Function at 0x140005620
Capabilities:
Create process on windows
Encode data using xor
Enumerate files on windows
Get disk information
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11b0]
mov eax, 0x12b0
call fcn.140035510
sub rsp, rax
movaps xmmword [rsp + 0x12a0], xmm6
movaps xmmword [rsp + 0x1290], xmm7
mov rax, qword [0x14007d0e0]
xor rax, rsp
mov qword [rbp + 0x1180], rax
mov rbx, rdx
mov edi, ecx
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], r12b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x140005690
lea rcx, [rbp - 0x50]
call fcn.14000a440
nop
lea rdx, [rbp - 0x50]
mov r10, qword [rbp - 0x50]
mov r11, qword [rbp - 0x38]
cmp r11, 0x10
cmovae rdx, r10
mov r9, qword [rbp - 0x40]
test r9, r9
je 0x1400056f2
lea rax, [r9 - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x5c
je 0x1400056ed
nop word [rax + rax]
cmp rcx, rdx
je 0x1400056f2
dec rcx
cmp byte [rcx], 0x5c
jne 0x1400056e0
sub rcx, rdx
jmp 0x1400056f9
mov rcx, 0xffffffffffffffff
inc rcx
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
cmp r9, rcx
jb 0x140005dfc
sub r9, rcx
mov r8, 0xffffffffffffffff
cmp r9, r8
cmovb r8, r9
lea rdx, [rbp - 0x50]
cmp r11, 0x10
cmovae rdx, r10
add rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.14000a440
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14000577d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005778
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e02
call fcn.140034c64
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x40], xmm1
lea rdx, [rbp + 0x40]
lea rcx, str..exe
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp edi, 2
jl 0x1400057d9
mov rdx, r12
mov r8, qword [rbx + 8]
lea rax, str._inv
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
inc rdx
cmp cl, byte [rax + rdx - 1]
jne 0x1400057d9
cmp rdx, 5
jne 0x1400057c0
mov dil, 1
jmp 0x1400057dc
xor dil, dil
mov r13d, 4
lea r14, [0x140080b20]
lea r15, [0x140080bf0]
lea rax, [rbp + 0x6c]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140005800
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
cmp r8, rbx
jne 0x140005831
lea rdx, [rbp + 0x6c]
call fcn.140037350
test eax, eax
je 0x140005c4b
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov r8, rbx
lea rdx, [rbp + 0x6c]
lea rcx, [rbp - 0x70]
call fcn.14000a440
nop
test dil, dil
je 0x140005a37
lea rdx, str.Deactivate
call fcn.14000af20
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, rax
call fcn.14000c080
mov rcx, rax
call fcn.14000b1c0
movdqa xmm6, xmmword [0x140073cb0]
movdqa xmm7, xmmword [0x140073ce0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r13 + rcx]
cmp dword [0x140080b00], eax
jle 0x1400058f4
lea rcx, [0x140080b00]
call fcn.140034dc4
cmp dword [0x140080b00], 0xffffffff
jne 0x1400058f4
movups xmmword [0x140080b20], xmm6
movups xmmword [0x140080b30], xmm7
mov byte [0x140080b40], 0x2e
lea rcx, [0x140061800]
call fcn.140035148
lea rcx, [0x140080b00]
call fcn.140034d64
cmp byte [0x140080b40], 0
je 0x14000594e
mov rax, r12
movdqa xmm2, xmmword [str.................HZrmWZAIOFW.kVMKZGA_]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + r14]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + r14], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x140005910
cmp rax, 0x21
jae 0x14000594e
nop dword [rax]
nop dword [rax + rax]
xor byte [rax + r14], 0x2e
inc rax
cmp rax, 0x21
jb 0x140005940
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r14 + r8], 0
jne 0x140005970
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14000a440
nop
lea rdx, [rsp + 0x70]
call fcn.140005040
nop
lea r9, [rsp + 0x50]
mov r8, rax
lea rdx, [rbp - 0x70]
call fcn.1400049d0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x1400059e1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e0e
call fcn.140034c64
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140005c10
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005df6
jmp 0x140005c0a
lea rdx, str.Activate
call fcn.14000af20
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov r8, qword [rbp - 0x60]
mov rcx, rax
call fcn.14000c080
mov rcx, rax
call fcn.14000b1c0
movdqa xmm6, xmmword [0x140073cb0]
movdqa xmm7, xmmword [0x140073ce0]
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [r13 + rcx]
cmp dword [0x140080b08], eax
jle 0x140005ad0
lea rcx, [0x140080b08]
call fcn.140034dc4
cmp dword [0x140080b08], 0xffffffff
jne 0x140005ad0
movups xmmword [0x140080bf0], xmm6
movups xmmword [0x140080c00], xmm7
mov byte [0x140080c10], 0x2e
lea rcx, [0x1400617e0]
call fcn.140035148
lea rcx, [0x140080b08]
call fcn.140034d64
cmp byte [0x140080c10], 0
je 0x140005b2e
mov rax, r12
movdqa xmm2, xmmword [str.................HZrmWZAIOFW.kVMKZGA_]
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax + r15]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + r15], xmm1
add rax, 0x10
cmp rax, 0x20
jb 0x140005af0
cmp rax, 0x21
jae 0x140005b2e
nop dword [rax]
nop dword [rax + rax]
xor byte [rax + r15], 0x2e
inc rax
cmp rax, 0x21
jb 0x140005b20
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x140005b50
mov rdx, r15
lea rcx, [rsp + 0x50]
call fcn.14000a440
nop
lea rdx, [rsp + 0x70]
call fcn.140005040
nop
mov r9, rax
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x70]
call fcn.1400049d0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140005bc1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e14
call fcn.140034c64
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140005c10
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e1a
call fcn.140034c64
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140005c4b
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005df0
call fcn.140034c64
lea rdx, [rbp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400057f0
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x980]
call fcn.140037190
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x180]
call fcn.140037190
mov r8d, 0x400
lea rdx, [rbp + 0x980]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x400
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x980]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
lea rcx, [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x140005d7d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov r8d, 0x104
lea rdx, [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rbp + 0x180]
lea r8, str.cmd.exe__C_ping_1.1.1.1__n_1__w_3000___Nul__Del__f__q___s_
mov edx, 0x208
lea rcx, [rbp + 0x980]
call fcn.140001190
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x980]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140005db4
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005daf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e08
call fcn.140034c64
xor eax, eax
mov rcx, qword [rbp + 0x1180]
xor rcx, rsp
call fcn.140034c40
lea r11, [rsp + 0x12b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003f0f0
nop
call fcn.14003f0f0
nop
call fcn.14000adc0
int3
call fcn.14003f0f0
nop
call fcn.14003f0f0
nop
call fcn.14003f0f0
nop
call fcn.14003f0f0
nop
call fcn.14003f0f0
int3