Function at 0x18005c188
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x478]
sub rsp, 0x550
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r14, rdx
mov r15, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x240]
call fcn.1801c27d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor r12d, r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
lea ecx, [r12 + 0x10]
call fcn.18009e460
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movdqu xmmword [rax], xmm0
lea rcx, [rsp + 0x20]
mov rax, qword [rsp + 0x20]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x180283720]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r12w
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r12w
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rbp + 0x240]
lea rcx, str._PUBLIC_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18005c251
cmp word [rbp + 0x240], 0x25
jne 0x18005c27e
mov r8d, ebx
lea rdx, [rbp + 0x240]
lea rcx, str._ALLUSERSPROFILE_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18005c5db
cmp word [rbp + 0x240], 0x25
je 0x18005c5db
lea rcx, [rbp + 0x240]
call fcn.1801ca1d4
cmp rax, 4
jb 0x18005c5db
lea rcx, [rbp + 0x246]
movzx eax, word [rbp + 0x246]
jmp 0x18005c2b7
cmp ax, 0x5c
je 0x18005c2be
cmp ax, 0x2f
je 0x18005c2be
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x18005c2a4
jmp 0x18005c2c2
mov word [rcx], r12w
movdqa xmm0, xmmword [0x180283720]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r12w
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x78]
call fcn.18005d244
nop
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x20]
call fcn.18005ce90
nop
lea rcx, [rbp - 0x78]
call fcn.18005e40c
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x240]
call fcn.18005bee4
jmp 0x18005c5d0
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x18005c322
mov rax, r12
jmp 0x18005c325
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
dec rdx
and rdx, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rdx*8]
lea rcx, [rsp + 0x48]
call fcn.18005d18c
mov rcx, qword [rsp + 0x30]
dec rcx
and rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + rcx*8]
call fcn.18005e40c
sub qword [rsp + 0x40], 1
jne 0x18005c36d
mov qword [rsp + 0x38], r12
jmp 0x18005c372
inc qword [rsp + 0x38]
lea r8, [0x1802812e4]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x78]
call fcn.18005d660
cmp qword [rax + 0x18], 8
jb 0x18005c391
mov rax, qword [rax]
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
lea rcx, [rbp - 0x78]
call fcn.18005e40c
cmp rsi, 0xffffffffffffffff
je 0x18005c5d0
lea rdx, str.cert8.db
lea rcx, [rbp + 0x1c]
call fcn.1801ca4d8
test eax, eax
jne 0x18005c3fb
lea r8d, [rax + 8]
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.18005b02c
lea r8, str.prefs.js
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.18005d660
nop
mov rcx, rax
call fcn.18005b64c
nop
jmp 0x18005c440
lea rdx, str.cert9.db
lea rcx, [rbp + 0x1c]
call fcn.1801ca4d8
test eax, eax
jne 0x18005c44c
lea r8d, [rax + 9]
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.18005b02c
lea r8, str.prefs.js
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.18005d660
nop
mov rcx, rax
call fcn.18005b64c
nop
lea rcx, [rsp + 0x68]
call fcn.18005e40c
jmp 0x18005c464
lea rdx, str.opcacrt6.dat
lea rcx, [rbp + 0x1c]
call fcn.1801ca4d8
test eax, eax
je 0x18005c562
mov eax, dword [rbp - 0x10]
and eax, 0x410
cmp eax, 0x10
jne 0x18005c54c
lea rdx, [0x180281198]
lea rcx, [rbp + 0x1c]
call fcn.1801ca670
test eax, eax
je 0x18005c54c
lea rdx, [0x180281354]
lea rcx, [rbp + 0x1c]
call fcn.1801ca670
test eax, eax
je 0x18005c54c
lea rdx, str.temp
lea rcx, [rbp + 0x1c]
call fcn.1801ca4d8
test eax, eax
je 0x18005c54c
lea rdx, str.microsoft
lea rcx, [rbp + 0x1c]
call fcn.1801ca4d8
test eax, eax
je 0x18005c54c
lea rdx, str.packages
lea rcx, [rbp + 0x1c]
call fcn.1801ca4d8
test eax, eax
je 0x18005c54c
lea r8, [0x180281194]
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x50]
call fcn.18005d660
nop
lea r8, [rbp + 0x1c]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.18005d708
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.18005ce90
nop
lea rcx, [rsp + 0x68]
call fcn.18005e40c
nop
lea rcx, [rbp - 0x50]
call fcn.18005e40c
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [r14 + 8]
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, 1
jne 0x18005c5aa
lea rdx, [rbp - 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x18005c5aa
jmp 0x18005c3b4
lea r8, [0x180281194]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.18005d660
nop
lea r8, [rbp + 0x1c]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.18005d708
nop
mov rdx, r15
mov rcx, rax
call fcn.18005b978
nop
lea rcx, [rbp - 0x50]
call fcn.18005e40c
nop
lea rcx, [rsp + 0x68]
call fcn.18005e40c
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [r14 + 8]
lea rcx, [r14 + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, 1
jne 0x18005c5db
cmp qword [rsp + 0x40], r12
jne 0x18005c313
lea rcx, [rbp - 0x30]
call fcn.18005e40c
nop
lea rcx, [rsp + 0x48]
call fcn.18005e40c
nop
lea rcx, [rsp + 0x20]
call fcn.18005cf44
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret