Function at 0x1400a746d
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x1400c6cc0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0xca8
lea rbp, [rsp + 0x30]
mov rdi, rsp
mov ecx, 0x32a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0xcc8]
mov qword [rbp + 0xc58], 0xfffffffffffffffe
mov rax, qword [0x140257090]
xor rax, rbp
mov qword [rbp + 0xc68], rax
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.1400a8f6b
lea rcx, [rbp + 8]
call fcn.1400a51ae
nop
mov dword [rbp + 0x44], 0
jmp 0x1400c6d32
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x1400c6d80
mov r9d, dword [rbp + 0x44]
mov r8d, dword [rbp + 0x44]
lea rdx, str.test__02x.doc_d
lea rcx, [rbp + 0x70]
call fcn.1400a7459
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xbf8]
call fcn.1400aaa8c
nop
lea rdx, [rbp + 0xbf8]
lea rcx, [rbp + 8]
call fcn.1400a5294
nop
lea rcx, [rbp + 0xbf8]
call fcn.1400a60ae
jmp 0x1400c6d2a
lea rax, [rbp + 8]
mov qword [rbp + 0xc8], rax
mov edx, 0x18
lea rcx, [rbp + 0xe8]
call fcn.1400aa82f
lea rdx, [rbp + 0xe8]
mov rcx, qword [rbp + 0xc8]
call fcn.1400a7693
nop
mov edx, 0x18
lea rcx, [rbp + 0x118]
call fcn.1400aa82f
lea rdx, [rbp + 0x118]
mov rcx, qword [rbp + 0xc8]
call fcn.1400a884a
nop
jmp 0x1400c6de3
lea rcx, [rbp + 0xe8]
call fcn.1400a5f3c
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0xe8]
call fcn.1400a71b1
movzx eax, al
test eax, eax
je 0x1400c6e9c
lea rcx, [rbp + 0xe8]
call fcn.1400a6bcb
mov qword [rbp + 0x148], rax
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x170]
call fcn.1400a5b68
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x170]
call fcn.1400a80e3
nop
mov rdx, qword [rbp + 0x148]
lea rcx, [rbp + 0x170]
call fcn.1400a5a00
lea rdx, [0x1400a60ef]
mov rcx, rax
call fcn.1400aa546
mov rcx, qword [rbp + 0x148]
call fcn.1400a7d78
mov rdx, rax
lea rcx, str.init_file:__s_n
call fcn.1400a8282
nop
lea rcx, [rbp + 0x170]
call fcn.1400aa4ce
jmp 0x1400c6dd7
lea rcx, [rbp + 0x118]
call fcn.1400a7c97
nop
lea rcx, [rbp + 0xe8]
call fcn.1400a7c97
call fcn.1400a9e57
lea rcx, str.test_zero.doc
call fcn.1400a597e
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 8]
mov qword [rbp + 0x298], rax
mov edx, 0x18
lea rcx, [rbp + 0x2b8]
call fcn.1400aa82f
lea rdx, [rbp + 0x2b8]
mov rcx, qword [rbp + 0x298]
call fcn.1400a7693
nop
mov edx, 0x18
lea rcx, [rbp + 0x2e8]
call fcn.1400aa82f
lea rdx, [rbp + 0x2e8]
mov rcx, qword [rbp + 0x298]
call fcn.1400a884a
nop
jmp 0x1400c6f34
lea rcx, [rbp + 0x2b8]
call fcn.1400a5f3c
lea rdx, [rbp + 0x2e8]
lea rcx, [rbp + 0x2b8]
call fcn.1400a71b1
movzx eax, al
test eax, eax
je 0x1400c7066
lea rcx, [rbp + 0x2b8]
call fcn.1400a6bcb
mov qword [rbp + 0x318], rax
lea r8, str..aes
mov rdx, qword [rbp + 0x318]
lea rcx, [rbp + 0x338]
call fcn.1400a5519
nop
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0x380]
call fcn.1400a5b68
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0x380]
call fcn.1400a80e3
nop
mov rdx, qword [rbp + 0x318]
lea rcx, [rbp + 0x380]
call fcn.1400a5a00
lea rdx, [0x1400a60ef]
mov rcx, rax
call fcn.1400aa546
mov rdx, qword [rbp + 0x318]
lea rcx, [rbp + 0x380]
call fcn.1400a5a00
lea rdx, [0x1400a60ef]
mov rcx, rax
call fcn.1400aa546
lea rcx, [rbp + 0x338]
call fcn.1400a7d78
mov rdx, rax
lea rcx, str.encrypt_file:__s_n
call fcn.1400a8282
nop
lea rcx, [rbp + 0x380]
call fcn.1400aa4ce
nop
lea rcx, [rbp + 0x338]
call fcn.1400a60ae
mov rcx, qword [rbp + 0x318]
call fcn.1400a7d78
mov rcx, rax
call fcn.1400a6b3a
mov rcx, qword [rbp + 0x318]
call fcn.1400a7d78
mov rdx, rax
lea rcx, str.delete_file:__s_n
call fcn.1400a8282
jmp 0x1400c6f28
lea rcx, [rbp + 0x2e8]
call fcn.1400a7c97
nop
lea rcx, [rbp + 0x2b8]
call fcn.1400a7c97
lea rcx, str.C:_test_zero.txt
call fcn.1400a597e
lea rcx, str.C:Windows_test_zero.txt
call fcn.1400a597e
mov dword [rbp + 0x4b0], 0
lea rax, [rbp + 0x4b4]
mov rdi, rax
xor eax, eax
mov ecx, 0x13c
rep stosb byte [rdi], al
lea rdx, [rbp + 0x4b0]
lea rcx, str.C:Windows
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp + 0x608], rax
cmp qword [rbp + 0x608], 0xffffffffffffffff
je 0x1400c716f
lea rdx, [rbp + 0x4b0]
mov rcx, qword [rbp + 0x608]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400c7162
lea rdx, [0x140203588]
lea rcx, [rbp + 0x4dc]
call fcn.1400a7c3d
test eax, eax
je 0x1400c7123
lea rdx, [0x14020358c]
lea rcx, [rbp + 0x4dc]
call fcn.1400a7c3d
test eax, eax
jne 0x1400c7125
jmp 0x1400c70dd
mov eax, dword [rbp + 0x4b0]
and eax, 0x10
test eax, eax
je 0x1400c715d
lea r9, [rbp + 0x4dc]
lea r8, str.C:Windows_s_test_zero.txt
mov edx, 0x104
lea rcx, [rbp + 0x630]
call fcn.1400a7661
lea rcx, [rbp + 0x630]
call fcn.1400a597e
jmp 0x1400c70dd
mov rcx, qword [rbp + 0x608]
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rax, [rbp + 8]
mov qword [rbp + 0x758], rax
mov edx, 0x18
lea rcx, [rbp + 0x778]
call fcn.1400aa82f
lea rdx, [rbp + 0x778]
mov rcx, qword [rbp + 0x758]
call fcn.1400a7693
nop
mov edx, 0x18
lea rcx, [rbp + 0x7a8]
call fcn.1400aa82f
lea rdx, [rbp + 0x7a8]
mov rcx, qword [rbp + 0x758]
call fcn.1400a884a
nop
jmp 0x1400c71d2
lea rcx, [rbp + 0x778]
call fcn.1400a5f3c
lea rdx, [rbp + 0x7a8]
lea rcx, [rbp + 0x778]
call fcn.1400a71b1
movzx eax, al
test eax, eax
je 0x1400c7259
lea rcx, [rbp + 0x778]
call fcn.1400a6bcb
mov qword [rbp + 0x7d8], rax
lea r8, str..aes
mov rdx, qword [rbp + 0x7d8]
lea rcx, [rbp + 0x7f8]
call fcn.1400a5519
lea rcx, [rbp + 0x7f8]
call fcn.1400a7d78
mov rcx, rax
call fcn.1400a6b3a
lea rcx, [rbp + 0x7f8]
call fcn.1400a7d78
mov rdx, rax
lea rcx, str.cleanup_file:__s_n
call fcn.1400a8282
lea rcx, [rbp + 0x7f8]
call fcn.1400a60ae
jmp 0x1400c71c6
lea rcx, [rbp + 0x7a8]
call fcn.1400a7c97
nop
lea rcx, [rbp + 0x778]
call fcn.1400a7c97
xor eax, eax
cmp eax, 1
je 0x1400c7286
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c7272
mov dword [rbp + 0xc34], 0
lea rcx, [rbp + 8]
call fcn.1400aa325
mov eax, dword [rbp + 0xc34]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140201500]
call fcn.1400a6fef
mov eax, edi
mov rcx, qword [rbp + 0xc68]
xor rcx, rbp
call fcn.1400a9b50
lea rsp, [rbp + 0xc78]
pop rdi
pop rbp
ret