbp + 0x400], rax
xor r12d, r12d
mov dword [rsp + 0x44], r12d
lea rcx, [rbp + 0x170]
call fcn.140032030
test al, al
jne 0x14000c1df
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000e800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000d409
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r12
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0x30]
call fcn.140003930
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rbp + 0x40]
sub rax, r15
cmp rax, 1
jb 0x14000d449
lea r14, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r14, qword [rbp + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
lea rsi, [r15 + 1]
mov ebx, 7
lea rdi, [rbp + 0xf0]
movabs rax, 0x7fffffffffffffff
lea edx, [rbx + 3]
cmp rsi, rbx
jbe 0x14000c2e2
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x14000c27d
mov rbx, rcx
lea rcx, [rax + rax]
jmp 0x14000c29d
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000d44f
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000c2c9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000d44f
mov rcx, rax
call fcn.140033fe8
test rax, rax
je 0x14000c37c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000c2db
test rcx, rcx
je 0x14000c2d8
call fcn.140033fe8
mov rdi, rax
jmp 0x14000c2db
mov rdi, r12
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rbx], 0x2a
xor r14d, r14d
mov word [rdi + rsi*2], r14w
lea r13d, [r14 + 0x40]
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rcx, qword [rbp + 0xf0]
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
mov qword [rbp - 0x58], rax
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x14000c388
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c383
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c383
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140033ec0
movdqa xmm0, xmmword [0x1400412f0]
movdqu xmmword [rbp + 0x100], xmm0
mov word [rbp + 0xf0], r14w
cmp r12, 0xffffffffffffffff
jne 0x14000c3ce
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ada0
lea rdx, [0x14000e800]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000d3c6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140005860
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x50]
call fcn.140005590
nop
nop dword [rax]
cmp dword [rbp + 0x1b0], 0x10
je 0x14000d2d1
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r14
mov qword [rbp + 0x88], r14
lea rax, [rbp + 0x1dc]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c450
lea rdx, [rbp + 0x1dc]
lea rcx, [rbp + 0x70]
call fcn.140003930
nop
lea r11, [rbp + 0x70]
mov rsi, qword [rbp + 0x88]
cmp rsi, 7
seta r14b
mov r10, qword [rbp + 0x70]
cmova r11, r10
mov rdi, qword [rbp + 0x80]
cmp rdi, 4
jb 0x14000d294
lea rbx, [rdi - 3]
lea rbx, [r11 + rbx*2]
mov rcx, r11
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14000c4dc
cmp word [rcx], 0x2e
je 0x14000c4d9
cmp rax, 1
je 0x14000c4dc
dec rax
add rcx, 2
cmp word [rcx], 0x2e
jne 0x14000c4c6
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14000d294
mov r8d, 4
lea rax, str..EXE
mov rdx, rax
mov r9, rcx
sub r9, rax
nop
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x14000c883
add rdx, 2
sub r8, 1
jne 0x14000c500
sub rcx, r11
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14000d294
movabs rax, 0x7ffffffffffffffe
sub rax, r15
cmp rax, rdi
jb 0x14000d443
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
lea rax, [rbp + 0x70]
test r14b, r14b
cmovne rax, r10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea rcx, [rbp + 0x150]
call fcn.140006330
or r13d, 0x20
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x1c4]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x1a0]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x14000d200
movabs r14, 0x7ffffffffffffffe
mov rax, r14
mov rcx, qword [rbp + 0x40]
sub rax, rcx
mov rdx, qword [rbp + 0x80]
cmp rax, rdx
jb 0x14000d46d
lea r9, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova r9, qword [rbp + 0x30]
lea rax, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rax, qword [rbp + 0x70]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xd0]
call fcn.140006330
bts r13d, 8
mov dword [rsp + 0x44], r13d
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova r8, qword [rbp + 0xd0]
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r15 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0xb0]
call fcn.14000e400
nop
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rcx, qword [rbp + 0xb0]
lea r8, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 7
cmova r8, qword [rbp + 0xd0]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r15 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0xb0]
lea rcx, [rsp + 0x48]
call fcn.14000b1b0
nop
mov rcx, qword [rsp + 0x48]
cmp rcx, qword [rsp + 0x50]
jne 0x14000c88c
test rcx, rcx
je 0x14000c736
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c722
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d37a
call fcn.140033ec0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14000c777
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c772
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d381
call fcn.140033ec0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x14000c7d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c7d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d388
call fcn.140033ec0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x14000c837
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c831
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d33b
call fcn.140033ec0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000c87a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c875
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d342
call fcn.140033ec0
mov r15, qword [rbp + 0x40]
jmp 0x14000d2ce
add rcx, 2
jmp 0x14000c4b0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.14000b680
nop
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x60], rbx
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x60], rax
cmp rbx, rax
je 0x14000d0c9
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], r15
lea rax, [rbp + 0x1dc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c8f0
lea rdx, [rbp + 0x1dc]
lea rcx, [rbp + 0x110]
call fcn.140003930
nop
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 7
seta r10b
mov r9, qword [rbp + 0x110]
cmova rdx, r9
mov rdi, qword [rbp + 0x120]
test rdi, rdi
je 0x14000c96b
mov rax, rdi
mov rcx, rdx
mov r8, r15
cmp word [rdx], 0x2d
je 0x14000c95b
cmp rax, 1
je 0x14000c95e
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x14000c948
mov r8, rcx
test r8, r8
je 0x14000c96b
sub r8, rdx
sar r8, 1
jmp 0x14000c972
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x14000c9d4
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp + 0x110]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0x90]
call fcn.140003930
bts r13d, 7
lea rax, [rbp + 0x90]
or r13d, 1
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xa8]
jmp 0x14000cace
movups xmmword [rbp + 0x50], xmm0
lea rsi, [rbp + 0x110]
test r10b, r10b
cmovne rsi, r9
cmp rdi, r14
ja 0x14000d467
cmp rdi, 7
ja 0x14000ca0d
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], 7
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x50], xmm0
jmp 0x14000cabe
mov rbx, rdi
or rbx, 7
cmp rbx, r14
jbe 0x14000ca2c
mov rbx, r14
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000ca5c
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000d461
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000ca8b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000d461
mov rcx, rax
call fcn.140033fe8
mov rcx, rax
test rax, rax
je 0x14000d365
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000ca9a
test rcx, rcx
je 0x14000ca97
call fcn.140033fe8
jmp 0x14000ca9a
mov rax, r15
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x60]
lea rax, [rbp + 0x50]
or r13d, 2
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x68]
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x180], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x190], xmm6
mov qword [rcx], r15
mov qword [rdx], 7
mov word [rax], r15w
test r13b, 2
je 0x14000cb3c
and r13d, 0xfffffffd
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000cb3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d349
call fcn.140033ec0
nop
test r13b, 1
je 0x14000cb8c
and r13d, 0xfffffffe
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000cb8c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d35e
call fcn.140033ec0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r15
mov qword [rbp + 0xa8], r15
mov rax, qword [rbx + 0x10]
cmp rax, 0x23
jb 0x14000d45b
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000cbd1
mov rdx, qword [rbx]
add rdx, 0x46
lea rcx, [rbp + 0x90]
call fcn.140003930
or r13d, 0x10
mov rdx, rbx
lea rcx, [rbp + 0x50]
call fcn.14000b900
nop
lea r9, [rbp + 0x90]
mov r8, rax
lea rcx, [rbp + 0x10]
call fcn.14000eea0
or r13d, 8
mov dword [rsp + 0x44], r13d
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000cc4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d350
call fcn.140033ec0
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r15w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x14000cca5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cca0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d357
call fcn.140033ec0
lea r11, [rbp + 0x180]
movdqa xmm0, xmm6
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rbp - 0x70], rcx
cmp rcx, 7
seta byte [rsp + 0x41]
movq rax, xmm7
mov qword [rbp - 0x68], rax
cmova r11, rax
lea r12, [rbp + 0x10]
mov r14, qword [rbp + 0x28]
cmp r14, 7
seta r9b
mov byte [rsp + 0x40], r9b
mov rsi, qword [rbp + 0x10]
cmova r12, rsi
movq rbx, xmm6
mov rdi, qword [rbp + 0x20]
cmp rbx, rdi
ja 0x14000cfc5
mov rax, rdi
sub rax, rbx
test rbx, rbx
je 0x14000cda1
inc rax
lea r15, [r12 + rax*2]
mov rax, r12
movzx r10d, word [r11]
mov rcx, r15
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14000cd4c
cmp word [rax], r10w
je 0x14000cd49
cmp rcx, 1
je 0x14000cd4c
dec rcx
add rax, 2
cmp word [rax], r10w
jne 0x14000cd36
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000cfc2
mov r8, rbx
mov rdx, r11
test rbx, rbx
je 0x14000cd88
mov r9, rax
sub r9, r11
nop dword [rax]
movzx ecx, word [r9 + rdx]
cmp cx, word [rdx]
jne 0x14000ced4
add rdx, 2
sub r8, 1
jne 0x14000cd70
sub rax, r12
sar rax, 1
xor r15d, r15d
cmp rax, 0xffffffffffffffff
je 0x14000cfc5
movzx r9d, byte [rsp + 0x40]
lea rdx, [rbp + 0x10]
test r9b, r9b
cmovne rdx, rsi
movabs r9, 0xcbf29ce484222325
lea r8, [rdi + rdi]
mov rcx, r15
test r8, r8
je 0x14000cde7
movabs r14, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r14
inc rcx
cmp rcx, r8
jb 0x14000cdd0
mov r14, qword [rbp + 0x28]
lea r8, [rbp + 0x10]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x50]
call fcn.140006720
mov rcx, qword [rax + 8]
mov rax, qword [rbp - 0x48]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rbp - 0x48]
jne 0x14000cee9
cmp rdi, 4
jb 0x14000cee9
lea rcx, [rdi - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], r15
cmp rdi, rcx
jb 0x14000d455
sub rdi, rcx
mov r8, 0xffffffffffffffff
cmp rdi, r8
cmovb r8, rdi
lea rax, [rbp + 0x10]
cmp byte [rsp + 0x40], 0
cmovne rax, rsi
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x130]
call fcn.140003930
or r13d, 0x204
mov dword [rsp + 0x44], r13d
lea r8, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x140]
cmp rdx, 4
jne 0x14000cedd
lea rax, str..EXE
mov rcx, rax
test rdx, rdx
je 0x14000cec4
sub r8, rax
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000cedd
add rcx, 2
sub rdx, 1
jne 0x14000ceb0
mov bl, 1
mov r14, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x10]
jmp 0x14000ceeb
add rax, 2
jmp 0x14000cd20
mov r14, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x10]
xor bl, bl
test r13b, 4
je 0x14000cf1f
and r13d, 0xfffffffb
mov dword [rsp + 0x44], r13d
mov r8, qword [rbp + 0x148]
cmp r8, 7
jbe 0x14000cf1f
mov rdx, qword [rbp + 0x130]
call fcn.1400030f0
mov r14, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x10]
test bl, bl
je 0x14000cfc5
lea rcx, [rbp + 0x10]
cmp r14, 7
cmova rcx, rsi
mov qword [rsp + 0x20], 0xb
lea r9, str.UnknownDisk
xor r8d, r8d
mov rdx, rdi
call fcn.140003840
cmp rax, 0xffffffffffffffff
je 0x14000cf5d
lea rdx, str.___Executed_file:
jmp 0x14000cf71
lea rdx, [rbp + 0x10]
call fcn.140032470
test al, al
jne 0x14000cfa7
lea rdx, [0x140037f10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400032c0
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
mov r8, qword [rbp + 0x20]
cmova rdx, qword [rbp + 0x10]
mov rcx, rax
call fcn.140003f60
lea rdx, [0x140005ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp + 0x10]
lea rdx, [rbp]
lea rcx, [rbp - 0x50]
call fcn.14000e840
mov r14, qword [rbp + 0x28]
mov rsi, qword [rbp + 0x10]
jmp 0x14000cfc5
xor r15d, r15d
cmp r14, 7
jbe 0x14000d000
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000cff8
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d35e
mov rcx, rsi
call fcn.140033ec0
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r15w
cmp byte [rsp + 0x41], 0
je 0x14000d053
mov rdx, qword [rbp - 0x70]
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d04d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d365
call fcn.140033ec0
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 7
jbe 0x14000d099
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d094
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d36c
call fcn.140033ec0
mov rbx, qword [rsp + 0x60]
add rbx, 0x20
mov qword [rsp + 0x60], rbx
cmp rbx, qword [rbp - 0x60]
movabs r14, 0x7ffffffffffffffe
jne 0x14000c8c0
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rbp - 0x58]
test rbx, rbx
je 0x14000d114
mov rdx, rax
mov rcx, rbx
call fcn.140009760
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d10e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d373
call fcn.140033ec0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000d15f
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d14b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d37a
call fcn.140033ec0
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x14000d1a0
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d19b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d381
call fcn.140033ec0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 7
jbe 0x14000d200
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d1fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d388
call fcn.140033ec0
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x14000d247
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d241
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d38f
call fcn.140033ec0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x14000c87a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d289
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d396
call fcn.140033ec0
mov r15, qword [rbp + 0x40]
jmp 0x14000d2ce
test r14b, r14b
je 0x14000d2ce
lea rdx, [rsi*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14000d2c6
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d396
mov rcx, r10
call fcn.140033ec0
xor r14d, r14d
lea rdx, [rbp + 0x1b0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000c420
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x14000d3ae
mov rax, qword [rbp - 0x28]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d39d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d39d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140033ec0
mov qword [rbp - 0x38], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov rdx, qword [rbp - 0x48]
call fcn.140005dd0
mov edx, 0x30
mov rcx, qword [rbp - 0x48]
call fcn.140033ec0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe 0x14000d409
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d404
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000d404
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140033ec0
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140033ea0
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002290
nop
call fcn.140002290
int3
call fcn.1400021f0
nop
call fcn.140003140
nop
call fcn.140003140
nop
call fcn.1400021f0
int3
call fcn.140002290
nop
call fcn.140002290
int3