Function at 0x14000fcd0
Capabilities:
Self delete using alternate data streams

Disassembly:
lea rcx, [0x1407f45c0]
jmp 0x14000fe30
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x2a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x220], 0xfffffffffffffffe
mov rdi, rcx
lea rsi, [rbp - 0x40]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x104
call sub.KERNEL32.dll_GetModuleFileNameW
mov ecx, 4
nop word [rax + rax]
cmp word [rbp + rcx*2 - 0x48], 0
je 0x14000febc
cmp word [rbp + rcx*2 - 0x46], 0
je 0x14000fec2
cmp word [rbp + rcx*2 - 0x44], 0
je 0x14000fec8
cmp word [rbp + rcx*2 - 0x42], 0
je 0x14000fece
cmp word [rbp + rcx*2 - 0x40], 0
je 0x14000fed1
add rcx, 5
cmp rcx, 0x108
jne 0x14000fe80
mov ecx, 0x104
jmp 0x14000fede
add rcx, 0xfffffffffffffffc
jmp 0x14000fed1
add rcx, 0xfffffffffffffffd
jmp 0x14000fed1
add rcx, 0xfffffffffffffffe
jmp 0x14000fed1
dec rcx
cmp rcx, 0x105
jae 0x14001024b
lea rax, [rcx*2 - 0x40]
add rax, rbp
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rax
mov word [rbp + 0x1f0], 0
lea rcx, [rbp + 0x1f8]
lea rdx, [rbp + 0x1e0]
call fcn.14000f5d0
mov rsi, qword [rbp + 0x208]
test rsi, rsi
je 0x1400101b0
mov rax, qword [rbp + 0x1f8]
mov rbx, qword [rbp + 0x200]
test rax, rax
je 0x140010213
mov qword [rbp + 0x1c8], rax
mov qword [rbp + 0x1d0], rbx
mov qword [rbp + 0x1d8], rsi
lea rcx, [rbp + 0x1f8]
lea rdx, [rbp + 0x1c8]
call fcn.140023d70
mov rcx, qword [rbp + 0x1f8]
mov rax, qword [rbp + 0x208]
add rax, rcx
mov qword [rbp + 0x218], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov word [rbp - 0x30], 0
mov dword [rbp - 0x28], 1
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp - 0x40]
call fcn.14000f8c0
mov rcx, qword [rbp + 0x1e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov qword [rbp + 0x210], rcx
mov edx, 0x10000
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileW
mov rsi, rax
mov rdx, qword [rbp + 0x1e8]
test rdx, rdx
je 0x14000fffa
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x210]
call fcn.14000f550
mov rdx, qword [rbp + 0x200]
cmp rsi, 0xffffffffffffffff
je 0x1400101d2
test rdx, rdx
je 0x140010022
mov r8d, 1
mov rcx, qword [rbp + 0x218]
call fcn.14000f550
movzx eax, byte [rdi + 8]
mov dword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
mov dword [rbp - 0x30], 0x12
movq xmm0, qword [rdi]
pxor xmm1, xmm1
punpcklbw xmm0, xmm1
movdqu xmmword [rbp - 0x2c], xmm0
mov word [rbp - 0x1c], ax
lea r8, [rbp - 0x40]
mov rcx, rsi
mov edx, 3
mov r9d, 0x2a
call sub.KERNEL32.dll_SetFileInformationByHandle
cmp eax, 1
jne 0x140010225
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
mov ebx, 4
cmp eax, 1
jne 0x1400101f5
lea rcx, [rbp + 0x1f8]
lea rdx, [rbp + 0x1c8]
call fcn.140023d70
mov rcx, qword [rbp + 0x1f8]
mov rax, qword [rbp + 0x208]
add rax, rcx
mov qword [rbp + 0x218], rcx
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x38], rax
mov word [rbp - 0x30], 0
mov dword [rbp - 0x28], 1
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp - 0x40]
call fcn.14000f8c0
mov rcx, qword [rbp + 0x1e0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov qword [rbp + 0x210], rcx
mov edx, 0x10000
xor r8d, r8d
xor r9d, r9d
call sub.KERNEL32.dll_CreateFileW
mov rsi, rax
mov rdx, qword [rbp + 0x1e8]
test rdx, rdx
je 0x140010132
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x210]
call fcn.14000f550
mov rdx, qword [rbp + 0x200]
cmp rsi, 0xffffffffffffffff
je 0x1400101d2
test rdx, rdx
je 0x14001015a
mov r8d, 1
mov rcx, qword [rbp + 0x218]
call fcn.14000f550
mov byte [rbp - 0x40], 1
lea r8, [rbp - 0x40]
mov rcx, rsi
mov edx, 4
mov r9d, 1
call sub.KERNEL32.dll_SetFileInformationByHandle
cmp eax, 1
jne 0x140010238
mov rcx, rsi
call sub.KERNEL32.dll_CloseHandle
cmp eax, 1
jne 0x1400101f5
mov rdx, qword [rbp + 0x1d0]
test rdx, rdx
je 0x1400101a9
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.14000f550
mov ebx, 6
jmp 0x1400101d0
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x1400101ce
mov rcx, qword [rbp + 0x1f8]
mov r8d, 1
call fcn.14000f550
xor ebx, ebx
jmp 0x140010213
test rdx, rdx
je 0x1400101e9
mov r8d, 1
mov rcx, qword [rbp + 0x218]
call fcn.14000f550
mov ebx, 1
mov rsi, 0xffffffffffffffff
mov rdx, qword [rbp + 0x1d0]
test rdx, rdx
je 0x140010213
mov rcx, qword [rbp + 0x1c8]
mov r8d, 1
call fcn.14000f550
mov rax, rbx
mov rdx, rsi
add rsp, 0x2a8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov ebx, 2
mov rdx, qword [rbp + 0x1d0]
test rdx, rdx
jne 0x140010201
jmp 0x140010213
mov ebx, 3
mov rdx, qword [rbp + 0x1d0]
test rdx, rdx
jne 0x140010201
jmp 0x140010213
lea r8, [0x1407f4630]
mov edx, 0x104
call fcn.14002ab80
ud2