Function at 0x140006640
Capabilities:
Encode data using xor
Enumerate files on windows
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x418]
sub rsp, 0x4e0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rsi, rdx
mov r13, rcx
mov qword [rsp + 0x38], rcx
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
movdqu xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], r14
lea ecx, [r14 + 0x10]
call fcn.14003f480
mov qword [rax + 8], r14
mov qword [rbp - 0x70], rax
lea rcx, [rbp - 0x70]
mov qword [rax], rcx
mov r8, qword [rbp - 0x50]
lea rax, [r8 + 1]
mov rdx, qword [rbp - 0x60]
cmp rdx, rax
ja 0x1400066e1
lea rcx, [rbp - 0x70]
call fcn.140015740
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x60]
lea rcx, [rdx - 1]
mov rax, qword [rbp - 0x58]
and rax, rcx
mov qword [rbp - 0x58], rax
lea rdi, [rax + r8]
and rcx, rdi
lea rbx, [rcx*8]
mov rax, qword [rbp - 0x68]
cmp qword [rax + rbx], 0
jne 0x140006724
mov ecx, 0x20
call fcn.14003f480
mov rcx, qword [rbp - 0x68]
mov qword [rcx + rbx], rax
mov rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x68]
lea rcx, [rdx - 1]
and rcx, rdi
mov rdx, rsi
mov rcx, qword [rax + rcx*8]
call fcn.14000f2b0
mov rcx, qword [rbp - 0x50]
add rcx, 1
mov qword [rbp - 0x50], rcx
je 0x140007201
nop dword [rax]
mov rax, qword [rbp - 0x58]
dec rax
add rcx, rax
mov rdx, qword [rbp - 0x60]
dec rdx
and rdx, rcx
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax + rdx*8]
lea rcx, [rbp + 0x38]
call fcn.14000f2b0
nop
lea rcx, [rbp - 0x70]
call fcn.1400018e0
movabs r8, 0x7ffffffffffffffe
mov rax, r8
mov rdx, qword [rbp + 0x48]
mov qword [rsp + 0x68], rdx
sub rax, rdx
cmp rax, 2
jb 0x140007244
lea r14, [rbp + 0x38]
mov rcx, qword [rbp + 0x50]
mov qword [rsp + 0x28], rcx
cmp rcx, 7
seta r15b
mov rax, qword [rbp + 0x38]
mov qword [rsp + 0x30], rax
cmova r14, rax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xor eax, eax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
lea rsi, [rdx + 2]
mov ebx, 7
lea rdi, [rbp - 8]
cmp rsi, rbx
jbe 0x14000682a
mov rbx, rsi
or rbx, 7
cmp rbx, r8
jbe 0x1400067f8
mov rbx, r8
jmp 0x140006805
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
inc rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 8]
call fcn.140013490
mov rdi, rax
dec rbx
mov qword [rbp - 8], rax
mov rdx, qword [rsp + 0x68]
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rbx
lea rbx, [rdx + rdx]
mov qword [rsp + 0x70], rbx
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.1400683e0
mov dword [rdi + rbx], 0x2a005c
xor r14d, r14d
mov word [rdi + rsi*2], r14w
or r12d, 4
mov dword [rsp + 0x20], r12d
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova rcx, qword [rbp - 8]
lea rdx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
jne 0x140006926
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x1400068cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007289
call fcn.14003f0f8
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r14w
test r15b, r15b
je 0x1400071f4
mov rdx, qword [rsp + 0x28]
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000691c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000723e
call fcn.14003f0f8
jmp 0x1400071f4
xor r15d, r15d
nop dword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r15
mov qword [rbp - 0x10], r15
lea rax, [rbp + 0x18c]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140006950
lea rdx, [rbp + 0x18c]
lea rcx, [rbp - 0x28]
call fcn.140013bf0
nop
lea r9, [rbp - 0x28]
mov r11, qword [rbp - 0x10]
cmp r11, 7
seta bl
mov r10, qword [rbp - 0x28]
cmova r9, r10
mov rdx, qword [rbp - 0x18]
cmp rdx, 1
jne 0x1400069b8
mov r8, rdx
lea rax, [0x140078bb4]
mov rcx, rax
test rdx, rdx
je 0x1400069f4
sub r9, rax
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x1400069b8
add rcx, 2
sub r8, 1
jne 0x1400069a2
jmp 0x1400069f4
lea r8, [rbp - 0x28]
test bl, bl
cmovne r8, r10
cmp rdx, 2
jne 0x140006a38
lea rax, [0x140078c48]
mov rcx, rax
test rdx, rdx
je 0x1400069f4
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x140006a38
add rcx, 2
sub rdx, 1
jne 0x1400069e0
cmp r11, 7
jbe 0x14000712a
lea rdx, [r11*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x140006a2b
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007283
mov rcx, r10
call fcn.14003f0f8
jmp 0x14000712a
lea r14, [rbp + 0x38]
cmp qword [rsp + 0x28], 7
