Function at 0x140003570
Capabilities:
Encode data using xor
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rcx]
xor r15d, r15d
mov dword [rbp + 0xc8], 0x30
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r15
lea r9, [rsp + 0x60]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0xc8]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x80000000
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xe0], 0x40
mov qword [rbp + 0xd8], rax
movdqu xmmword [rbp + 0xe8], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x14000363e
lea rcx, [0x1400065c0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400040f0
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0xf8]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
movsxd rdx, dword [rbp + 0x100]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x40], r15
mov r14, rax
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r15d
cmp qword [rbp + 0x100], r15
jle 0x1400036e1
mov rcx, r14
xor byte [rcx], 0xc1
inc edx
movsxd rax, edx
inc rcx
cmp rax, qword [rbp + 0x100]
jl 0x1400036cd
lea r13, [0x14000a450]
mov rcx, r14
mov rdx, r13
sub rdx, r14
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x1400036f1
cmp qword [rsp + 0x68], 1
lea rcx, [0x140009150]
mov edx, r15d
lea r9, [0x140009250]
mov edi, r15d
lea r10, [0x140009350]
mov ebx, r15d
lea r11, [0x140009450]
lea rsi, [0x140009550]
je 0x1400039cb
mov r8, r15
lea r14, [0x140009050]
cmp byte [r8 + r13], 0xd
jne 0x140003998
lea rsi, [r8 + 1]
cmp byte [rsi + r13], 0xa
jne 0x140003998
test edi, edi
jne 0x14000377f
mov eax, ebx
mov rcx, r14
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
mov rcx, r14
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003979
cmp edi, 1
jne 0x14000379f
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009150]
jmp 0x140003775
cmp edi, 2
jne 0x1400037c2
mov eax, ebx
mov rcx, r9
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009250]
jmp 0x140003775
cmp edi, 3
jne 0x1400037e5
mov eax, ebx
mov rcx, r10
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009350]
jmp 0x140003775
cmp edi, 4
jne 0x14000380b
mov eax, ebx
mov rcx, r11
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009450]
jmp 0x140003775
cmp edi, 5
jne 0x140003835
mov eax, ebx
lea rcx, [0x140009550]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009550]
jmp 0x140003775
cmp edi, 6
jne 0x14000385f
mov eax, ebx
lea rcx, [0x140009650]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009650]
jmp 0x140003775
cmp edi, 7
jne 0x140003889
mov eax, ebx
lea rcx, [0x140009750]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009750]
jmp 0x140003775
cmp edi, 8
jne 0x1400038b3
mov eax, ebx
lea rcx, [0x140009850]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009850]
jmp 0x140003775
cmp edi, 9
jne 0x1400038dd
mov eax, ebx
lea rcx, [0x140009950]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009950]
jmp 0x140003775
cmp edi, 0xa
jne 0x1400038eb
lea rcx, [0x140009a50]
jmp 0x140003967
cmp edi, 0xb
jne 0x1400038f9
lea rcx, [0x140009b50]
jmp 0x140003967
cmp edi, 0xc
jne 0x140003907
lea rcx, [0x140009c50]
jmp 0x140003967
cmp edi, 0xd
jne 0x140003915
lea rcx, [0x140009d50]
jmp 0x140003967
cmp edi, 0xe
jne 0x140003923
lea rcx, [0x140009e50]
jmp 0x140003967
cmp edi, 0xf
jne 0x140003931
lea rcx, [0x140009f50]
jmp 0x140003967
cmp edi, 0x10
jne 0x14000393f
lea rcx, [0x14000a050]
jmp 0x140003967
cmp edi, 0x11
jne 0x14000394d
lea rcx, [0x14000a150]
jmp 0x140003967
cmp edi, 0x12
jne 0x14000395b
lea rcx, [0x14000a250]
jmp 0x140003967
cmp edi, 0x13
jne 0x14000398e
lea rcx, [0x14000a350]
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea r11, [0x140009450]
lea r10, [0x140009350]
lea r9, [0x140009250]
inc edi
mov r8, rsi
inc ebx
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
inc ebx
dec rcx
movsxd rax, ebx
inc r8
cmp rax, rcx
lea rcx, [0x140009150]
jb 0x14000373f
mov r14, qword [rsp + 0x78]
lea rcx, [0x140009150]
lea rsi, [0x140009550]
movsxd rbx, edx
cmp rbx, qword [rsp + 0x68]
jae 0x140003c56
test edi, edi
jne 0x140003a08
lfence
mov r8, qword [rsp + 0x68]
lea rdi, [0x140009050]
sub r8, rbx
lea rdx, [rbx + r13]
mov rcx, rdi
call sub.ntoskrnl.exe_strncpy
mov rcx, rdi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003c5d
cmp edi, 1
jne 0x140003a3c
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rsi, [0x140009150]
mov rcx, rsi
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140009050]
jmp 0x140003c64
cmp edi, 2
jne 0x140003a7a
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r9
call sub.ntoskrnl.exe_strncpy
lea r13, [0x140009250]
mov rcx, r13
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140009050]
lea rsi, [0x140009150]
jmp 0x140003c6b
cmp edi, 3
jne 0x140003aa7
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r10
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009350]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140003c56
cmp edi, 4
jne 0x140003acc
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r11
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009450]
jmp 0x140003a9d
cmp edi, 5
jne 0x140003aed
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, rsi
call sub.ntoskrnl.exe_strncpy
mov rcx, rsi
jmp 0x140003a9d
cmp edi, 6
jne 0x140003b16
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140009650]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009650]
jmp 0x140003a9d
cmp edi, 7
jne 0x140003b42
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140009750]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009750]
jmp 0x140003a9d
cmp edi, 8
jne 0x140003b6e
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140009850]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009850]
jmp 0x140003a9d
lea rsi, [rbx + r13]
cmp edi, 9
jne 0x140003b9d
lfence
mov r8, qword [rsp + 0x68]
lea rcx, [0x140009950]
sub r8, rbx
mov rdx, rsi
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140009950]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 0xa
jne 0x140003bb1
mov rdx, rsi
lea rcx, [0x140009a50]
jmp 0x140003c46
cmp edi, 0xb
jne 0x140003bc5
mov rdx, rsi
lea rcx, [0x140009b50]
jmp 0x140003c46
cmp edi, 0xc
jne 0x140003bd6
mov rdx, rsi
lea rcx, [0x140009c50]
jmp 0x140003c46
cmp edi, 0xd
jne 0x140003be7
mov rdx, rsi
lea rcx, [0x140009d50]
jmp 0x140003c46
cmp edi, 0xe
jne 0x140003bf8
mov rdx, rsi
lea rcx, [0x140009e50]
jmp 0x140003c46
cmp edi, 0xf
jne 0x140003c09
mov rdx, rsi
lea rcx, [0x140009f50]
jmp 0x140003c46
cmp edi, 0x10
jne 0x140003c1a
mov rdx, rsi
lea rcx, [0x14000a050]
jmp 0x140003c46
cmp edi, 0x11
jne 0x140003c28
lea rcx, [0x14000a150]
jmp 0x140003c42
cmp edi, 0x12
jne 0x140003c36
lea rcx, [0x14000a250]
jmp 0x140003c42
cmp edi, 0x13
jne 0x140003c56
lea rcx, [0x14000a350]
lea rdx, [rbx + r13]
lfence
mov r8, qword [rsp + 0x68]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rdi, [0x140009050]
lea rsi, [0x140009150]
lea r13, [0x140009250]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], r15b
jne 0x140003c72
test rax, rax
je 0x140003ca3
mov rdx, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rsp + 0x78]
lea rcx, [0x14000b960]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rsi + rax], r15b
jne 0x140003ca6
test rax, rax
je 0x140003cd5
mov rdx, rsi
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x68]
lea rcx, [0x14000b950]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rax + r13], r15b
jne 0x140003cd8
test rax, rax
je 0x140003d07
mov rdx, r13
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [0x14000b940]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009350]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003d11
test rax, rax
je 0x140003d40
mov rdx, rcx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [0x14000b930]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009450]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003d4a
test rax, rax
je 0x140003d79
mov rdx, rcx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x38]
lea rcx, [0x14000b920]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009550]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003d83
test rax, rax
je 0x140003db2
mov rdx, rcx
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x28]
lea rcx, [0x14000b910]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009650]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003dbc
test rax, rax
je 0x140003deb
mov rdx, rcx
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 0x18]
lea rcx, [0x14000b900]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009750]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003df5
test rax, rax
je 0x140003e24
mov rdx, rcx
lea rcx, [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp - 8]
lea rcx, [0x14000b8f0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009850]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003e2e
test rax, rax
je 0x140003e5d
mov rdx, rcx
lea rcx, [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 8]
lea rcx, [0x14000b8e0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009950]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003e67
test rax, rax
je 0x140003e96
mov rdx, rcx
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x18]
lea rcx, [0x14000b8d0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009a50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003ea0
test rax, rax
je 0x140003ecf
mov rdx, rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x28]
lea rcx, [0x14000b8c0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009b50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003ed9
test rax, rax
je 0x140003f08
mov rdx, rcx
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x38]
lea rcx, [0x14000b8b0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009c50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003f12
test rax, rax
je 0x140003f41
mov rdx, rcx
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x48]
lea rcx, [0x14000b8a0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009d50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003f4b
test rax, rax
je 0x140003f7a
mov rdx, rcx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x58]
lea rcx, [0x14000b890]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009e50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003f84
test rax, rax
je 0x140003fb3
mov rdx, rcx
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [0x14000b880]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140009f50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003fbd
test rax, rax
je 0x140003fec
mov rdx, rcx
lea rcx, [rbp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x78]
lea rcx, [0x14000b870]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x14000a050]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140003ff6
test rax, rax
je 0x14000402b
mov rdx, rcx
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x88]
lea rcx, [0x14000b860]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x14000a150]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140004035
test rax, rax
je 0x14000406a
mov rdx, rcx
lea rcx, [rbp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0x98]
lea rcx, [0x14000b850]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x14000a250]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140004074
test rax, rax
je 0x1400040a9
mov rdx, rcx
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0xa8]
lea rcx, [0x14000b840]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rax, [0x14000a350]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x1400040b0
test rbx, rbx
je 0x1400040e5
mov rdx, rax
lea rcx, [rbp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitString]
mov r8b, 1
lea rdx, [rbp + 0xb8]
lea rcx, [0x14000b830]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140005f30
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret