Function at 0x1400033a0
Capabilities:
Encode data using xor
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rcx]
xor r15d, r15d
mov dword [rbp + 0xc8], 0x30
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r15
lea r9, [rsp + 0x60]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0xc8]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x80000000
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xe0], 0x40
mov qword [rbp + 0xd8], rax
movdqu xmmword [rbp + 0xe8], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x14000346e
lea rcx, [0x140005e00]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003f20
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0xf8]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
movsxd rdx, dword [rbp + 0x100]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x40], r15
mov r14, rax
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r15d
cmp qword [rbp + 0x100], r15
jle 0x140003511
mov rcx, r14
xor byte [rcx], 0xc1
inc edx
movsxd rax, edx
inc rcx
cmp rax, qword [rbp + 0x100]
jl 0x1400034fd
lea r13, [0x140009450]
mov rcx, r14
mov rdx, r13
sub rdx, r14
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x140003521
cmp qword [rsp + 0x68], 1
lea rcx, [0x140008150]
mov edx, r15d
lea r9, [0x140008250]
mov edi, r15d
lea r10, [0x140008350]
mov ebx, r15d
lea r11, [0x140008450]
lea rsi, [0x140008550]
je 0x1400037fb
mov r8, r15
lea r14, [0x140008050]
cmp byte [r8 + r13], 0xd
jne 0x1400037c8
lea rsi, [r8 + 1]
cmp byte [rsi + r13], 0xa
jne 0x1400037c8
test edi, edi
jne 0x1400035af
mov eax, ebx
mov rcx, r14
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
mov rcx, r14
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400037a9
cmp edi, 1
jne 0x1400035cf
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008150]
jmp 0x1400035a5
cmp edi, 2
jne 0x1400035f2
mov eax, ebx
mov rcx, r9
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008250]
jmp 0x1400035a5
cmp edi, 3
jne 0x140003615
mov eax, ebx
mov rcx, r10
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008350]
jmp 0x1400035a5
cmp edi, 4
jne 0x14000363b
mov eax, ebx
mov rcx, r11
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008450]
jmp 0x1400035a5
cmp edi, 5
jne 0x140003665
mov eax, ebx
lea rcx, [0x140008550]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008550]
jmp 0x1400035a5
cmp edi, 6
jne 0x14000368f
mov eax, ebx
lea rcx, [0x140008650]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008650]
jmp 0x1400035a5
cmp edi, 7
jne 0x1400036b9
mov eax, ebx
lea rcx, [0x140008750]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008750]
jmp 0x1400035a5
cmp edi, 8
jne 0x1400036e3
mov eax, ebx
lea rcx, [0x140008850]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008850]
jmp 0x1400035a5
cmp edi, 9
jne 0x14000370d
mov eax, ebx
lea rcx, [0x140008950]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008950]
jmp 0x1400035a5
cmp edi, 0xa
jne 0x14000371b
lea rcx, [0x140008a50]
jmp 0x140003797
cmp edi, 0xb
jne 0x140003729
lea rcx, [0x140008b50]
jmp 0x140003797
cmp edi, 0xc
jne 0x140003737
lea rcx, [0x140008c50]
jmp 0x140003797
cmp edi, 0xd
jne 0x140003745
lea rcx, [0x140008d50]
jmp 0x140003797
cmp edi, 0xe
jne 0x140003753
lea rcx, [0x140008e50]
jmp 0x140003797
cmp edi, 0xf
jne 0x140003761
lea rcx, [0x140008f50]
jmp 0x140003797
cmp edi, 0x10
jne 0x14000376f
lea rcx, [0x140009050]
jmp 0x140003797
cmp edi, 0x11
jne 0x14000377d
lea rcx, [0x140009150]
jmp 0x140003797
cmp edi, 0x12
jne 0x14000378b
lea rcx, [0x140009250]
jmp 0x140003797
cmp edi, 0x13
jne 0x1400037be
lea rcx, [0x140009350]
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea r11, [0x140008450]
lea r10, [0x140008350]
lea r9, [0x140008250]
inc edi
mov r8, rsi
inc ebx
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
inc ebx
dec rcx
movsxd rax, ebx
inc r8
cmp rax, rcx
lea rcx, [0x140008150]
jb 0x14000356f
mov r14, qword [rsp + 0x78]
lea rcx, [0x140008150]
lea rsi, [0x140008550]
movsxd rbx, edx
cmp rbx, qword [rsp + 0x68]
jae 0x140003a86
test edi, edi
jne 0x140003838
lfence
mov r8, qword [rsp + 0x68]
lea rdi, [0x140008050]
sub r8, rbx
lea rdx, [rbx + r13]
mov rcx, rdi
call sub.ntoskrnl.exe_strncpy
mov rcx, rdi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003a8d
cmp edi, 1
jne 0x14000386c
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rsi, [0x140008150]
mov rcx, rsi
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140008050]
jmp 0x140003a94
cmp edi, 2
jne 0x1400038aa
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r9
call sub.ntoskrnl.exe_strncpy
lea r13, [0x140008250]
mov rcx, r13
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140008050]
lea rsi, [0x140008150]
jmp 0x140003a9b
cmp edi, 3
jne 0x1400038d7
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r10
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008350]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003a86
cmp edi, 4
jne 0x1400038fc
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r11
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008450]
jmp 0x1400038cd
cmp edi, 5
jne 0x14000391d
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, rsi
call sub.ntoskrnl.exe_strncpy
mov rcx, rsi
jmp 0x1400038cd
cmp edi, 6
jne 0x140003946
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140008650]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008650]
jmp 0x1400038cd
cmp edi, 7
jne 0x140003972
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140008750]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008750]
jmp 0x1400038cd
cmp edi, 8
jne 0x14000399e
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140008850]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008850]
jmp 0x1400038cd
lea rsi, [rbx + r13]
cmp edi, 9
jne 0x1400039cd
lfence
mov r8, qword [rsp + 0x68]
lea rcx, [0x140008950]
sub r8, rbx
mov rdx, rsi
