Function at 0x140001b2c
Capabilities:
Encode data using xor
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rcx]
xor r15d, r15d
mov dword [rbp + 0xc8], 0x30
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r15
lea r9, [rsp + 0x60]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0xc8]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x80000000
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xe0], 0x40
mov qword [rbp + 0xd8], rax
movdqu xmmword [rbp + 0xe8], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x140001bfa
lea rcx, [0x140003030]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400026ac
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0xf8]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
movsxd rdx, dword [rbp + 0x100]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x40], r15
mov r14, rax
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r15d
cmp qword [rbp + 0x100], r15
jle 0x140001c9d
mov rcx, r14
xor byte [rcx], 0xc1
inc edx
movsxd rax, edx
inc rcx
cmp rax, qword [rbp + 0x100]
jl 0x140001c89
lea r13, [0x140006450]
mov rcx, r14
mov rdx, r13
sub rdx, r14
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x140001cad
cmp qword [rsp + 0x68], 1
lea rcx, [0x140005150]
mov edx, r15d
lea r9, [0x140005250]
mov edi, r15d
lea r10, [0x140005350]
mov ebx, r15d
lea r11, [0x140005450]
lea rsi, [0x140005550]
je 0x140001f87
mov r8, r15
lea r14, [0x140005050]
cmp byte [r8 + r13], 0xd
jne 0x140001f54
lea rsi, [r8 + 1]
cmp byte [rsi + r13], 0xa
jne 0x140001f54
test edi, edi
jne 0x140001d3b
mov eax, ebx
mov rcx, r14
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
mov rcx, r14
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140001f35
cmp edi, 1
jne 0x140001d5b
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005150]
jmp 0x140001d31
cmp edi, 2
jne 0x140001d7e
mov eax, ebx
mov rcx, r9
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005250]
jmp 0x140001d31
cmp edi, 3
jne 0x140001da1
mov eax, ebx
mov rcx, r10
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005350]
jmp 0x140001d31
cmp edi, 4
jne 0x140001dc7
mov eax, ebx
mov rcx, r11
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005450]
jmp 0x140001d31
cmp edi, 5
jne 0x140001df1
mov eax, ebx
lea rcx, [0x140005550]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005550]
jmp 0x140001d31
cmp edi, 6
jne 0x140001e1b
mov eax, ebx
lea rcx, [0x140005650]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005650]
jmp 0x140001d31
cmp edi, 7
jne 0x140001e45
mov eax, ebx
lea rcx, [0x140005750]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005750]
jmp 0x140001d31
cmp edi, 8
jne 0x140001e6f
mov eax, ebx
lea rcx, [0x140005850]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005850]
jmp 0x140001d31
cmp edi, 9
jne 0x140001e99
mov eax, ebx
lea rcx, [0x140005950]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005950]
jmp 0x140001d31
cmp edi, 0xa
jne 0x140001ea7
lea rcx, [0x140005a50]
jmp 0x140001f23
cmp edi, 0xb
jne 0x140001eb5
lea rcx, [0x140005b50]
jmp 0x140001f23
cmp edi, 0xc
jne 0x140001ec3
lea rcx, [0x140005c50]
jmp 0x140001f23
cmp edi, 0xd
jne 0x140001ed1
lea rcx, [0x140005d50]
jmp 0x140001f23
cmp edi, 0xe
jne 0x140001edf
lea rcx, [0x140005e50]
jmp 0x140001f23
cmp edi, 0xf
jne 0x140001eed
lea rcx, [0x140005f50]
jmp 0x140001f23
cmp edi, 0x10
jne 0x140001efb
lea rcx, [0x140006050]
jmp 0x140001f23
cmp edi, 0x11
jne 0x140001f09
lea rcx, [0x140006150]
jmp 0x140001f23
cmp edi, 0x12
jne 0x140001f17
lea rcx, [0x140006250]
jmp 0x140001f23
cmp edi, 0x13
jne 0x140001f4a
lea rcx, [0x140006350]
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea r11, [0x140005450]
lea r10, [0x140005350]
lea r9, [0x140005250]
inc edi
mov r8, rsi
inc ebx
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
inc ebx
dec rcx
movsxd rax, ebx
inc r8
cmp rax, rcx
lea rcx, [0x140005150]
jb 0x140001cfb
mov r14, qword [rsp + 0x78]
lea rcx, [0x140005150]
lea rsi, [0x140005550]
movsxd rbx, edx
cmp rbx, qword [rsp + 0x68]
jae 0x140002212
test edi, edi
jne 0x140001fc4
lfence
mov r8, qword [rsp + 0x68]
lea rdi, [0x140005050]
sub r8, rbx
lea rdx, [rbx + r13]
mov rcx, rdi
call sub.ntoskrnl.exe_strncpy
mov rcx, rdi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140002219
cmp edi, 1
jne 0x140001ff8
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rsi, [0x140005150]
mov rcx, rsi
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140005050]
jmp 0x140002220
cmp edi, 2
jne 0x140002036
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r9
call sub.ntoskrnl.exe_strncpy
lea r13, [0x140005250]
mov rcx, r13
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140005050]
lea rsi, [0x140005150]
jmp 0x140002227
cmp edi, 3
jne 0x140002063
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r10
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005350]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140002212
cmp edi, 4
jne 0x140002088
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r11
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005450]
jmp 0x140002059
cmp edi, 5
jne 0x1400020a9
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, rsi
call sub.ntoskrnl.exe_strncpy
mov rcx, rsi
jmp 0x140002059
cmp edi, 6
jne 0x1400020d2
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140005650]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005650]
jmp 0x140002059
cmp edi, 7
jne 0x1400020fe
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140005750]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005750]
jmp 0x140002059
cmp edi, 8
jne 0x14000212a
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140005850]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005850]
jmp 0x140002059
lea rsi, [rbx + r13]
cmp edi, 9
jne 0x140002159
lfence
mov r8, qword [rsp + 0x68]
lea rcx, [0x140005950]
sub r8, rbx
mov rdx, rsi
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140005950]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 0xa
jne 0x14000216d
mov rdx, rsi
lea rcx, [0x140005a50]
jmp 0x140002202
cmp edi, 0xb
jne 0x140002181
mov rdx, rsi
lea rcx, [0x140005b50]
jmp 0x140002202
cmp edi, 0xc
jne 0x140002192
mov rdx, rsi
lea rcx, [0x140005c50]
jmp 0x140002202
cmp edi, 0xd
jne 0x1400021a3
mov rdx, rsi
lea rcx, [0x140005d50]
jmp 0x140002202
cmp edi, 0xe
jne 0x1400021b4
mov rdx, rsi
lea rcx, [0x140005e50]
jmp 0x140002202
cmp edi, 0xf
jne 0x1400021c5
mov rdx, rsi
lea rcx, [0x140005f50]
jmp 0x140002202
cmp edi, 0x10
jne 0x1400021d6
mov rdx, rsi
lea rcx, [0x140006050]
jmp 0x140002202
cmp edi, 0x11
jne 0x1400021e4
lea rcx, [0x140006150]
jmp 0x1400021fe
cmp edi, 0x12
jne 0x1400021f2
lea rcx, [0x140006250]
jmp 0x1400021fe
cmp edi, 0x13
jne 0x140002212
lea rcx, [0x140006350]
lea rdx, [rbx + r13]
lfence
mov r8, qword [rsp + 0x68]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rdi, [0x140005050]
lea rsi, [0x140005150]
lea r13, [0x140005250]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], r15b
jne 0x14000222e
test rax, rax
je 0x14000225f
mov rdx, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x78]
lea rcx, [0x1400079d0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rsi + rax], r15b
jne 0x140002262
test rax, rax
je 0x140002291
mov rdx, rsi
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x68]
lea rcx, [0x1400079c0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rax + r13], r15b
jne 0x140002294
test rax, rax
je 0x1400022c3
mov rdx, r13
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [0x1400079b0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005350]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400022cd
test rax, rax
je 0x1400022fc
mov rdx, rcx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [0x1400079a0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005450]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002306
test rax, rax
je 0x140002335
mov rdx, rcx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x38]
lea rcx, [0x140007990]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005550]
inc rax
cmp byte [rcx + rax], r15b
jne 0x14000233f
test rax, rax
je 0x14000236e
mov rdx, rcx
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x28]
lea rcx, [0x140007980]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005650]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002378
test rax, rax
je 0x1400023a7
mov rdx, rcx
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x18]
lea rcx, [0x140007970]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005750]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400023b1
test rax, rax
je 0x1400023e0
mov rdx, rcx
lea rcx, [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 8]
lea rcx, [0x140007960]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005850]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400023ea
test rax, rax
je 0x140002419
mov rdx, rcx
lea rcx, [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 8]
lea rcx, [0x140007950]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005950]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002423
test rax, rax
je 0x140002452
mov rdx, rcx
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x18]
lea rcx, [0x140007940]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005a50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x14000245c
test rax, rax
je 0x14000248b
mov rdx, rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x28]
lea rcx, [0x140007930]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005b50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002495
test rax, rax
je 0x1400024c4
mov rdx, rcx
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x38]
lea rcx, [0x140007920]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005c50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400024ce
test rax, rax
je 0x1400024fd
mov rdx, rcx
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x48]
lea rcx, [0x140007910]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005d50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002507
test rax, rax
je 0x140002536
mov rdx, rcx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x58]
lea rcx, [0x140007900]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005e50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002540
test rax, rax
je 0x14000256f
mov rdx, rcx
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [0x1400078f0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140005f50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002579
test rax, rax
je 0x1400025a8
mov rdx, rcx
lea rcx, [rbp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x78]
lea rcx, [0x1400078e0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006050]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400025b2
test rax, rax
je 0x1400025e7
mov rdx, rcx
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x88]
lea rcx, [0x1400078d0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006150]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400025f1
test rax, rax
je 0x140002626
mov rdx, rcx
lea rcx, [rbp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x98]
lea rcx, [0x1400078c0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006250]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002630
test rax, rax
je 0x140002665
mov rdx, rcx
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xa8]
lea rcx, [0x1400078b0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rax, [0x140006350]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x14000266c
test rbx, rbx
je 0x1400026a1
mov rdx, rax
lea rcx, [rbp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xb8]
lea rcx, [0x1400078a0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140002ad0
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret