Function at 0x6f1292e0
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
mov qword [rsp + 0x208], rcx
mov qword [rsp + 0x200], rdx
mov qword [rsp + 0x1f8], r8
mov dword [rsp + 0x1f4], r9d
lea rax, str._userprofile__appdatalocal
mov qword [rsp + 0x98], rax
mov ecx, 0x105
call sub.msvcrt.dll_malloc
mov qword [rsp + 0x90], rax
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x70], 0
lea rcx, str.Shlwapi.dll
call fcn.6f1345a0
mov rcx, rax
lea rdx, str.PathUnExpandEnvStringsA
call fcn.6f1341a0
mov qword [0x6f152f90], rax
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ecx, 0x10
mov dword [rsp + 0x4c], eax
call sub.msvcrt.dll_malloc
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rax], 0
mov rax, qword [rsp + 0x68]
mov qword [rax + 8], 0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.msvcrt.dll__strlwr]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call fcn.6f127740
xor eax, eax
cmp qword [rsp + 0x68], 0
mov byte [rsp + 0x4b], al
je 0x6f1293fb
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
setne cl
mov byte [rsp + 0x4b], cl
mov al, byte [rsp + 0x4b]
test al, 1
jne 0x6f12940c
jmp 0x6f129fe4
mov rcx, qword [rsp + 0x68]
call fcn.6f127de0
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x200]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
mov r9, qword [rsp + 0x1f8]
mov r10d, dword [rsp + 0x1f4]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x20], r10d
call fcn.6f128140
cmp qword [rsp + 0x70], 0
jne 0x6f129cd3
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x60]
mov r8, qword [rax]
mov rax, rsp
mov qword [rax + 0x20], 0
lea r9, [0x6f14c93c]
mov edx, 0x104
call fcn.6f127ea0
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x44], eax
call sub.msvcrt.dll_strlen
movabs rcx, 0xf8fdbb780481a433
add rax, rcx
movabs r8, 0xdb338420e03a1c1a
add rax, r8
sub rax, rcx
movabs rcx, 0xad87581692291870
sub rax, rcx
sub rax, 2
add rax, rcx
movabs rcx, 0xbb89966f82569aa1
add rax, rcx
sub rax, r8
sub rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
shl rcx, 0
add rax, rcx
mov qword [rsp + 0x58], rax
jmp 0x6f1294fc
mov rcx, qword [rsp + 0x90]
lea rdx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x80], rax
mov rax, 0xffffffffffffffff
cmp rax, qword [rsp + 0x80]
jne 0x6f12953e
jmp 0x6f129534
jmp 0x6f129539
jmp 0x6f129cce
jmp 0x6f129543
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
xor r8d, r8d
cmp eax, 0
mov byte [rsp + 0x43], r8b
je 0x6f1299fa
xor eax, eax
mov ecx, dword [0x6f152f78]
mov edx, dword [0x6f152f84]
mov r8d, 0x82bc88b6
add r8d, 0
sub r8d, 1
sub r8d, 0x82bc88b6
sub eax, r8d
mov r8d, ecx
sub r8d, eax
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
and r11b, 1
mov bl, 1
mov sil, bl
xor sil, 1
mov dil, r9b
and dil, sil
or r11b, dil
mov sil, r10b
xor sil, 0xff
and sil, 0
mov dil, bl
xor dil, 0
mov bpl, r10b
and bpl, dil
mov r14b, bl
xor r14b, 1
and r14b, 0
and dil, 1
or sil, bpl
or r14b, dil
xor sil, r14b
mov dil, bl
xor dil, 1
and dil, 1
mov bpl, bl
xor bpl, 1
and bpl, 1
or dil, bpl
mov bpl, r11b
xor bpl, 0xff
mov r14b, bl
xor r14b, 1
mov r15b, bl
xor r15b, 0
or bpl, r14b
or r15b, 0
xor bpl, 0xff
and bpl, r15b
mov r14b, dil
xor r14b, 0xff
mov r15b, r9b
xor r15b, r14b
and r15b, r9b
mov r9b, bl
xor r9b, 1
mov r14b, sil
xor r14b, r9b
and r14b, sil
xor r10b, 0xff
mov r9b, dil
xor r9b, 0xff
mov r12b, bl
xor r12b, 0
or r10b, r9b
or r12b, 0
xor r10b, 0xff
and r10b, r12b
mov r9b, bpl
xor r9b, 0xff
mov r12b, r15b
xor r12b, 0xff
mov r13b, bl
xor r13b, 0
mov al, r9b
and al, 0
and bpl, r13b
mov cl, r12b
and cl, 0
and r15b, r13b
or al, bpl
or cl, r15b
xor al, cl
or r9b, r12b
xor r9b, 0xff
or r13b, 0
and r9b, r13b
or al, r9b
mov cl, r14b
and cl, r10b
xor r14b, r10b
or cl, r14b
mov r9b, al
xor r9b, 0xff
mov r10b, cl
and r10b, r9b
xor cl, 0xff
and al, cl
or r10b, al
mov al, r11b
xor al, 0xff
mov cl, sil
xor cl, 0xff
mov r9b, bl
xor r9b, 1
mov bpl, al
and bpl, 0xff
and r11b, r9b
mov r14b, cl
and r14b, 0xff
and sil, r9b
or bpl, r11b
or r14b, sil
xor bpl, r14b
or al, cl
xor al, 0xff
or r9b, 1
and al, r9b
or bpl, al
mov al, bpl
xor al, 0xff
and al, 1
xor bl, 1
and bpl, bl
or al, bpl
mov cl, dil
and cl, 1
xor dil, 1
or cl, dil
xor cl, 0xff
mov r9b, al
xor r9b, cl
and r9b, al
mov al, r10b
and al, r9b
xor r10b, r9b
or al, r10b
test al, 1
jne 0x6f129753
jmp 0x6f12a043
xor eax, eax
cmp qword [rsp + 0x70], 0
sete cl
mov edx, dword [0x6f152f78]
mov r8d, dword [0x6f152f84]
mov r9d, edx
add r9d, 0xedefc5a3
sub r9d, 0x76f5b008
sub r9d, 0xedefc5a3
sub eax, 1
add r9d, eax
sub r9d, 0x3327f3c0
add r9d, 0x76f5b008
add r9d, 0x3327f3c0
imul edx, r9d
and edx, 1
cmp edx, 0
sete r10b
cmp r8d, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 1
mov sil, 1
mov dil, sil
xor dil, 1
mov bpl, r10b
and bpl, dil
mov r14b, sil
xor r14b, 1
and r14b, 0xff
and dil, 1
or bl, bpl
or r14b, dil
xor bl, r14b
mov dil, r11b
xor dil, 0xff
and dil, 1
mov bpl, sil
xor bpl, 1
mov r14b, r11b
and r14b, bpl
mov r15b, sil
xor r15b, 1
and r15b, 0xff
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, sil
xor bpl, 1
and bpl, 1
mov r14b, sil
xor r14b, 1
and r14b, 1
or bpl, r14b
mov r14b, sil
xor r14b, 1
mov r15b, bl
xor r15b, r14b
and r15b, bl
xor r10b, 0xff
mov r14b, bpl
xor r14b, 0xff
mov r12b, sil
xor r12b, 0
or r10b, r14b
or r12b, 0
xor r10b, 0xff
and r10b, r12b
mov r14b, dil
xor r14b, 0xff
mov r12b, sil
xor r12b, 1
mov r13b, sil
xor r13b, 1
or r14b, r12b
or r13b, 1
xor r14b, 0xff
and r14b, r13b
mov r12b, bpl
xor r12b, 0xff
mov r13b, r11b
xor r13b, r12b
and r13b, r11b
mov r11b, r15b
xor r11b, 0xff
mov r12b, r10b
xor r12b, 0xff
mov al, sil
xor al, 0
mov dl, r11b
and dl, 0
and r15b, al
mov r8b, r12b
and r8b, 0
and r10b, al
or dl, r15b
or r8b, r10b
xor dl, r8b
or r11b, r12b
xor r11b, 0xff
or al, 0
and r11b, al
or dl, r11b
mov al, r14b
xor al, 0xff
mov r8b, r13b
xor r8b, 0xff
mov r10b, sil
xor r10b, 1
mov r11b, al
and r11b, 0xff
and r14b, r10b
mov r15b, r8b
and r15b, 0xff
and r13b, r10b
or r11b, r14b
or r15b, r13b
xor r11b, r15b
or al, r8b
xor al, 0xff
or r10b, 1
and al, r10b
or r11b, al
mov al, dl
xor al, 0xff
mov r8b, r11b
and r8b, al
xor r11b, 0xff
and dl, r11b
or r8b, dl
mov al, bl
xor al, 0xff
mov dl, dil
xor dl, 0xff
mov r10b, sil
xor r10b, 0
mov r11b, al
and r11b, 0
and bl, r10b
mov r14b, dl
and r14b, 0
and dil, r10b
or r11b, bl
or r14b, dil
xor r11b, r14b
or al, dl
xor al, 0xff
or r10b, 0
and al, r10b
or r11b, al
mov al, r11b
xor al, 0xff
and al, 0
mov dl, sil
xor dl, 0
and r11b, dl
mov r10b, sil
xor r10b, 1
and r10b, 0
and dl, 1
or al, r11b
or r10b, dl
xor al, r10b
mov dl, sil
xor dl, 1
mov r10b, bpl
xor r10b, 0xff
xor sil, 1
mov r11b, dl
and r11b, 0xff
mov bl, sil
and bl, 1
mov dil, r10b
and dil, 0xff
and bpl, sil
or r11b, bl
or dil, bpl
xor r11b, dil
or dl, r10b
xor dl, 0xff
or sil, 1
and dl, sil
or r11b, dl
xor r11b, 0xff
mov dl, al
xor dl, r11b
and dl, al
mov al, r8b
and al, dl
xor r8b, dl
or al, r8b
test al, 1
mov byte [rsp + 0x42], cl
jne 0x6f1299ed
jmp 0x6f12a043
mov al, byte [rsp + 0x42]
mov byte [rsp + 0x43], al
jmp 0x6f1299fa
mov al, byte [rsp + 0x43]
test al, 1
jne 0x6f129a0b
jmp 0x6f129cc9
lea rax, [rsp + 0xa8]
add rax, 0x2c
mov rcx, rax
lea rdx, [0x6f14c93f]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
je 0x6f129a59
lea rax, [rsp + 0xa8]
add rax, 0x2c
mov rcx, rax
lea rdx, [0x6f14c941]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, 0
jne 0x6f129a5e
jmp 0x6f129543
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x50]
movabs r9, 0x4694bbb6339f4efe
sub rcx, r9
sub rcx, r8
add rcx, r9
mov r8d, 0x104
movabs r9, 0x4f4a34dd358bd34a
sub r8, r9
add r8, rcx
add r8, r9
lea rcx, [rsp + 0xa8]
add rcx, 0x2c
mov r9, rsp
mov qword [r9 + 0x20], 0
lea r9, [0x6f14c944]
mov qword [rsp + 0x38], rcx
mov rcx, rdx
mov edx, r8d
mov r8, r9
mov r9, qword [rsp + 0x38]
call fcn.6f127ea0
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x34], eax
call qword [sym.imp.msvcrt.dll__strlwr]
mov edx, dword [rsp + 0xa8]
mov r10d, 0xffffffff
mov r11d, r10d
xor r11d, 0x10
and r11d, 0xffffffff
xor r10d, 0xffffffff
and r10d, 0x10
or r11d, r10d
mov r10d, edx
xor r10d, 0xffffffff
mov esi, r11d
and esi, r10d
xor r11d, 0xffffffff
mov r10d, edx
and r10d, r11d
or esi, r10d
xor edx, 0xffffffff
mov r10d, esi
xor r10d, edx
and r10d, esi
cmp r10d, 0
je 0x6f129c8d
mov eax, dword [rsp + 0xa8]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0xd82ad1ab
mov edx, 0xffffffff
mov r8d, edx
xor r8d, 0xd82ad1ab
and eax, r8d
mov r9d, edx
xor r9d, 0xffffffff
and r9d, 0xd82ad1ab
and r8d, 0xffffffff
or ecx, eax
or r9d, r8d
xor ecx, r9d
mov eax, edx
xor eax, 0x400
and eax, 0x1a53c0bf
mov r8d, edx
xor r8d, 0x1a53c0bf
mov r9d, r8d
and r9d, 0x400
mov r10d, edx
xor r10d, 0xffffffff
and r10d, 0x1a53c0bf
and r8d, 0xffffffff
or eax, r9d
or r10d, r8d
xor eax, r10d
mov r8d, edx
xor r8d, 0xec2f257c
and r8d, 0xffffffff
mov r9d, edx
xor r9d, 0xffffffff
and r9d, 0xec2f257c
or r8d, r9d
mov r9d, ecx
and r9d, eax
xor ecx, eax
or r9d, ecx
mov eax, r8d
and eax, 0xec2f257c
xor r8d, 0xec2f257c
or eax, r8d
mov ecx, r9d
xor ecx, 0xffffffff
and ecx, 0x8fc633da
mov r8d, edx
xor r8d, 0x8fc633da
and r9d, r8d
xor edx, 0xffffffff
and edx, 0x8fc633da
and r8d, 0xffffffff
or ecx, r9d
or edx, r8d
xor ecx, edx
xor eax, 0xffffffff
mov edx, ecx
xor edx, eax
and edx, ecx
cmp edx, 0
jne 0x6f129c8d
mov rcx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x90]
mov edx, 0x10
call fcn.6f128bd0
cmp eax, 0
jne 0x6f129c8d
jmp 0x6f129c71
jmp 0x6f129c76
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x68]
call fcn.6f127740
jmp 0x6f129cc4
jmp 0x6f129c92
jmp 0x6f129c97
mov rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x1f8]
mov eax, dword [rsp + 0x1f4]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x20], eax
call fcn.6f128140
jmp 0x6f129543
jmp 0x6f129cce
jmp 0x6f129fd5
xor eax, eax
mov ecx, dword [0x6f152f78]
mov edx, dword [0x6f152f84]
mov r8d, ecx
sub r8d, 0x55060f72
add r8d, 0xb67b99de
add r8d, 0x55060f72
sub eax, 1
add r8d, eax
sub r8d, 0xab35b316
sub r8d, 0xb67b99de
add r8d, 0xab35b316
imul ecx, r8d
and ecx, 1
cmp ecx, 0
sete r9b
cmp edx, 0xa
setl r10b
mov r11b, r9b
xor r11b, 0xff
mov bl, r10b
xor bl, 0xff
mov sil, 1
mov dil, sil
xor dil, 0
or r11b, bl
or dil, 0
xor r11b, 0xff
and r11b, dil
mov bl, r9b
xor bl, 0xff
mov dil, r10b
and dil, bl
xor r10b, 0xff
and r9b, r10b
or dil, r9b
mov r9b, r11b
xor r9b, 0xff
mov r10b, dil
xor r10b, 0xff
xor sil, 1
mov bl, r9b
and bl, 0xff
and r11b, sil
mov bpl, r10b
and bpl, 0xff
and dil, sil
or bl, r11b
or bpl, dil
xor bl, bpl
or r9b, r10b
xor r9b, 0xff
or sil, 1
and r9b, sil
or bl, r9b
test bl, 1
jne 0x6f129db1
jmp 0x6f12a048
xor eax, eax
mov ecx, dword [0x6f152f78]
mov edx, dword [0x6f152f84]
mov r8d, ecx
sub r8d, 0x59e8acec
sub r8d, 0xc401bc45
add r8d, 0x59e8acec
mov r9d, eax
sub r9d, 1
add r8d, r9d
mov r9d, eax
sub r9d, r8d
mov r8d, eax
sub r8d, 0xc401bc45
add r9d, r8d
sub eax, r9d
imul ecx, eax
and ecx, 1
cmp ecx, 0
sete r10b
cmp edx, 0xa
setl r11b
mov bl, r10b
xor bl, 0xff
and bl, 1
mov sil, 1
mov dil, sil
xor dil, 1
mov bpl, r10b
and bpl, dil
or bl, bpl
mov dil, r11b
xor dil, 0xff
and dil, 0
mov bpl, sil
xor bpl, 0
mov r14b, r11b
and r14b, bpl
mov r15b, sil
xor r15b, 1
and r15b, 0
and bpl, 1
or dil, r14b
or r15b, bpl
xor dil, r15b
mov bpl, sil
xor bpl, 1
and bpl, 1
mov r14b, sil
xor r14b, 1
and r14b, 1
or bpl, r14b
mov r14b, bl
xor r14b, 0xff
mov r15b, sil
xor r15b, 1
mov r12b, sil
xor r12b, 0
or r14b, r15b
or r12b, 0
xor r14b, 0xff
and r14b, r12b
xor r10b, 0xff
mov r15b, bpl
xor r15b, 0xff
mov r12b, sil
xor r12b, 1
or r10b, r15b
or r12b, 1
xor r10b, 0xff
and r10b, r12b
mov r15b, sil
xor r15b, 1
mov r12b, dil
xor r12b, r15b
and r12b, dil
xor r11b, 0xff
mov r15b, bpl
xor r15b, 0xff
mov r13b, sil
xor r13b, 1
or r11b, r15b
or r13b, 1
xor r11b, 0xff
and r11b, r13b
mov r15b, r14b
and r15b, r10b
xor r14b, r10b
or r15b, r14b
mov r10b, r12b
and r10b, r11b
xor r12b, r11b
or r10b, r12b
mov r11b, r15b
xor r11b, 0xff
and r11b, 0
mov r14b, sil
xor r14b, 0
and r15b, r14b
mov r12b, r10b
xor r12b, 0xff
and r12b, 0
and r10b, r14b
or r11b, r15b
or r12b, r10b
xor r11b, r12b
mov r10b, bl
xor r10b, 0xff
mov r14b, dil
xor r14b, 0xff
mov r15b, sil
xor r15b, 0
mov r12b, r10b
and r12b, 0
and bl, r15b
mov r13b, r14b
and r13b, 0
and dil, r15b
or r12b, bl
or r13b, dil
xor r12b, r13b
or r10b, r14b
xor r10b, 0xff
or r15b, 0
and r10b, r15b
or r12b, r10b
mov r10b, r12b
xor r10b, 0xff
and r10b, 0
mov bl, sil
xor bl, 0
and r12b, bl
xor sil, 1
and sil, 0
and bl, 1
or r10b, r12b
or sil, bl
xor r10b, sil
mov bl, bpl
and bl, 1
xor bpl, 1
or bl, bpl
xor bl, 0xff
mov sil, r10b
xor sil, bl
and sil, r10b
mov r10b, r11b
and r10b, sil
xor r11b, sil
or r10b, r11b
test r10b, 1
jne 0x6f129fc6
jmp 0x6f12a048
jmp 0x6f129fcb
jmp 0x6f129fd0
jmp 0x6f129fd5
mov rcx, qword [rsp + 0x60]
call fcn.6f1276f0
jmp 0x6f1293d9
mov rcx, qword [rsp + 0x90]
call sub.msvcrt.dll_free
cmp qword [rsp + 0x70], 0
jne 0x6f12a00d
mov dword [rsp + 0x214], 0xffffffff
jmp 0x6f12a028
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x208]
mov qword [rcx], rax
mov dword [rsp + 0x214], 0
mov eax, dword [rsp + 0x214]
add rsp, 0x218
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x6f129753
jmp 0x6f129db1