Function at 0x1400031b0
Capabilities:
Encode data using xor
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rcx]
xor r15d, r15d
mov dword [rbp + 0xc8], 0x30
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r15
lea r9, [rsp + 0x60]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0xc8]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x80000000
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xe0], 0x40
mov qword [rbp + 0xd8], rax
movdqu xmmword [rbp + 0xe8], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x14000327e
lea rcx, [0x140005c00]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003d30
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0xf8]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
movsxd rdx, dword [rbp + 0x100]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x40], r15
mov r14, rax
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r15d
cmp qword [rbp + 0x100], r15
jle 0x140003321
mov rcx, r14
xor byte [rcx], 0xc1
inc edx
movsxd rax, edx
inc rcx
cmp rax, qword [rbp + 0x100]
jl 0x14000330d
lea r13, [0x140008450]
mov rcx, r14
mov rdx, r13
sub rdx, r14
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x140003331
cmp qword [rsp + 0x68], 1
lea rcx, [0x140007150]
mov edx, r15d
lea r9, [0x140007250]
mov edi, r15d
lea r10, [0x140007350]
mov ebx, r15d
lea r11, [0x140007450]
lea rsi, [0x140007550]
je 0x14000360b
mov r8, r15
lea r14, [0x140007050]
cmp byte [r8 + r13], 0xd
jne 0x1400035d8
lea rsi, [r8 + 1]
cmp byte [rsi + r13], 0xa
jne 0x1400035d8
test edi, edi
jne 0x1400033bf
mov eax, ebx
mov rcx, r14
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
mov rcx, r14
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400035b9
cmp edi, 1
jne 0x1400033df
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007150]
jmp 0x1400033b5
cmp edi, 2
jne 0x140003402
mov eax, ebx
mov rcx, r9
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007250]
jmp 0x1400033b5
cmp edi, 3
jne 0x140003425
mov eax, ebx
mov rcx, r10
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007350]
jmp 0x1400033b5
cmp edi, 4
jne 0x14000344b
mov eax, ebx
mov rcx, r11
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007450]
jmp 0x1400033b5
cmp edi, 5
jne 0x140003475
mov eax, ebx
lea rcx, [0x140007550]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007550]
jmp 0x1400033b5
cmp edi, 6
jne 0x14000349f
mov eax, ebx
lea rcx, [0x140007650]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007650]
jmp 0x1400033b5
cmp edi, 7
jne 0x1400034c9
mov eax, ebx
lea rcx, [0x140007750]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007750]
jmp 0x1400033b5
cmp edi, 8
jne 0x1400034f3
mov eax, ebx
lea rcx, [0x140007850]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007850]
jmp 0x1400033b5
cmp edi, 9
jne 0x14000351d
mov eax, ebx
lea rcx, [0x140007950]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007950]
jmp 0x1400033b5
cmp edi, 0xa
jne 0x14000352b
lea rcx, [0x140007a50]
jmp 0x1400035a7
cmp edi, 0xb
jne 0x140003539
lea rcx, [0x140007b50]
jmp 0x1400035a7
cmp edi, 0xc
jne 0x140003547
lea rcx, [0x140007c50]
jmp 0x1400035a7
cmp edi, 0xd
jne 0x140003555
lea rcx, [0x140007d50]
jmp 0x1400035a7
cmp edi, 0xe
jne 0x140003563
lea rcx, [0x140007e50]
jmp 0x1400035a7
cmp edi, 0xf
jne 0x140003571
lea rcx, [0x140007f50]
jmp 0x1400035a7
cmp edi, 0x10
jne 0x14000357f
lea rcx, [0x140008050]
jmp 0x1400035a7
cmp edi, 0x11
jne 0x14000358d
lea rcx, [0x140008150]
jmp 0x1400035a7
cmp edi, 0x12
jne 0x14000359b
lea rcx, [0x140008250]
jmp 0x1400035a7
cmp edi, 0x13
jne 0x1400035ce
lea rcx, [0x140008350]
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea r11, [0x140007450]
lea r10, [0x140007350]
lea r9, [0x140007250]
inc edi
mov r8, rsi
inc ebx
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
inc ebx
dec rcx
movsxd rax, ebx
inc r8
cmp rax, rcx
lea rcx, [0x140007150]
jb 0x14000337f
mov r14, qword [rsp + 0x78]
lea rcx, [0x140007150]
lea rsi, [0x140007550]
movsxd rbx, edx
cmp rbx, qword [rsp + 0x68]
jae 0x140003896
test edi, edi
jne 0x140003648
lfence
mov r8, qword [rsp + 0x68]
lea rdi, [0x140007050]
sub r8, rbx
lea rdx, [rbx + r13]
mov rcx, rdi
call sub.ntoskrnl.exe_strncpy
mov rcx, rdi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000389d
cmp edi, 1
jne 0x14000367c
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rsi, [0x140007150]
mov rcx, rsi
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140007050]
jmp 0x1400038a4
cmp edi, 2
jne 0x1400036ba
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r9
call sub.ntoskrnl.exe_strncpy
lea r13, [0x140007250]
mov rcx, r13
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140007050]
lea rsi, [0x140007150]
jmp 0x1400038ab
cmp edi, 3
jne 0x1400036e7
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r10
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007350]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003896
cmp edi, 4
jne 0x14000370c
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r11
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007450]
jmp 0x1400036dd
cmp edi, 5
jne 0x14000372d
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, rsi
call sub.ntoskrnl.exe_strncpy
mov rcx, rsi
jmp 0x1400036dd
cmp edi, 6
jne 0x140003756
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140007650]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007650]
jmp 0x1400036dd
cmp edi, 7
jne 0x140003782
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140007750]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007750]
jmp 0x1400036dd
cmp edi, 8
jne 0x1400037ae
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140007850]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007850]
jmp 0x1400036dd
lea rsi, [rbx + r13]
cmp edi, 9
jne 0x1400037dd
lfence
mov r8, qword [rsp + 0x68]
lea rcx, [0x140007950]
sub r8, rbx
mov rdx, rsi
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140007950]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 0xa
jne 0x1400037f1
mov rdx, rsi
lea rcx, [0x140007a50]
jmp 0x140003886
cmp edi, 0xb
jne 0x140003805
mov rdx, rsi
lea rcx, [0x140007b50]
jmp 0x140003886
cmp edi, 0xc
jne 0x140003816
mov rdx, rsi
lea rcx, [0x140007c50]
jmp 0x140003886
cmp edi, 0xd
jne 0x140003827
mov rdx, rsi
lea rcx, [0x140007d50]
jmp 0x140003886
cmp edi, 0xe
jne 0x140003838
mov rdx, rsi
lea rcx, [0x140007e50]
jmp 0x140003886
cmp edi, 0xf
jne 0x140003849
mov rdx, rsi
lea rcx, [0x140007f50]
jmp 0x140003886
cmp edi, 0x10
jne 0x14000385a
mov rdx, rsi
lea rcx, [0x140008050]
jmp 0x140003886
cmp edi, 0x11
jne 0x140003868
lea rcx, [0x140008150]
jmp 0x140003882
cmp edi, 0x12
jne 0x140003876
lea rcx, [0x140008250]
jmp 0x140003882
cmp edi, 0x13
jne 0x140003896
lea rcx, [0x140008350]
lea rdx, [rbx + r13]
lfence
mov r8, qword [rsp + 0x68]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rdi, [0x140007050]
lea rsi, [0x140007150]
lea r13, [0x140007250]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], r15b
jne 0x1400038b2
test rax, rax
je 0x1400038e3
mov rdx, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x78]
lea rcx, [0x140009c90]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rsi + rax], r15b
jne 0x1400038e6
test rax, rax
je 0x140003915
mov rdx, rsi
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x68]
lea rcx, [0x140009c80]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rax + r13], r15b
jne 0x140003918
test rax, rax
je 0x140003947
mov rdx, r13
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [0x140009c70]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007350]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003951
test rax, rax
je 0x140003980
mov rdx, rcx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [0x140009c60]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007450]
inc rax
cmp byte [rcx + rax], r15b
jne 0x14000398a
test rax, rax
je 0x1400039b9
mov rdx, rcx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x38]
lea rcx, [0x140009c50]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007550]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400039c3
test rax, rax
je 0x1400039f2
mov rdx, rcx
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x28]
lea rcx, [0x140009c40]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007650]
inc rax
cmp byte [rcx + rax], r15b
jne 0x1400039fc
test rax, rax
je 0x140003a2b
mov rdx, rcx
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x18]
lea rcx, [0x140009c30]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007750]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003a35
test rax, rax
je 0x140003a64
mov rdx, rcx
lea rcx, [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 8]
lea rcx, [0x140009c20]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007850]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003a6e
test rax, rax
je 0x140003a9d
mov rdx, rcx
lea rcx, [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 8]
lea rcx, [0x140009c10]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007950]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003aa7
test rax, rax
je 0x140003ad6
mov rdx, rcx
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x18]
lea rcx, [0x140009c00]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007a50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003ae0
test rax, rax
je 0x140003b0f
mov rdx, rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x28]
lea rcx, [0x140009bf0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007b50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003b19
test rax, rax
je 0x140003b48
mov rdx, rcx
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x38]
lea rcx, [0x140009be0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007c50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003b52
test rax, rax
je 0x140003b81
mov rdx, rcx
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x48]
lea rcx, [0x140009bd0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007d50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003b8b
test rax, rax
je 0x140003bba
mov rdx, rcx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x58]
lea rcx, [0x140009bc0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007e50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003bc4
test rax, rax
je 0x140003bf3
mov rdx, rcx
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [0x140009bb0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007f50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003bfd
test rax, rax
je 0x140003c2c
mov rdx, rcx
lea rcx, [rbp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x78]
lea rcx, [0x140009ba0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008050]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003c36
test rax, rax
je 0x140003c6b
mov rdx, rcx
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x88]
lea rcx, [0x140009b90]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008150]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003c75
test rax, rax
je 0x140003caa
mov rdx, rcx
lea rcx, [rbp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x98]
lea rcx, [0x140009b80]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140008250]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003cb4
test rax, rax
je 0x140003ce9
mov rdx, rcx
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xa8]
lea rcx, [0x140009b70]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rax, [0x140008350]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140003cf0
test rbx, rbx
je 0x140003d25
mov rdx, rax
lea rcx, [rbp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xb8]
lea rcx, [0x140009b60]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140005640
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret