Function at 0x140004670
Capabilities:
Enumerate files on windows
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x510
mov rax, qword [0x140071180]
xor rax, rsp
mov qword [rsp + 0x500], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rsp + 0x70], 0x238
mov ebx, edi
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400046e4
nop word [rax + rax]
inc ebx
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400046d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0x28
jge 0x140004733
lea rdx, str.Too_few_processes._Exiting...
lea rcx, [0x140075770]
call fcn.140008710
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140008390
movzx edx, al
mov rcx, rbx
call fcn.140009450
mov rcx, rbx
call fcn.1400092f0
mov al, 1
jmp 0x1400048d3
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp eax, 0x493e0
jae 0x140004749
lea rdx, str.System_recently_started._Exiting...
jmp 0x1400046f9
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov ecx, 0x30
call fcn.1400220b8
mov rbp, rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], 0x10
mov qword [rsp + 0x60], 0x17
movups xmm0, xmmword [str.C:WindowsTemp_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140065060]
movups xmmword [rax + 0x10], xmm1
mov word [rax + 0x20], di
mov qword [rsp + 0x28], rdi
mov ecx, 0x30
call fcn.1400220b8
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x140065680]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbp]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rax + 0x10], xmm1
mov dword [rax + 0x20], 0x2a
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 7
cmova rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x14000482a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004825
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400048fc
call fcn.1400220a0
movdqa xmm0, xmmword [0x140065660]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], di
cmp rsi, 0xffffffffffffffff
je 0x1400048c1
nop dword [rax]
nop word [rax + rax]
test byte [rsp + 0x2b0], 0x10
lea ebx, [rdi + 1]
cmovne ebx, edi
mov edi, ebx
lea rdx, [rsp + 0x2b0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140004850
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 3
jg 0x1400048c1
lea rdx, str.Not_enough_files_in_TEMP_directory._Exiting...
lea rcx, [0x140075770]
call fcn.140008710
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140008390
movzx edx, al
mov rcx, rbx
call fcn.140009450
mov rcx, rbx
call fcn.1400092f0
mov bl, 1
jmp 0x1400048c3
xor bl, bl
mov edx, 0x30
mov rcx, rbp
call fcn.1400220a0
movzx eax, bl
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.140022080
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.140033358
nop
int3