Function at 0x140077f70
Capabilities:
Contain obfuscated stackstrings
Delete file
Read file on windows
Write file on windows

Disassembly:
push rbp
push rsi
lea rbp, [rsp - 0x1018]
mov eax, 0x1118
call fcn.1400b6710
sub rsp, rax
lea rdx, [0x140140120]
mov rsi, rcx
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x140078acb
mov qword [rsp + 0x1130], rbx
lea rcx, [rsi + 0x28]
mov qword [rsp + 0x1110], rdi
mov ebx, 2
mov qword [rsp + 0x1108], r12
mov edx, ebx
mov qword [rsp + 0x1100], r13
mov qword [rsp + 0x10f8], r14
mov qword [rsp + 0x10f0], r15
mov dword [rsi + 0x298], 0x100
call fcn.140025da0
mov r8, rax
lea r9, [0x140140140]
mov rdx, 0xffffffffffffffff
nop
movzx r14d, word [r8 + rdx*2 + 2]
movzx ecx, word [r9 + rdx*2 + 2]
sub r14d, ecx
jne 0x140078029
add rdx, rbx
cmp rdx, 0xf
je 0x140078029
movzx r14d, word [r8 + rdx*2]
movzx eax, word [r9 + rdx*2]
sub r14d, eax
je 0x140078000
mov r9d, dword [rsi + 0x260]
test r14d, r14d
mov r8d, dword [rsi + 0x258]
mov eax, 8
mov r13d, reloc.WSOCK32.dll_recv
mov r15d, 5
mov edx, r13d
mov rcx, rsi
cmove edx, eax
cmove r15d, ebx
call fcn.140024600
xor ebx, ebx
lea rcx, [rsi + 0x2a0]
mov eax, ebx
mov qword [rsi + 0x268], rbx
test r14d, r14d
mov edi, pe_nt_image_headers64
cmove eax, edi
mov dword [rsi + 0x29c], eax
call fcn.140028c40
mov rcx, qword [rsi + 0x4a8]
cmp rcx, 0xffffffffffffffff
je 0x1400780ae
cmp byte [rsi + 0x6b8], bl
je 0x1400780a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov qword [rsi + 0x4a8], rax
mov byte [rsi + 0x6b8], 1
lea rcx, [rsi + 0x2a0]
nop dword [rax]
movzx eax, word [rcx]
mov word [rcx + 0x210], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400780c0
mov qword [rsp + 0x30], rbx
lea rcx, [rsi + 0x2a0]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 0x4a8], rax
cmp rax, 0xffffffffffffffff
jne 0x140078113
mov eax, 0x80040204
jmp 0x140078a9b
mov ecx, dword [rsi + 0x298]
mov eax, 4
imul ecx, dword [rsi + 0x258]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400b609c
mov qword [rsi + 0x6c0], rax
test rax, rax
jne 0x140078151
mov eax, 0x80040202
jmp 0x140078a9b
mov rcx, rsi
mov dword [rsi + 0x6c8], ebx
call fcn.1400246e0
mov rcx, qword [rsi + 0x6c0]
mov edi, eax
call fcn.1400b60a4
mov ecx, edi
shr ecx, 0x1f
test cl, cl
je 0x1400781b3
mov rcx, qword [rsi + 0x4a8]
cmp rcx, 0xffffffffffffffff
je 0x14007819f
cmp byte [rsi + 0x6b8], bl
je 0x140078191
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov qword [rsi + 0x4a8], rax
lea rcx, [rsi + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, edi
jmp 0x140078a9b
mov rcx, qword [rsi + 0x38]
lea rdi, [rsi + 0x38]
movaps xmmword [rsp + 0x10e0], xmm6
lea r9, [rbp + 0x1040]
movaps xmmword [rsp + 0x10d0], xmm7
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x10c0], xmm8
mov r8d, 4
movaps xmmword [rsp + 0x10b0], xmm9
mov dword [rsp + 0x60], 0x676b6a61
mov byte [rbp + 0x1038], 2
mov dword [rbp + 0x1040], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi]
lea r9, [rbp + 0x1040]
mov r8d, 1
mov dword [rbp + 0x1040], ebx
lea rdx, [rbp + 0x1038]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor r9d, r9d
lea r12, [rsi + 0x6d0]
mov qword [r12], rbx
xor r8d, r8d
mov qword [r12 + 8], rdi
mov rcx, qword [rdi]
lea edx, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
lea rax, [rbp - 0x50]
mov qword [r12 + 0x18], 0x400
mov edx, r15d
mov qword [r12 + 0x10], rax
mov rcx, r12
call fcn.140076a60
mov edx, dword [rsi + 0x258]
mov rcx, r12
call fcn.140076a60
mov edx, dword [rsi + 0x298]
mov rcx, r12
call fcn.140076a60
xor edx, edx
mov rcx, r12
call fcn.140076a60
mov edx, 4
mov rcx, r12
call fcn.140076a60
xor edx, edx
mov rcx, r12
call fcn.140076a60
mov eax, dword [rsi + 0x258]
test r14d, r14d
mov edx, dword [rsi + 0x260]
mov ecx, 0xffffffff
mov r8, rbx
mov word [rbp - 0x72], ax
setne r8b
mov dword [rbp - 0x64], 0x61746164
inc r8
mov dword [rbp - 0x7c], 0x20746d66
imul r8, rax
movzx eax, ax
imul r8, qword [rsi + 0x268]
mov dword [rbp - 0x78], r13d
cmp r8, rcx
mov dword [rbp - 0x70], edx
cmovg r8d, ecx
mov ecx, 1
mov word [rbp - 0x74], cx
test r14d, r14d
mov ecx, ebx
mov dword [rbp - 0x60], r8d
setne cl
inc cx
movzx ecx, cx
imul ecx, eax
movzx eax, cx
mov word [rbp - 0x68], ax
imul eax, edx
test r14d, r14d
mov dword [rbp - 0x6c], eax
lea eax, [r8 + 0x24]
mov dword [rsp + 0x78], 0x46464952
mov r15d, 8
mov dword [rsp + 0x7c], eax
cmove r13w, r15w
mov dword [rbp - 0x80], 0x45564157
mov word [rbp - 0x66], r13w
mov rcx, r12
mov r13d, 2
mov r8d, r13d
lea edx, [r15 + 1]
call fcn.140076ad0
mov edi, 0x2c
lea r8d, [r15 - 3]
mov edx, edi
mov rcx, r12
call fcn.140076ad0
lea r14, [rsp + 0x78]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r14]
mov r8d, r15d
mov rcx, r12
call fcn.140076ad0
lea r14, [r14 + 1]
sub edi, 1
jne 0x140078390
mov rcx, qword [rsi + 0x4a8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [rsi + 0x298]
mov rdi, qword [rsi + 0x268]
add edx, 3
mov ecx, dword [rsi + 0x258]
mov qword [rsp + 0x70], rdi
mov dword [rbp + 0x1048], ebx
call fcn.140078ef0
mov ecx, dword [rsi + 0x258]
mov edx, 4
mov r15, rax
mov qword [rsp + 0x50], rax
call fcn.140078ef0
mov ecx, dword [rsi + 0x258]
mov r10, rax
mov qword [rsp + 0x58], rax
mov r9d, ebx
test ecx, ecx
je 0x140078467
nop dword [rax]
nop word [rax + rax]
mov r8d, r9d
mov rdx, rbx
mov rcx, qword [r15 + r8*8]
mov dword [rcx], ebx
mov rcx, qword [r15 + r8*8]
mov dword [rcx + 4], ebx
mov rax, qword [r15 + r8*8]
mov dword [rax + 8], ebx
add qword [r15 + r8*8], 0xc
nop
mov rcx, qword [r10 + r8*8]
mov eax, dword [rsi + 0x29c]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x10
jl 0x140078440
mov eax, dword [rsi + 0x258]
inc r9d
cmp r9d, eax
jb 0x140078420
mov ecx, eax
movsd xmm6, qword [0x14012c8e0]
xorps xmm7, xmm7
movss xmm8, dword [0x1401481a0]
movss xmm9, dword [0x14012bc68]
nop dword [rax]
nop dword [rax + rax]
movsxd rdx, dword [rsi + 0x298]
cmp rdx, rdi
mov r14d, edx
cmovge r14d, edi
test r14d, r14d
je 0x1400789d5
mov edi, ebx
test ecx, ecx
je 0x140078506
mov r13, qword [rsp + 0x50]
lea r15d, [r14*4]
nop dword [rax]
mov rcx, qword [rsi + 0x4a8]
lea r9, [rbp + 0x1040]
mov edx, edi
mov r8d, r15d
mov dword [rbp + 0x1040], ebx
mov qword [rsp + 0x20], rbx
mov rdx, qword [r13 + rdx*8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsi + 0x258]
inc edi
cmp edi, eax
jb 0x1400784c0
mov edx, dword [rsi + 0x298]
mov r15, r13
mov r13d, 2
mov ecx, eax
mov rdi, qword [rsp + 0x70]
movsxd rax, r14d
sub rdi, rax
mov qword [rsp + 0x70], rdi
cmp r14d, edx
je 0x140078543
mov r8d, r13d
mov edx, 5
mov rcx, r12
call fcn.140076ad0
mov edx, r14d
mov dword [rsi + 0x298], r14d
mov rcx, r12
call fcn.140076a60
mov ecx, dword [rsi + 0x258]
mov dword [rsp + 0x4c], ebx
mov edx, ebx
test ecx, ecx
je 0x1400789c5
mov r8d, dword [rsi + 0x298]
mov rcx, rsi
mov r13d, edx
mov qword [rsp + 0x68], r13
mov dword [rbp + 0x1040], ebx
mov r13, qword [r15 + r13*8]
mov rdx, r13
mov qword [rsp + 0x40], r13
call fcn.140076570
mov r8, qword [rsp + 0x68]
cmp eax, 0x20
mov r10, qword [rsp + 0x58]
mov r15d, eax
mov eax, 0x20
cmovg r15d, eax
mov rcx, qword [r10 + r8*8]
mov edx, dword [rcx + 0xc]
add edx, dword [rcx + 8]
add edx, dword [rcx + 4]
mov eax, dword [rcx]
add eax, 2
add eax, edx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [rsp + 0x48], eax
mov edi, eax
cmp r15d, 0x20
jne 0x1400785e5
mov r9d, dword [rbp + 0x1048]
test r9d, r9d
je 0x1400785d0
lea ecx, [r9 - 1]
sar edi, cl
sar edi, 1
mov r14d, dword [rsi + 0x298]
mov r15d, r9d
mov r13d, 8
jmp 0x140078753
test r15d, r15d
je 0x1400785f2
lea ecx, [r15 - 1]
sar edi, cl
sar edi, 1
mov r14d, dword [rsi + 0x298]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov r9d, edi
lea rax, [rbp + 0x1040]
mov r8d, r14d
mov rdx, r13
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.140077da0
movss xmm1, dword [rsp + 0x64]
mov r13d, eax
comiss xmm1, xmm7
jbe 0x140078673
cvtps2pd xmm0, xmm1
movabs rax, 0x8000000000000000
xorps xmm2, xmm2
addsd xmm0, xmm6
cvttsd2si rcx, xmm0
cmp rcx, rax
je 0x140078676
xorps xmm2, xmm2
cvtsi2sd xmm2, rcx
ucomisd xmm2, xmm0
je 0x140078676
unpcklpd xmm0, xmm0
movmskpd eax, xmm0
xorps xmm0, xmm0
and eax, 1
sub rcx, rax
cvtsi2sd xmm0, rcx
jmp 0x140078676
xorps xmm0, xmm0
subss xmm1, xmm8
movabs rax, 0x8000000000000000
cvttsd2si edx, xmm0
addss xmm1, xmm9
xorps xmm2, xmm2
mov dword [rbp + 0x1040], edx
cvtps2pd xmm0, xmm1
cvttsd2si rcx, xmm0
cmp rcx, rax
je 0x1400786c9
xorps xmm2, xmm2
cvtsi2sd xmm2, rcx
ucomisd xmm2, xmm0
je 0x1400786c9
unpcklpd xmm0, xmm0
movmskpd eax, xmm0
xorps xmm0, xmm0
and eax, 1
sub rcx, rax
cvtsi2sd xmm0, rcx
cvttsd2si eax, xmm0
mov r10d, edx
cmp eax, edx
cmovle r10d, eax
test r10d, r10d
jle 0x140078742
lea ecx, [r10 - 1]
mov r11d, 1
shl r11d, cl
mov r9d, ebx
test r14d, r14d
jle 0x140078728
mov r8, qword [rsp + 0x40]
nop word [rax + rax]
mov edx, dword [r8]
lea r8, [r8 + 4]
add edx, r11d
mov ecx, r10d
sar edx, cl
inc r9d
mov dword [r8 - 4], edx
mov r14d, dword [rsi + 0x298]
cmp r9d, r14d
jl 0x140078700
mov edx, dword [rbp + 0x1040]
mov edi, dword [rsp + 0x48]
add r15d, r10d
je 0x140078739
lea ecx, [r15 - 1]
sar edi, cl
sar edi, 1
sub edx, r10d
mov dword [rbp + 0x1040], edx
mov r10, qword [rsp + 0x58]
mov r9d, dword [rbp + 0x1048]
mov r8, qword [rsp + 0x68]
mov eax, r14d
cdq
sub eax, edx
sar eax, 1
mov edx, eax
test r14d, r14d
jle 0x140078780
mov rcx, qword [rsp + 0x40]
mov eax, r14d
nop word [rax + rax]
add edx, dword [rcx]
lea rcx, [rcx + 4]
sub rax, 1
jne 0x140078770
nop dword [rax]
mov rcx, qword [r10 + r8*8]
mov r14d, 2
mov eax, dword [rcx + 4]
mov dword [rcx], eax
mov rcx, qword [r10 + r8*8]
mov eax, dword [rcx + 8]
mov dword [rcx + 4], eax
mov rcx, qword [r10 + r8*8]
mov eax, dword [rcx + 0xc]
mov dword [rcx + 8], eax
mov eax, edx
cdq
mov ecx, r15d
idiv dword [rsi + 0x298]
shl eax, cl
mov rcx, qword [r10 + r8*8]
mov dword [rcx + 0xc], eax
cmp r15d, r9d
je 0x1400787e1
mov r8d, r14d
lea edx, [r14 + 4]
mov rcx, r12
call fcn.140076ad0
mov r8d, r14d
mov edx, r15d
mov rcx, r12
call fcn.140076ad0
mov dword [rbp + 0x1048], r15d
mov r8d, r14d
mov edx, r13d
mov rcx, r12
call fcn.140076ad0
cmp r13d, 8
je 0x140078972
mov r14d, dword [rbp + 0x1040]
mov r8d, 3
mov edx, r14d
mov rcx, r12
call fcn.140076ad0
test r13d, r13d
je 0x140078931
sub r13d, 1
je 0x1400788ea
sub r13d, 1
je 0x14007888c
cmp r13d, 1
jne 0x140078972
mov edi, ebx
cmp dword [rsi + 0x298], ebx
jle 0x140078972
mov rcx, qword [rsp + 0x40]
lea r15d, [r14 + 1]
add rcx, 0xfffffffffffffff8
nop
mov eax, dword [rcx]
lea r14, [rcx + 4]
sub eax, dword [r14]
lea edx, [rax + rax*2]
sub edx, dword [rcx - 4]
add edx, dword [rcx + 8]
jns 0x14007886d
not edx
add edx, edx
or edx, 1
jmp 0x14007886f
add edx, edx
mov r8d, r15d
mov rcx, r12
call fcn.140076ad0
inc edi
mov rcx, r14
cmp edi, dword [rsi + 0x298]
jl 0x140078850
jmp 0x140078972
mov edi, ebx
cmp dword [rsi + 0x298], ebx
jle 0x140078972
mov rcx, qword [rsp + 0x40]
lea r15d, [r14 + 1]
add rcx, 0xfffffffffffffff8
nop word [rax + rax]
mov eax, dword [rcx + 4]
lea r14, [rcx + 4]
mov edx, dword [rcx + 8]
add eax, eax
sub edx, eax
add edx, dword [rcx]
jns 0x1400788cb
not edx
add edx, edx
or edx, 1
jmp 0x1400788cd
add edx, edx
mov r8d, r15d
mov rcx, r12
call fcn.140076ad0
inc edi
mov rcx, r14
cmp edi, dword [rsi + 0x298]
jl 0x1400788b0
jmp 0x140078972
mov r14d, ebx
cmp dword [rsi + 0x298], ebx
jle 0x140078972
mov r15d, dword [rbp + 0x1040]
mov rdi, qword [rsp + 0x40]
mov edx, dword [rdi]
sub edx, dword [rdi - 4]
jns 0x140078911
not edx
add edx, edx
or edx, 1
jmp 0x140078913
add edx, edx
lea r8d, [r15 + 1]
mov rcx, r12
call fcn.140076ad0
inc r14d
add rdi, 4
cmp r14d, dword [rsi + 0x298]
jl 0x140078901
jmp 0x140078972
mov r15d, ebx
cmp dword [rsi + 0x298], ebx
jle 0x140078972
lea r13d, [r14 + 1]
mov r14, qword [rsp + 0x40]
mov edx, dword [r14]
sub edx, edi
jns 0x140078955
not edx
add edx, edx
or edx, 1
jmp 0x140078957
add edx, edx
mov r8d, r13d
mov rcx, r12
call fcn.140076ad0
inc r15d
add r14, 4
cmp r15d, dword [rsi + 0x298]
jl 0x140078945
mov rdx, qword [rsp + 0x40]
movsxd rax, dword [rsi + 0x298]
mov r15, qword [rsp + 0x50]
mov ecx, dword [rdx + rax*4 - 0xc]
mov dword [rdx - 0xc], ecx
movsxd rax, dword [rsi + 0x298]
mov ecx, dword [rdx + rax*4 - 8]
mov dword [rdx - 8], ecx
movsxd rax, dword [rsi + 0x298]
mov ecx, dword [rdx + rax*4 - 4]
mov dword [rdx - 4], ecx
mov edx, dword [rsp + 0x4c]
mov eax, dword [rsi + 0x258]
inc edx
mov dword [rsp + 0x4c], edx
cmp edx, eax
jb 0x140078551
mov rdi, qword [rsp + 0x70]
mov ecx, eax
mov r15, qword [rsp + 0x50]
mov r13d, 2
jmp 0x140078490
mov r8d, r13d
mov edx, 4
mov rcx, r12
call fcn.140076ad0
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 0x1f]
call fcn.140076ad0
mov r8d, dword [r12 + 0x1c]
movaps xmm9, xmmword [rsp + 0x10b0]
movaps xmm8, xmmword [rsp + 0x10c0]
movaps xmm7, xmmword [rsp + 0x10d0]
movaps xmm6, xmmword [rsp + 0x10e0]
test r8d, r8d
je 0x140078a51
mov rcx, qword [r12 + 8]
lea r8d, [r8*4]
mov rdx, qword [r12 + 0x10]
lea r9, [rbp + 0x1040]
mov dword [rbp + 0x1040], ebx
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [r12 + 0x1c], ebx
mov rcx, r15
call fcn.1400b60a4
mov rcx, qword [rsp + 0x58]
call fcn.1400b60a4
mov rcx, qword [rsi + 0x4a8]
cmp rcx, 0xffffffffffffffff
je 0x140078a8c
cmp byte [rsi + 0x6b8], bl
je 0x140078a7e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, 0xffffffffffffffff
mov qword [rsi + 0x4a8], rax
lea rcx, [rsi + 0x2a0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
mov r14, qword [rsp + 0x10f8]
mov r13, qword [rsp + 0x1100]
mov r12, qword [rsp + 0x1108]
mov rdi, qword [rsp + 0x1110]
mov rbx, qword [rsp + 0x1130]
mov r15, qword [rsp + 0x10f0]
add rsp, 0x1118
pop rsi
pop rbp
ret