Once the get_targets function returns (with a list of files that match these regexes) the malware reads each file’s contents, (if they are under 0x1c00 bytes in length) via call to lfsc_get_contents, and then exfiltrates said contents to the attacker’s remote command and control server (via ei_forensic_sendfile