Function at 0x1400438c0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x680]
sub rsp, 0x780
mov rax, qword [0x1400fae80]
xor rax, rsp
mov qword [rbp + 0x670], rax
mov rax, qword [rcx + 8]
mov r14d, dword [rcx]
mov rbx, qword [rcx + 0x10]
xor r13d, r13d
lea rcx, [rbp + 0x341]
xor edx, edx
mov esi, r13d
mov r8d, 0x103
mov qword [rsp + 0x58], rax
mov byte [rbp + 0x340], sil
mov edi, 1
call fcn.14006c5d0
mov rcx, qword [rsp + 0x58]
lea r12, [0x1400bd5e8]
lea r15d, [rdi + 1]
cmp r14d, edi
jle 0x14004394a
mov rsi, qword [rcx + 8]
mov edi, r15d
cmp r14d, 3
jl 0x140043993
movsxd rax, edi
mov rax, qword [rcx + rax*8]
mov rcx, rax
mov qword [rsp + 0x60], rax
call fcn.1400016d6
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140043989
mov rcx, qword [rsp + 0x60]
lea r8d, [rax + 5]
lea rdx, str.eventlog
call fcn.14006e458
test eax, eax
jne 0x140043993
mov eax, dword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
mov r15d, eax
inc edi
cmp r14d, 1
je 0x140043e09
lea rdx, str.list
mov rcx, rsi
call fcn.14006cac4
test eax, eax
je 0x140043e09
lea rdx, str.scan
mov rcx, rsi
call fcn.14006cac4
test eax, eax
jne 0x140043b70
lea rcx, [rbp - 0x6f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x70], r13b
call fcn.14006c5d0
lea rcx, [rbp + 0x451]
xor edx, edx
mov r8d, 0x103
mov byte [rbp + 0x450], r13b
call fcn.14006c5d0
lea rsi, str..log
cmp r14d, edi
jle 0x140043a13
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
mov rsi, qword [rsi + rax*8]
xor r9d, r9d
lea rcx, [rbp + 0x450]
mov edx, 0x104
lea r8d, [r9 + 3]
mov qword [rsp + 0x20], r13
call fcn.140001ac8
cmp dword [0x140112fc8], 1
jne 0x140043a54
lea r9, str._logs__n
lea r8, [0x1400c35a0]
mov rdx, rbx
mov ecx, 0x20000
call fcn.140045f20
lea rax, [0x1400bcb5c]
lea r9, [rbp + 0x450]
lea r8, [0x1400bcb60]
lea rdx, [rbp + 0x560]
mov ecx, 0x104
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.140045f20
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140043b43
lea r8, [rbp + 0x20c]
lea rcx, [rbp - 0x70]
or r9, 0xffffffffffffffff
mov edx, 0x104
call fcn.14006d1d8
movzx ecx, byte [rbp - 0x70]
movzx eax, byte [rbp - 0x6f]
cmp cl, byte [0x1400caf7c]
jne 0x140043ad6
cmp al, byte [0x1400caf7d]
je 0x140043b1a
cmp cl, byte [0x1400bd13c]
jne 0x140043af2
cmp al, byte [0x1400bd13d]
jne 0x140043af2
movzx eax, byte [rbp - 0x6e]
cmp al, byte [0x1400bd13e]
je 0x140043b1a
cmp dword [0x140112fc8], 1
lea r9, [rbp - 0x70]
mov rdx, rbx
mov ecx, 0x20000
lea r8, str._name__s__name__n
je 0x140043b15
lea r8, [0x1400bfa34]
call fcn.140045f70
lea rdx, [rbp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140043b3a
lea r8, [rbp + 0xcc]
jmp 0x140043aac
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x140112fc8], 1
jne 0x140043e0e
lea r9, str.__logs__n
lea r8, [0x1400c35a0]
mov rdx, rbx
mov ecx, 0x20000
call fcn.140045f70
jmp 0x140043e0e
lea rdx, str.close
mov rcx, rsi
call fcn.14006cac4
test eax, eax
jne 0x140043bbc
mov ecx, r15d
call fcn.14000154b
test eax, eax
jne 0x140043b98
lea r8, str._s_log_not_open_n
