Function at 0x14006a230
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 0x40
xor edi, edi
mov dword [rsp + 0x20], eax
mov edx, edi
mov dword [rsp + 0x24], 0xb800c2
mov ebx, 0x81
mov dword [rsp + 0x28], 0xd400df
mov dword [rsp + 0x2c], 0xe900f7
mov dword [rsp + 0x30], 0xfa00e0
mov dword [rsp + 0x34], 0xe700e8
mov dword [rsp + 0x38], 0xca00ab
mov dword [rbp - 0x7d], 0xe200e4
mov dword [rbp - 0x79], 0xe300ea
mov dword [rbp - 0x75], 0xea00b9
mov dword [rbp - 0x71], 0xa200ab
mov dword [rbp - 0x6d], 0xca00bc
mov dword [rbp - 0x69], 0xe800d2
mov dword [rbp - 0x65], 0xf900f0
mov dword [rbp - 0x61], 0xdb00bb
mov dword [rbp - 0x5d], 0xf300fc
mov dword [rbp - 0x59], 0xd300fa
mov dword [rbp - 0x55], 0xee00fd
mov dword [rbp - 0x51], 0xd100c2
mov dword [rbp - 0x4d], 0xc500cb
mov dword [rbp - 0x49], 0xcd00cf
mov dword [rbp - 0x45], 0xf600db
mov dword [rbp - 0x41], 0xc200ee
mov dword [rbp - 0x3d], 0xc700ca
mov dword [rbp - 0x39], 0xd500c1
mov dword [rbp - 0x35], 0xf100ed
mov dword [rbp - 0x31], 0xda00dc
mov dword [rbp - 0x2d], 0xdf00d3
mov dword [rbp - 0x29], 0xe400d0
mov dword [rbp - 0x25], 0xdb00fb
mov dword [rbp - 0x21], 0xd900c8
mov dword [rbp - 0x1d], 0xd70093
mov dword [rbp - 0x19], 0xa900d1
mov dword [rbp - 0x15], 0xc1
test eax, eax
je 0x14006a38b
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14006a370
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x44
mov edx, edi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xb800c2
mov dword [rsp + 0x28], 0xd400df
mov dword [rsp + 0x2c], 0xe900f7
mov dword [rsp + 0x30], 0xfa00e0
mov dword [rsp + 0x34], 0xe700e8
mov dword [rsp + 0x38], 0xca00ab
mov dword [rbp - 0x7d], 0xe200e4
mov dword [rbp - 0x79], 0xe300ea
mov dword [rbp - 0x75], 0xea00b9
mov dword [rbp - 0x71], 0xa200ab
mov dword [rbp - 0x6d], 0xca00bc
mov dword [rbp - 0x69], 0xe800d2
mov dword [rbp - 0x65], 0xf900f0
mov dword [rbp - 0x61], 0xdb00bb
mov dword [rbp - 0x5d], 0xf300fc
mov dword [rbp - 0x59], 0xd300fa
mov dword [rbp - 0x55], 0xee00fd
mov dword [rbp - 0x51], 0xd100c2
mov dword [rbp - 0x4d], 0xc500cb
mov dword [rbp - 0x49], 0xcd00cf
mov dword [rbp - 0x45], 0xf600db
mov dword [rbp - 0x41], 0xc200ee
mov dword [rbp - 0x3d], 0xc700ca
mov dword [rbp - 0x39], 0xd500c1
mov dword [rbp - 0x35], 0xf100ed
mov dword [rbp - 0x31], 0xda00dc
mov dword [rbp - 0x2d], 0xdf00d3
mov dword [rbp - 0x29], 0xe400d0
mov dword [rbp - 0x25], 0xdb00fb
mov dword [rbp - 0x21], 0xd900c8
mov dword [rbp - 0x1d], 0xdf00fa
mov dword [rbp - 0x19], 0xa500d2
mov dword [rbp - 0x15], 0xab00ef
mov dword [rbp - 0x11], 0xad00ad
mov dword [rbp - 0xd], 0xc5
test eax, eax
je 0x14006a4cb
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14006a4b0
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.14006a8d0
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x14006a516
nop dword [rax]
nop word [rax + rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x14006a500
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, edi
mov dword [rsp + 0x20], 0x45
mov dword [rsp + 0x24], 0xb800c2
mov dword [rsp + 0x28], 0xd400df
mov dword [rsp + 0x2c], 0xe900f7
mov dword [rsp + 0x30], 0xfa00e0
mov dword [rsp + 0x34], 0xe700e8
mov dword [rsp + 0x38], 0xca00ab
mov dword [rbp - 0x7d], 0xe200e4
mov dword [rbp - 0x79], 0xe300ea
mov dword [rbp - 0x75], 0xea00b9
mov dword [rbp - 0x71], 0xa200ab
mov dword [rbp - 0x6d], 0xca00bc
mov dword [rbp - 0x69], 0xe800d2
mov dword [rbp - 0x65], 0xf900f0
mov dword [rbp - 0x61], 0xdb00bb
mov dword [rbp - 0x5d], 0xf300fc
mov dword [rbp - 0x59], 0xd300fa
mov dword [rbp - 0x55], 0xee00fd
mov dword [rbp - 0x51], 0xd100c2
mov dword [rbp - 0x4d], 0xc500cb
mov dword [rbp - 0x49], 0xcd00cf
mov dword [rbp - 0x45], 0xf600db
mov dword [rbp - 0x41], 0xc200ee
mov dword [rbp - 0x3d], 0xc700ca
mov dword [rbp - 0x39], 0xd500c1
mov dword [rbp - 0x35], 0xf100ed
mov dword [rbp - 0x31], 0xda00dc
mov dword [rbp - 0x2d], 0xdf00d3
mov dword [rbp - 0x29], 0xe400d0
mov dword [rbp - 0x25], 0xdb00fb
mov dword [rbp - 0x21], 0xd900c8
mov dword [rbp - 0x1d], 0xd000f4
mov dword [rbp - 0x19], 0xb500cf
mov dword [rbp - 0x15], 0xec00b5
mov dword [rbp - 0x11], 0xaa00aa
mov dword [rbp - 0xd], 0xc600ac
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14006a630
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.14006aa40
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x14006a696
nop dword [rax]
nop word [rax + rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x14006a680
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.14006ab90
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x14006a6d6
nop dword [rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x14006a6c0
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.14006ad30
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x14006a716
nop dword [rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x14006a700
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, edi
mov dword [rsp + 0x20], 0x47
mov dword [rsp + 0x24], 0xb800c2
mov dword [rsp + 0x28], 0xd400df
mov dword [rsp + 0x2c], 0xe900f7
mov dword [rsp + 0x30], 0xfa00e0
mov dword [rsp + 0x34], 0xe700e8
mov dword [rsp + 0x38], 0xca00ab
mov dword [rbp - 0x7d], 0xe200e4
mov dword [rbp - 0x79], 0xe300ea
mov dword [rbp - 0x75], 0xea00b9
mov dword [rbp - 0x71], 0xa200ab
mov dword [rbp - 0x6d], 0xd300bc
mov dword [rbp - 0x69], 0xf100e7
mov dword [rbp - 0x65], 0xba00fa
mov dword [rbp - 0x61], 0xfd00dc
mov dword [rbp - 0x5d], 0xfb00f0
mov dword [rbp - 0x59], 0xfc00ec
mov dword [rbp - 0x55], 0xc300ed
mov dword [rbp - 0x51], 0xca00d6
mov dword [rbp - 0x4d], 0xce00c6
mov dword [rbp - 0x49], 0xda00c2
mov dword [rbp - 0x45], 0xef00f5
mov dword [rbp - 0x41], 0xcb00c5
mov dword [rbp - 0x3d], 0xc000c4
mov dword [rbp - 0x39], 0xec00ca
mov dword [rbp - 0x35], 0xdd00f2
mov dword [rbp - 0x31], 0xd200dd
mov dword [rbp - 0x2d], 0xd100dc
mov dword [rbp - 0x29], 0xfa00eb
mov dword [rbp - 0x25], 0xc900d8
mov dword [rbp - 0x21], 0xf400de
mov dword [rbp - 0x1d], 0xcc00dc
mov dword [rbp - 0x19], 0xb700db
mov dword [rbp - 0x15], 0xb000a0
mov dword [rbp - 0x11], 0xea00a6
mov dword [rbp - 0xd], 0xa800ac
mov dword [rbp - 9], 0xc800ae
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14006a840
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.14006ae90
mov edx, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x14006a894
mov ecx, edx
lea r8d, [rbx + rdx]
inc edx
xor word [r9 + rcx*2], r8w
mov ecx, dword [rax]
cmp edx, ecx
jb 0x14006a881
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret