Function at 0x140001170
Capabilities:
Enumerate files on windows
Get common file path
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push rbp
lea rbp, [rsp - 0xa50]
sub rsp, 0xb50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xa40], rax
lea rdx, [rbp + 0x620]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1400011be
lea rcx, str.Failed_to_get_the_Temp_folder_path._n
call fcn.140001110
mov eax, 1
jmp 0x14000140f
lea r9, [rbp + 0x620]
mov edx, 0x104
lea r8, str._s_sysinfo.txt
lea rcx, [rbp + 0x830]
call fcn.140001060
lea r8, [0x1400034a8]
lea rdx, [rbp + 0x830]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
test eax, eax
je 0x140001210
lea rcx, str.Error_opening_log_file._n
call fcn.140001110
mov eax, 1
jmp 0x14000140f
mov qword [rsp + 0xb60], rbx
lea rcx, [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rdx, str.System_Information:_n
mov rcx, rbx
call fcn.1400010c0
movzx r8d, word [rsp + 0x40]
lea rdx, str.__Processor_Architecture:__u_n
mov rcx, rbx
call fcn.1400010c0
mov r8d, dword [rsp + 0x60]
lea rdx, str.__Number_of_Processors:__u_n
mov rcx, rbx
call fcn.1400010c0
mov r8d, dword [rsp + 0x44]
lea rdx, str.__Page_size:__u_bytes_n_n
mov rcx, rbx
call fcn.1400010c0
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
lea rdx, str.Memory_Information:_n
mov rcx, rbx
call fcn.1400010c0
mov r8, qword [rsp + 0x78]
lea rdx, str.__Total_Physical_Memory:__llu_MB_n
shr r8, 0x14
mov rcx, rbx
call fcn.1400010c0
mov r8, qword [rbp - 0x80]
lea rdx, str.__Available_Physical_Memory:__llu_MB_n_n
shr r8, 0x14
mov rcx, rbx
call fcn.1400010c0
mov rbx, qword [rsp + 0x30]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x200]
mov dword [rsp + 0x38], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, rbx
test eax, eax
je 0x140001300
lea r8, [rbp + 0x200]
lea rdx, str.Username:__s_n
call fcn.1400010c0
jmp 0x14000130c
lea rdx, str.Failed_to_get_the_username._n
call fcn.1400010c0
lea rax, [rbp + 0x410]
mov qword [rsp + 0xb68], rdi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x10
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400013d5
mov rbx, qword [rsp + 0x30]
lea r9, [rbp + 0x410]
lea r8, str._s.
mov edx, 0x104
lea rcx, [rbp + 0x200]
call fcn.140001060
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x200]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea r8, [rbp + 0x410]
mov rcx, rbx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001391
lea rdx, str.Failed_to_open_directory:__s_n
call fcn.140001010
jmp 0x1400013e6
lea rdx, str._nFiles_in_directory__s:_n
call fcn.140001010
nop dword [rax]
test byte [rbp - 0x50], 0x10
jne 0x1400013b9
lea r8, [rbp - 0x24]
mov rcx, rbx
lea rdx, str.___s_n
call fcn.140001010
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400013a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1400013e6
mov rcx, qword [rsp + 0x30]
lea rdx, str.Failed_to_get_the_Desktop_directory_path._n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, str.System_information_has_been_saved_to_sysinfo.txt_in_the_Temp_folder_n
call fcn.140001110
mov rdi, qword [rsp + 0xb68]
xor eax, eax
mov rbx, qword [rsp + 0xb60]
mov rcx, qword [rbp + 0xa40]
xor rcx, rsp
call fcn.140001440
add rsp, 0xb50
pop rbp
ret