Function at 0x1800a19d0
Capabilities:
Delete file
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1802ee528]
xor rax, rsp
mov qword [rbp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x48], 0x5c5b5e5a
mov dword [rsp + 0x4c], 0x594854
mov byte [rsp + 0x50], 1
xor r14d, r14d
mov ecx, r14d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x36]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 7
jb 0x1800a1a30
mov byte [rsp + 0x50], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rsp + 0x48]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x1800a1a66
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.18005a740
nop
lea rdx, [0x1802efbd0]
cmp qword [0x1802efbe8], 0x10
cmovae rdx, qword [0x1802efbd0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1800a1ab0
lea rcx, [rsp + 0x28]
call fcn.18005a740
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x20]
call fcn.1800a2630
nop
mov qword [0x1802efbc0], 0
mov byte [0x1802efbc8], 0
mov qword [0x1802efb70], 0
mov word [0x1802efb78], 0
mov byte [0x1802efb7a], 0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1802efbf0], xmm0
movups xmmword [0x1802efc00], xmm0
movups xmmword [0x1802efc10], xmm0
movups xmmword [0x1802efc20], xmm0
mov byte [0x1802efc30], al
mov dword [0x1802ef738], eax
movups xmmword [0x1802efb80], xmm0
mov qword [0x1802efb90], rax
mov dword [0x1802efb98], eax
mov byte [0x1802efb9c], al
lea rcx, [0x1802ef8d0]
call fcn.180003e60
lea rcx, [rbp - 0x80]
cmp byte [0x1802efb08], 0
je 0x1800a2041
lea rdx, [rbp - 0x20]
call fcn.18000a550
mov rdx, rax
lea rcx, [0x1802ef8d0]
call fcn.180005ec0
mov eax, dword [0x18013dc3c]
mov dword [rsp + 0x58], eax
cmp byte [0x18013dc3f], 0
je 0x1800a1c70
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1800a1c34
movdqa xmm3, xmmword [0x180116610]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x18013f530]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x18013f530]
shufps xmm2, xmm0, 0xdd
mov ecx, 4
movd xmm0, ecx
psrad xmm2, xmm0
mov ecx, Ordinal_35
movd xmm0, ecx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x18013f2f0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18013f320]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x18013f460]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x58], xmm2
jmp 0x1800a1c70
lea r9, [rsp + 0x58]
mov r8d, r14d
nop dword [rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1800a1c40
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
lea rax, [rsp + 0x58]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800a1c90
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x40]
call fcn.18005a740
nop
mov dword [rsp + 0x48], 0x504c5957
mov dword [rsp + 0x4c], 0x5c4c4258
mov dword [rsp + 0x50], 0x1004c4d
mov rcx, r14
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x36]
xor byte [rsp + rcx + 0x48], al
inc rcx
cmp rcx, 0xa
jb 0x1800a1cd0
mov byte [rsp + 0x53], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rsp + 0x48]
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800a1d00
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call fcn.18005a740
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
lea rcx, [0x1802ef8d0]
call fcn.180006d40
nop
cmp byte [0x1802efb08], 0
je 0x1800a1fcc
mov dword [rsp + 0x58], 0x90d0604
mov dword [rsp + 0x5c], 0x1000e08
mov rcx, r14
nop
lea eax, [rcx + 0x36]
xor byte [rsp + rcx + 0x58], al
inc rcx
cmp rcx, 6
jb 0x1800a1d50
mov byte [rsp + 0x5f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
lea rax, [rsp + 0x58]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800a1d80
mov r8, rbx
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x80]
call fcn.18005a740
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x28]
lea rcx, [0x1802ef8d0]
call fcn.180007940
nop
lea r9, [rsp + 0x20]
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.18008e500
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [0x1802eded8]
call fcn.18000b0f0
lea rdx, [rbp - 0x40]
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x28]
cmp rsi, 0x10
cmovae rdx, rdi
lea rcx, [rbp - 0x60]
mov rbx, qword [rbp - 0x48]
cmp rbx, 0x10
cmovae rcx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
cmp r8, qword [rbp - 0x30]
jne 0x1800a1fe9
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800a1fe9
mov byte [0x1802ef61b], 1
mov byte [0x1802ef5d1], 1
mov byte [0x1802ef61c], 1
mov byte [0x1802ef61a], 1
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1800a1e8c
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a1e83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a1e83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180106b84
mov rbx, qword [rbp - 0x48]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1800a1edd
mov rdx, qword [rsp + 0x38]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a1ec6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a1ec6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180106b84
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov rbx, qword [rbp - 0x48]
cmp rbx, 0x10
jb 0x1800a1f18
lea rdx, [rbx + 1]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a1f13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a1f13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180106b84
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
cmp rsi, 0x10
jb 0x1800a1f63
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800a1f5a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a1f5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180106b84
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800a1fa1
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a1f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800a1f9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180106b84
mov al, 1
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.180106c20
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [0x1802efbd0]
call fcn.18000a230
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
movdqa xmm0, xmmword [0x18013f440]
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [str._g___mm__0_7u]
movdqu xmmword [rbp + 0x10], xmm1
mov byte [rbp + 0x20], 1
lea rcx, [rbp]
call fcn.1800a77c0
mov rdx, rax
lea rcx, [rbp - 0x80]
call fcn.18000a510
lea rcx, [rbp - 0x80]
call fcn.18000a230
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
lea rdx, [0x1802efb10]
call fcn.18000a550
lea rcx, [rbp - 0x80]
call fcn.18000a230
mov rdx, rax
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3