Function at 0x14004d510
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x310]
sub rsp, 0x410
mov rax, qword [0x1400a41c0]
xor rax, rsp
mov qword [rbp + 0x300], rax
mov rdi, rdx
mov qword [rbp - 0x70], rdx
mov r14, rcx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], rdx
xor r12d, r12d
mov rcx, qword [0x1400a4e60]
test rcx, rcx
je 0x14004dce5
lea rbx, [0x1400a4e50]
mov rax, rbx
cmp qword [0x1400a4e68], 0xf
cmova rax, qword [0x1400a4e50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
call fcn.1400555d8
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14000d660
nop
lea rcx, [rsp + 0x30]
call fcn.14000d8f0
lea rdx, [rbp - 0x68]
mov rcx, rax
call fcn.14000da00
nop
mov r8d, 4
lea rdx, str..xml
mov rcx, rax
call fcn.14000f4e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x14004d63f
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d63a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd6f
call fcn.140056b5c
movdqa xmm0, xmmword [0x140096e20]
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x68], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004d692
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d68d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd75
call fcn.140056b5c
movdqa xmm0, xmmword [0x140096e00]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x28], rax
call fcn.1400555d8
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.14000d660
nop
lea rcx, [rsp + 0x70]
call fcn.14000e460
movzx esi, al
mov rdx, qword [rbp - 0x78]
cmp rdx, 7
jbe 0x14004d732
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d72d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd7b
call fcn.140056b5c
test sil, sil
je 0x14004d807
mov r9d, 4
lea r8, str.tips
lea rdx, [0x140096b28]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x14004d7f3
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14004d79b
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d796
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd5d
call fcn.140056b5c
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rcx, r14
call fcn.140009790
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14004dd24
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004dd1f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004dd63
jmp 0x14004dd1c
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edx, edx
mov r8d, 0x308
lea rcx, [rbp - 0x10]
call fcn.140080990
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x10]
call fcn.14004f920
nop
lea rdx, str.xml_version_1.0__encoding_UTF_8_
lea rcx, [rbp - 0x10]
call fcn.140052320
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140051ee0
cmp qword [0x1400a4e68], 0xf
cmova rbx, qword [0x1400a4e50]
mov qword [rsp + 0x20], rbx
mov rax, qword [0x1400a4e60]
mov qword [rsp + 0x28], rax
call fcn.1400555d8
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.14000d660
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
lea rdx, [rcx + rax*2]
mov rbx, rdx
call fcn.14000d7e0
cmp rax, rdx
je 0x14004d8ec
nop dword [rax]
movzx ecx, word [rax]
cmp cx, 0x5c
je 0x14004d8bf
cmp cx, 0x2f
jne 0x14004d8c8
add rax, 2
cmp rax, rdx
jne 0x14004d8b0
cmp rax, rdx
je 0x14004d8ec
nop dword [rax]
lea r8, [rbx - 2]
movzx ecx, word [r8]
cmp cx, 0x5c
je 0x14004d8ec
cmp cx, 0x2f
je 0x14004d8ec
mov rbx, r8
cmp rax, r8
jne 0x14004d8d0
mov qword [rsp + 0x20], rbx
sub rdx, rbx
sar rdx, 1
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140017210
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.14000da00
nop
cmp qword [rax + 0x18], 0xf
jbe 0x14004d926
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.1400523e0
mov r15, rax
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14004d971
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d96c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd81
call fcn.140056b5c
movdqa xmm0, xmmword [0x140096e20]
movdqu xmmword [rbp - 0x80], xmm0
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004d9c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d9c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd87
call fcn.140056b5c
movdqa xmm0, xmmword [0x140096e00]
movdqu xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x30], r12w
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004da23
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004da16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd8d
call fcn.140056b5c
movdqa xmm0, xmmword [0x140096e00]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r12w
movzx ebx, byte [rdi + 0x20]
lea rdx, str.shellcodemode
mov rcx, r15
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
movzx ebx, byte [rdi + 0x21]
lea rdx, str.emptythetext
mov rcx, r15
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
movzx ebx, byte [rdi + 0x22]
lea rdx, str.obfuscateentrypoint
mov rcx, r15
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
mov rbx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14004da96
mov rbx, qword [rdi]
lea rdx, str.outFileName
mov rcx, r15
call fcn.140051500
mov rdx, rbx
mov rcx, rax
call fcn.140053e90
movzx ebx, byte [rdi + 0x23]
lea rdx, str.obfrandomnode
mov rcx, r15
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
mov rax, qword [r14 + 8]
cmp qword [r14], rax
je 0x14004dc7c
lea rdx, str.obf_funcs
lea rcx, [rbp - 0x10]
call fcn.1400523e0
mov r13, rax
mov rax, qword [r14 + 8]
mov rsi, qword [r14]
cmp rsi, rax
je 0x14004dc71
mov rdi, rax
nop dword [rax]
nop word [rax + rax]
lea rdx, str.obf_funcs
lea rcx, [rbp - 0x10]
call fcn.1400523e0
mov r12, rax
lea rbx, [rsi + 8]
cmp qword [rsi + 0x20], 0xf
jbe 0x14004db31
mov rbx, qword [rbx]
lea rdx, str.name
mov rcx, r12
call fcn.140051500
mov rdx, rbx
mov rcx, rax
call fcn.140053e90
movzx ebx, byte [rsi + 0x2c]
lea rdx, str.obfuscate
mov rcx, r12
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
mov ebx, dword [rsi + 0x28]
lea rdx, str.size
mov rcx, r12
call fcn.140051500
mov edx, ebx
mov rcx, rax
call fcn.140053dc0
mov ebx, dword [rsi + 4]
lea rdx, str.offset
mov rcx, r12
call fcn.140051500
mov edx, ebx
mov rcx, rax
call fcn.140053dc0
mov ebx, dword [rsi]
lea rdx, [0x140096c10]
mov rcx, r12
call fcn.140051500
mov edx, ebx
mov rcx, rax
call fcn.140053cf0
movzx ebx, byte [rsi + 0x2d]
lea rdx, str.ctfflattening
mov rcx, r12
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
movzx ebx, byte [rsi + 0x2e]
lea rdx, str.movobf
mov rcx, r12
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
movzx ebx, byte [rsi + 0x2f]
lea rdx, str.mutateobf
mov rcx, r12
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
movzx ebx, byte [rsi + 0x30]
lea rdx, str.leaobf
mov rcx, r12
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
movzx ebx, byte [rsi + 0x31]
lea rdx, str.antidisassembly
mov rcx, r12
call fcn.140051500
movzx edx, bl
mov rcx, rax
call fcn.140053ea0
mov rdx, r12
mov rcx, r13
call fcn.140051e70
add rsi, 0x38
cmp rsi, rdi
jne 0x14004db10
mov rdi, qword [rbp - 0x70]
xor r12d, r12d
mov rdx, r13
mov rcx, r15
call fcn.140051e70
mov rdx, r15
lea rcx, [rbp - 0x10]
call fcn.140051e70
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
xor r8d, r8d
lea rcx, [rbp - 0x10]
call fcn.140053b20
nop
lea rcx, [rbp - 0x10]
call fcn.14004fef0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14004dce5
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004dcdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004dd5d
call fcn.140056b5c
nop
mov rcx, r14
call fcn.140009790
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14004dd24
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004dd1f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004dd69
mov rcx, r8
call fcn.140056b5c
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r12
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140056a30
mov rbx, qword [rsp + 0x460]
add rsp, 0x410
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14005cc44
nop
call fcn.14005cc44
int3
call fcn.14005cc44
nop
call fcn.14005cc44
nop
call fcn.14005cc44
int3
call fcn.14005cc44
nop
call fcn.14005cc44
nop
call fcn.14005cc44
nop
call fcn.14005cc44
int3