Function at 0x140006b40
Capabilities:
Create process on windows
Delete file
Enumerate process modules
Get common file path
Get disk information
Set console window title
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3960]
mov eax, 0x3a60
call fcn.140010db0
sub rsp, rax
movaps xmmword [rsp + 0x3a50], xmm6
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x3940], rax
xor esi, esi
mov r12d, esi
mov dword [rbp - 0x20], esi
lea rcx, str.GloryRust____discord.gg_f8dpNWHuKY
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rdx, str.Checker_for_GloryRust__3
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400161e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x1400161e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Select_an_action:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140016218]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.1___Checking_the_game
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.2___Steam_account_checker
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.3___Check_of_all_processes
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.4___LastActivityView
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.5___Checking_the_hash_of_the_program
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.6___USBDeview
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.7___BrowsingHistoryView
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.8___Detect_AntiChecker
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.9___Checking_for_file_deletion
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x140016218]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Enter_the_action_number:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
lea rdx, [rbp + 0x1a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
mov eax, dword [rbp + 0x1a0]
dec eax
cmp eax, 9
ja case.0x140006df3.10
cdqe
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x9254]
add rcx, rdx
jmp rcx
lea rcx, [rbp + 0x58]
call fcn.14000b6b0
nop
lea rcx, [rbp + 0x3300]
call fcn.140009340
lea rcx, [rbp + 0x3300]
call fcn.140009350
nop
cmp qword [rbp + 0x3388], 0
jne 0x140006e30
lea rdx, str.______Error_opening_file_for_writing.
jmp 0x140007463
lea rdx, str.Enter_the_process_name__for_example__RustClient.exe_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
lea rdx, [rbp + 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d240
lea r8, [rbp - 0x18]
mov edx, 0x1000
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x14000745c
mov r15d, dword [rbp - 0x18]
shr r15d, 2
mov ebx, esi
test r15d, r15d
je 0x140006f32
lea r14, [rbp + 0x1f0]
nop dword [rax + rax]
mov r8d, dword [r14]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140006f23
lea r9, [rbp - 0x18]
mov r8d, 8
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140006f1a
mov r9d, 0x104
lea r8, [rbp + 0x3620]
mov rdx, qword [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov r9d, 0x104
lea r8, [rbp + 0x3830]
mov rdx, qword [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rdx, qword [rbp + 0x58]
lea rcx, [rbp + 0x3830]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140006fdb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
add r14, 4
cmp ebx, r15d
jb 0x140006e90
lea rdx, str.______The_process_was_not_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0xf
cmova rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
mov rcx, rax
call fcn.14000ec30
lea rdx, [0x14000ccd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Do_you_want_to_try_again___y_n_:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d420
cmp byte [rsp + 0x40], 0x6e
jne 0x140006e30
lea rcx, [rbp + 0x3308]
call fcn.14000bd90
test rax, rax
jne 0x140007484
mov rax, qword [rbp + 0x3300]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x3300]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
jmp 0x140007484
lea rdx, str._____Process_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [rbp + 0x3830]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str._____Process_found:
lea rcx, [rbp + 0x3300]
call fcn.14000caf0
mov rcx, rax
lea rdx, [rbp + 0x3830]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Modules:
lea rcx, [rbp + 0x3300]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r9, [rbp - 0x20]
mov r8d, 0x2000
lea rdx, [rbp + 0x11f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x1400073f9
mov dword [rsp + 0x68], esi
mov eax, dword [rbp - 0x20]
test rax, 0xfffffffffffffff8
jbe 0x1400073f9
lea rdx, [rbp + 0x11f0]
mov qword [rbp + 0x50], rdx
mov r15, 0xffffffffffffffff
nop dword [rax]
mov r9d, 0x104
lea r8, [rbp + 0x3510]
mov rdx, qword [rdx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, r15d
lea r8, [rbp + 0x3510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovb rax, r15
mov rcx, rax
call fcn.1400100e4
mov r14, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea r8, [rbp + 0x3510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a8], xmm0
mov qword [rbp + 0x1b8], rsi
mov qword [rbp + 0x1c0], rsi
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140007140
mov rdx, r14
lea rcx, [rbp + 0x1a8]
call fcn.14000d8e0
nop
mov rcx, r14
call fcn.14000fd90
lea rbx, [rbp + 0x1a8]
mov r12, qword [rbp + 0x1a8]
mov r13, qword [rbp + 0x1c0]
cmp r13, 7
cmova rbx, r12
mov r14, qword [rbp + 0x1b8]
test r14, r14
je 0x140007253
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x31f0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x140013a9c]
mov r8d, 0x100
movzx eax, word [rcx]
cmp ax, r8w
jae 0x140007205
movzx eax, al
mov byte [rbp + rax + 0x31f0], 1
add rcx, 2
lea rax, [0x140013a9e]
cmp rcx, rax
jne 0x1400071b1
lea rax, [r14 - 1]
mov rcx, r15
cmp rax, r15
cmovb rcx, rax
lea rdx, [rbx + rcx*2]
movzx eax, word [rdx]
cmp ax, r8w
jae 0x1400071fa
cmp byte [rbp + rax + 0x31f0], 0
jne 0x14000724b
cmp rdx, rbx
je 0x140007253
sub rdx, 2
jmp 0x1400071e7
lea rax, [r14 - 1]
mov rcx, r15
cmp rax, r15
cmovb rcx, rax
lea rdx, [rbx + rcx*2]
nop word [rax + rax]
mov ecx, 1
lea rax, [0x140013a9c]
movzx r8d, word [rdx]
cmp word [rax], r8w
je 0x14000724b
add rax, 2
sub rcx, 1
jne 0x140007230
cmp rdx, rbx
je 0x140007253
sub rdx, 2
jmp 0x140007220
sub rdx, rbx
sar rdx, 1
jmp 0x140007256
mov rdx, r15
inc rdx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rsi
cmp r14, rdx
jb 0x14000924e
sub r14, rdx
mov r8, r15
cmp r14, r15
cmovb r8, r14
lea rax, [rbp + 0x1a8]
cmp r13, 7
cmova rax, r12
lea rdx, [rax + rdx*2]
lea rcx, [rbp + 0x1d0]
call fcn.14000d8e0
nop
mov rax, qword [0x1400d1238]
mov r10, qword [0x1400d1230]
mov r14, qword [rbp + 0x1e8]
mov rbx, qword [rbp + 0x1d0]
cmp r10, rax
je 0x140007327
mov r11, qword [rbp + 0x1e0]
nop
lea rdx, [rbp + 0x1d0]
cmp r14, 7
cmova rdx, rbx
mov r8, r10
cmp qword [r10 + 0x18], 7
jbe 0x1400072ec
mov r8, qword [r10]
mov r9, qword [r10 + 0x10]
cmp r9, r11
jne 0x140007319
test r9, r9
je 0x140007322
nop word [rax + rax]
movzx ecx, word [rdx]
cmp word [r8], cx
jne 0x140007319
add r8, 2
add rdx, 2
sub r9, 1
jne 0x140007300
jmp 0x140007322
add r10, 0x20
cmp r10, rax
jne 0x1400072d0
cmp r10, rax
jne 0x14000734b
lea rdx, [rbp + 0x3510]
lea rcx, [rbp + 0x3300]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
cmp r14, 7
jbe 0x140007387
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000737e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000744e
mov rcx, rbx
call fcn.14000fd90
nop
mov rdx, qword [rbp + 0x1c0]
cmp rdx, 7
jbe 0x1400073cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007455
call fcn.14000fd90
mov r12d, dword [rsp + 0x68]
inc r12d
mov dword [rsp + 0x68], r12d
mov rdx, qword [rbp + 0x50]
add rdx, 8
mov qword [rbp + 0x50], rdx
mov ecx, dword [rbp - 0x20]
shr rcx, 3
movsxd rax, r12d
cmp rax, rcx
jb 0x1400070b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0x7d0
lea rcx, [rbp + 0x50]
call fcn.14000cf30
lea rdx, str._____Press_Enter_to_exit...
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rcx, rax
lea rdx, [0x14000ccd0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
cmp eax, 0xd
je 0x140007484
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
cmp eax, 0x2d
jne 0x140007436
jmp 0x140007484
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, str.______Error_enumerating_processes.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
lea rdx, [0x14000ccd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov esi, 1
lea rcx, [rbp + 0x3300]
call fcn.140009280
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x1400074cf
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400074ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
mov eax, esi
jmp 0x140009219
call fcn.140005990
jmp case.0x140006df3.10
lea rcx, [rbp]
call fcn.1400067c0
lea rcx, [rbp]
call fcn.140006400
nop
lea rdx, str.processes.txt
lea rcx, [rbp - 0x40]
call fcn.14000b2f0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.1400067d0
nop
lea rcx, [rbp - 0x40]
call fcn.140003a70
nop
lea rcx, [rbp]
call fcn.140006790
jmp case.0x140006df3.10
lea rdx, [rbp + 0x3510]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x31f0]
xor r8d, r8d
lea rdx, [0x14001649c]
lea rcx, [rbp + 0x3510]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, 0x2e
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x140007574
mov byte [rax], sil
lea rcx, [rbp + 0x31f0]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], sil
jne 0x140007580
mov eax, dword [0x140013a94]
mov dword [rcx], eax
movzx eax, byte [0x140013a98]
mov byte [rcx + 4], al
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400075f9
mov r8d, 0x20948
lea rdx, [0x14001d0a0]
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x31f0]
lea rdx, [0x1400164a0]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp case.0x140006df3.10
lea rcx, [rbp + 0x10]
call fcn.140004fe0
lea rdx, str.af394eee27140a5f309cfd8792bcb3ba
lea rcx, [rbp + 0x3300]
call fcn.14000b550
nop
lea rdx, str.ee3b4a848f0460221ed88d9591010e6c
lea rcx, [rbp + 0x3320]
call fcn.14000b550
nop
lea rdx, str.cfce0b6f646b464249812ff091c03bd2
lea rcx, [rbp + 0x3340]
call fcn.14000b550
nop
lea rdx, str.b365af317ae730a67c936f21432b9c71
lea rcx, [rbp + 0x3360]
call fcn.14000b550
nop
lea rdx, str.ec801a7d4b72a288ec6c207bb9ff0131
lea rcx, [rbp + 0x3380]
call fcn.14000b550
nop
lea rdx, str.01deeaf6a3ac4ecea37fd6f21c3ea66a
lea rcx, [rbp + 0x33a0]
call fcn.14000b550
nop
lea rdx, str.f98918abcdcabad79d98370ca2841127
lea rcx, [rbp + 0x33c0]
call fcn.14000b550
nop
lea rdx, str.353175bd6262fbee99148d234e15be8a
lea rcx, [rbp + 0x33e0]
call fcn.14000b550
nop
lea rdx, str.d93c87d7270e2f650b47a58f2400a438
lea rcx, [rbp + 0x3400]
call fcn.14000b550
nop
lea rdx, str.f6324bc46976c3111dcd6556b1bc4789
lea rcx, [rbp + 0x3420]
call fcn.14000b550
nop
lea rax, [rbp + 0x3300]
mov qword [rbp], rax
lea rax, [rbp + 0x3440]
mov qword [rbp + 8], rax
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp + 0x10]
call fcn.140009ea0
nop
lea r9, [0x14000b4f0]
mov edx, 0x20
mov r8d, 0xa
lea rcx, [rbp + 0x3300]
call fcn.14000fdd4
lea rcx, [rbp + 0x30]
call fcn.140004fe0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x30], xmm1
mov qword [rbp + 0x40], rsi
lea rcx, [rbp + 0x30]
call fcn.1400062b0
lea rcx, [rbp - 0x60]
call fcn.140004fe0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], rsi
mov rdi, qword [rbp + 0x38]
mov rbx, qword [rbp + 0x30]
cmp rbx, rdi
je 0x1400077b5
nop dword [rax + rax]
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.140005e20
add rbx, 0x20
cmp rbx, rdi
jne 0x1400077a0
mov rdi, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x58]
mov qword [rbp - 0x70], rbx
cmp rdi, rbx
je 0x1400078bc
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.140005b30
nop
mov r13, qword [rbp - 0x28]
mov r15, qword [rbp - 0x40]
mov r14, qword [rbp - 0x30]
test r14, r14
je 0x140007874
mov r12, qword [rbp + 0x18]
mov rbx, qword [rbp + 0x10]
cmp rbx, r12
je 0x140007870
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000780d
mov rdx, qword [rbx]
lea rcx, [rbp - 0x40]
cmp r13, 0xf
cmova rcx, r15
cmp r14, qword [rbx + 0x10]
jne 0x140007867
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007867
lea rdx, str.A_match_was_found:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000caf0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14000784b
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rax
call fcn.14000ec30
lea rdx, [0x14000ccd0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
add rbx, 0x20
cmp rbx, r12
jne 0x140007800
mov rbx, qword [rbp - 0x70]
cmp r13, 0xf
jbe 0x1400078a7
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000789f
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007903
mov rcx, r15
call fcn.14000fd90
add rdi, 0x20
cmp rdi, rbx
jne 0x1400077d0
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x60]
test rdi, rdi
je 0x14000791b
mov rdx, rbx
mov rcx, rdi
call fcn.14000db10
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x60]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000790a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000790a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000fd90
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140007975
mov rdx, qword [rbp + 0x38]
call fcn.14000db10
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x30]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007964
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007964
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je case.0x140006df3.10
mov rdx, qword [rbp + 0x18]
call fcn.14000db10
mov rdx, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x10]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009212
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rdx, [rbp + 0x3510]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x31f0]
xor r8d, r8d
lea rdx, [0x14001649c]
lea rcx, [rbp + 0x3510]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, 0x2e
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x140007a14
mov byte [rax], sil
lea rcx, [rbp + 0x31f0]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], sil
jne 0x140007a20
mov eax, dword [0x140013a94]
mov dword [rcx], eax
movzx eax, byte [0x140013a98]
mov byte [rcx + 4], al
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400075f9
mov r8d, 0x200d0
lea rdx, [0x1400b05f0]
jmp 0x1400075de
lea rdx, [rbp + 0x3510]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x31f0]
xor r8d, r8d
lea rdx, [0x14001649c]
lea rcx, [rbp + 0x3510]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov edx, 0x2e
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
test rax, rax
je 0x140007ad1
mov byte [rax], sil
lea rcx, [rbp + 0x31f0]
dec rcx
nop dword [rax + rax]
lea rcx, [rcx + 1]
cmp byte [rcx], sil
jne 0x140007ae0
mov eax, dword [0x140013a94]
mov dword [rcx], eax
movzx eax, byte [0x140013a98]
mov byte [rcx + 4], al
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x31f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400075f9
mov r8d, 0x72c00
lea rdx, [0x14003d9f0]
jmp 0x1400075de
lea rcx, [rbp + 0x10]
call fcn.140004fe0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x10], xmm1
mov qword [rbp + 0x20], rsi
lea rcx, [rbp + 0x10]
call fcn.140004800
movzx edx, al
lea rcx, [rbp + 0x10]
call fcn.140005aa0
nop
lea rcx, [rbp + 0x10]
call fcn.14000ad30
jmp case.0x140006df3.10
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [rsp + 0x68], eax
mov r13d, esi
mov dword [rbp - 0x18], esi
lea r14, [0x140016678]
lea rbx, [0x140016670]
movdqa xmm6, xmmword [0x140016a60]
test al, 1
je 0x140008aab
lea r15d, [r13 + 0x41]
mov byte [rsp + 0x40], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
movsx edx, r15b
mov r8d, 1
lea rcx, [rsp + 0x70]
call fcn.14000d7b0
nop
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
cmp rax, 4
jb 0x140007c89
lea rax, [r8 + 4]
mov qword [rbp - 0x80], rax
lea rdi, [rsp + 0x70]
cmp rcx, 7
cmova rdi, qword [rsp + 0x70]
cmp r14, rdi
jbe 0x140007c2e
lea rax, [rdi + r8*2]
cmp rbx, rax
ja 0x140007c2e
cmp rdi, rbx
ja 0x140007c23
mov r14, rsi
jmp 0x140007c34
mov r14, rdi
sub r14, rbx
sar r14, 1
jmp 0x140007c34
mov r14d, 4
lea rcx, [rdi + 8]
lea r8, [r8*2 + 2]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
lea rbx, [r14 + r14]
mov r8, rbx
lea rdx, [0x140016670]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbx]
mov r8d, 4
sub r8, r14
add r8, r8
lea rdx, [0x140016670]
lea rdx, [rdx + 8]
lea rdx, [rdx + r14*2]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
jmp 0x140007ca1
mov qword [rsp + 0x28], 4
mov edx, 4
lea rcx, [rsp + 0x70]
call fcn.14000f940
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or r12d, 4
mov dword [rbp - 0x20], r12d
mov r8d, 0xe
lea rdx, str.:_Recycle.Bin
lea rcx, [rbp - 0x60]
call fcn.14000c1d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140007d59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007d54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bb5
call fcn.14000fd90
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x140007daa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007da5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bbc
call fcn.14000fd90
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], si
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 7
cmova rdx, qword [rbp + 0x58]
mov rax, qword [rbp + 0x68]
lea r8, [rax + rax]
sar r8, 1
lea rcx, [rbp - 0x40]
call fcn.14000c1d0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000c4b0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140007e5b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bc3
call fcn.14000fd90
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
lea rdx, [rbp + 0x1c8]
call qword [sym.imp.MSVCP140.dll__Stat]
cmp eax, 8
je 0x140007e87
cmp eax, 0xffffffff
je 0x140007e87
mov bl, 1
jmp 0x140007e89
xor bl, bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140007ecb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ec6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bca
call fcn.14000fd90
test bl, bl
je 0x14000828f
mov r13d, esi
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.14000c680
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x80]
call fcn.140003e70
nop
lea rcx, [rbp - 0x40]
call fcn.140003a70
lea rcx, [rbp + 0xe0]
call fcn.1400047e0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
mov rdi, qword [rbp + 0x80]
mov rbx, qword [rdi]
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rsi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
cmp rbx, rdi
je 0x140007fef
lea rax, [rbp + 0xe0]
mov qword [rbp], rax
mov qword [rbp + 8], rsi
mov ecx, 0x90
call fcn.14000e290
mov r15, rax
mov qword [rbp + 8], rax
lea r8, [rbx + 0x10]
lea rdx, [rax + 0x10]
call fcn.14000f8a0
mov qword [rbp + 8], rsi
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x58], r15
mov r12d, 1
mov qword [rsp + 0x50], r12
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x140007fe5
nop dword [rax]
nop word [rax + rax]
mov qword [rbp + 8], rsi
mov ecx, 0x90
call fcn.14000fd98
mov r14, rax
mov qword [rbp + 8], rax
lea r8, [rbx + 0x10]
lea rdx, [rax + 0x10]
call fcn.14000f8a0
mov qword [r15], r14
mov qword [r14 + 8], r15
mov qword [rbp + 8], rsi
mov r15, r14
mov qword [rsp + 0x58], r14
inc r12
mov qword [rsp + 0x50], r12
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140007fa0
movzx r15d, byte [rsp + 0x40]
mov r12d, dword [rbp - 0x20]
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x48]
call fcn.14000dc30
nop
lea rcx, [rsp + 0x48]
call fcn.14000c100
nop
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xf0]
call fcn.1400046e0
movzx eax, byte [rbp + 0xc0]
mov byte [rbp + 0x120], al
mov eax, dword [rbp + 0xc4]
mov dword [rbp + 0x124], eax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rax
lea rcx, [rbp + 0x140]
call fcn.140003cd0
nop
nop dword [rax]
mov rax, qword [rbp + 0x140]
mov rdx, qword [rax]
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x14000809e
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x1400080a5
mov rax, qword [rax]
cmp qword [r8], rax
jmp 0x1400080a3
cmp qword [rdx + 0x10], 0
je 0x1400080df
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 7
cmova rcx, qword [rbp + 0xf0]
lea rdx, [rbp + 0x1cc]
call qword [sym.imp.MSVCP140.dll__Stat]
cmp eax, 1
jne 0x1400080d1
inc r13d
lea rcx, [rbp + 0xe0]
call fcn.140004050
jmp 0x140008070
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x140008125
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bd1
call fcn.14000fd90
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], si
lea rcx, [rbp + 0x140]
call fcn.14000b1b0
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 7
jbe 0x140008191
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000818c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bd8
call fcn.14000fd90
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], si
lea rcx, [rbp + 0xe0]
call fcn.14000b1b0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 7
jbe 0x1400081fd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bdf
call fcn.14000fd90
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], si
lea rcx, [rbp + 0x80]
call fcn.14000b1b0
lea rdx, str.Recycle_Bin_folder_on_disk
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000cd10
mov rcx, rax
movzx edx, r15b
call fcn.14000d010
mov rcx, rax
test r13d, r13d
jne 0x140008252
lea rdx, str.:_cleared
jmp 0x140008274
lea rdx, str.:_contains
call fcn.14000cd10
mov rcx, rax
mov edx, r13d
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, str._files
call fcn.14000cd10
mov rcx, rax
lea rdx, [0x14000cef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r13d, dword [rbp - 0x18]
jmp 0x1400082cd
lea rdx, str.Recycle_Bin_folder_on_disk
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000cd10
mov rcx, rax
movzx edx, r15b
call fcn.14000d010
mov rcx, rax
lea rdx, str.:_not_found
call fcn.14000cd10
mov rcx, rax
lea rdx, [0x14000cef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
movsx edx, r15b
mov r8d, 1
lea rcx, [rsp + 0x48]
call fcn.14000d7b0
nop
mov r8d, 6
lea rdx, str.:Temp
lea rcx, [rsp + 0x48]
call fcn.14000c1d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
or r12d, 3
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x14000837e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008379
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008be6
call fcn.14000fd90
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], si
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
lea r8, [rax + rax]
sar r8, 1
lea rcx, [rbp - 0x40]
call fcn.14000c1d0
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14000c4b0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000842c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008426
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bed
call fcn.14000fd90
nop
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova rcx, qword [rbp - 0x60]
lea rdx, [rbp + 0x50]
call qword [sym.imp.MSVCP140.dll__Stat]
cmp eax, 8
je 0x140008452
cmp eax, 0xffffffff
je 0x140008452
mov bl, 1
jmp 0x140008454
xor bl, bl
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x140008494
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000848f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bf4
call fcn.14000fd90
test bl, bl
je 0x1400089ca
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], rsi
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rdx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x20]
lea r8, [rax + rax]
sar r8, 1
lea rcx, [rbp - 0x40]
call fcn.14000c1d0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000c4b0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140008548
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008bfb
call fcn.14000fd90
nop
mov ecx, 8
call fcn.14000fd98
mov qword [rax], rsi
lea r8, [0x14000bf90]
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14000d5f0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xf0]
call fcn.14000b330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], si
movdqa xmmword [rbp + 0x130], xmm6
mov dword [rbp + 0x1a4], esi
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdx, qword [rsp + 0x48]
lea r9, [rbp - 0x10]
lea r8, [rbp + 0x1a4]
lea rcx, [rbp + 0x3620]
call qword [sym.imp.MSVCP140.dll__Open_dir]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx], rax
test rax, rax
je 0x1400085ff
mov r8d, dword [rbp - 0x10]
lea rdx, [rbp + 0x3620]
lea rcx, [rbp + 0xe0]
call fcn.14000bfc0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140008641
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000863c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008c02
call fcn.14000fd90
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movdqa xmmword [rbp + 0x80], xmm0
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x140008686
lock inc dword [rcx + 8]
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rcx
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x90]
call fcn.14000b330
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0xb0]
call fcn.14000b330
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0xd8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
mov ecx, 8
call fcn.14000fd98
mov qword [rax], rsi
lea r8, [0x14000bf90]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], si
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
movdqa xmmword [rbp + 0x190], xmm6
mov rbx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140008799
test rbx, rbx
je 0x1400087a2
mov rax, qword [rbx]
cmp qword [rcx], rax
jmp 0x14000879c
test rbx, rbx
je 0x1400088cb
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rcx, qword [rbp + 0xb0]
lea rdx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Stat]
cmp eax, 1
jne 0x140008866
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xb0]
call fcn.140003ae0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, qword [rbp - 0x50]
je 0x140008819
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
add qword [rbp - 0x58], 0x20
jmp 0x140008826
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14000f5f0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140008866
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008861
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008c09
call fcn.14000fd90
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008780
lea r8, [rbp - 0x68]
lea rcx, [rbp + 0x3620]
call qword [sym.imp.MSVCP140.dll__Read_dir]
cmp word [rax], 0
jne 0x1400088af
mov rcx, qword [rbp + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.MSVCP140.dll__Close_dir]
mov rax, qword [rbp + 0x80]
mov qword [rax], rsi
jmp 0x140008780
mov r8d, dword [rbp - 0x68]
lea rdx, [rbp + 0x3620]
lea rcx, [rbp + 0x80]
call fcn.14000bfc0
jmp 0x140008780
lea rcx, [rbp + 0x140]
call fcn.140003bd0
nop
lea rcx, [rbp + 0x80]
call fcn.140003bd0
nop
lea rcx, [rbp + 0xe0]
call fcn.140003bd0
mov rax, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x58]
lea rdx, str._TEMP__folder_on_disk
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
cmp rax, rbx
jne 0x140008926
call fcn.14000cd10
mov rcx, rax
movzx edx, r15b
call fcn.14000d010
lea rdx, str.:_cleared
jmp 0x140008960
sub rbx, rax
sar rbx, 5
call fcn.14000cd10
mov rcx, rax
movzx edx, r15b
call fcn.14000d010
mov rcx, rax
lea rdx, str.:_contains
call fcn.14000cd10
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, str._files
mov rcx, rax
call fcn.14000cd10
lea rdx, [0x14000cef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140008a09
mov rdx, qword [rbp - 0x58]
call fcn.14000dba0
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x60]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400089c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008c10
call fcn.14000fd90
jmp 0x140008a09
lea rdx, str._TEMP__folder_on_disk
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000cd10
mov rcx, rax
movzx edx, r15b
call fcn.14000d010
mov rcx, rax
lea rdx, str.:_not_found
call fcn.14000cd10
mov rcx, rax
lea rdx, [0x14000cef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140008a49
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008c17
call fcn.14000fd90
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x140008a99
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008a94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008c1e
call fcn.14000fd90
lea r14, [0x140016678]
lea rbx, [0x140016670]
mov eax, dword [rsp + 0x68]
shr eax, 1
mov dword [rsp + 0x68], eax
inc r13d
mov dword [rbp - 0x18], r13d
cmp r13d, 0x1a
jl 0x140007ba6
lea rdx, [rbp + 0x3300]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
lea rax, [rbp + 0x3300]
mov r15, 0xffffffffffffffff
inc r15
cmp word [rax + r15*2], 0
jne 0x140008af1
mov r8, r15
lea rdx, [rbp + 0x3300]
lea rcx, [rbp + 0x30]
call fcn.14000d8e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x40]
lea r8, [rax + rax]
sar r8, 1
lea rcx, [rbp - 0x40]
call fcn.14000c1d0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000c4b0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140008c2b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000fd90
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Stat]
cmp eax, 8
je 0x140008c54
cmp eax, 0xffffffff
je 0x140008c54
mov bl, 1
jmp 0x140008c56
xor bl, bl
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140008c9b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008c96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
test bl, bl
je 0x1400091b0
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov qword [rbp - 0x50], rsi
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], si
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], si
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 7
cmova rdx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x40]
lea r8, [rax + rax]
sar r8, 1
lea rcx, [rbp - 0x40]
call fcn.14000c1d0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000c4b0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140008d52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008d4c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008d4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
nop
mov ecx, 8
call fcn.14000fd98
mov qword [rax], rsi
lea r8, [0x14000bf90]
