Function at 0x1400027a0
Capabilities:
Acquire credentials from windows credential manager
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Delete file
Encode data using xor
Execute command
Persist via default file association registry key
Persist via windows service
Schedule task via at
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov byte [rsp + 0x50], 0x63
mov byte [rsp + 0x51], 0x1c
mov byte [rsp + 0x52], 0x7d
mov byte [rsp + 0x53], 0x71
mov byte [rsp + 0x54], 0x42
mov byte [rsp + 0x55], 0x41
mov byte [rsp + 0x56], 0x44
mov byte [rsp + 0x57], 0x4d
mov byte [rsp + 0x58], 0x55
mov byte [rsp + 0x59], 0x58
mov byte [rsp + 0x5a], 0x76
mov byte [rsp + 0x5b], 0x46
mov byte [rsp + 0x5c], 0x4c
mov byte [rsp + 0x5d], 0x5f
mov byte [rsp + 0x5e], 0x46
mov byte [rsp + 0x5f], 0x5f
mov byte [rsp + 0x60], 0x6c
mov byte [rsp + 0x61], 0x50
mov byte [rsp + 0x62], 0x5f
mov byte [rsp + 0x63], 0x18
mov byte [rsp + 0x64], 0x59
mov byte [rsp + 0x65], 0x5e
mov byte [rsp + 0x66], 0x44
mov byte [rsp + 0x67], 0x32
movzx eax, byte [rsp + 0x50]
xor esi, esi
mov r9d, esi
movabs r12, 0xa2d6c779897c0423
mov r10, r12
lea rax, [rsp + 0x50]
sub r10, rax
lea r15d, [rsi + 0xf]
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x50]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r15d
cmp rcx, r15
cmovae rcx, r15
shl cl, 2
mov rax, r12
shr rax, cl
and al, r15b
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x50], al
inc r9
cmp r9, 0x18
jb 0x140002880
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
lea rax, [rsp + 0x50]
mov r13, 0xffffffffffffffff
mov rbx, r13
nop dword [rax]
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400028e0
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x1400030f3
cmp rbx, r15
ja 0x140002924
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r15
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x30], sil
jmp 0x1400029c1
mov rax, rbx
or rax, r15
mov qword [rbp + 0x70], rax
cmp rax, r14
jbe 0x140002960
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400067b0
test rax, rax
je 0x140002a8d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400029a1
mov ecx, 0x16
mov qword [rbp + 0x50], rcx
cmp rax, rcx
cmovb rax, rcx
mov r14, rax
lea rcx, [rax + 1]
cmp rcx, 0x1000
jb 0x14000298f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400030f9
jmp 0x140002941
test rcx, rcx
je 0x14000299e
call fcn.1400067b0
mov rdi, rax
jmp 0x1400029a1
mov rdi, rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r14
mov r8, rbx
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], sil
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xf0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rdx, qword [rbp + 0x30]
lea rcx, [rbp + 0xf0]
call fcn.140004730
nop
mov r8d, 0x1888f8
lea rdx, str._echo_off_r_ndel__C:WindowsprefetchCONHOST.EXE_0C6456FB.pf___r_ndel__C:WindowsprefetchCONHOST.EXE_0C6456FB.pf___r_ndel__C:WindowsprefetchCLEANER.EXE_08C569E3.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:WindowsprefetchCONHOST.EXE_0C6456FB.pf___r_ndel__C:WindowsprefetchTASKKILL.EXE_0ECD41EC.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:WindowsprefetchCLEANER.EXE_08C569E3.pf___r_ndel__C:WindowsprefetchRUNTIMEBROKER.EXE_4551A062.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:WindowsprefetchTOOL.EXE_7A8EFD97.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_nc403512a_5906_4795_92c4_7ab8289ad538_apps.csg___r_nc403512a_5906_4795_92c4_7ab8289ad538_apps.csg___r_ndel__C:WindowsprefetchTASKKILL.EXE_0ECD41EC.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:WindowsprefetchATTRIB.EXE_58A07CAF.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:WindowsprefetchTASKKILL.EXE_0ECD41EC.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheMetaData___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheMetaDataFB0D848F74F70BB2EAA93746D24D9749___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheMetaData77EC63BDA74BD0D0E0426DC8F8008506___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:System_Volume_Information_tracking.log___r_ndel__C:System_Volume_Information_tracking.log___r_ndel__C:System_Volume_InformationIndexerVolumeGuid___r_ndel__C:System_Volume_Information_tracking.log___r_ndel__C:System_Volume_Information_tracking.log___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheContent___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheContentFB0D848F74F70BB2EAA93746D24D9749___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheContent77EC63BDA74BD0D0E0426DC8F8008506___r_ndel__C:WindowsINF_netrasa.PNF___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheContent___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheContentFB0D848F74F70BB2EAA93746D24D9749___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_n___Critical_10.0.18362.411_1_3d6901e11d91b131dc12ed0eb6c4813e1f2c6_00000000_ae9bff9d_3843_4303_9058_46cbde99eb19Report.wer___r_n___Critical_10.0.18362.411_1_3d6901e11d91b131dc12ed0eb6c4813e1f2c6_00000000_ae9bff9d_3843_4303_9058_46cbde99eb19Report.wer____r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_n___Critical_10.0.18362.411_1_3d6901e11d91b131dc12ed0eb6c4813e1f2c6_00000000_ae9bff9d_3843_4303_9058_46cbde99eb19___r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf____r_ndel__C:Windowsprefetch_reg.EXE_0AC99A87.pf___r_ndel__C:Users_username_AppDataLocalLowMicrosoftCryptnetUrlCacheMetaData___r_ndel__C:Users_usernam
lea rcx, [rbp + 0xf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
lea rcx, [rbp + 0xf8]
call fcn.140005310
test rax, rax
jne 0x140002a4e
mov rax, qword [rbp + 0xf0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0xf0]
xor r8d, r8d
lea edx, [r8 + 2]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
lea rcx, [rbp + 0xf0]
call fcn.1400026e0
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140002a99
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a94
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400067f4
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], r15
mov byte [rbp + 0x30], 0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
mov dword [rbp + 0xe4], eax
mov dword [rbp + 0x80], 0x68
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], rax
mov byte [rsp + 0x68], 0x63
mov byte [rsp + 0x69], 0x1c
mov byte [rsp + 0x6a], 0x7d
mov byte [rsp + 0x6b], 0x71
mov byte [rsp + 0x6c], 0x42
mov byte [rsp + 0x6d], 0x41
mov byte [rsp + 0x6e], 0x44
mov byte [rsp + 0x6f], 0x4d
mov byte [rsp + 0x70], 0x55
mov byte [rsp + 0x71], 0x58
mov byte [rsp + 0x72], 0x76
mov byte [rsp + 0x73], 0x46
mov byte [rsp + 0x74], 0x4c
mov byte [rsp + 0x75], 0x5f
mov byte [rsp + 0x76], 0x46
mov byte [rsp + 0x77], 0x5f
mov byte [rsp + 0x78], 0x6c
mov byte [rsp + 0x79], 0x50
mov byte [rsp + 0x7a], 0x5f
mov byte [rsp + 0x7b], 0x18
mov byte [rsp + 0x7c], 0x59
mov byte [rsp + 0x7d], 0x5e
mov byte [rsp + 0x7e], 0x44
mov byte [rsp + 0x7f], 0x32
movzx eax, byte [rsp + 0x68]
mov r9, rsi
mov r10, r12
lea rax, [rsp + 0x68]
sub r10, rax
nop dword [rax]
nop word [rax + rax]
lea rdx, [rsp + 0x68]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r15
shl cl, 2
mov rax, r12
shr rax, cl
and al, 0xf
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rsp + r9 + 0x68], al
inc r9
cmp r9, 0x18
jb 0x140002b90
lea rcx, [rsp + 0x68]
mov r14, r13
inc r14
cmp byte [rcx + r14], 0
jne 0x140002bd3
lea rbx, [r14 + 1]
mov eax, 2
mul rbx
cmovo rax, r13
mov rcx, rax
call fcn.1400067fc
mov rdi, rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x68]
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x78]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002ff7
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbp - 0x80], 0x63
mov byte [rbp - 0x7f], 0x1c
mov byte [rbp - 0x7e], 0x7d
mov byte [rbp - 0x7d], 0x71
mov byte [rbp - 0x7c], 0x42
mov byte [rbp - 0x7b], 0x41
mov byte [rbp - 0x7a], 0x44
mov byte [rbp - 0x79], 0x4d
mov byte [rbp - 0x78], 0x55
mov byte [rbp - 0x77], 0x58
mov byte [rbp - 0x76], 0x76
mov byte [rbp - 0x75], 0x46
mov byte [rbp - 0x74], 0x4c
mov byte [rbp - 0x73], 0x5f
mov byte [rbp - 0x72], 0x46
mov byte [rbp - 0x71], 0x5f
mov byte [rbp - 0x70], 0x6c
mov byte [rbp - 0x6f], 0x50
mov byte [rbp - 0x6e], 0x5f
mov byte [rbp - 0x6d], 0x18
mov byte [rbp - 0x6c], 0x59
mov byte [rbp - 0x6b], 0x5e
mov byte [rbp - 0x6a], 0x44
mov byte [rbp - 0x69], 0x32
movzx eax, byte [rbp - 0x80]
mov r9, rsi
mov r10, r12
lea rax, [rbp - 0x80]
sub r10, rax
nop word [rax + rax]
lea rdx, [rbp - 0x80]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r15
shl cl, 2
mov rax, r12
shr rax, cl
and al, 0xf
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x80], al
inc r9
cmp r9, 0x18
jb 0x140002cf0
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov byte [rbp - 0x50], 0xe4
mov byte [rbp - 0x4f], 0xe9
mov byte [rbp - 0x4e], 0xeb
mov byte [rbp - 0x4d], 0xa9
mov byte [rbp - 0x4c], 0xaa
mov byte [rbp - 0x4b], 0xca
mov byte [rbp - 0x4a], 0xb0
mov byte [rbp - 0x49], 0xdb
mov byte [rbp - 0x48], 0xeb
mov byte [rbp - 0x47], 0xee
mov byte [rbp - 0x46], 0xe8
mov byte [rbp - 0x45], 0xe0
mov byte [rbp - 0x44], 0xfb
mov byte [rbp - 0x43], 0xeb
mov byte [rbp - 0x42], 0xc1
mov byte [rbp - 0x41], 0xfc
mov byte [rbp - 0x40], 0xe2
mov byte [rbp - 0x3f], 0xea
mov byte [rbp - 0x3e], 0xfe
mov byte [rbp - 0x3d], 0xfa
mov byte [rbp - 0x3c], 0xfd
mov byte [rbp - 0x3b], 0xc9
mov byte [rbp - 0x3a], 0xe8
mov byte [rbp - 0x39], 0xf3
mov byte [rbp - 0x38], 0xf4
mov byte [rbp - 0x37], 0xf9
mov byte [rbp - 0x36], pe_nt_image_headers64
mov byte [rbp - 0x35], 0xfa
mov byte [rbp - 0x34], 0xef
mov byte [rbp - 0x33], 0xe4
mov byte [rbp - 0x32], 0xcd
mov byte [rbp - 0x31], 0xca
mov byte [rbp - 0x30], 0xc1
mov byte [rbp - 0x2f], 0xc0
mov byte [rbp - 0x2e], 0xf4
mov byte [rbp - 0x2d], 0xcc
mov byte [rbp - 0x2c], 0xda
mov byte [rbp - 0x2b], 0xdf
mov byte [rbp - 0x2a], 0xc3
mov byte [rbp - 0x29], 0xcf
mov byte [rbp - 0x28], 0xc7
mov byte [rbp - 0x27], 0xe1
mov byte [rbp - 0x26], 0xdc
mov byte [rbp - 0x25], 0xdf
mov byte [rbp - 0x24], 0xe8
mov byte [rbp - 0x23], 0xd9
mov byte [rbp - 0x22], 0xc6
mov byte [rbp - 0x21], 0xd8
mov byte [rbp - 0x20], 0xfc
mov byte [rbp - 0x1f], 0xd3
mov byte [rbp - 0x1e], 0xd4
mov byte [rbp - 0x1d], 0xd8
mov byte [rbp - 0x1c], 0xd4
mov byte [rbp - 0x1b], 0xff
mov byte [rbp - 0x1a], 0xd5
mov byte [rbp - 0x19], 0xd2
mov byte [rbp - 0x18], 0xc6
mov byte [rbp - 0x17], 0xf3
mov byte [rbp - 0x16], 0xdd
mov byte [rbp - 0x15], 0xdc
mov byte [rbp - 0x14], 0xd4
mov byte [rbp - 0x13], 0xad
mov byte [rbp - 0x12], 0xe0
mov byte [rbp - 0x11], 0xc9
movzx eax, byte [rbp - 0x50]
mov r9, rsi
movabs rbx, 0xb38311c9631ff283
mov r10, rbx
lea rax, [rbp - 0x50]
sub r10, rax
nop
lea rdx, [rbp - 0x50]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r15
shl cl, 2
mov rax, rbx
shr rax, cl
and al, 0xf
add dl, r10b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x50], al
inc r9
cmp r9, 0x40
jb 0x140002e50
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov byte [rbp - 0x10], 0xe4
mov byte [rbp - 0xf], 0xe9
mov byte [rbp - 0xe], 0xeb
mov byte [rbp - 0xd], 0xa9
mov byte [rbp - 0xc], 0xaa
mov byte [rbp - 0xb], 0xca
mov byte [rbp - 0xa], 0xb0
mov byte [rbp - 9], 0xdb
mov byte [rbp - 8], 0xeb
mov byte [rbp - 7], 0xee
mov byte [rbp - 6], 0xe8
mov byte [rbp - 5], 0xe0
mov byte [rbp - 4], 0xfb
mov byte [rbp - 3], 0xeb
mov byte [rbp - 2], 0xc1
mov byte [rbp - 1], 0xfc
mov byte [rbp], 0xe2
mov byte [rbp + 1], 0xea
mov byte [rbp + 2], 0xfe
mov byte [rbp + 3], 0xfa
mov byte [rbp + 4], 0xfd
mov byte [rbp + 5], 0xc9
mov byte [rbp + 6], 0xe8
mov byte [rbp + 7], 0xf3
mov byte [rbp + 8], 0xf4
mov byte [rbp + 9], 0xf9
mov byte [rbp + 0xa], pe_nt_image_headers64
mov byte [rbp + 0xb], 0xfa
mov byte [rbp + 0xc], 0xef
mov byte [rbp + 0xd], 0xe4
mov byte [rbp + 0xe], 0xcd
mov byte [rbp + 0xf], 0xca
mov byte [rbp + 0x10], 0xc1
mov byte [rbp + 0x11], 0xc0
mov byte [rbp + 0x12], 0xf4
mov byte [rbp + 0x13], 0xcc
mov byte [rbp + 0x14], 0xda
mov byte [rbp + 0x15], 0xdf
mov byte [rbp + 0x16], 0xc3
mov byte [rbp + 0x17], 0xcf
mov byte [rbp + 0x18], 0xc7
mov byte [rbp + 0x19], 0xe1
mov byte [rbp + 0x1a], 0xdc
mov byte [rbp + 0x1b], 0xdf
mov byte [rbp + 0x1c], 0xe8
mov byte [rbp + 0x1d], 0xd9
mov byte [rbp + 0x1e], 0xc6
mov byte [rbp + 0x1f], 0xd8
mov byte [rbp + 0x20], 0xfc
mov byte [rbp + 0x21], 0xd3
mov byte [rbp + 0x22], 0xd4
mov byte [rbp + 0x23], 0xd8
mov byte [rbp + 0x24], 0xd4
mov byte [rbp + 0x25], 0xff
mov byte [rbp + 0x26], 0xd5
mov byte [rbp + 0x27], 0xd2
mov byte [rbp + 0x28], 0xc6
mov byte [rbp + 0x29], 0xf3
mov byte [rbp + 0x2a], 0xdd
mov byte [rbp + 0x2b], 0xdc
mov byte [rbp + 0x2c], 0xd4
mov byte [rbp + 0x2d], 0xad
mov byte [rbp + 0x2e], 0xe0
mov byte [rbp + 0x2f], 0xc9
movzx eax, byte [rbp - 0x10]
mov r9, rbx
lea rax, [rbp - 0x10]
sub r9, rax
lea rdx, [rbp - 0x10]
add rdx, rsi
movsx r8, byte [rdx]
mov rcx, rsi
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r15
shl cl, 2
mov rax, rbx
shr rax, cl
and al, 0xf
add dl, r9b
xor al, dl
xor al, r8b
mov byte [rbp + rsi - 0x10], al
inc rsi
cmp rsi, 0x40
jb 0x140002fa2
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1400085f8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x1400030c3
lea rdx, str._n_____Failed_to_clean_ban_traces_
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400055c0
mov byte [rbp - 0x68], 0x63
mov byte [rbp - 0x67], 0x1c
mov byte [rbp - 0x66], 0x7d
mov byte [rbp - 0x65], 0x71
mov byte [rbp - 0x64], 0x42
mov byte [rbp - 0x63], 0x41
mov byte [rbp - 0x62], 0x44
mov byte [rbp - 0x61], 0x4d
mov byte [rbp - 0x60], 0x55
mov byte [rbp - 0x5f], 0x58
mov byte [rbp - 0x5e], 0x76
mov byte [rbp - 0x5d], 0x46
mov byte [rbp - 0x5c], 0x4c
mov byte [rbp - 0x5b], 0x5f
mov byte [rbp - 0x5a], 0x46
mov byte [rbp - 0x59], 0x5f
mov byte [rbp - 0x58], 0x6c
mov byte [rbp - 0x57], 0x50
mov byte [rbp - 0x56], 0x5f
mov byte [rbp - 0x55], 0x18
mov byte [rbp - 0x54], 0x59
mov byte [rbp - 0x53], 0x5e
mov byte [rbp - 0x52], 0x44
mov byte [rbp - 0x51], 0x32
movzx eax, byte [rbp - 0x68]
mov r9, r12
lea rax, [rbp - 0x68]
sub r9, rax
nop dword [rax + rax]
lea rdx, [rbp - 0x68]
add rdx, rsi
movsx r8, byte [rdx]
mov rcx, rsi
and ecx, 0xf
cmp rcx, 0xf
cmovae rcx, r15
shl cl, 2
mov rax, r12
shr rax, cl
and al, 0xf
add dl, r9b
xor al, dl
xor al, r8b
mov byte [rbp + rsi - 0x68], al
inc rsi
cmp rsi, 0x18
jb 0x140003080
lea rcx, [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140006790
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011b0
int3
call fcn.140001110
int3