Function at 0x1400070f4
Capabilities:
Contain obfuscated stackstrings
Delete file
Encode data using xor
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r15
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
call fcn.1400031b8
mov rcx, rax
call fcn.140003498
call fcn.1400031b8
xor ebx, ebx
cmp qword [rax + 0x20], 0xffffffffffffffff
jne 0x1400074c1
movdqa xmm0, xmmword [0x1400713a0]
xor eax, eax
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x4b], al
mov r8d, ebx
mov dword [rbp + 0x47], 0xae515018
movsxd rdx, r8d
lea eax, [r8 + 0x6d]
inc r8d
xor byte [rbp + rdx + 0x37], al
cmp r8d, 0x14
jb 0x14000714a
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x37]
mov byte [rbp + 0x4b], bl
call fcn.140009cdc
lea rdx, [0x140009e4c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movdqa xmm0, xmmword [0x1400713d0]
mov edx, ebx
movdqu xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x47], 0xae0d1b0d
mov dword [rbp + 0x4b], 0xe6fae4
movsxd rcx, edx
lea eax, [rdx + 0x6d]
inc edx
xor byte [rbp + rcx + 0x37], al
cmp edx, 0x17
jb 0x14000719e
movdqa xmm0, xmmword [0x1400713c0]
mov edx, ebx
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x4e], bl
mov dword [rbp + 0x27], 0xed1b1552
mov dword [rbp + 0x2b], 0xe1f3f2e0
mov dword [rbp + 0x2f], 0xf0e2a8f7
mov word [rbp + 0x33], 0xec
movsxd rcx, edx
lea eax, [rdx + 0x6d]
inc edx
xor byte [rbp + rcx + 0x17], al
cmp edx, 0x1d
jb 0x1400071dc
lea rdx, [rbp + 0x37]
mov byte [rbp + 0x34], bl
lea rcx, [rbp + 0x17]
call fcn.1400046a8
movdqa xmm0, xmmword [0x140071470]
xor eax, eax
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x4b], al
mov edx, ebx
mov dword [rbp + 0x47], 0xf3060d53
movsxd rcx, edx
lea eax, [rdx + 0x6d]
inc edx
xor byte [rbp + rcx + 0x37], al
cmp edx, 0x14
jb 0x140007218
movdqa xmm0, xmmword [0x1400713c0]
xor eax, eax
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 0x31], al
mov edx, ebx
mov byte [rbp + 0x4b], bl
mov dword [rbp + 0x27], 0xf60d1a52
mov dword [rbp + 0x2b], 0xf7adb6b7
mov word [rbp + 0x2f], 0xf5fc
movsxd rcx, edx
lea eax, [rdx + 0x6d]
inc edx
xor byte [rbp + rcx + 0x17], al
cmp edx, 0x1a
jb 0x140007254
lea rdx, [rbp + 0x37]
mov byte [rbp + 0x31], bl
lea rcx, [rbp + 0x17]
call fcn.1400046a8
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [rbp - 0x19], 0x2c542c2e
mov word [rbp + 0xf], ax
mov edx, ebx
mov dword [rbp - 0x15], 0x2c272c33
mov r15d, 0x2c6d
mov dword [rbp - 0x11], 0x2c1c2c18
mov dword [rbp - 0xd], 0x2c1b2c17
mov dword [rbp - 9], 0x2c052c02
mov dword [rbp - 5], 0x2c1c2c2b
mov dword [rbp - 1], 0x2c0c2c0b
mov dword [rbp + 3], 0x2c482c4d
mov dword [rbp + 7], 0x2c0d2c53
mov dword [rbp + 0xb], 0x2cf32c06
movsxd rcx, edx
lea eax, [r15 + rdx]
inc edx
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 0x14
jb 0x1400072d4
movdqa xmm0, xmmword [0x140071370]
lea rax, [rbp - 0x19]
movdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0xf], bx
or r8, 0xffffffffffffffff
mov qword [rbp + 0x17], rbx
inc r8
cmp word [rax + r8*2], bx
jne 0x140007304
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.1400097e0
mov edx, ebx
mov dword [rbp - 0x19], 0x2c542c2e
mov dword [rbp - 0x15], 0x2c272c33
mov dword [rbp - 0x11], 0x2c1c2c18
mov dword [rbp - 0xd], 0x2c1b2c17
mov dword [rbp - 9], 0x2c052c02
mov dword [rbp - 5], 0x2c132c2b
mov dword [rbp - 1], 0x2c172c1d
mov dword [rbp + 3], 0x2c0c2c1a
mov dword [rbp + 7], 0x2c1b2c0d
mov dword [rbp + 0xb], 0x2cae2c0d
mov dword [rbp + 0xf], 0x2cfa2ce4
mov dword [rbp + 0x13], 0x2ce6
movsxd rcx, edx
lea eax, [r15 + rdx]
inc edx
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 0x17
jb 0x140007371
movdqa xmm0, xmmword [0x140071370]
lea rax, [rbp - 0x19]
movdqu xmmword [rbp + 0x47], xmm0
mov word [rbp + 0x15], bx
or r8, 0xffffffffffffffff
mov qword [rbp + 0x37], rbx
inc r8
cmp word [rax + r8*2], bx
jne 0x1400073a1
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x37]
call fcn.1400097e0
lea rdx, [rbp + 0x17]
lea rcx, [rbp + 0x37]
call fcn.140002d20
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov dword [rbp - 0x19], 0x2c542c2e
mov word [rbp + 0xf], ax
mov edx, ebx
mov dword [rbp - 0x15], 0x2c272c33
mov dword [rbp - 0x11], 0x2c1c2c18
mov dword [rbp - 0xd], 0x2c1b2c17
mov dword [rbp - 9], 0x2c052c02
mov dword [rbp - 5], 0x2c1c2c2b
mov dword [rbp - 1], 0x2c0c2c0b
mov dword [rbp + 3], 0x2c482c4d
mov dword [rbp + 7], 0x2c0d2c53
mov dword [rbp + 0xb], 0x2cf32c06
movsxd rcx, edx
lea eax, [r15 + rdx]
inc edx
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 0x14
jb 0x14000741e
lea rcx, [rbp - 0x19]
mov word [rbp + 0xf], bx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, ebx
mov dword [rbp - 0x19], 0x2c542c2e
mov dword [rbp - 0x15], 0x2c272c33
mov dword [rbp - 0x11], 0x2c1c2c18
mov dword [rbp - 0xd], 0x2c1b2c17
mov dword [rbp - 9], 0x2c052c02
mov dword [rbp - 5], 0x2c132c2b
mov dword [rbp - 1], 0x2c172c1d
mov dword [rbp + 3], 0x2c0c2c1a
mov dword [rbp + 7], 0x2c1b2c0d
mov dword [rbp + 0xb], 0x2cae2c0d
mov dword [rbp + 0xf], 0x2cfa2ce4
mov dword [rbp + 0x13], 0x2ce6
movsxd rcx, edx
lea eax, [r15 + rdx]
inc edx
xor word [rbp + rcx*2 - 0x19], ax
cmp edx, 0x17
jb 0x140007495
lea rcx, [rbp - 0x19]
mov word [rbp + 0x15], bx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400031b8
mov rcx, rax
call fcn.140003498
call fcn.1400031b8
movdqa xmm0, xmmword [0x1400713a0]
cmp qword [rax + 0x20], 0xffffffffffffffff
je 0x14000752b
movdqu xmmword [rbp + 0x37], xmm0
mov dword [rbp + 0x47], 0x5e1a18
mov r9d, ebx
movsxd r8, r9d
lea eax, [r9 + 0x6d]
inc r9d
xor byte [rbp + r8 + 0x37], al
cmp r9d, 0x13
jb 0x1400074f1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x37]
mov byte [rbp + 0x4a], bl
call fcn.140009cdc
lea rdx, [0x140009e4c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000759f
xor eax, eax
mov dword [rbp + 0x27], 0xf21a5e18
mov byte [rbp + 0x31], al
mov r8d, ebx
movdqu xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x2b], 0xa4f1edf3
mov word [rbp + 0x2f], 0xbab8
movsxd rdx, r8d
lea eax, [r8 + 0x6d]
inc r8d
xor byte [rbp + rdx + 0x17], al
cmp r8d, 0x1a
jb 0x14000754c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp + 0x17]
mov byte [rbp + 0x31], bl
call fcn.140009cdc
lea rdx, [0x140009e4c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov r13, qword [r11 + 0x18]
mov r15, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret