Function at 0x18000fc30
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1800c1280]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rbx, rcx
mov qword [rbp - 0x11], rcx
movups xmm0, xmmword [0x1800812a0]
movups xmmword [rbp - 0x39], xmm0
movsd xmm0, qword [0x1800812b0]
movsd qword [rbp - 0x29], xmm0
movdqa xmm6, xmmword [0x180082050]
mov esi, dword [0x1800c1268]
cmp byte [str.IQZS_P], 0
je 0x18000fdf0
cmp esi, 2
jl 0x18000fdb1
movdqa xmm4, xmmword [0x180081ff0]
xor edx, edx
movdqa xmm3, xmmword [0x1800820e0]
movdqa xmm5, xmmword [0x180082020]
movdqa xmm0, xmmword [0x180082070]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x35]
mov r8d, dword [rbp - 0x49]
nop
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x18
jl 0x18000fcd0
jmp 0x18000fdf0
lea r9, [rbp - 0x39]
xor r8d, r8d
nop dword [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x18
jl 0x18000fdc0
lea rax, [rbp - 0x39]
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x18000fe00
mov rdx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x1800101be
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18000fe30
mov rax, qword [rbx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x39]
mov r8, rbx
movzx edx, byte [rbp - 0x59]
lea rcx, [rbp - 9]
call fcn.180003420
nop
xor r8d, r8d
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x39]
call fcn.180001170
nop
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 7
cmova rcx, qword [rbp - 0x39]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 0x17]
call fcn.18007b68c
mov r8d, eax
test eax, eax
jne 0x18000fed9
mov edx, dword [rbp + 0x27]
test dl, 1
mov ecx, 0x1ff
mov eax, 0x16d
cmovne ecx, eax
mov dword [rbp - 0x45], ecx
mov ecx, edx
shr ecx, 0xa
test cl, 1
je 0x18000fece
mov eax, dword [rbp + 0x2b]
cmp eax, 0xa000000c
jne 0x18000fec0
mov edx, 4
jmp 0x18000fefd
cmp eax, 0xa0000003
jne 0x18000fece
mov edx, 0xa
jmp 0x18000fefd
shr edx, 4
and edx, 1
or edx, 2
jmp 0x18000fefd
mov dword [rbp - 0x45], 0xffff
sub eax, 2
je 0x18000fef8
sub eax, 1
je 0x18000fef8
sub eax, 0x32
je 0x18000fef8
cmp eax, 0x46
je 0x18000fef8
xor edx, edx
jmp 0x18000fefd
mov edx, 1
mov dword [rbp - 0x49], r8d
lea rax, [0x1800c0a48]
mov qword [rbp - 0x41], rax
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
test edx, edx
je 0x18001011d
cmp edx, 1
sete dil
lea rcx, [rbp - 0x39]
call fcn.180009460
test dil, dil
je 0x1800100cf
mov byte [rbp - 0x59], 0
movups xmm0, xmmword [0x1800812b8]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [0x1800812c8]
mov dword [rbp - 0x29], eax
movzx eax, word [0x1800812cc]
mov word [rbp - 0x25], ax
movzx eax, byte [0x1800812ce]
mov byte [rbp - 0x23], al
xor ecx, ecx
cmp esi, 2
jl 0x180010084
movdqa xmm4, xmmword [0x180081ff0]
movdqa xmm3, xmmword [0x1800820e0]
movdqa xmm5, xmmword [0x180082020]
movdqa xmm0, xmmword [0x180082070]
movdqa xmmword [rbp - 0x49], xmm0
lea rdx, [rbp - 0x35]
mov r8d, dword [rbp - 0x49]
nop dword [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm3
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x10
jl 0x18000ffa0
cmp ecx, 0x17
jge 0x1800100bc
movsxd rax, ecx
lea r8, [rbp - 0x39]
add r8, rax
nop
mov eax, 0x4bda12f7
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
sub al, dl
add al, 0x32
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x17
jl 0x180010090
xor r9d, r9d
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x39]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rcx, qword [rbp - 9]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x180010133
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001012e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001012e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov dil, 1
test r8d, r8d
jne 0x1800101c4
jmp 0x18000ff24
call fcn.18007ba78
movdqa xmm0, xmmword [0x180081fc0]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18001017a
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180010175
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800101b7
mov rcx, r8
call fcn.18007ba78
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.18007c090
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1800094f0
nop
lea r8, [rbp - 0x39]
lea rdx, [rbp - 0x49]
lea rcx, str.exists
call fcn.1800092d0
int3