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140008950]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 0xa
jne 0x1400039e1
mov rdx, rsi
lea rcx, [0x140008a50]
jmp 0x140003a76
cmp edi, 0xb
jne 0x1400039f5
mov rdx, rsi
lea rcx, [0x140008b50]
jmp 0x140003a76
cmp edi, 0xc
jne 0x140003a06
mov rdx, rsi
lea rcx, [0x140008c50]
jmp 0x140003a76
cmp edi, 0xd
jne 0x140003a17
mov rdx, rsi
lea rcx, [0x140008d50]
jmp 0x140003a76
cmp edi, 0xe
jne 0x140003a28
mov rdx, rsi
lea rcx, [0x140008e50]
jmp 0x140003a76
cmp edi, 0xf
jne 0x140003a39
mov rdx, rsi
lea rcx, [0x140008f50]
jmp 0x140003a76
cmp edi, 0x10
jne 0x140003a4a
mov rdx, rsi
lea rcx, [0x140009050]
jmp 0x140003a76
cmp edi, 0x11
jne 0x140003a58
lea rcx, [0x140009150]
jmp 0x140003a72
cmp edi, 0x12
jne 0x140003a66
lea rcx, [0x140009250]
jmp 0x140003a72
cmp edi, 0x13
jne 0x140003a86
lea rcx, [0x140009350]
lea rdx, [rbx + r13]
lfence
mov r8, qword [rsp + 0x68]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rdi, [0x140008050]
lea rsi, [0x140008150]
lea r13, [0x140008250]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], r15b
jne 0x140003aa2
test rax, rax
je 0x140003ad3
mov rdx, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rsp + 0x78]
lea rcx, [0x14000ac90]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rsi + rax], r15b
jne 0x140003ad6
test rax, rax
je 0x140003b05
mov rdx, rsi
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x68]
lea rcx, [0x14000ac80]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rax + r13], r15b
jne 0x140003b08
test rax, rax
je 0x140003b37
mov rdx, r13
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [0x14000ac70]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008350]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003b41
test rax, rax
je 0x140003b70
mov rdx, rcx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [0x14000ac60]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008450]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003b7a
test rax, rax
je 0x140003ba9
mov rdx, rcx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x38]
lea rcx, [0x14000ac50]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008550]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003bb3
test rax, rax
je 0x140003be2
mov rdx, rcx
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x28]
lea rcx, [0x14000ac40]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008650]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003bec
test rax, rax
je 0x140003c1b
mov rdx, rcx
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x18]
lea rcx, [0x14000ac30]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008750]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003c25
test rax, rax
je 0x140003c54
mov rdx, rcx
lea rcx, [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 8]
lea rcx, [0x14000ac20]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008850]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003c5e
test rax, rax
je 0x140003c8d
mov rdx, rcx
lea rcx, [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 8]
lea rcx, [0x14000ac10]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008950]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003c97
test rax, rax
je 0x140003cc6
mov rdx, rcx
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x18]
lea rcx, [0x14000ac00]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008a50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003cd0
test rax, rax
je 0x140003cff
mov rdx, rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x28]
lea rcx, [0x14000abf0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008b50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003d09
test rax, rax
je 0x140003d38
mov rdx, rcx
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x38]
lea rcx, [0x14000abe0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008c50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003d42
test rax, rax
je 0x140003d71
mov rdx, rcx
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x48]
lea rcx, [0x14000abd0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008d50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003d7b
test rax, rax
je 0x140003daa
mov rdx, rcx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x58]
lea rcx, [0x14000abc0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008e50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003db4
test rax, rax
je 0x140003de3
mov rdx, rcx
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [0x14000abb0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008f50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003ded
test rax, rax
je 0x140003e1c
mov rdx, rcx
lea rcx, [rbp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x78]
lea rcx, [0x14000aba0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009050]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003e26
test rax, rax
je 0x140003e5b
mov rdx, rcx
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x88]
lea rcx, [0x14000ab90]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009150]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003e65
test rax, rax
je 0x140003e9a
mov rdx, rcx
lea rcx, [rbp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x98]
lea rcx, [0x14000ab80]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009250]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003ea4
test rax, rax
je 0x140003ed9
mov rdx, rcx
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0xa8]
lea rcx, [0x14000ab70]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rax, [0x140009350]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140003ee0
test rbx, rbx
je 0x140003f15
mov rdx, rax
lea rcx, [rbp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0xb8]
lea rcx, [0x14000ab60]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140005830
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret