Function at 0x140002630
Capabilities:
Encode data using xor
Execute command
Get disk information
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x140072168]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0xa0]
call fcn.140001eb0
nop
lea rcx, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 8
cmovae rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
movdqa xmm0, xmmword [0x14005f5a0]
movdqu xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0xd0], 0x9b8f9d8c
mov dword [rsp + 0xd4], 0x222f20d1
mov dword [rsp + 0xd8], 0x100242d
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx - 0x15]
xor byte [rsp + rdx + 0xc0], al
inc rdx
cmp rdx, 0x1a
jb 0x1400026d0
mov byte [rsp + 0xdb], 0
lea rdx, [rsp + 0xc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003070
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x70], 0x9e8088
mov byte [rsp + 0x74], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x15]
xor byte [rsp + rcx + 0x70], al
inc rcx
cmp rcx, 3
jb 0x140002720
mov byte [rsp + 0x74], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
movdqa xmm1, xmmword [0x14005f550]
movdqu xmmword [rsp + 0x90], xmm1
mov byte [rsp + 0x80], 0
mov dword [rsp + 0xc0], 0x8781cce1
mov dword [rsp + 0xc4], 0x919f958c
mov dword [rsp + 0xc8], 0xd6cf9599
mov word [rsp + 0xcc], pe_nt_image_headers64
mov rdx, rbx
lea eax, [rdx - 0x15]
xor byte [rsp + rdx + 0xc0], al
inc rdx
cmp rdx, 0xc
jb 0x140002792
mov byte [rsp + 0xcd], 0
lea rdx, [rsp + 0xc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003070
lea rdx, [rsp + 0x80]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003280
lea rcx, [0x14005f50c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
xor edx, edx
mov r8d, 0x105
lea rcx, [rsp + 0xe0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x70]
mov r8d, 0x105
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x140002899
mov r8d, dword [rsp + 0x70]
test r8d, r8d
je 0x140002886
lea r10, [rsp + 0xd5]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140002840
lea r9, [rsp + 0x40]
lea r8, [rsp + 0xd5]
mov rdx, r10
lea rcx, [rsp + 0x48]
call fcn.140003470
jmp 0x1400028e1
lea rdx, [0x14005f490]
lea rcx, [rsp + 0x48]
call fcn.140002bb0
jmp 0x1400028e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea rdx, str.CWELL_NIGGER_NIGGER_NIGGER
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140003070
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140003240]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [0x14005f490]
lea rcx, [rsp + 0x48]
call fcn.140002bb0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x80]
call fcn.1400228b4
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140002934
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000292f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000292f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400520f0
xor eax, eax
mov word [rsp + 0x40], ax
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140003070
lea rdx, [0x140003240]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.140002320
lea rdx, [rsp + 0x78]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
cmp dword [rsp + 0x78], 1
je 0x1400029dd
movdqa xmm0, xmmword [0x14005f580]
movdqu xmmword [rsp + 0xc0], xmm0
mov word [rsp + 0xd0], pe_nt_image_headers64
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
nop
lea eax, [rbx - 0x15]
xor byte [rsp + rbx + 0xc0], al
inc rbx
cmp rbx, 0x10
jb 0x1400029a0
mov byte [rsp + 0xd1], 0
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.140003070
lea rdx, [0x140003240]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400029e2
call fcn.140001f80
lea rdx, str.no_i_sigma_loaded
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003070
lea rdx, [0x140003240]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140002a4c
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a47
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400520f0
movdqa xmm0, xmmword [0x14005f550]
movdqu xmmword [rsp + 0x90], xmm0
mov byte [rsp + 0x80], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 8
jb 0x140002ab0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002aab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002aab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400520f0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400520d0
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rdi
ret