cmova r14, qword [rsp + 0x30]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov rsi, qword [rsp + 0x68]
inc rsi
mov ebx, 7
lea rdi, [rsp + 0x48]
cmp rsi, rbx
jbe 0x140006abb
mov rbx, rsi
or rbx, 7
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
jbe 0x140006a8c
mov rbx, rax
jmp 0x140006a99
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
inc rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140013490
mov rdi, rax
dec rbx
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x70]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call fcn.1400683e0
mov word [rdi + rbx], 0x5c
mov word [rdi + rsi*2], r15w
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rsp + 0x48]
call fcn.14000f140
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x18], xmm6
movups xmm7, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm7
xor r8d, r8d
mov qword [rax + 0x10], r8
mov qword [rax + 0x18], 7
mov word [rax], r8w
or r12d, 3
mov dword [rsp + 0x20], r12d
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140006b6f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000724a
call fcn.14003f0f8
xor r8d, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r8w
test byte [rbp + 0x160], 0x10
je 0x140006d54
mov r13, qword [r13 + 0x2e0]
mov rax, qword [r13]
cmp rax, r13
je 0x140006c7b
mov r15, qword [rbp + 0x28]
mov r12, qword [rbp + 0x18]
nop dword [rax]
lea rbx, [rax + 0x10]
mov rdi, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x140006bc2
mov rbx, qword [rbx]
lea rsi, [rbp + 0x18]
mov r10, qword [rbp + 0x30]
cmp r10, 7
cmova rsi, r12
cmp rdi, r15
ja 0x140006c6c
mov rcx, r15
sub rcx, rdi
test rdi, rdi
je 0x140006d14
inc rcx
lea r14, [rsi + rcx*2]
mov rcx, rsi
movzx r11d, word [rbx]
nop dword [rax + rax]
mov rdx, r14
sub rdx, rcx
sar rdx, 1
je 0x140006c27
cmp word [rcx], r11w
je 0x140006c24
cmp rdx, 1
je 0x140006c27
dec rdx
add rcx, 2
cmp word [rcx], r11w
jne 0x140006c11
mov r8, rcx
mov rcx, r8
test r8, r8
je 0x140006c69
mov r9, rdi
mov r8, rbx
test rdi, rdi
je 0x140006c59
mov r10, rcx
sub r10, rbx
movzx edx, word [r8 + r10]
cmp dx, word [r8]
jne 0x140006d04
add r8, 2
sub r9, 1
jne 0x140006c40
sub rcx, rsi
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x140006d10
xor r8d, r8d
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, r13
jne 0x140006bb0
mov r8, qword [rbp - 0x50]
lea rax, [r8 + 1]
mov rdx, qword [rbp - 0x60]
cmp rdx, rax
ja 0x140006c9d
lea rcx, [rbp - 0x70]
call fcn.140015740
mov r8, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x60]
lea rcx, [rdx - 1]
mov rax, qword [rbp - 0x58]
and rax, rcx
mov qword [rbp - 0x58], rax
lea rdi, [rax + r8]
mov rax, rdi
and rax, rcx
lea rbx, [rax*8]
mov rax, qword [rbp - 0x68]
cmp qword [rbx + rax], 0
jne 0x140006ce3
mov ecx, 0x20
call fcn.14003f480
mov rcx, qword [rbp - 0x68]
mov qword [rcx + rbx], rax
mov rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x68]
lea rcx, [rdx - 1]
and rcx, rdi
lea rdx, [rbp + 0x18]
mov rcx, qword [rax + rcx*8]
call fcn.14000f2b0
inc qword [rbp - 0x50]
mov rdi, qword [rbp + 0x30]
jmp 0x1400070aa
add rcx, 2
xor r8d, r8d
jmp 0x140006c00
mov r10, qword [rbp + 0x30]
cmp r10, 7
jbe 0x1400070e7
lea rdx, [r10*2 + 2]
mov rax, r12
cmp rdx, 0x1000
jb 0x140006d4c
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000727d
mov rcx, r12
jmp 0x1400070e1
lea rbx, [rbp - 0x28]
mov rsi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x10]
cmp r14, 7
cmova rbx, rsi
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x140006eaa
mov r15d, 0x100
mov r8d, r15d
xor edx, edx
lea rcx, [rbp + 0x60]
call fcn.140068a80
lea r9, [0x140078bb4]
mov rcx, r9
movzx eax, word [rcx]
cmp ax, r15w
jae 0x140006def
movzx eax, al
mov byte [rbp + rax + 0x60], 1
add rcx, 2
lea rax, [0x140078bb6]
cmp rcx, rax
jne 0x140006d93
lea rcx, [rdi - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea rdx, [rbx + rax*2]
nop word [rax + rax]
movzx eax, word [rdx]
cmp ax, r15w
jae 0x140006de0
cmp byte [rbp + rax + 0x60], 0
jne 0x140006e4e
cmp rdx, rbx
je 0x140006ea7
sub rdx, 2
jmp 0x140006dd0
lea rcx, [rdi - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea rdx, [rbx + rax*2]
mov r10d, 0x2e
nop dword [rax + rax]
mov eax, 1
movzx r8d, word [rdx]
mov rcx, r9
cmp r10w, r8w
je 0x140006e4e
cmp rax, 1
je 0x140006e3a
dec rax
add rcx, 2
cmp word [rcx], r8w
jne 0x140006e22
test rcx, rcx
jne 0x140006e4e
cmp rdx, rbx
je 0x140006e45
sub rdx, 2
jmp 0x140006e10
mov rdx, 0xffffffffffffffff
jmp 0x140006e54
sub rdx, rbx
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140006ea7
inc rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
cmp rdi, rdx
jb 0x140007250
sub rdi, rdx
mov r8, 0xffffffffffffffff
cmp rdi, r8
cmovb r8, rdi
lea rax, [rbp - 0x28]
cmp r14, 7
cmova rax, rsi
lea rdx, [rax + rdx*2]
lea rcx, [rbp - 0x48]
call fcn.140013bf0
or r12d, 0x18
jmp 0x140006ed0
xor r8d, r8d
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r8
mov qword [rbp - 0x30], r8
xor r8d, r8d
lea rdx, [0x140078a5c]
lea rcx, [rbp - 0x48]
call fcn.140013bf0
or r12d, 8
mov dword [rsp + 0x20], r12d
lea rdi, [rbp - 0x48]
mov r15, qword [rbp - 0x30]
cmp r15, 7
seta al
mov rsi, qword [rbp - 0x48]
cmova rdi, rsi
lea rcx, [rbp - 0x48]
test al, al
mov rax, qword [rbp - 0x38]
je 0x140006f01
mov rbx, rsi
lea r14, [rsi + rax*2]
jmp 0x140006f09
lea r14, [rcx + rax*2]
lea rbx, [rbp - 0x48]
cmp rbx, r14
je 0x140006f32
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.140046b50
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, r14
jne 0x140006f11
mov r15, qword [rbp - 0x30]
mov rax, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x48]
lea rdx, [rbp - 0x48]
cmp r15, 7
cmova rdx, rsi
movabs r9, 0xcbf29ce484222325
lea r8, [rax + rax]
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x140006f77
movabs r12, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r12
inc rcx
cmp rcx, r8
jb 0x140006f61
xor r12d, r12d
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x80]
lea rcx, [r13 + 0x298]
call fcn.140017ab0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x140006f9b
mov rcx, qword [r13 + 0x2a0]
cmp rcx, qword [r13 + 0x2a0]
je 0x14000706a
lea rcx, [r13 + 0x158]
call fcn.140018af4
test eax, eax
jne 0x14000726c
cmp dword [r13 + 0x1a4], 0x7fffffff
je 0x140007256
lea rbx, [r13 + 0x130]
mov rax, qword [rbx + 0x20]
inc rax
cmp qword [rbx + 0x10], rax
ja 0x140006fe9
mov rcx, rbx
call fcn.140015740
mov rdx, qword [rbx + 0x10]
dec rdx
mov rcx, rdx
and rcx, qword [rbx + 0x18]
mov qword [rbx + 0x18], rcx
mov r14, qword [rbx + 0x20]
add r14, rcx
mov rax, r14
and rax, rdx
lea rdi, [rax*8]
mov rax, qword [rbx + 8]
cmp qword [rdi + rax], 0
jne 0x14000702d
mov ecx, 0x20
call fcn.14003f480
mov rcx, qword [rbx + 8]
mov qword [rdi + rcx], rax
mov rdx, qword [rbx + 0x10]
dec rdx
and rdx, r14
mov rax, qword [rbx + 8]
mov rdx, qword [rax + rdx*8]
movups xmmword [rdx], xmm6
movups xmmword [rdx + 0x10], xmm7
mov edi, 7
mov word [rbp + 0x18], r12w
inc qword [rbx + 0x20]
lea rcx, [r13 + 0x158]
call fcn.140018afc
mov r15, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x48]
jmp 0x14000706e
mov rdi, qword [rbp + 0x30]
cmp r15, 7
jbe 0x1400070aa
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400070a1
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007277
mov rcx, rsi
call fcn.14003f0f8
nop
cmp rdi, 7
jbe 0x1400070e7
lea rdx, [rdi*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000727d
call fcn.14003f0f8
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x140007127
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140007122
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007283
call fcn.14003f0f8
xor r15d, r15d
lea rdx, [rbp + 0x160]
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov r13, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x20]
jne 0x140006930
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000719b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007196
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007289
call fcn.14003f0f8
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r15w
mov rax, qword [rsp + 0x28]
cmp rax, 7
jbe 0x1400071ea
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400071e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000723e
call fcn.14003f0f8
mov r12d, dword [rsp + 0x20]
mov r13, qword [rsp + 0x38]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
jne 0x140006750
lea rcx, [rbp - 0x70]
call fcn.140001740
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.14003f0d0
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140045efc
nop
call fcn.140001e80
nop
call fcn.140045efc
int3
call fcn.140012ad0
nop
mov dword [r13 + 0x1a4], 0x7ffffffe
mov ecx, 6
call fcn.14001a0f0
int3
mov ecx, 5
call fcn.14001a0f0
nop
call fcn.140045efc
nop
call fcn.140045efc
nop
call fcn.140045efc
nop
call fcn.140045efc
int3