jmp 0x140043ba7
mov ecx, r15d
call fcn.140001014
lea r8, str._s_log_closed_n
mov r9, r12
mov rdx, rbx
mov ecx, 0x20000
call fcn.140045f20
jmp 0x140043e0e
cmp r14d, 2
je 0x140043c47
cmp r14d, edi
jle 0x140043d85
lea rdx, str.open
mov rcx, rsi
call fcn.14006cac4
test eax, eax
je 0x140043c47
lea rdx, str.write
mov rcx, rsi
call fcn.14006cac4
test eax, eax
je 0x140043c0c
lea rdx, [0x1400cb0c0]
mov rcx, rsi
call fcn.14006cac4
test eax, eax
jne 0x140043d85
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
mov ecx, r15d
mov rdi, qword [rsi + rax*8]
call fcn.14000154b
test eax, eax
jne 0x140043c30
lea r8, str._s_log_not_opened_n
jmp 0x140043ba7
lea rdx, [0x1400bfa34]
mov r8, rdi
mov ecx, r15d
call fcn.1400013f2
jmp 0x140043e0e
mov dword [rsp + 0x50], r13d
cmp r14d, 2
jle 0x140043d6e
mov rsi, qword [rsp + 0x58]
movsxd rax, edi
inc edi
mov rsi, qword [rsi + rax*8]
mov edx, 0x25
mov rcx, rsi
call fcn.140070854
test rax, rax
je 0x140043d41
xor eax, eax
xor ecx, ecx
mov byte [rbp + 0x320], r13b
mov qword [rbp + 0x321], rax
mov qword [rbp + 0x329], rax
mov word [rbp + 0x331], ax
mov byte [rbp + 0x333], al
call fcn.14006ceec
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
xor eax, eax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov dword [rsp + 0x68], r13d
call fcn.140071b30
test eax, eax
jne 0x140043d41
mov eax, dword [rsp + 0x68]
mov edx, dword [rsp + 0x78]
mov r9d, dword [rsp + 0x7c]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x6c]
inc edx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x70]
lea r8, str._04d__02d__02d__02d_02d_02d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x74]
add r9d, 0x76c
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], edx
lea rdx, [rbp + 0x320]
mov ecx, setsockopt
call fcn.140045f20
lea r8, [rbp + 0x320]
lea rdx, str._DATETIME_
mov rcx, rsi
call fcn.140001618
mov r13, rax
mov rsi, rax
cmp r14d, edi
jle 0x140043d8c
mov rax, qword [rsp + 0x58]
movsxd rcx, edi
lea rdx, str.append
mov rcx, qword [rax + rcx*8]
call fcn.14006cac4
mov ecx, dword [rsp + 0x50]
test eax, eax
mov eax, 1
cmove ecx, eax
jmp 0x140043d90
lea rdx, str.open
mov rcx, rsi
call fcn.14006cac4
test eax, eax
jne 0x140043c64
xor eax, eax
jmp 0x140043e11
mov ecx, dword [rsp + 0x50]
mov r8d, ecx
mov rdx, rsi
mov ecx, r15d
call fcn.1400012e4
lea rcx, [rbp + 0x340]
mov r8, rsi
mov edx, 0x104
call fcn.140001b3b
mov ecx, r15d
call fcn.14000154b
test eax, eax
jne 0x140043dc7
lea r8, str._s_log:_ERROR_opening__s_n
jmp 0x140043dde
cmp dword [0x140112fc8], 0
lea r8, str._s_log_opened:__s_n
je 0x140043dde
lea r8, str._result__n___logid__s__logid__n___logfilename__s__logfilename__n____result_
lea rax, [rbp + 0x340]
mov r9, r12
mov rdx, rbx
mov ecx, 0x20000
mov qword [rsp + 0x20], rax
call fcn.140045f20
test r13, r13
je 0x140043e0e
mov rcx, r13
call fcn.14006c470
jmp 0x140043e0e
call fcn.140001730
mov rax, rbx
mov rcx, qword [rbp + 0x670]
xor rcx, rsp
call fcn.14006cfe0
lea r11, [rsp + 0x780]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret