Function at 0x140003910
Capabilities:
Encode data using xor
Move file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x270], rax
lea rax, [rsp + 0x2e8]
movabs r14, 0x6a7f49c7b32571d8
mov rsi, qword [rax]
mov r12d, edx
xor ebx, ebx
mov qword [rbp + 8], rsi
mov qword [rax], rbx
lea rdx, [rbp + 0x60]
movabs rax, 0x1422b1b22c019011
movabs r15, 0x1422b1b22c01f263
mov qword [rbp], rax
mov r13, rcx
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x60]
mov qword [rbp + 0x148], rax
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x60], xmm0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x140003b87
movabs rax, 0x784bd0f40c5cdf38
movabs rdx, 0x3ec3bcdb885059cc
mov qword [rbp], rax
movabs rcx, 0x63a0a1dd5b5dfc8a
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x1a1069a8c70515bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xe91941b19cd757e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x7c1c4af7b2f93ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x285da8b62f9131de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x222e8d9615f65fb7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdx
mov rdx, r13
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x108], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call fcn.140001060
movabs rax, 0x1422b1dc49719d05
lea rcx, [rbp + 0xc0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xc0]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
lea rcx, [rsp + 0x2e8]
mov qword [rcx], rsi
jmp 0x1400045b4
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov rcx, rdi
movsxd r14, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rcx, r14
mov r15, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x140003cc0
movabs rax, 0x7b4fd4ff0c5cdf38
movabs rcx, 0x63a0a1dd5b5dfc8a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x91025abd20508aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xa81a0db6959e4dec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x63a0a1d73f3890e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x1422b1b22c01f263
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x6a7f49c7b32571d8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vzeroupper
call fcn.140001060
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400045a5
mov r9, rdi
mov r8, r15
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140003de9
movabs rax, 0x7b4fd4ff0c5cdf38
movabs rcx, 0x63a0a1dd5b5dfc8a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x91025abd20508aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xa81a0db6959e4dec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x63a0a1d73f3890e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x1422b1b22c01f263
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x6a7f49c7b32571d8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vzeroupper
call fcn.140001060
mov rcx, rsi
jmp 0x14000459f
mov edx, ebx
test r14d, r14d
jle 0x140003e96
cmp r14d, 0x40
jb 0x140003e96
lea eax, [r14 - 1]
movsxd rcx, eax
lea rax, [rcx + rsi]
lea r8, [rcx + rdi]
cmp rdi, rax
ja 0x140003e17
cmp r8, rsi
jae 0x140003e96
movsx eax, r12b
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
mov eax, r14d
and eax, 0x8000003f
jge 0x140003e3d
dec eax
or eax, 0xffffffc0
inc eax
sub r14d, eax
mov rcx, rsi
movsxd r8, r14d
sub rcx, rdi
nop dword [rax]
movdqu xmm1, xmmword [rbx + rsi + 0x20]
lea rax, [rbx + rdi]
add edx, 0x40
movdqu xmm0, xmmword [rcx + rax]
xorps xmm1, xmm2
xorps xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rbx + rsi + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rbx + rsi + 0x30]
add rbx, 0x40
movdqu xmmword [rax + 0x20], xmm1
xorps xmm0, xmm2
movdqu xmmword [rax + 0x30], xmm0
cmp rbx, r8
jl 0x140003e50
movsxd rax, edx
cmp rax, r15
jge 0x140003ec4
mov r8, rsi
lea rcx, [rax + rdi]
sub r8, rdi
mov rdx, r15
sub rdx, rax
nop
movzx eax, r12b
xor al, byte [r8 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140003eb0
movabs rax, 0x1422b1b22c019014
lea rdx, [rbp + 0x70]
mov qword [rbp], rax
movabs r14, 0x6a7f49c7b32571d8
mov rax, qword [rbp]
movabs r12, 0x1422b1b22c01f263
mov qword [rbp + 0x70], rax
mov rcx, r13
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x70]
mov qword [rbp + 0x158], rax
xorps xmm0, xmmword [rbp + 0x150]
movdqa xmmword [rbp + 0x70], xmm0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x1400040e0
movabs rax, 0x784bd0f40c5cdf38
movabs rdx, 0x3ec3bcdb885059cc
mov qword [rbp], rax
movabs rcx, 0x63a0a1dd5b5dfc8a
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x1a1069a8c70515bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xe91941b19cd757e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x17c9d3aa7b2f93ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x285da8b62f9131de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x222e8d9615f65fb7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdx
mov rdx, r13
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x108], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call fcn.140001060
movabs rax, 0x1422b1dc49719d05
lea rcx, [rbp + 0xc0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x140004593
mov r9, rbx
mov r8, r15
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, r15
je 0x1400042ae
movabs rax, 0x784bd0f40c5cdf38
movabs rcx, 0x63a0a1dd5b5dfc8a
mov qword [rbp], rax
movabs rdx, 0x3ec3bcdb885059cc
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x180869a8c70515bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xbb1f43bdda924de4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x2c481b93e298cf3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x4b48adf961d63ec3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0x3ec9cffea86a3ca0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x20]
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x222e8d9615f65fb7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdx
mov rdx, r13
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
mov qword [rbp + 0x108], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqa xmmword [rbp + 0x40], xmm2
vzeroupper
call fcn.140001060
movabs rax, 0x1422d4c645738505
lea rcx, [rbp + 0xc0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xc0]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140004593
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
movabs rax, 0x6052c8c04f2f8146
lea r8, [rbp + 0x80]
mov qword [rbp], rax
lea rcx, [rbp + 0x160]
mov rax, qword [rbp]
mov r9, r13
mov qword [rbp + 0x80], rax
mov edx, 0x104
movabs rax, 0x6a7f49c7b32515bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x128], rax
xorps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x80], xmm0
call fcn.1400010c0
lea rdx, [rbp + 0x160]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
movabs rcx, 0x63a0a1dd5b5dfc8a
test eax, eax
je 0x14000449e
movabs rax, 0x784bd0f40c5cdf38
mov rdx, r13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xf0d69a8c70515bd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xa5154bf89f9a58e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x63a0abae7e7dc6ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x120]
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0x120], ymm1
vzeroupper
call fcn.140001060
movabs rax, 0x1422d4df4d6f9711
lea rcx, [rbp + 0xc0]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0xc0]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0xc0], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
jmp 0x140004593
movabs rax, 0x6641dff70c5cd938
lea rdx, [rbp + 0x160]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x4f5f73a3d65101a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xc97c2dd8faf733fe
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc97c2dd8faf7398d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0xa0]
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vzeroupper
call fcn.140001060
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
movsxd rdx, dword [0x14000ee70]
lea r8, [0x14000cf30]
mov qword [r8 + rdx*8], rax
inc edx
mov dword [0x14000ee70], edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbp + 8]
lea rcx, [rsp + 0x2e8]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140006390
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret