Function at 0x18000f490
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 0x70], rdx
mov dword [rsp + 0x30], 0xf36af30e
mov dword [rsp + 0x34], 0xf378f30a
mov dword [rsp + 0x38], 0xf334f30c
mov dword [rsp + 0x3c], 0xf333f337
mov dword [rsp + 0x40], 0xf33af33c
mov dword [rsp + 0x44], 0xf30ef336
mov dword [rsp + 0x48], 0xf342f306
mov dword [rsp + 0x4c], 0xf311f315
mov dword [rsp + 0x50], 0xf308f309
mov dword [rsp + 0x54], 0xf31af302
mov dword [rsp + 0x58], 0xf308f308
mov dword [rsp + 0x5c], 0xf309f307
mov dword [rsp + 0x60], 0xf30af34d
mov dword [rsp + 0x64], 0xf319f31d
mov dword [rsp + 0x68], 0xf317f307
mov dword [rsp + 0x6c], 0xf301
xor r15d, r15d
mov ecx, r15d
mov edx, r15d
mov r12d, 0xcab
nop dword [rax]
movzx eax, cx
sub ax, r12w
xor word [rsp + rdx*2 + 0x30], ax
inc ecx
movsxd rdx, ecx
cmp rdx, 0x1f
jb 0x18000f560
mov word [rsp + 0x6e], r15w
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180015960
lea rdx, [0x180015b40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18000f5b1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call fcn.18000e010
nop
mov rcx, rax
call fcn.18001a4c0
test al, al
sete bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000f60e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f609
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000f609
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180029c7c
test bl, bl
jne 0x18000f9a2
lea rcx, [rbp - 0x68]
call fcn.18000e140
nop
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rdx, qword [rbp - 0x68]
mov r8d, 0x22
lea rcx, [rbp - 0x40]
call fcn.180005fe0
nop
mov rbx, qword [rdi + 8]
sub rbx, qword [rdi]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
movabs rax, 0x1c926b9d39431d5f
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0x23d6df
sub rcx, rax
add ecx, ebx
movsxd rsi, ecx
add rsi, 0xdd95
mov rcx, rsi
call fcn.18002a030
mov r14, rax
mov rbx, r15
test rsi, rsi
je 0x18000f6d6
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
mov eax, 0x80808081
imul r9d
add edx, r9d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r9d, ecx
mov byte [rbx + r14], r9b
inc rbx
cmp rbx, rsi
jb 0x18000f6a3
mov r8, rsi
mov rdx, r14
lea rcx, [rbp - 0x40]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov dword [rsp + 0x34], 0xf378f30a
test byte [rdx + rax + 0x10], 6
je 0x18000f7ca
mov dword [rsp + 0x30], 0xf377f30e
mov dword [rsp + 0x38], 0xf328f31c
mov dword [rsp + 0x3c], 0xf333f329
mov dword [rsp + 0x40], 0xf37ef32f
mov dword [rsp + 0x44], 0xf315f33b
mov dword [rsp + 0x48], 0xf312f30c
mov dword [rsp + 0x4c], 0xf30af30a
mov dword [rsp + 0x50], 0xf346f302
mov dword [rsp + 0x54], 0xf300f314
mov dword [rsp + 0x58], 0xf31ef300
mov dword [rsp + 0x5c], 0xf305f34b
mov dword [rsp + 0x60], 0xf31df303
mov dword [rsp + 0x64], 0xf314f306
mov dword [rsp + 0x68], 0xf352f314
mov dword [rsp + 0x6c], 0xf31cf307
mov dword [rsp + 0x70], 0xf356f310
mov dword [rsp + 0x74], 0xf311f313
mov dword [rsp + 0x78], 0xf311f30a
xor eax, eax
mov word [rsp + 0x7c], ax
mov r8d, r15d
mov r9, r15
nop dword [rax]
movzx eax, r8w
sub ax, r12w
xor word [rsp + r9*2 + 0x30], ax
inc r8d
movsxd r9, r8d
cmp r9, 0x26
jb 0x18000f7a0
mov word [rsp + 0x7c], r15w
lea rdx, [rsp + 0x30]
jmp 0x18000f8a2
mov dword [rsp + 0x30], 0xf37df30e
mov dword [rsp + 0x38], 0xf32ff30f
mov dword [rsp + 0x3c], 0xf37cf337
mov dword [rsp + 0x40], 0xf32cf339
mov dword [rsp + 0x44], 0xf316f336
mov dword [rsp + 0x48], 0xf310f304
mov dword [rsp + 0x4c], 0xf300f343
mov dword [rsp + 0x50], 0xf312f304
mov dword [rsp + 0x54], 0xf348f306
mov dword [rsp + 0x58], 0xf30ff30d
mov dword [rsp + 0x5c], 0xf318f318
mov dword [rsp + 0x60], 0xf301f31f
mov dword [rsp + 0x64], 0xf315f316
mov dword [rsp + 0x68], 0xf352f315
mov dword [rsp + 0x6c], 0xf311f311
mov dword [rsp + 0x70], 0xf319f313
mov dword [rsp + 0x74], 0xf31df305
mov dword [rsp + 0x78], 0xf30ff359
mov dword [rsp + 0x7c], 0xf310f315
mov dword [rbp - 0x80], 0xf310f314
mov dword [rbp - 0x7c], 0xf314
mov edx, r15d
mov r8, r15
nop word [rax + rax]
movzx eax, dx
sub ax, r12w
xor word [rsp + r8*2 + 0x30], ax
inc edx
movsxd r8, edx
cmp r8, 0x2b
jb 0x18000f880
mov word [rbp - 0x7a], r15w
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180015960
lea rdx, [0x180015b40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rbp - 0x38]
call fcn.180005f30
test rax, rax
jne 0x18000f8e8
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, r14
call fcn.180029c7c
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wremove]
nop
test eax, eax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x40], rax
mov rax, qword [rbp - 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x44], edx
lea rcx, [rbp - 0x38]
je 0x18000f9ed
call fcn.1800055b0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x18000f991
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f98c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000fa3e
call fcn.180029c7c
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000f9e6
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000f9d6
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000fac7
mov rcx, r8
call fcn.180029c7c
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
xor al, al
jmp 0x18000fa9d
call fcn.1800055b0
lea rcx, [rbp - 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x18000fa4a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000fa45
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000fa45
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180029c7c
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r15w
mov rcx, qword [rdi]
test rcx, rcx
je 0x18000fa9b
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18000fa8b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000fac7
mov rcx, r8
call fcn.180029c7c
mov qword [rdi], r15
mov qword [rdi + 8], r15
mov qword [rdi + 0x10], r15
mov al, 1
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180029c20
mov rbx, qword [rsp + 0x230]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3