Function at 0x14000ba00
Capabilities:
Encode data using xor
Enumerate files on windows
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x448]
sub rsp, 0x520
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14004b040]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor r12d, r12d
mov dword [rsp + 0x44], r12d
lea rcx, [rbp + 0x160]
call fcn.1400313f0
test al, al
jne 0x14000ba7f
lea rdx, str.Failed_to_retrieve_last_logon_time.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000acc0
lea rdx, [0x14000df70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000cb85
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov r8d, 0x14
lea rdx, str.C:WindowsPrefetch_
lea rcx, [rbp + 0x20]
call fcn.140003930
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rbp + 0x30]
sub rax, r15
cmp rax, 1
jb 0x14000cbc5
lea r14, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r14, qword [rbp + 0x20]
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
lea rsi, [r15 + 1]
mov ebx, 7
lea rdi, [rbp + 0xe0]
movabs rax, 0x7fffffffffffffff
lea edx, [rbx + 3]
cmp rsi, rbx
jbe 0x14000bb82
mov rbx, rsi
or rbx, 7
cmp rbx, rcx
jbe 0x14000bb1d
mov rbx, rcx
lea rcx, [rax + rax]
jmp 0x14000bb3d
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x14000cbcb
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000bb69
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000cbcb
mov rcx, rax
call fcn.1400333a8
test rax, rax
je 0x14000bc1c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000bb7b
test rcx, rcx
je 0x14000bb78
call fcn.1400333a8
mov rdi, rax
jmp 0x14000bb7b
mov rdi, r12
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xf0], rsi
mov qword [rbp + 0xf8], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rbx], 0x2a
xor r14d, r14d
mov word [rdi + rsi*2], r14w
lea esi, [r14 + 0x40]
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 7
cmova rcx, qword [rbp + 0xe0]
lea rdx, [rbp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r13, rax
mov qword [rbp - 0x70], rax
mov rdx, qword [rbp + 0xf8]
cmp rdx, 7
jbe 0x14000bc28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bc23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140033280
movdqa xmm0, xmmword [0x140040b00]
movdqu xmmword [rbp + 0xf0], xmm0
mov word [rbp + 0xe0], r14w
cmp r13, 0xffffffffffffffff
jne 0x14000bc6e
lea rdx, str.____Prefetch_directory_not_found._Ensure_that_C:WindowsPrefetch_exists_and_ban_the_player_if_not.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000acc0
lea rdx, [0x14000df70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000cb42
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, str._Forensic_Scanner__Running_checks_to_detect_executed_files_with_Prefetch..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140005860
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rbp - 0x60]
call fcn.140005590
nop
nop dword [rax]
cmp dword [rbp + 0x1a0], 0x10
je 0x14000ca4d
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], r14
lea rax, [rbp + 0x1cc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000bcf0
lea rdx, [rbp + 0x1cc]
lea rcx, [rbp + 0x60]
call fcn.140003930
nop
lea r11, [rbp + 0x60]
mov r14, qword [rbp + 0x78]
cmp r14, 7
seta r12b
mov r10, qword [rbp + 0x60]
cmova r11, r10
mov rdi, qword [rbp + 0x70]
cmp rdi, 4
jb 0x14000ca10
lea rbx, [rdi - 3]
lea rbx, [r11 + rbx*2]
mov rax, r11
nop dword [rax]
mov rcx, rbx
sub rcx, rax
sar rcx, 1
mov edx, 0
je 0x14000bd6c
cmp word [rax], 0x2e
je 0x14000bd69
cmp rcx, 1
je 0x14000bd6c
dec rcx
add rax, 2
cmp word [rax], 0x2e
jne 0x14000bd56
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14000ca10
mov r8d, 4
lea rcx, str..EXE
mov rdx, rcx
mov r9, rax
sub r9, rcx
nop
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x14000c107
add rdx, 2
sub r8, 1
jne 0x14000bd90
sub rax, r11
sar rax, 1
cmp rax, 0xffffffffffffffff
je 0x14000ca10
movabs rax, 0x7ffffffffffffffe
sub rax, r15
cmp rax, rdi
jb 0x14000cbbf
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r9, qword [rbp + 0x20]
lea rax, [rbp + 0x60]
test r12b, r12b
cmovne rax, r10
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea rcx, [rbp + 0x140]
call fcn.140006330
or esi, 0x20
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1b4]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x14000c97c
movabs r15, 0x7ffffffffffffffe
mov rax, r15
mov rcx, qword [rbp + 0x30]
sub rax, rcx
mov rdx, qword [rbp + 0x70]
cmp rax, rdx
jb 0x14000cbe9
lea r9, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova r9, qword [rbp + 0x20]
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rax, qword [rbp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0xc0]
call fcn.140006330
bts esi, 8
mov dword [rsp + 0x44], esi
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova r8, qword [rbp + 0xc0]
xor r14d, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r14 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.14000db70
nop
lea rcx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rcx, qword [rbp + 0xa0]
lea r8, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 7
cmova r8, qword [rbp + 0xc0]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0xfde9
lea r9d, [r14 - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x48]
call fcn.14000b0d0
nop
mov rcx, qword [rsp + 0x48]
cmp rcx, qword [rsp + 0x50]
jne 0x14000c110
test rcx, rcx
je 0x14000bfbd
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bfa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caf6
call fcn.140033280
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000bffe
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bff9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cafd
call fcn.140033280
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x14000c05d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cb04
call fcn.140033280
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], 7
mov word [rbp + 0xc0], r14w
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x14000c0be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c0b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cab7
call fcn.140033280
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14000c0fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c0f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cabe
call fcn.140033280
mov r15, qword [rbp + 0x30]
jmp 0x14000ca4d
add rax, 2
jmp 0x14000bd40
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14000b5a0
nop
mov r12, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x78], rax
cmp r12, rax
je 0x14000c843
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], r14
lea rax, [rbp + 0x1cc]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000c170
lea rdx, [rbp + 0x1cc]
lea rcx, [rbp + 0x100]
call fcn.140003930
nop
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 7
seta r10b
mov r9, qword [rbp + 0x100]
cmova rdx, r9
mov rdi, qword [rbp + 0x110]
test rdi, rdi
je 0x14000c1eb
mov rax, rdi
mov rcx, rdx
mov r8, r14
cmp word [rdx], 0x2d
je 0x14000c1db
cmp rax, 1
je 0x14000c1de
dec rax
add rcx, 2
cmp word [rcx], 0x2d
jne 0x14000c1c8
mov r8, rcx
test r8, r8
je 0x14000c1eb
sub r8, rdx
sar r8, 1
jmp 0x14000c1f2
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
cmp r8, 0xffffffffffffffff
je 0x14000c252
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp + 0x100]
test r10b, r10b
cmovne rdx, r9
lea rcx, [rbp + 0x80]
call fcn.140003930
bts esi, 7
lea rax, [rbp + 0x80]
or esi, 1
lea rcx, [rbp + 0x90]
lea rdx, [rbp + 0x98]
jmp 0x14000c349
movups xmmword [rbp + 0x40], xmm0
lea r14, [rbp + 0x100]
test r10b, r10b
cmovne r14, r9
cmp rdi, r15
ja 0x14000cbe3
cmp rdi, 7
ja 0x14000c28c
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x40], xmm0
jmp 0x14000c337
mov rbx, rdi
or rbx, 7
cmp rbx, r15
jbe 0x14000c2ab
mov rbx, r15
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000c2db
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000cbdd
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000c30a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000cbdd
mov rcx, rax
call fcn.1400333a8
mov rcx, rax
test rax, rax
je 0x14000cae1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000c318
test rcx, rcx
je 0x14000c316
call fcn.1400333a8
jmp 0x14000c318
xor eax, eax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rbx
lea r8, [rdi*2 + 2]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x40]
or esi, 2
lea rcx, [rbp + 0x50]
lea rdx, [rbp + 0x58]
xor r14d, r14d
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0x170], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm6
mov qword [rcx], r14
mov qword [rdx], 7
mov word [rax], r14w
test sil, 2
je 0x14000c3b6
and esi, 0xfffffffd
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14000c3b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cac5
call fcn.140033280
nop
test sil, 1
je 0x14000c405
and esi, 0xfffffffe
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x14000c405
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c400
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cada
call fcn.140033280
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r14
mov qword [rbp + 0x98], r14
mov rax, qword [r12 + 0x10]
cmp rax, 0x23
jb 0x14000cbd7
add rax, 0xffffffffffffffdd
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
mov rdx, r12
cmp qword [r12 + 0x18], 7
jbe 0x14000c44d
mov rdx, qword [r12]
add rdx, 0x46
lea rcx, [rbp + 0x80]
call fcn.140003930
or esi, 0x10
mov rdx, r12
lea rcx, [rbp + 0x40]
call fcn.14000b820
nop
lea r9, [rbp + 0x80]
mov r8, rax
lea rcx, [rbp]
call fcn.14000e610
or esi, 8
mov dword [rsp + 0x44], esi
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x14000c4c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cacc
call fcn.140033280
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], r14w
mov rdx, qword [rbp + 0x98]
cmp rdx, 7
jbe 0x14000c51e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cad3
call fcn.140033280
lea r9, [rbp + 0x170]
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 7
seta r13b
mov byte [rsp + 0x40], r13b
movq rdi, xmm7
cmova r9, rdi
lea rcx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rcx, qword [rbp]
movq qword [rsp + 0x20], xmm6
xor r8d, r8d
mov rdx, qword [rbp + 0x10]
call fcn.140003840
cmp rax, 0xffffffffffffffff
je 0x14000c74b
lea rdx, [rbp]
call fcn.140031830
test al, al
jne 0x14000c74b
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
seta r14b
cmova rdx, qword [rbp]
movabs r9, 0xcbf29ce484222325
mov rbx, qword [rbp + 0x10]
lea r8, [rbx + rbx]
xor eax, eax
mov ecx, eax
test r8, r8
je 0x14000c5d9
movabs r13, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, r8
jb 0x14000c5c0
movzx r13d, byte [rsp + 0x40]
lea r8, [rbp]
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.140006720
mov rcx, qword [rax + 8]
mov rax, qword [rbp - 0x58]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [rbp - 0x58]
jne 0x14000c6c8
cmp rbx, 4
jb 0x14000c6c8
lea rcx, [rbx - 4]
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xor eax, eax
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], rax
cmp rbx, rcx
jb 0x14000cbd1
sub rbx, rcx
mov r8, 0xffffffffffffffff
cmp rbx, r8
cmovb r8, rbx
lea rax, [rbp]
test r14b, r14b
cmovne rax, qword [rbp]
lea rdx, [rax + rcx*2]
lea rcx, [rbp + 0x120]
call fcn.140003930
or esi, 0x204
mov dword [rsp + 0x44], esi
lea r8, [rbp + 0x120]
mov r10, qword [rbp + 0x120]
mov r9, qword [rbp + 0x138]
cmp r9, 7
cmova r8, r10
mov rdx, qword [rbp + 0x130]
cmp rdx, 4
jne 0x14000c6d6
lea rax, str..EXE
mov rcx, rax
test rdx, rdx
je 0x14000c6c4
sub r8, rax
nop word [rax + rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x14000c6d6
add rcx, 2
sub rdx, 1
jne 0x14000c6b0
mov bl, 1
jmp 0x14000c6d8
mov r9, qword [rbp + 0x138]
mov r10, qword [rbp + 0x120]
xor bl, bl
test sil, 4
je 0x14000c6f6
and esi, 0xfffffffb
mov dword [rsp + 0x44], esi
cmp r9, 7
jbe 0x14000c6f6
mov r8, r9
mov rdx, r10
call fcn.1400030f0
test bl, bl
je 0x14000c748
lea rdx, [0x140037f10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400032c0
lea rdx, [rbp]
cmp qword [rbp + 0x18], 7
cmova rdx, qword [rbp]
mov r8, qword [rbp + 0x10]
mov rcx, rax
call fcn.140003f60
lea rdx, [0x140005ad0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea r8, [rbp]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.14000dfb0
xor r14d, r14d
mov rax, qword [rbp + 0x18]
cmp rax, 7
jbe 0x14000c78b
lea rdx, [rax*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c786
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cada
call fcn.140033280
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], 7
mov word [rbp], r14w
test r13b, r13b
je 0x14000c7d7
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000c7ce
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cae1
mov rcx, rdi
call fcn.140033280
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 7
jbe 0x14000c81d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cae8
call fcn.140033280
add r12, 0x20
cmp r12, qword [rbp - 0x78]
movabs r15, 0x7ffffffffffffffe
jne 0x14000c140
mov rax, qword [rsp + 0x70]
mov r12, qword [rsp + 0x68]
mov r13, qword [rbp - 0x70]
test r12, r12
je 0x14000c88f
mov rdx, rax
mov rcx, r12
call fcn.140009730
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c889
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caef
call fcn.140033280
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000c8da
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c8c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000caf6
call fcn.140033280
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000c91b
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c916
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cafd
call fcn.140033280
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x14000c97f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c975
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cb04
call fcn.140033280
jmp 0x14000c97f
xor r14d, r14d
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x14000c9c6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c9c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cb0b
call fcn.140033280
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14000c0fe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca05
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cb12
call fcn.140033280
mov r15, qword [rbp + 0x30]
jmp 0x14000ca4d
test r12b, r12b
je 0x14000ca4a
lea rdx, [r14*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14000ca42
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000cb12
mov rcx, r10
call fcn.140033280
xor r14d, r14d
lea rdx, [rbp + 0x1a0]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000bcc0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000cb2a
mov rax, qword [rbp - 0x38]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cb19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140033280
mov qword [rbp - 0x48], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x40], xmm0
mov rdx, qword [rbp - 0x58]
call fcn.140005dd0
mov edx, 0x30
mov rcx, qword [rbp - 0x58]
call fcn.140033280
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14000cb85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cb80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140033280
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140033260
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002290
nop
call fcn.140002290
int3
call fcn.1400021f0
nop
call fcn.140003140
nop
call fcn.140003140
nop
call fcn.1400021f0
int3
call fcn.140002290
nop
call fcn.140002290
int3