Function at 0x140055490
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x530]
sub rsp, 0x630
mov rax, qword [0x1401e9060]
xor rax, rsp
mov qword [rbp + 0x520], rax
movdqa xmm0, xmmword [0x1401cce20]
movdqu xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x38], 0x1006154
xor r15d, r15d
mov ecx, r15d
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x2c]
xor byte [rsp + rcx + 0x28], al
inc rcx
cmp rcx, 0x12
jb 0x1400554f0
mov byte [rsp + 0x3b], r15b
mov qword [rbp], r15
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbp], 0
mov r8d, reloc.WS2_32.dll_select
lea rdx, [rsp + 0x28]
lea rcx, [rbp]
call fcn.140092f40
nop
lea rcx, [rbp - 0x20]
call fcn.140053e30
nop
lea rsi, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
jb 0x140055553
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x10]
add rbx, rdi
mov rsi, rdi
jmp 0x14005555f
lea rbx, [rbp - 0x20]
add rbx, qword [rbp - 0x10]
lea rdi, [rbp - 0x20]
cmp rdi, rbx
je 0x14005557b
sub rsi, rdi
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x140055567
lea rax, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rax, qword [rbp]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x58], rax
call fcn.1400fe0a8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14004a4a0
nop
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14004af80
nop
cmp byte [rbp + 0x2c8], 0
je 0x140055624
mov ecx, 0x58
call fcn.1400fcca0
mov rdi, rax
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_std::filesystem::_Dir_enum_impl_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
lea rdx, [rbp + 0x50]
mov rcx, rbx
call fcn.14004b230
nop
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rdi
jmp 0x140055628
mov rdi, qword [rbp - 0x28]
mov ebx, dword [rbp + 0x2cc]
mov rcx, qword [rbp + 0x70]
call fcn.1400fe204
lea rcx, [rbp + 0x50]
call fcn.140092b40
test ebx, ebx
jne 0x1400559d5
lea rcx, [rsp + 0x40]
call fcn.140092b40
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
test rdi, rdi
je 0x140055666
lock inc dword [rdi + 8]
mov rdi, qword [rbp - 0x28]
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x60], xmm0
test rdi, rdi
je 0x14005567c
lock inc dword [rdi + 8]
mov rdi, qword [rbp - 0x28]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
mov r14d, 0xffffffff
test rdi, rdi
je 0x1400556c0
mov eax, r14d
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1400556c0
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400556c0
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov r12d, 0x28b4
mov r13d, 0xd64
nop dword [rax]
mov rsi, qword [rbp - 0x60]
test rsi, rsi
je 0x140055917
lea rdx, [rsi + 0x20]
lea rcx, [rbp + 0x20]
call fcn.1400909a0
nop
lea rcx, [rbp + 0x20]
mov rax, qword [rbp + 0x30]
cmp qword [rbp + 0x38], 8
jb 0x140055704
mov rdi, qword [rbp + 0x20]
lea rbx, [rdi + rax*2]
jmp 0x14005570c
lea rbx, [rcx + rax*2]
lea rdi, [rbp + 0x20]
mov qword [rbp - 0x50], r15
mov rcx, r15
mov qword [rbp - 0x40], rcx
mov r8d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], r8
mov byte [rbp - 0x50], cl
mov rdx, rbx
sub rdx, rdi
sar rdx, 1
cmp rdx, r8
jbe 0x140055746
lea rcx, [rbp - 0x50]
call fcn.140094820
mov rcx, r15
mov qword [rbp - 0x40], rcx
mov r8, qword [rbp - 0x38]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x60], rax
cmp rdi, rbx
je 0x140055799
movzx r9d, byte [rdi]
cmp rcx, r8
jae 0x14005577d
lea rax, [rcx + 1]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp r8, 0x10
cmovae rax, qword [rbp - 0x50]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140055786
lea rcx, [rbp - 0x50]
call fcn.140094970
add rdi, 2
mov r8, qword [rbp - 0x38]
cmp rdi, rbx
je 0x140055799
mov rcx, qword [rbp - 0x40]
jmp 0x140055754
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x50]
cmp r8, 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400557d3
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, dword [r12 + rdi]
test al, 1
jne 0x14005580c
or eax, 1
mov dword [r12 + rdi], eax
mov dword [r13 + rdi + 2], 0x1dba81a
mov word [r13 + rdi], 0xe04c
lea rcx, [0x1401097e0]
call fcn.1400fcdbc
nop
lea rdx, [rdi + r13]
cmp byte [rdx + 5], 0
je 0x14005582d
xor byte [rdx], 0x1b
xor byte [rdx + 1], 0xad
xor byte [rdx + 2], 0x53
xor byte [rdx + 3], 0xeb
xor byte [rdx + 4], 0xdb
mov byte [rdx + 5], 0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x14005585b
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
lea rcx, [rbp - 0x50]
call fcn.140092cd0
nop
lea rcx, [rbp + 0x20]
call fcn.140092b40
nop
lea rdx, [rbp + 0x2d0]
mov rcx, qword [rsi + 0x40]
call fcn.1400fe1e4
cmp eax, 0x12
je 0x1400558c7
test eax, eax
jne 0x1400559cd
cmp word [rbp + 0x2fc], 0x2e
jne 0x1400558b3
movzx eax, word [rbp + 0x2fe]
test ax, ax
je 0x140055870
cmp ax, 0x2e
jne 0x1400558b3
cmp word [rbp + 0x300], 0
je 0x140055870
lea rdx, [rbp + 0x2d0]
mov rcx, rsi
call fcn.14004b0f0
jmp 0x1400556d4
mov rsi, r15
mov qword [rbp - 0x60], r15
mov rbx, qword [rbp - 0x58]
mov qword [rbp - 0x58], r15
test rbx, rbx
je 0x1400556d4
mov eax, r14d
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400556d0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400556d0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1400556d0
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140055951
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140055951
mov rbx, qword [rbp - 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, r14d
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140055951
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14005598a
mov eax, r14d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14005598a
mov rbx, qword [rbp - 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r14d
cmp r14d, 1
jne 0x14005598a
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rbp - 0x20]
call fcn.140092cd0
nop
lea rcx, [rbp]
call fcn.140092cd0
mov rcx, qword [rbp + 0x520]
xor rcx, rsp
call fcn.1400fcc80
lea r11, [rsp + 0x630]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov edx, eax
call fcn.14004adc0
nop
lea r8, [rsp + 0x40]
mov edx, ebx
call fcn.14004aeb0
int3