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14000d5f0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xf0]
call fcn.14000b330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], si
movdqa xmmword [rbp + 0x130], xmm6
mov dword [rbp - 0x68], esi
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdx, qword [rsp + 0x48]
lea r9, [rbp - 0x10]
lea r8, [rbp - 0x68]
lea rcx, [rbp + 0x3620]
call qword [sym.imp.MSVCP140.dll__Open_dir]
mov rcx, qword [rbp + 0xe0]
mov qword [rcx], rax
test rax, rax
je 0x140008e03
mov r8d, dword [rbp - 0x10]
lea rdx, [rbp + 0x3620]
lea rcx, [rbp + 0xe0]
call fcn.14000bfc0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140008e48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008e43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movdqa xmmword [rbp + 0x80], xmm0
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x140008e8d
lock inc dword [rcx + 8]
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rcx
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x90]
call fcn.14000b330
nop
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0xb0]
call fcn.14000b330
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0x138]
mov qword [rbp + 0xd8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
mov ecx, 8
call fcn.14000fd98
mov qword [rax], rsi
lea r8, [0x14000bf90]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], 7
mov word [rbp + 0x150], si
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], 7
mov word [rbp + 0x170], si
movdqa xmmword [rbp + 0x190], xmm6
mov rbx, qword [rbp + 0x140]
nop word [rax + rax]
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x140008fa9
test rbx, rbx
je 0x140008fb2
mov rax, qword [rbx]
cmp qword [rcx], rax
jmp 0x140008fac
test rbx, rbx
je 0x1400090de
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 7
cmova rcx, qword [rbp + 0xb0]
lea rdx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Stat]
cmp eax, 1
jne 0x140009072
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xb0]
call fcn.140003ae0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, qword [rbp - 0x50]
je 0x140009029
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
add qword [rbp - 0x58], 0x20
jmp 0x140009036
mov r8, rax
lea rcx, [rbp - 0x60]
call fcn.14000f5f0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140009072
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000906d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400090d7
call fcn.14000fd90
mov rax, qword [rbp + 0x80]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008f90
lea r8, [rbp - 0x68]
lea rcx, [rbp + 0x3620]
call qword [sym.imp.MSVCP140.dll__Read_dir]
cmp word [rax], 0
jne 0x1400090bb
mov rcx, qword [rbp + 0x80]
mov rcx, qword [rcx]
call qword [sym.imp.MSVCP140.dll__Close_dir]
mov rax, qword [rbp + 0x80]
mov qword [rax], rsi
jmp 0x140008f90
mov r8d, dword [rbp - 0x68]
lea rdx, [rbp + 0x3620]
lea rcx, [rbp + 0x80]
call fcn.14000bfc0
jmp 0x140008f90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x140]
call fcn.140003bd0
nop
lea rcx, [rbp + 0x80]
call fcn.140003bd0
nop
lea rcx, [rbp + 0xe0]
call fcn.140003bd0
mov rax, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
cmp rax, rbx
jne 0x140009121
lea rdx, str.The__TEMP__folder_in_the_user_profile_has_been_cleared
jmp 0x14000914a
sub rbx, rax
sar rbx, 5
lea rdx, str.The__TEMP__folder_in_the_user_profile_contains
call fcn.14000cd10
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, str._files
call fcn.14000cd10
lea rdx, [0x14000cef0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400091d4
mov rdx, qword [rbp - 0x58]
call fcn.14000dba0
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x60]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400091a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400091a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
jmp 0x1400091d4
lea rdx, str.The__TEMP__folder_in_the_user_profile_not_found
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14000cd10
mov rcx, rax
lea rdx, [0x14000cef0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 7
jbe case.0x140006df3.10
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009212
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009212
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fd90
xor eax, eax
mov rcx, qword [rbp + 0x3940]
xor rcx, rsp
call fcn.14000fd70
lea r11, [rsp + 0x3a60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000c1b0
nop
cmc
insd dword [rdi], dx
add byte [rax], al
invalid