Function at 0x140011470
Capabilities:
Contain obfuscated stackstrings
Delete file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c0
mov rax, qword [0x14014dd80]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbp, rcx
mov r14d, r8d
mov r15, rdx
lea rcx, [rsp + 0xa1]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0xa0], 0
call fcn.1400167a0
lea rcx, [rsp + 0x40]
lea rdx, [rbp + 0xc0]
mov r8d, 0x60
call fcn.140016910
mov edx, 0x60
lea rcx, [rsp + 0x40]
mov r8d, edx
call fcn.140002ab8
lea rdx, [rbp + 0x33c]
xor esi, esi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xa0]
mov edi, 0x79
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], esi
mov dword [rsp + 0xa0], 0x61636f4c
mov dword [rsp + 0x20], 0x60
mov dword [rsp + 0xa4], 0x6365536c
mov dword [rsp + 0xa8], 0x74697275
mov word [rsp + 0xac], di
call fcn.140005ef0
mov dword [rsp + 0xa0], 0x72746552
mov word [rsp + 0xa4], di
call fcn.140005340
lea rcx, [rbp + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.140005490
lea r9d, [rdi - 0x78]
lea rdx, [rbp + 0x870]
mov r8d, 0x104
mov rcx, rbp
mov dword [rsp + 0x20], esi
call fcn.14000fb70
mov eax, dword [0x1400274e4]
mov dword [rbp + 0x974], eax
movzx eax, byte [0x1400274e8]
or rcx, 0xffffffffffffffff
mov byte [rbp + 0x978], al
xor eax, eax
lea rdi, [rbp + 0x974]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400115d0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r9d, r14d
mov rcx, rbp
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], esi
call fcn.140010280
mov edi, eax
test eax, eax
jne 0x14001161c
lea rdx, [rbp + 0x74c]
lea rcx, [rbp + 0x974]
call fcn.140009950
mov edi, eax
mov rsi, qword [rsp + 0x38]
mov r12d, dword [rsp + 0x30]
test r14d, r14d
je 0x140011706
test edi, edi
je 0x1400117e0
test rsi, rsi
je 0x140011706
test r12d, r12d
je 0x140011706
call fcn.140005340
lea rcx, [rbp + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.140005490
lea rdx, [rbp + 0x870]
mov r9d, 1
mov r8d, 0x104
mov rcx, rbp
mov dword [rsp + 0x20], 0
call fcn.14000fb70
mov eax, dword [0x1400274e4]
mov dword [rbp + 0x974], eax
movzx eax, byte [0x1400274e8]
or rcx, 0xffffffffffffffff
mov byte [rbp + 0x978], al
xor eax, eax
lea rdi, [rbp + 0x974]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbp + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400116c0
lea rcx, [rbp + 0x870]
mov r9d, 1
mov r8d, r12d
mov rdx, rsi
call fcn.140005b90
mov edi, eax
test eax, eax
jne 0x14001170e
lea rdx, [rbp + 0x74c]
lea rcx, [rbp + 0x974]
call fcn.140009950
mov edi, eax
test edi, edi
je 0x1400117e0
test rsi, rsi
je 0x1400117f6
test r12d, r12d
je 0x1400117e0
call fcn.140005340
lea rcx, [rbp + 0x870]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x870]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.140005490
lea rdx, [rbp + 0x870]
mov r9d, 1
mov r8d, 0x104
mov rcx, rbp
mov dword [rsp + 0x20], 0
call fcn.14000fb70
mov eax, dword [0x1400274e4]
mov dword [rbp + 0x974], eax
movzx eax, byte [0x1400274e8]
or rcx, 0xffffffffffffffff
mov byte [rbp + 0x978], al
xor eax, eax
lea rdi, [rbp + 0x974]
repne scasb al, byte [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x870]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1400117a0
lea r9, [rbp + 0x74c]
lea r8, [rbp + 0x870]
mov edx, r12d
mov rcx, rsi
call fcn.140010c90
mov edi, eax
test eax, eax
je 0x1400117e0
lea r8, [rbp + 0x870]
call fcn.140010c90
mov edi, eax
test rsi, rsi
je 0x1400117f6
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 5
mov rcx, rbp
call fcn.14000ffd0
test eax, eax
jne 0x14001180e
mov eax, 2
jmp 0x140011817
mov dword [r15], 0x65
mov eax, edi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1400168a0
mov rbx, qword [rsp + 0x210]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret