Function at 0x140022eb0
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1401973d0]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r12, rcx
mov qword [rbp + 0xf8], rcx
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023a9e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x100], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023aa9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x120], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023ab4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x118], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023abf
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x108], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023aca
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x110], rax
mov r14d, 0xe
mov eax, r14d
mov dword [rbp - 0x80], eax
mov dword [rbp - 0x7c], 0x4a001d
mov dword [rbp - 0x78], 0x570066
mov dword [rbp - 0x74], 0x5a0053
mov dword [rbp - 0x70], 0x63004d
mov dword [rbp - 0x6c], 0x320065
mov dword [rbp - 0x68], 0x37006c
mov dword [rbp - 0x64], 0x31003c
mov dword [rbp - 0x60], 0x46
xor r13d, r13d
mov edx, r13d
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x7c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp - 0x80]
cmp edx, eax
jb 0x140022ff0
mov word [rbp + rax*2 - 0x7c], r13w
mov r9, qword [r12]
mov r8, qword [0x1401a6c08]
lea rdx, [rbp - 0x7c]
lea rcx, [rbp + 0x120]
call fcn.14000cb80
mov eax, 0x14
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], 0x5c005c
mov dword [rbp - 0x28], 0x54004a
mov dword [rbp - 0x24], 0x5e0048
mov dword [rbp - 0x20], 0x5c005f
mov dword [rbp - 0x1c], 0x240028
mov dword [rbp - 0x18], 0x66006d
mov dword [rbp - 0x14], 0x6a0037
mov dword [rbp - 0x10], 0x340063
mov dword [rbp - 0xc], 0x3d0066
mov dword [rbp - 8], 0x3f0032
mov dword [rbp - 4], 0x4c
mov edx, r13d
test eax, eax
je 0x1400230a9
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x2c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp - 0x30]
cmp edx, eax
jb 0x140023090
mov word [rbp + rax*2 - 0x2c], r13w
mov r9, qword [r12]
mov r8, r9
lea rdx, [rbp - 0x2c]
lea rcx, [rbp + 0x100]
call fcn.14000cb80
lea rax, [rsp + 0x70]
mov qword [rbp + 0xd0], rax
mov dword [rsp + 0x30], 9
mov dword [rsp + 0x34], 0x54004b
mov dword [rsp + 0x38], 0x55005b
mov dword [rsp + 0x3c], 0x5b0055
mov dword [rsp + 0x40], 0x4c005b
mov dword [rsp + 0x44], 0x410034
mov edx, r13d
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x34]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x30]
cmp edx, eax
jb 0x140023110
mov word [rsp + rax*2 + 0x34], r13w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023ad5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x34]
mov rsi, 0xffffffffffffffff
cmp rax, 0x10000
lea rax, [rsp + 0x34]
jae 0x140023179
movzx edx, ax
lea rcx, [rsp + 0x70]
call fcn.14000c690
jmp 0x14002319b
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140023180
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x70]
call fcn.14000c910
nop
mov rbx, qword [rbp + 0x100]
add rbx, 0xffffffffffffffe8
mov rcx, rbx
call fcn.14000c810
add rax, 0x18
mov qword [rbp + 0xa8], rax
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.1400041c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
cmp rcx, rbx
je 0x14002322b
cmp dword [rbx + 0x10], 0
jl 0x14002321a
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002321a
call fcn.14000c810
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14002320d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x100], rax
jmp 0x14002322b
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x100]
call fcn.14000c910
nop
mov rdx, qword [rbp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002324b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rsp + 0x60], 5
mov dword [rsp + 0x64], 0x6b007d
mov dword [rsp + 0x68], 0x740068
mov dword [rsp + 0x6c], 0x3d006e
mov edx, r13d
nop
mov eax, edx
lea rcx, [rsp + 0x64]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x60]
cmp edx, eax
jb 0x140023270
mov word [rsp + rax*2 + 0x64], r13w
mov rdi, qword [rbp + 0x100]
mov rax, rdi
lea r8, [rsp + 0x64]
sub r8, rdi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400232b7
add rax, 2
test ecx, ecx
jne 0x1400232a3
test edx, edx
jne 0x140023345
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400232e0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023301
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023322
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023a27
mov rcx, qword [rdx]
jmp 0x140023a20
lea rax, [rbp + 0xb0]
mov qword [rbp + 0xd8], rax
mov rbx, qword [rbp + 0x120]
lea r15, [rbx - 0x18]
mov rcx, r15
call fcn.14000c810
add rax, 0x18
mov qword [rbp + 0xb0], rax
lea rcx, [rdi - 0x18]
call fcn.14000c810
add rax, 0x18
mov qword [rbp + 0xb8], rax
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0xb8]
call fcn.140003910
test al, al
je 0x140023915
xorps xmm0, xmm0
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x140], 0xf
mov byte [rbp + 0x128], 0
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x150]
call fcn.140120b10
mov rdx, rbx
lea rcx, [rbp + 0x150]
call fcn.140007e50
nop
mov edi, 0x2b
nop dword [rax]
mov rax, qword [rbp + 0x150]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x190]
mov rcx, qword [rax + 8]
mov qword [rbp + 0xf0], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0xe8]
call fcn.14000f7f0
mov r8, qword [rax]
mov dl, 0xa
mov rcx, rax
call qword [r8 + 0x40]
movzx ebx, al
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x140023455
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test rax, rax
je 0x140023455
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
movzx r8d, bl
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x150]
call fcn.14000e510
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x1400238ed
lea rdx, [rbp + 0x128]
cmp qword [rbp + 0x140], 0x10
cmovae rdx, qword [rbp + 0x128]
lea rcx, [rbp + 0x118]
call fcn.140009650
mov eax, 0x19
mov dword [rbp], eax
mov dword [rbp + 4], 0x4a001d
mov dword [rbp + 8], 0x5f0066
mov dword [rbp + 0xc], 0x4d0059
mov dword [rbp + 0x10], 0x4b0051
mov dword [rbp + 0x14], 0x200023
mov dword [rbp + 0x18], 0x2b0021
mov dword [rbp + 0x1c], 0x190021
mov dword [rbp + 0x20], 0x340063
mov dword [rbp + 0x24], 0x240066
mov dword [rbp + 0x28], 0x25002b
mov dword [rbp + 0x2c], 0x2b0025
mov dword [rbp + 0x30], 0x3c002b
mov dword [rbp + 0x34], 0x510024
mov edx, r13d
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp + 4]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp]
cmp edx, eax
jb 0x140023510
mov word [rbp + rax*2 + 4], r13w
mov rbx, qword [rbp + 0x118]
mov r9, rbx
mov r8, qword [0x1401a6c08]
lea rdx, [rbp + 4]
lea rcx, [rbp + 0x100]
call fcn.14000cb80
xor edx, edx
mov rcx, qword [rbp + 0x100]
call fcn.140125278
test eax, eax
je 0x1400233f0
mov eax, 0x19
mov dword [rbp + 0x38], eax
mov dword [rbp + 0x3c], 0x5c005c
mov dword [rbp + 0x40], 0x54004a
mov dword [rbp + 0x44], 0x5e0048
mov dword [rbp + 0x48], 0x5c005f
mov dword [rbp + 0x4c], 0x240028
mov dword [rbp + 0x50], 0x66006d
mov dword [rbp + 0x54], 0x6a0037
mov dword [rbp + 0x58], 0x340063
mov dword [rbp + 0x5c], 0x240066
mov dword [rbp + 0x60], 0x25002b
mov dword [rbp + 0x64], 0x2b0025
mov dword [rbp + 0x68], 0x3c002b
mov dword [rbp + 0x6c], 0x510024
mov edx, r13d
nop dword [rax]
mov eax, edx
lea rcx, [rbp + 0x3c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp + 0x38]
cmp edx, eax
jb 0x1400235d0
mov word [rbp + rax*2 + 0x3c], r13w
mov r9, rbx
mov r8, qword [r12]
lea rdx, [rbp + 0x3c]
lea rcx, [rbp + 0x108]
call fcn.14000cb80
lea rax, [rsp + 0x78]
mov qword [rbp + 0xe0], rax
mov dword [rsp + 0x48], 9
mov dword [rsp + 0x4c], 0x54004b
mov dword [rsp + 0x50], 0x55005b
mov dword [rsp + 0x54], 0x5b0055
mov dword [rsp + 0x58], 0x4c005b
mov dword [rsp + 0x5c], 0x410034
mov edx, r13d
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x4c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x48]
cmp edx, eax
jb 0x140023650
mov word [rsp + rax*2 + 0x4c], r13w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140023a93
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x4c]
cmp rax, 0x10000
lea rax, [rsp + 0x4c]
jae 0x1400236b2
movzx edx, ax
lea rcx, [rsp + 0x78]
call fcn.14000c690
jmp 0x1400236d0
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x1400236b5
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x78]
call fcn.14000c910
nop
mov rbx, qword [rbp + 0x108]
add rbx, 0xffffffffffffffe8
mov rcx, rbx
call fcn.14000c810
add rax, 0x18
mov qword [rbp + 0xc0], rax
lea r8, [rsp + 0x78]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xd0]
call fcn.1400041c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
cmp rcx, rbx
je 0x140023760
cmp dword [rbx + 0x10], 0
jl 0x14002374f
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14002374f
call fcn.14000c810
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140023742
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x108], rax
jmp 0x140023760
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0x108]
call fcn.14000c910
nop
mov rdx, qword [rbp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023780
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 0x19
mov dword [rbp + 0x70], eax
mov dword [rbp + 0x74], 0x4a001d
mov dword [rbp + 0x78], 0x5f0066
mov dword [rbp + 0x7c], 0x4d0059
mov dword [rbp + 0x80], 0x4b0051
mov dword [rbp + 0x84], 0x200023
mov dword [rbp + 0x88], 0x2b0021
mov dword [rbp + 0x8c], 0x190021
mov dword [rbp + 0x90], 0x340063
mov dword [rbp + 0x94], 0x240066
mov dword [rbp + 0x98], 0x25002b
mov dword [rbp + 0x9c], 0x2b0025
mov dword [rbp + 0xa0], 0x3c002b
mov dword [rbp + 0xa4], 0x510024
mov edx, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, edx
lea rcx, [rbp + 0x74]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rbp + 0x70]
cmp edx, eax
jb 0x140023810
mov word [rbp + rax*2 + 0x74], r13w
mov r9, qword [rbp + 0x118]
mov r8, qword [0x1401a6c08]
lea rdx, [rbp + 0x74]
lea rcx, [rbp + 0x110]
call fcn.14000cb80
mov ecx, 0x18
call fcn.14011e060
mov rbx, rax
mov qword [rax], r13
mov qword [rax + 8], r13
mov qword [rax + 0x10], r13
lea r8, [rbp + 0x108]
mov rdx, r13
mov rcx, rax
call fcn.14002a9e0
mov rdi, qword [rbx + 8]
cmp rdi, qword [rbx + 0x10]
je 0x14002389f
mov rcx, qword [rbp + 0x110]
add rcx, 0xffffffffffffffe8
call fcn.14000c810
add rax, 0x18
mov qword [rdi], rax
add qword [rbx + 8], 8
jmp 0x1400238b1
lea r8, [rbp + 0x110]
mov rdx, rdi
mov rcx, rbx
call fcn.14002a9e0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
mov r9, rbx
lea r8, [0x140022930]
xor edx, edx
xor ecx, ecx
call fcn.14013727c
movsxd rdx, dword [0x1401a2bc0]
lea r8, [0x1401a2bd0]
mov qword [r8 + rdx*8], rax
inc edx
mov dword [0x1401a2bc0], edx
jmp 0x1400233e7
lea rcx, [rbp + 0x150]
call fcn.140007db0
nop
lea rcx, [rbp + 0x150]
call fcn.1400059d0
nop
lea rcx, [rbp + 0x128]
call fcn.140010cc0
jmp 0x140023921
lea rcx, [0x14016e180]
call fcn.140010c60
mov dword [rbp - 0x58], r14d
mov dword [rbp - 0x54], 0x4a001d
mov dword [rbp - 0x50], 0x570066
mov dword [rbp - 0x4c], 0x5a0053
mov dword [rbp - 0x48], 0x63004d
mov dword [rbp - 0x44], 0x320065
mov dword [rbp - 0x40], 0x37006c
mov dword [rbp - 0x3c], 0x31003c
mov dword [rbp - 0x38], 0x46
mov edx, r13d
mov eax, edx
lea rcx, [rbp - 0x54]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov r14d, dword [rbp - 0x58]
cmp edx, r14d
jb 0x140023960
mov word [rbp + r14*2 - 0x54], r13w
mov r9, qword [r12]
mov r8, qword [0x1401a6c08]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x100]
call fcn.14000cb80
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
mov rdx, qword [rbp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400239cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400239ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x118]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023a0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov eax, esi
lock xadd dword [r15 + 0x10], eax
sub eax, 1
jg 0x140023a27
mov rcx, qword [r15]
mov rdx, r15
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140023a48
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140023a63
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14011e030
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
int3