Function at 0x140075080
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1406a0188]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
imul eax, ebx
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str..Nal
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14007516b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x140163b00]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x140163ab0]
movdqu xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x140163ac0]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x6163696c
mov dword [rbp + 0xb], 0x6e6f6974
mov byte [rbp + 0xf], sil
lea rdx, [rbp - 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140070910
lea rdx, [0x1400725c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rax, [rsi - 1]
jmp 0x1400756ad
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1406a6500], xmm0
movups xmmword [0x1406a6510], xmm0
movups xmmword [0x1406a6520], xmm0
movups xmmword [0x1406a6530], xmm0
movups xmmword [0x1406a6540], xmm0
movups xmmword [0x1406a6550], xmm0
mov dword [0x1406a6560], eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub r8d, ecx
add r8d, 0xa
movsxd rdi, r8d
test r8d, r8d
jle 0x140075217
mov rbx, rsi
movabs r15, 0x4ec4ec4ec4ec4ec5
lea r14, [0x140000000]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, r15
mul rcx
shr rdx, 4
imul rax, rdx, 0x34
sub rcx, rax
movzx eax, byte [rcx + r14 + 0x163520]
mov byte [rbx + r14 + 0x6a6500], al
inc rbx
cmp rbx, rdi
jl 0x1400751e4
movdqa xmm0, xmmword [0x140163aa0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x72642067
mov dword [rbp - 0x15], 0x72657669
mov word [rbp - 0x11], 0x20
lea rdx, [rbp - 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140070910
lea rdx, [0x1400725c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp + 0x17]
call fcn.140074ab0
nop
cmp qword [rbp + 0x27], 0
jne 0x1400752ac
movdqa xmm0, xmmword [0x140163860]
movdqa xmm1, xmmword [0x140163ad0]
mov byte [rbp - 9], 0
movdqu xmmword [rbp - 0x19], xmm1
movdqu xmmword [rbp - 0x29], xmm0
lea rdx, [rbp - 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140070910
lea rdx, [0x1400725c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x140075660
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
mov r8d, 0x8708
lea rdx, [0x14015ae00]
lea rcx, [rbp + 0x17]
call fcn.140079110
test al, al
jne 0x1400752fc
movdqa xmm0, xmmword [0x1401639e0]
movdqa xmm1, xmmword [0x140163a60]
mov dword [rbp - 9], 0x69662072
mov word [rbp - 5], 0x656c
mov byte [rbp - 3], al
jmp 0x14007527d
lea rcx, [rbp + 0x17]
call fcn.140078750
test al, al
jne 0x14007548b
movdqa xmm0, xmmword [0x1401638d0]
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1401638c0]
movdqu xmmword [rbp - 0x19], xmm1
movdqa xmm0, xmmword [0x1401638e0]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x287c2e33
mov dword [rbp + 0xb], 0x387c3934
mov dword [rbp + 0xf], 0x392a352e
mov word [rbp + 0x13], 0x2e
nop
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x28], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x27], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x26], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x25], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x24], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x23], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x22], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x21], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x20], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x1f], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x1e], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x1d], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x1c], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x1b], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x1a], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x19], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x18], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x17], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x16], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x15], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x14], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x13], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x12], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x11], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0x10], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0xf], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0xe], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0xd], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0xc], al
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rsi - 0xb], al
add rsi, 0x1e
cmp rsi, 0x3c
jb 0x140075350
mov byte [rbp + 0x14], 0
lea rdx, [rbp - 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140070910
lea rdx, [0x1400725c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
jmp 0x140075660
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..Nal
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x140075627
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], ntohs
mov qword [rbp - 0x11], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ntoskrnl.exe]
movsd qword [rbp - 0x29], xmm0
mov eax, dword [0x140163560]
mov dword [rbp - 0x21], eax
mov byte [rbp - 0x1d], 0
lea rcx, [rbp - 0x29]
call fcn.1400795a0
mov qword [0x1406a6568], rax
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14007554e
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140075542
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140075542
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140149858
mov rax, qword [0x1406a6568]
test rax, rax
jne 0x140075577
movdqa xmm0, xmmword [0x140163980]
movdqa xmm1, xmmword [0x140163a70]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x6578652e
mov byte [rbp - 5], al
jmp 0x140075633
mov rcx, rbx
call fcn.140072d70
test al, al
jne 0x1400755b5
movdqa xmm0, xmmword [0x1401639f0]
movdqa xmm1, xmmword [0x140163930]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x42687361
mov dword [rbp - 5], 0x656b6375
mov dword [rbp - 1], 0x73694c74
mov word [rbp + 3], reloc.WS2_32.dll_WSACleanup
jmp 0x140075633
mov rcx, rbx
call fcn.1400734a0
test al, al
jne 0x1400755ef
movdqa xmm0, xmmword [0x1401639a0]
movdqa xmm1, xmmword [0x140163950]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x44646564
mov dword [rbp - 5], 0x65766972
mov word [rbp - 1], 0x7372
mov byte [rbp + 1], al
jmp 0x140075633
mov rcx, rbx
call fcn.140073750
test al, al
jne 0x140075667
movdqa xmm0, xmmword [0x140163970]
movdqa xmm1, xmmword [0x140163a40]
movdqu xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x69724472
mov dword [rbp - 5], 0x4c726576
mov dword [rbp - 1], 0x747369
jmp 0x140075633
movdqa xmm0, xmmword [0x140163990]
mov byte [rbp - 0x19], 0
movdqu xmmword [rbp - 0x29], xmm0
lea rdx, [rbp - 0x28]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140070910
lea rdx, [0x1400725c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, rbx
call fcn.140076310
mov rbx, 0xffffffffffffffff
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x1400756aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400756a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400756a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140149858
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140149980
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret