Function at 0x140011c70
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x910]
sub rsp, 0xa10
mov rax, qword [0x14009c020]
xor rax, rsp
mov qword [rbp + 0x900], rax
movzx r14d, r9b
mov byte [rsp + 0x32], r9b
mov dword [rsp + 0x34], r8d
mov r12, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x250
lea rcx, [rbp + 0x6b0]
call fcn.14004b2f0
nop
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rax, [0x14009cc90]
mov qword [rbp - 0x58], rax
mov word [rbp - 0x38], 0
mov dword [rbp - 0x30], 0xabcd
mov dword [rbp - 0x24], 0xabcd
lea rax, [rbp - 0x58]
mov qword [rbp - 0x2c], rax
mov dword [rbp + 0x1ea], 0xabcd
lea rax, [rbp - 0x20]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x48], 0x104
mov qword [rbp - 0x40], 0x104
xor edi, edi
mov qword [rbp - 0x50], rdi
mov word [rbp - 0x20], di
lea rax, [rbp - 0x20]
mov qword [rbp - 0x68], rax
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.140007410
nop
mov r13d, edi
lea rcx, [rbp - 0x70]
call fcn.140006480
mov rbx, r12
test r12, r12
je 0x140011dd1
cmp word [r12], di
je 0x140011dd1
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140011db0
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x140011db0
mov r8, qword [rdx + 8]
test r8, r8
je 0x140011db0
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x14001246b
cmp word [rcx + rax*2], 0x5c
je 0x140011db0
movsxd rax, r8d
dec rax
cmp rax, qword [rdx + 0x10]
ja 0x14001246b
cmp word [rcx + rax*2], 0x2f
je 0x140011db0
lea edx, [rdi + 0x5c]
lea rcx, [rbp - 0x70]
call fcn.140006fb0
nop dword [rax]
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140011dbf
cmp ax, 0x2f
jne 0x140011dc5
add rbx, 2
jmp 0x140011db0
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140007130
lea rbx, str..bdx
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140011e30
mov r8, qword [rcx - 0xc]
test r8, r8
je 0x140011e30
mov r9, qword [r8 + 8]
test r9, r9
je 0x140011e30
movsxd rax, r9d
dec rax
cmp rax, qword [r8 + 0x10]
ja 0x14001246b
cmp word [rcx + rax*2], 0x5c
je 0x140011e30
movsxd rax, r9d
dec rax
cmp rax, qword [r8 + 0x10]
ja 0x14001246b
cmp word [rcx + rax*2], 0x2f
je 0x140011e30
mov edx, 0x5c
lea rcx, [rbp - 0x70]
call fcn.140006fb0
nop
movzx eax, word [rbx]
cmp ax, 0x5c
je 0x140011e3f
cmp ax, 0x2f
jne 0x140011e45
add rbx, 2
jmp 0x140011e30
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140007130
lea r15, [0x14008d480]
mov rcx, r15
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rcx, rax
lea rdx, [rbp + 0x6b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
jne 0x140011e8f
lea edx, [rcx + 0x40]
lea rcx, [rbp - 0x70]
call fcn.140007630
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov rax, rdi
mov rcx, qword [rbp - 0x70]
cmp word [rcx], di
je 0x140011eaa
inc rax
cmp word [rcx + rax*2], di
jne 0x140011ea1
test rcx, rcx
je 0x140011ebe
mov rdx, qword [rcx - 0xc]
test rdx, rdx
je 0x140011ebe
mov r8, qword [rdx + 0x10]
jmp 0x140011ec1
mov r8, rdi
cmp rax, r8
ja 0x14001246b
test rcx, rcx
je 0x140011ed5
mov rdx, qword [rcx - 0xc]
jmp 0x140011ed8
mov rdx, rdi
mov qword [rdx + 8], rax
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140011f1a
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140011f1a
cmp dword [rcx - 0x10], 0xabcd
jne 0x14001246b
cmp dword [rcx - 4], 0xabcd
jne 0x14001246b
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x14001246b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov ecx, 0x280
call fcn.140048438
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsp + 0x38], rax
cmp rbx, 0xffffffffffffffff
je 0x140012144
movzx edi, byte [rbp + 0x978]
nop dword [rax]
nop dword [rax + rax]
test byte [rbp + 0x6b0], 0x10
jne 0x140012123
mov byte [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x6dc]
mov rdx, r12
mov rcx, rsi
call fcn.14000ef70
test al, al
jne 0x140012123
test dil, dil
je 0x140011fa0
cmp byte [rsp + 0x30], al
je 0x140012123
lea rax, [rbp + 0x210]
mov qword [rbp + 0x200], rax
lea rax, [0x14009cc90]
mov qword [rbp + 0x208], rax
mov word [rbp + 0x228], 0
mov dword [rbp + 0x230], 0xabcd
mov dword [rbp + 0x23c], 0xabcd
lea rax, [rbp + 0x208]
mov qword [rbp + 0x234], rax
mov dword [rbp + 0x44a], 0xabcd
lea rax, [rbp + 0x240]
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x218], 0x104
mov qword [rbp + 0x220], 0x104
xor eax, eax
mov qword [rbp + 0x210], rax
mov word [rbp + 0x240], ax
lea rax, [rbp + 0x240]
mov qword [rbp + 0x1f8], rax
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0x6dc]
lea rcx, [rbp + 0x1f0]
call fcn.140007510
test al, al
je 0x140012475
mov rcx, qword [rbp + 0x1f0]
test rcx, rcx
je 0x140012096
mov rax, qword [rcx - 0xc]
test rax, rax
je 0x140012096
cmp dword [rcx - 0x10], 0xabcd
jne 0x140012475
cmp dword [rcx - 4], 0xabcd
jne 0x140012475
mov rax, qword [rax + 0x10]
cmp dword [rcx + rax*2 + 2], 0xabcd
jne 0x140012475
test rcx, rcx
je 0x1400120e3
call fcn.140056b9c
mov rdx, qword [rbp + 0x1f0]
test rdx, rdx
je 0x1400120e3
mov rax, qword [rdx - 0xc]
test rax, rax
je 0x1400120e6
cmp dword [rdx - 0x10], 0xabcd
jne 0x140012461
cmp dword [rdx - 4], 0xabcd
jne 0x140012461
mov rax, qword [rax + 0x10]
cmp dword [rdx + rax*2 + 2], 0xabcd
jne 0x140012461
jmp 0x1400120e6
mov rdx, r15
lea rcx, [rbp + 0x450]
call fcn.140006700
nop
lea r8, [rbp + 0x450]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140015bf0
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
nop
lea rcx, [rbp + 0x1f0]
call fcn.140006d00
lea rdx, [rbp + 0x6b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140011f60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, str.preinstall
mov rcx, r12
call fcn.1400544fc
test eax, eax
sete dil
mov byte [rsp + 0x31], dil
mov rax, qword [rsp + 0x38]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14001241a
movzx r15d, byte [rbp + 0x970]
test r15b, r15b
je 0x1400121f1
mov byte [rsp + 0x30], 0
mov rax, qword [rbx + 0x20]
lea rcx, [0x14008d480]
mov r8, rcx
test rax, rax
cmovne r8, rax
mov rdx, rcx
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
lea rdx, [0x14008d480]
test rcx, rcx
cmovne rdx, rcx
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.140010d60
add r13d, eax
lea rcx, [rbp + 0x450]
call fcn.140006d00
test dil, dil
je 0x1400121f1
cmp byte [rsp + 0x30], 0
je 0x1400121f1
mov byte [rsi + 0x4b8], 1
test r14b, r14b
je 0x1400123c0
mov rax, qword [rbx + 0x20]
lea rdi, [0x14008d480]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
lea rcx, str.run_script__s
call fcn.14000b8f0
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
mov rax, qword [rbx + 0x20]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
test rcx, rcx
cmovne rdi, rcx
mov rdx, rdi
lea rcx, str._Script_running_vbs:_szFile____s__n
call fcn.14000bc30
xor eax, eax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], ax
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x60], rax
mov qword [rbp - 0x78], rax
imul r8d, dword [rsp + 0x34], 0x3e8
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.1400015e0
mov r14d, eax
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140012313
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001230d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001245b
call fcn.140048430
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
mov rax, qword [rbx + 0x20]
lea rdi, [0x14008d480]
mov r8, rdi
test rax, rax
cmovne r8, rax
mov rdx, rdi
mov rax, qword [rbp - 0x70]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140006590
nop
mov rcx, qword [rax]
mov rdx, rdi
test rcx, rcx
cmovne rdx, rcx
mov r8d, r14d
lea rcx, str.run_script__s____0x_x
call fcn.14000b8f0
nop
lea rcx, [rbp + 0x450]
call fcn.140006d00
xor edi, edi
test r14d, r14d
sete dil
add r13d, edi
mov rax, qword [rbx + 0x20]
lea r8, [0x14008d480]
test rax, rax
cmovne r8, rax
mov byte [rsp + 0x20], 0
mov r9d, r14d
mov rdx, r12
mov rcx, rsi
call fcn.14000f210
inc dword [rsi + 0x4bc]
add dword [rsi + 0x4c0], edi
movzx edi, byte [rsp + 0x31]
movzx r14d, byte [rsp + 0x32]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400123ec
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400123e7
cmp rbx, qword [rax + 0x10]
jne 0x1400123e7
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400123d4
mov rbx, rax
jmp 0x14001240f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14001240f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140012400
cmp rbx, qword [rsp + 0x38]
jne 0x140012177
lea rcx, [rsp + 0x38]
call fcn.140014c00
nop
lea rcx, [rbp - 0x70]
call fcn.140006d00
mov eax, r13d
mov rcx, qword [rbp + 0x900]
xor rcx, rsp
call fcn.140048410
mov rbx, qword [rsp + 0xa68]
add rsp, 0xa10
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140054034
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
nop
xor edx, edx
xor ecx, ecx
call fcn.14004aaec
int3