Function at 0x140003750
Capabilities:
Encode data using xor
Move file
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rbx, rcx
mov qword [rbp - 1], rcx
mov rdi, qword [rcx + 0x10]
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp r15, 0xf
jbe 0x14000379c
mov rsi, qword [rcx]
cmp rdi, 4
jb 0x1400037ef
lea r14, [rdi + rsi]
lea r8, [r14 - 3]
sub r8, rsi
mov edx, 0x2e
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400037ef
nop
cmp dword [rax], 0x6578652e
je 0x1400037e6
inc rax
lea r8, [r14 - 3]
sub r8, rax
mov edx, 0x2e
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400037c0
jmp 0x1400037ef
sub rax, rsi
cmp rax, 0xffffffffffffffff
jne 0x140003833
mov rax, r15
sub rax, rdi
cmp rax, 4
jb 0x14000381d
lea rax, [rdi + 4]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r15, 0xf
jbe 0x14000380f
mov rax, qword [rbx]
mov dword [rax + rdi], 0x6578652e
mov byte [rax + rdi + 4], 0
jmp 0x140003833
mov qword [rsp + 0x20], 4
mov edx, 4
mov rcx, rbx
call fcn.140004940
lea rcx, [rbp + 7]
call fcn.140003230
nop
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rcx, qword [rbp + 7]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rbp + 0x17]
mov rdx, qword [rbp + 0x1f]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x14000388c
lea rax, [rcx + 4]
mov qword [rbp + 0x17], rax
lea rax, [rbp + 7]
cmp rdx, 0xf
cmova rax, qword [rbp + 7]
mov dword [rax + rcx], 0x6578652e
mov byte [rax + rcx + 4], 0
lea rax, [rbp + 7]
jmp 0x1400038a3
mov qword [rsp + 0x20], 4
mov edx, 4
lea rcx, [rbp + 7]
call fcn.140004940
cmp qword [rax + 0x18], 0xf
jbe 0x1400038ad
mov rax, qword [rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400038ba
mov rcx, qword [rbx]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
xor edi, edi
test eax, eax
je 0x140003af2
movups xmm0, xmmword [str.LNRPTJV_2xy6____]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [0x140007728]
movups xmmword [rbp - 0x39], xmm1
mov eax, dword [0x140007738]
mov dword [rbp - 0x29], eax
movzx eax, byte [0x14000773c]
mov byte [rbp - 0x25], al
mov r8d, edi
cmp dword [0x14000a098], 2
jl 0x140003a27
movdqa xmm4, xmmword [0x140007870]
movdqa xmm3, xmmword [0x1400078c0]
movdqa xmm5, xmmword [str.6666]
movdqa xmm0, xmmword [0x1400078b0]
movdqa xmmword [rbp - 0x59], xmm0
lea rcx, [rbp - 0x45]
movdqa xmm6, xmmword [0x140007890]
mov edx, dword [rbp - 0x59]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x20
jl 0x140003940
cmp r8d, 0x25
jge 0x140003a70
movsxd rax, r8d
lea r9, [rbp - 0x49]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x25
jl 0x140003a40
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x21]
call fcn.140002c90
nop
cmp qword [rax + 0x18], 0xf
jbe 0x140003a88
mov rax, qword [rax]
mov qword [rbp - 0x59], rax
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140003a93
mov qword [rbp - 0x51], rcx
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
lea rcx, [rbp - 0x59]
call fcn.140004370
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x140003af2
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003aec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004f24
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x140003b30
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004f24
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], send
mov byte [rbp + 7], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003b76
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140003b71
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003bb3
mov rcx, r8
call fcn.140004f24
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140004ec0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3