Function at 0x140001300
Capabilities:
Delete file
Encode data using xor
Enumerate files on windows
Enumerate files recursively
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x14000c010]
xor rax, rsp
mov qword [rbp + 0x110], rax
mov qword [rsp + 0x78], rdx
mov r12, rcx
mov qword [rsp + 0x30], rcx
mov rsi, qword [rcx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rsi
cmp rax, 2
jb 0x1400018b4
mov r15, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14000136a
mov r15, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea r14, [rsi + 2]
mov ebx, 0xf
lea rdi, [rsp + 0x38]
lea eax, [rbx + 7]
lea r13, [rbx - 0x10]
cmp r14, rbx
jbe 0x140001403
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400013a6
mov rbx, rcx
jmp 0x1400013ad
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, r13
cmp rcx, 0x1000
jb 0x1400013ed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400018ba
mov rcx, rax
call fcn.140006490
test rax, rax
je 0x14000147d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400013fe
test rcx, rcx
je 0x1400013fc
call fcn.140006490
mov rdi, rax
jmp 0x1400013fe
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov word [rdi + rsi], 0x2a5c
mov byte [rdi + r14], 0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
lea rdx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140001489
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001484
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001484
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400067f4
movdqa xmm0, xmmword [0x140008910]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
cmp rdi, r13
je 0x14000187e
xor r14d, r14d
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
lea rax, [rbp - 4]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x1400014c6
lea rdx, [rbp - 4]
lea rcx, [rbp - 0x70]
call fcn.140004f90
nop
lea rax, [rbp - 0x70]
mov rbx, qword [rbp - 0x58]
cmp rbx, 0x10
setae cl
mov byte [rsp + 0x20], cl
mov rsi, qword [rbp - 0x70]
cmovae rax, rsi
mov r13, qword [rbp - 0x60]
cmp r13, 1
jne 0x14000151a
cmp byte [rax], 0x2e
jne 0x14000150d
mov eax, r14d
jmp 0x140001512
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400017e7
lea rax, [rbp - 0x70]
test cl, cl
cmovne rax, rsi
cmp r13, 2
jne 0x140001547
cmp byte [rax], 0x2e
jne 0x14000153a
cmp byte [rax + 1], 0x2e
jne 0x14000153a
mov eax, r14d
jmp 0x14000153f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400017e7
mov r15, qword [r12 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 1
jb 0x1400018ae
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x18], 0x10
jb 0x140001575
mov r12, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
lea r14, [r15 + 1]
mov ebx, 0xf
lea rdi, [rsp + 0x58]
cmp r14, rbx
jbe 0x140001615
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400015ab
mov rbx, rcx
jmp 0x1400015b8
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x1400015ff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400018a8
mov rcx, rax
call fcn.140006490
test rax, rax
je 0x140001837
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001610
test rcx, rcx
je 0x14000160e
call fcn.140006490
mov rdi, rax
jmp 0x140001610
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], rbx
mov r8, r15
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0x5c
mov byte [rdi + r14], 0
lea rdx, [rbp - 0x70]
cmp byte [rsp + 0x20], 0
cmovne rdx, rsi
mov r8, r13
lea rcx, [rsp + 0x58]
call fcn.140004b10
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor r14d, r14d
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x1400016be
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000183e
call fcn.1400067f4
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rbx, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x70]
test byte [rbp - 0x30], 0x10
je 0x1400016f2
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp - 0x50]
call fcn.140001300
jmp 0x1400017a2
lea rdx, [rbp - 0x70]
cmp rbx, 0x10
cmovae rdx, rsi
movabs r9, 0xcbf29ce484222325
mov rcx, r14
mov r8, qword [rbp - 0x60]
test r8, r8
je 0x140001737
movabs rbx, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rbx
inc rcx
cmp rcx, r8
jb 0x140001720
mov rbx, qword [rbp - 0x58]
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140005fb0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400017a2
cmp rcx, qword [rdi + 8]
je 0x1400017a2
lea rcx, [0x14000ca50]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
jne 0x14000185b
cmp dword [0x14000ca9c], 0x7fffffff
je 0x140001845
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [0x14000ca50]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400017dd
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400017d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001867
call fcn.1400067f4
mov rdi, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
cmp rbx, 0x10
jb 0x14000181a
lea rdx, [rbx + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001812
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000186e
mov rcx, rsi
call fcn.1400067f4
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140001875
mov r13, 0xffffffffffffffff
jmp 0x1400014b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [0x14000ca9c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140006470
mov rbx, qword [rsp + 0x270]
add rsp, 0x220
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001140
nop
call fcn.140001290
nop
call fcn.140001290
int3
call fcn.140001140
int3