Function at 0x1400022cc
Capabilities:
Encode data using xor
Get file attributes
Print debug messages
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
movups xmm0, xmmword [rcx]
xor r15d, r15d
mov dword [rbp + 0xc8], 0x30
mov dword [rsp + 0x50], r15d
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], r15
lea r9, [rsp + 0x60]
mov dword [rsp + 0x40], 0x20
lea r8, [rbp + 0xc8]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x70]
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x80000000
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], r15
mov qword [rbp + 0xd0], r15
mov dword [rbp + 0xe0], 0x40
mov qword [rbp + 0xd8], rax
movdqu xmmword [rbp + 0xe8], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jns 0x14000239a
lea rcx, [0x140004a00]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x140002e4c
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 0xf8]
mov r9d, 0x18
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x60]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
movsxd rdx, dword [rbp + 0x100]
mov ecx, 1
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov ecx, dword [rbp + 0x100]
xor r9d, r9d
mov qword [rsp + 0x40], r15
mov r14, rax
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov dword [rsp + 0x30], ecx
xor edx, edx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, r15d
cmp qword [rbp + 0x100], r15
jle 0x14000243d
mov rcx, r14
xor byte [rcx], 0xc1
inc edx
movsxd rax, edx
inc rcx
cmp rax, qword [rbp + 0x100]
jl 0x140002429
lea r13, [0x140007450]
mov rcx, r14
mov rdx, r13
sub rdx, r14
mov al, byte [rcx]
mov byte [rdx + rcx], al
inc rcx
test al, al
jne 0x14000244d
cmp qword [rsp + 0x68], 1
lea rcx, [0x140006150]
mov edx, r15d
lea r9, [0x140006250]
mov edi, r15d
lea r10, [0x140006350]
mov ebx, r15d
lea r11, [0x140006450]
lea rsi, [0x140006550]
je 0x140002727
mov r8, r15
lea r14, [0x140006050]
cmp byte [r8 + r13], 0xd
jne 0x1400026f4
lea rsi, [r8 + 1]
cmp byte [rsi + r13], 0xa
jne 0x1400026f4
test edi, edi
jne 0x1400024db
mov eax, ebx
mov rcx, r14
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
mov rcx, r14
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400026d5
cmp edi, 1
jne 0x1400024fb
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006150]
jmp 0x1400024d1
cmp edi, 2
jne 0x14000251e
mov eax, ebx
mov rcx, r9
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006250]
jmp 0x1400024d1
cmp edi, 3
jne 0x140002541
mov eax, ebx
mov rcx, r10
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006350]
jmp 0x1400024d1
cmp edi, 4
jne 0x140002567
mov eax, ebx
mov rcx, r11
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006450]
jmp 0x1400024d1
cmp edi, 5
jne 0x140002591
mov eax, ebx
lea rcx, [0x140006550]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006550]
jmp 0x1400024d1
cmp edi, 6
jne 0x1400025bb
mov eax, ebx
lea rcx, [0x140006650]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006650]
jmp 0x1400024d1
cmp edi, 7
jne 0x1400025e5
mov eax, ebx
lea rcx, [0x140006750]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006750]
jmp 0x1400024d1
cmp edi, 8
jne 0x14000260f
mov eax, ebx
lea rcx, [0x140006850]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006850]
jmp 0x1400024d1
cmp edi, 9
jne 0x140002639
mov eax, ebx
lea rcx, [0x140006950]
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006950]
jmp 0x1400024d1
cmp edi, 0xa
jne 0x140002647
lea rcx, [0x140006a50]
jmp 0x1400026c3
cmp edi, 0xb
jne 0x140002655
lea rcx, [0x140006b50]
jmp 0x1400026c3
cmp edi, 0xc
jne 0x140002663
lea rcx, [0x140006c50]
jmp 0x1400026c3
cmp edi, 0xd
jne 0x140002671
lea rcx, [0x140006d50]
jmp 0x1400026c3
cmp edi, 0xe
jne 0x14000267f
lea rcx, [0x140006e50]
jmp 0x1400026c3
cmp edi, 0xf
jne 0x14000268d
lea rcx, [0x140006f50]
jmp 0x1400026c3
cmp edi, 0x10
jne 0x14000269b
lea rcx, [0x140007050]
jmp 0x1400026c3
cmp edi, 0x11
jne 0x1400026a9
lea rcx, [0x140007150]
jmp 0x1400026c3
cmp edi, 0x12
jne 0x1400026b7
lea rcx, [0x140007250]
jmp 0x1400026c3
cmp edi, 0x13
jne 0x1400026ea
lea rcx, [0x140007350]
mov eax, ebx
sub eax, edx
movsxd rdx, edx
add rdx, r13
movsxd r8, eax
call sub.ntoskrnl.exe_strncpy
lea r11, [0x140006450]
lea r10, [0x140006350]
lea r9, [0x140006250]
inc edi
mov r8, rsi
inc ebx
lea edx, [rbx + 1]
mov rcx, qword [rsp + 0x68]
inc ebx
dec rcx
movsxd rax, ebx
inc r8
cmp rax, rcx
lea rcx, [0x140006150]
jb 0x14000249b
mov r14, qword [rsp + 0x78]
lea rcx, [0x140006150]
lea rsi, [0x140006550]
movsxd rbx, edx
cmp rbx, qword [rsp + 0x68]
jae 0x1400029b2
test edi, edi
jne 0x140002764
lfence
mov r8, qword [rsp + 0x68]
lea rdi, [0x140006050]
sub r8, rbx
lea rdx, [rbx + r13]
mov rcx, rdi
call sub.ntoskrnl.exe_strncpy
mov rcx, rdi
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400029b9
cmp edi, 1
jne 0x140002798
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rsi, [0x140006150]
mov rcx, rsi
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140006050]
jmp 0x1400029c0
cmp edi, 2
jne 0x1400027d6
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r9
call sub.ntoskrnl.exe_strncpy
lea r13, [0x140006250]
mov rcx, r13
call sub.ntoskrnl.exe_DbgPrint
lea rdi, [0x140006050]
lea rsi, [0x140006150]
jmp 0x1400029c7
cmp edi, 3
jne 0x140002803
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r10
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006350]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400029b2
cmp edi, 4
jne 0x140002828
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, r11
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006450]
jmp 0x1400027f9
cmp edi, 5
jne 0x140002849
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
mov rcx, rsi
call sub.ntoskrnl.exe_strncpy
mov rcx, rsi
jmp 0x1400027f9
cmp edi, 6
jne 0x140002872
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140006650]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006650]
jmp 0x1400027f9
cmp edi, 7
jne 0x14000289e
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140006750]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006750]
jmp 0x1400027f9
cmp edi, 8
jne 0x1400028ca
lfence
mov r8, qword [rsp + 0x68]
lea rdx, [rbx + r13]
sub r8, rbx
lea rcx, [0x140006850]
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006850]
jmp 0x1400027f9
lea rsi, [rbx + r13]
cmp edi, 9
jne 0x1400028f9
lfence
mov r8, qword [rsp + 0x68]
lea rcx, [0x140006950]
sub r8, rbx
mov rdx, rsi
call sub.ntoskrnl.exe_strncpy
lea rcx, [0x140006950]
call sub.ntoskrnl.exe_DbgPrint
cmp edi, 0xa
jne 0x14000290d
mov rdx, rsi
lea rcx, [0x140006a50]
jmp 0x1400029a2
cmp edi, 0xb
jne 0x140002921
mov rdx, rsi
lea rcx, [0x140006b50]
jmp 0x1400029a2
cmp edi, 0xc
jne 0x140002932
mov rdx, rsi
lea rcx, [0x140006c50]
jmp 0x1400029a2
cmp edi, 0xd
jne 0x140002943
mov rdx, rsi
lea rcx, [0x140006d50]
jmp 0x1400029a2
cmp edi, 0xe
jne 0x140002954
mov rdx, rsi
lea rcx, [0x140006e50]
jmp 0x1400029a2
cmp edi, 0xf
jne 0x140002965
mov rdx, rsi
lea rcx, [0x140006f50]
jmp 0x1400029a2
cmp edi, 0x10
jne 0x140002976
mov rdx, rsi
lea rcx, [0x140007050]
jmp 0x1400029a2
cmp edi, 0x11
jne 0x140002984
lea rcx, [0x140007150]
jmp 0x14000299e
cmp edi, 0x12
jne 0x140002992
lea rcx, [0x140007250]
jmp 0x14000299e
cmp edi, 0x13
jne 0x1400029b2
lea rcx, [0x140007350]
lea rdx, [rbx + r13]
lfence
mov r8, qword [rsp + 0x68]
sub r8, rbx
call sub.ntoskrnl.exe_strncpy
lea rdi, [0x140006050]
lea rsi, [0x140006150]
lea r13, [0x140006250]
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rdi + rax], r15b
jne 0x1400029ce
test rax, rax
je 0x1400029ff
mov rdx, rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rsp + 0x78]
lea rcx, [0x140008c90]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rsi + rax], r15b
jne 0x140002a02
test rax, rax
je 0x140002a31
mov rdx, rsi
lea rcx, [rbp - 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x68]
lea rcx, [0x140008c80]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
inc rax
cmp byte [rax + r13], r15b
jne 0x140002a34
test rax, rax
je 0x140002a63
mov rdx, r13
lea rcx, [rbp - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x58]
lea rcx, [0x140008c70]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006350]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002a6d
test rax, rax
je 0x140002a9c
mov rdx, rcx
lea rcx, [rbp - 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x48]
lea rcx, [0x140008c60]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006450]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002aa6
test rax, rax
je 0x140002ad5
mov rdx, rcx
lea rcx, [rbp - 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x38]
lea rcx, [0x140008c50]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006550]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002adf
test rax, rax
je 0x140002b0e
mov rdx, rcx
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x28]
lea rcx, [0x140008c40]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006650]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002b18
test rax, rax
je 0x140002b47
mov rdx, rcx
lea rcx, [rbp - 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 0x18]
lea rcx, [0x140008c30]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006750]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002b51
test rax, rax
je 0x140002b80
mov rdx, rcx
lea rcx, [rbp - 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp - 8]
lea rcx, [0x140008c20]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006850]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002b8a
test rax, rax
je 0x140002bb9
mov rdx, rcx
lea rcx, [rbp + 8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 8]
lea rcx, [0x140008c10]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006950]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002bc3
test rax, rax
je 0x140002bf2
mov rdx, rcx
lea rcx, [rbp + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x18]
lea rcx, [0x140008c00]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006a50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002bfc
test rax, rax
je 0x140002c2b
mov rdx, rcx
lea rcx, [rbp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x28]
lea rcx, [0x140008bf0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006b50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002c35
test rax, rax
je 0x140002c64
mov rdx, rcx
lea rcx, [rbp + 0x38]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x38]
lea rcx, [0x140008be0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006c50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002c6e
test rax, rax
je 0x140002c9d
mov rdx, rcx
lea rcx, [rbp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x48]
lea rcx, [0x140008bd0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006d50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002ca7
test rax, rax
je 0x140002cd6
mov rdx, rcx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x58]
lea rcx, [0x140008bc0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006e50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002ce0
test rax, rax
je 0x140002d0f
mov rdx, rcx
lea rcx, [rbp + 0x68]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [0x140008bb0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140006f50]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002d19
test rax, rax
je 0x140002d48
mov rdx, rcx
lea rcx, [rbp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x78]
lea rcx, [0x140008ba0]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007050]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002d52
test rax, rax
je 0x140002d87
mov rdx, rcx
lea rcx, [rbp + 0x88]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x88]
lea rcx, [0x140008b90]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007150]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002d91
test rax, rax
je 0x140002dc6
mov rdx, rcx
lea rcx, [rbp + 0x98]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x98]
lea rcx, [0x140008b80]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
mov rax, rbx
lea rcx, [0x140007250]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140002dd0
test rax, rax
je 0x140002e05
mov rdx, rcx
lea rcx, [rbp + 0xa8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xa8]
lea rcx, [0x140008b70]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
lea rax, [0x140007350]
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140002e0c
test rbx, rbx
je 0x140002e41
mov rdx, rax
lea rcx, [rbp + 0xb8]
call qword [sym.imp.ntoskrnl.exe_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xb8]
lea rcx, [0x140008b60]
call qword [sym.imp.ntoskrnl.exe_RtlAnsiStringToUnicodeString]
xor edx, edx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.140004430
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret