Function at 0x18005c620
Capabilities:
Enumerate files on windows
Query environment variable
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x558]
sub rsp, 0x620
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, rdx
mov r14, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xc0]
call fcn.1801c27d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea ecx, [r12 + 0x10]
call fcn.18009e460
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movdqu xmmword [rax], xmm0
lea rcx, [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x180283720]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r12w
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], r12w
mov ebx, 0x104
mov r8d, ebx
lea rdx, [rbp + 0xc0]
lea rcx, str._PROGRAMFILES_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18005c754
cmp word [rbp + 0xc0], 0x25
je 0x18005c754
lea rcx, [rbp + 0xc6]
movzx eax, word [rbp + 0xc6]
jmp 0x18005c709
cmp ax, 0x5c
je 0x18005c710
cmp ax, 0x2f
je 0x18005c710
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x18005c6f6
jmp 0x18005c714
mov word [rcx], r12w
movdqa xmm0, xmmword [0x180283720]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r12w
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.18005d244
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.18005ce90
nop
lea rcx, [rsp + 0x20]
call fcn.18005e40c
mov r8d, ebx
lea rdx, [rbp + 0xc0]
lea rcx, str._PROGRAMFILES_x86__
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18005c7e7
cmp word [rbp + 0xc0], 0x25
je 0x18005c7e7
lea rcx, [rbp + 0xc6]
movzx eax, word [rbp + 0xc6]
jmp 0x18005c79c
cmp ax, 0x5c
je 0x18005c7a3
cmp ax, 0x2f
je 0x18005c7a3
add rcx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x18005c789
jmp 0x18005c7a7
mov word [rcx], r12w
movdqa xmm0, xmmword [0x180283720]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], r12w
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.18005d244
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.18005ce90
nop
lea rcx, [rsp + 0x20]
call fcn.18005e40c
lea rcx, vtable.ProtocolFilters::IOB.0
mov qword [rbp - 0x70], rcx
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov eax, 0x6400000
mov dword [rbp - 0x58], eax
mov r13d, 1
mov dword [rbp - 0x54], r13d
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], r13d
mov rbx, r14
cmp qword [r14 + 0x18], 8
jb 0x18005c831
mov rbx, qword [r14]
lea rcx, [rbp - 0x70]
call fcn.18006d240
lea rdx, [0x180281238]
mov rcx, rbx
call fcn.1801c91e8
mov rbx, rax
test rax, rax
je 0x18005cdd8
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.1801c9b24
mov rcx, rbx
call fcn.1801ca07c
movsxd rdi, eax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1801c9b24
test rdi, rdi
jne 0x18005c88e
mov rcx, rbx
call fcn.1801c95dc
mov rsi, qword [rbp - 0x68]
jmp 0x18005c8ea
cmp edi, dword [rbp - 0x5c]
jae 0x18005c8a2
mov dword [rbp - 0x60], edi
mov eax, edi
mov rsi, qword [rbp - 0x68]
mov byte [rax + rsi], r12b
jmp 0x18005c8cc
mov r8d, edi
sub r8d, dword [rbp - 0x5c]
xor r9d, r9d
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.18006d160
test al, al
jne 0x18005c8c8
mov rcx, rbx
call fcn.1801c95dc
jmp 0x18005cdd8
mov rsi, qword [rbp - 0x68]
mov r9, rbx
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call fcn.1801c9490
mov rcx, rbx
cmp rax, rdi
jne 0x18005c8be
call fcn.1801c95dc
mov qword [rsp + 0x40], r12
mov dil, r12b
mov qword [rbp - 0x30], rsi
lea rcx, [rsp + 0x20]
call fcn.18006d240
mov r8d, dword [rbp - 0x60]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x40]
call fcn.1800e0c20
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18005cdd8
call fcn.1800e2890
mov rcx, rax
call fcn.1800e1700
mov rbx, rax
test rax, rax
je 0x18005c9a5
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call fcn.1800e2a60
test eax, eax
je 0x18005c99d
mov edi, 0xa
jmp 0x18005c986
mov r8d, r13d
lea rdx, [rbp + 0x570]
mov rcx, rbx
call fcn.1800e1b50
test eax, eax
jle 0x18005c986
mov al, byte [rbp + 0x570]
mov byte [rbp + 0x578], al
mov r9b, r13b
mov r8d, r13d
lea rdx, [rbp + 0x578]
lea rcx, [rsp + 0x20]
call fcn.18006d160
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rbx
call fcn.1800e0ee0
test eax, eax
jne 0x18005c94d
mov dil, r13b
mov rcx, rbx
call fcn.1800e1060
mov rcx, qword [rsp + 0x40]
call fcn.1800e0b50
test dil, dil
je 0x18005cdd8
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.18005d2c0
nop
lea rdx, [0x180281194]
lea rcx, [rsp + 0x70]
call fcn.18005d0bc
or r14, 0xffffffffffffffff
cmp rax, r14
je 0x18005ca3e
lea r8, [rax + 1]
mov r9, r14
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.18005d018
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x18005ca35
lea rcx, [rsp + 0x70]
call fcn.18005e40c
lea r8d, [r14 + 0x21]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1801c2370
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
lea rcx, [rbp - 0x50]
call fcn.18005e40c
lea rdx, [0x180281198]
lea rcx, [rsp + 0x70]
call fcn.18005d0bc
cmp rax, r14
je 0x18005caab
mov r9, rax
xor r8d, r8d
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x70]
call fcn.18005d018
mov rbx, rax
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x18005caa2
lea rcx, [rsp + 0x70]
call fcn.18005e40c
mov r8d, 0x20
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1801c2370
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
lea rcx, [rbp - 0x50]
call fcn.18005e40c
lea rcx, [rsp + 0x70]
call fcn.18005af4c
jmp 0x18005cdc2
mov rax, qword [rsp + 0x48]
test rax, rax
jne 0x18005cac9
mov rax, r12
jmp 0x18005cacc
mov rax, qword [rax]
mov rdx, qword [rax + 0x10]
sub rdx, r13
and rdx, qword [rsp + 0x60]
mov rax, qword [rax + 8]
mov rdx, qword [rax + rdx*8]
lea rcx, [rbp - 0x28]
call fcn.18005d18c
mov rcx, qword [rsp + 0x58]
dec rcx
and rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + rcx*8]
call fcn.18005e40c
sub qword [rsp + 0x68], r13
jne 0x18005cb12
mov qword [rsp + 0x60], r12
jmp 0x18005cb17
add qword [rsp + 0x60], r13
lea r8, [0x1802812e4]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x80]
call fcn.18005d660
cmp qword [rax + 0x18], 8
jb 0x18005cb38
mov rax, qword [rax]
lea rdx, [rbp + 0x2d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
lea rcx, [rbp + 0x80]
call fcn.18005e40c
cmp rsi, r14
je 0x18005cdc2
mov ecx, dword [rbp + 0x2d0]
and ecx, 0x410
cmp ecx, 0x10
jne 0x18005cd82
lea rdx, [0x180281198]
lea rcx, [rbp + 0x2fc]
call fcn.1801ca670
test eax, eax
je 0x18005cd82
lea rdx, [0x180281354]
lea rcx, [rbp + 0x2fc]
call fcn.1801ca670
test eax, eax
je 0x18005cd82
lea rdx, str.temp
lea rcx, [rbp + 0x2fc]
call fcn.1801ca4d8
test eax, eax
je 0x18005cd82
lea rdx, str.microsoft
lea rcx, [rbp + 0x2fc]
call fcn.1801ca4d8
test eax, eax
je 0x18005cd82
lea rdx, str.packages
lea rcx, [rbp + 0x2fc]
call fcn.1801ca4d8
test eax, eax
je 0x18005cd82
lea rdx, str.ca_certs
lea rcx, [rbp + 0x2fc]
call fcn.1801ca670
lea r8, [0x180281194]
lea rdx, [rbp - 0x28]
test eax, eax
jne 0x18005cd24
lea rcx, [rbp + 0x40]
call fcn.18005d660
nop
lea r8, [rbp + 0x2fc]
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.18005d708
nop
lea r8, [0x180281194]
mov rdx, rax
lea rcx, [rbp + 0xa0]
call fcn.18005d708
nop
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, qword [rbp - 0x80]
mov rcx, rax
call fcn.18005d51c
mov rbx, rax
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], r12
mov r8d, 0x20
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1801c2370
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 7
mov word [rbx], r12w
lea r8, str..pem
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x50]
call fcn.18005d708
nop
lea rcx, [rbp - 8]
call fcn.18005e40c
nop
lea rcx, [rbp + 0xa0]
call fcn.18005e40c
nop
lea rcx, [rbp + 0x20]
call fcn.18005e40c
nop
lea rcx, [rbp + 0x40]
call fcn.18005e40c
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rcx, qword [rbp - 0x50]
lea rdx, [0x18028140c]
call fcn.1801c91e8
mov rbx, rax
test rax, rax
je 0x18005cd1e
mov r8d, dword [rsp + 0x30]
mov r9, rax
mov rdx, r13
mov rcx, qword [rsp + 0x28]
call fcn.1801c9890
mov rcx, rbx
call fcn.1801c95dc
lea rcx, [rbp - 0x50]
jmp 0x18005cd5e
lea rcx, [rbp + 0x20]
call fcn.18005d660
nop
lea r8, [rbp + 0x2fc]
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.18005d708
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18005ce90
nop
lea rcx, [rbp + 0x40]
call fcn.18005e40c
nop
lea rcx, [rbp + 0x20]
call fcn.18005e40c
lea rdi, [r15 + 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [r15 + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, r13b
jne 0x18005cd9e
lea rdx, [rbp + 0x2d0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x18005cb60
lea rdi, [r15 + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bl, byte [r15 + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, r13b
jne 0x18005cdcd
cmp qword [rsp + 0x68], r12
jne 0x18005caba
lea rcx, [rsp + 0x70]
call fcn.18005e40c
nop
lea rbx, vtable.ProtocolFilters::IOB.0
mov qword [rsp + 0x20], rbx
lea rcx, [rsp + 0x20]
call fcn.18006d240
nop
mov qword [rbp - 0x70], rbx
lea rcx, [rbp - 0x70]
call fcn.18006d240
nop
lea rcx, [rbp + 0x60]
call fcn.18005e40c
nop
lea rcx, [rbp - 0x28]
call fcn.18005e40c
nop
lea rcx, [rsp + 0x48]
call fcn.18005cf44
mov rbx, qword [rsp + 0x660]
add rsp, 0x620
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret