Function at 0x140039f50
Capabilities:
Create thread
Encode data using xor
Execute command
Link many functions at runtime
Set console window title

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov rax, qword [0x1401cd300]
xor rax, rsp
mov qword [rbp + 0x3f], rax
movups xmm0, xmmword [0x1400e9658]
movzx eax, word [0x1400e9668]
xor edi, edi
cmp byte [0x1400e9669], dil
mov r15d, 0x2f684bdb
movups xmmword [rbp - 9], xmm0
mov word [rbp + 7], ax
mov r12b, reloc.WS2_32.dll_gethostname
mov esi, 1
je 0x140039fe6
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x12
jl 0x140039fb7
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.14003331c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r14, str.user32
mov rbx, rax
test rax, rax
jne 0x14003a072
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14003a072
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14003a12f
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14003a0d9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.NtUserGetAsyncKeyState
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14003a0d9
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400e8a98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x14003a12f
movups xmm0, xmmword [rbx]
movups xmmword [0x1401ce5c8], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [0x1401ce5d8], xmm1
mov eax, dword [rbx + 0x18]
mov dword [0x1401ce5e0], eax
movzx eax, word [rbx + 0x1c]
mov word [0x1401ce5e4], ax
movups xmm0, xmmword [rcx]
movups xmmword [0x1401ce5e8], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [0x1401ce5f8], xmm1
mov eax, dword [rcx + 0x18]
mov dword [0x1401ce600], eax
movzx eax, word [rcx + 0x1c]
mov word [0x1401ce604], ax
call fcn.140037034
mov ebx, 0x3e8
mov r14d, 4
test al, al
jne 0x14003a382
cmp byte [0x1400e966f], dil
mov eax, dword [str.ZVH_ZVH_]
mov dword [rbp - 9], eax
je 0x14003a18e
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, r14d
jl 0x14003a160
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140038538
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400e9673], dil
mov eax, dword [0x1400e9670]
mov dword [rbp - 9], eax
je 0x14003a1ec
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, r14d
jl 0x14003a1be
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140037034
test al, al
jne 0x14003a268
movups xmm0, xmmword [0x1400e9678]
movzx eax, word [0x1400e9698]
mov r8d, edi
movups xmm1, xmmword [0x1400e9688]
mov word [rbp + 0x37], ax
lea r9, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm1
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x22
jl 0x14003a227
lea rcx, [rbp + 0x17]
call fcn.14003a8a8
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140037034
test al, al
je 0x14003a382
cmp byte [0x1400e969f], dil
mov eax, dword [0x1400e969c]
mov dword [rbp - 9], eax
je 0x14003a2bc
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, r14d
jl 0x14003a28e
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400e96a7], dil
mov rax, qword [0x1400e96a0]
mov qword [rbp - 9], rax
je 0x14003a310
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 8
jl 0x14003a2e1
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400e96b1], dil
movsd xmm0, qword [0x1400e96a8]
movzx eax, word [0x1400e96b0]
movsd qword [rbp - 9], xmm0
mov word [rbp - 1], ax
je 0x14003a371
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0xa
jl 0x14003a342
lea rcx, [rbp - 9]
call fcn.14003a8a8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140037034
test al, al
je 0x14003a49c
cmp byte [0x1400e96b7], dil
mov eax, dword [0x1400e96b4]
mov dword [rbp - 9], eax
je 0x14003a3d6
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, r14d
jl 0x14003a3a8
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400e96bf], dil
mov rax, qword [0x1400e96b8]
mov qword [rbp - 9], rax
je 0x14003a42a
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 8
jl 0x14003a3fb
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1400e96c0]
mov al, byte [0x1400e96d8]
lea r9, [rbp - 9]
mov byte [rbp + 0xf], al
mov r8d, edi
movups xmmword [rbp - 9], xmm0
movsd xmm0, qword [0x1400e96d0]
movsd qword [rbp + 7], xmm0
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x19
jl 0x14003a45c
lea rcx, [rbp - 9]
call fcn.14003a8a8
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x1400e96df], dil
mov eax, dword [str.ZVH_ZUWSO]
mov dword [rbp - 9], eax
je 0x14003a4e3
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, r14d
jl 0x14003a4b5
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x1400e96e7], dil
mov rax, qword [0x1400e96e0]
mov qword [rbp - 9], rax
je 0x14003a537
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 8
jl 0x14003a508
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x1400e9721], dil
movups xmm0, xmmword [str.w_HHQ_Q_a]
movzx eax, word [0x1400e9720]
mov word [rbp + 7], ax
movups xmmword [rbp - 9], xmm0
je 0x14003a5a7
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x12
jl 0x14003a578
movups xmm1, xmmword [0x1400e96f8]
movzx eax, word [0x1400e9708]
mov r8d, edi
movups xmm0, xmmword [0x1400e96e8]
mov word [rbp + 0x37], ax
lea r9, [rbp + 0x17]
movups xmmword [rbp + 0x27], xmm1
movups xmmword [rbp + 0x17], xmm0
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x22
jl 0x14003a5cf
xor r9d, r9d
lea r8, [rbp - 9]
lea rdx, [rbp + 0x17]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14003a676
xor eax, eax
mov dword [rbp - 9], 0x81869cb4
mov byte [rbp + 1], al
mov edx, edi
mov dword [rbp - 5], 0x9c8c9e98
mov word [rbp - 1], 0xdbda
movsxd rcx, edx
lea eax, [rdx - 0xe]
add edx, esi
xor byte [rbp + rcx - 9], al
cmp edx, 0xa
jb 0x14003a62e
lea rdx, [rbp - 9]
mov byte [rbp + 1], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401ce208], rax
test rax, rax
jne 0x14003a66b
cmp byte [0x1401ce1c9], dil
jne 0x14003a66b
mov byte [0x1401ce1c9], sil
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x1401ce208], rdi
je 0x14003a613
cmp byte [0x1400e9727], dil
mov eax, dword [str.ZVH_]
mov dword [rbp - 9], eax
je 0x14003a6c6
mov r8d, edi
lea r9, [rbp - 9]
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, r14d
jl 0x14003a698
lea rcx, [rbp - 9]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm0, xmmword [0x1400e9728]
movzx eax, word [0x1400e9748]
mov r8d, edi
movups xmm1, xmmword [str.__x_]
mov word [rbp + 0x37], ax
lea r9, [rbp + 0x17]
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm1
mov eax, r15d
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
add r8d, esi
sub al, cl
add al, r12b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x22
jl 0x14003a6f8
lea rcx, [rbp + 0x17]
call fcn.1400370d4
call fcn.140037078
mov qword [0x1401ce218], rax
call fcn.140036fdc
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400357c8]
mov qword [0x1401ce220], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [rbp - 0x55], edi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x21], rdi
call qword [sym.imp.GDI32.dll_GetStockObject]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x29], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
lea r14, str.Notepad
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x59]
lea rax, [0x140035cd4]
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x51], rax
mov dword [rbp - 0x59], 3
call qword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x14003a7d4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_Notepad
call fcn.14002c6e0
mov ecx, esi
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov qword [rsp + 0x58], rdi
mov r9d, 0x80000000
mov qword [rsp + 0x50], rdi
xor r8d, r8d
mov qword [rsp + 0x48], rdi
mov rdx, r14
mov qword [rsp + 0x40], rdi
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, rax
mov qword [0x1401ce668], rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401ce668]
lea rdx, [0x1400e8698]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401ce668]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x1401ce668]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.1400397e4
call fcn.140039a7c
xor eax, eax
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400df3e0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret