Function at 0x140041ac0
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400bc040]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor r14d, r14d
xorps xmm0, xmm0
mov dword [rbp - 0x68], r14d
movdqu xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r14
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp - 0x68]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13d, 1
lea r15, [r14 - 1]
cmp dword [rbp - 0x68], r13d
jle 0x140041e7a
lea r12, [rax + 8]
movabs rdi, 0x7ffffffffffffffe
mov rcx, qword [r12]
lea rdx, [0x1400a7114]
call fcn.140086f48
mov rsi, qword [r12]
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
test rax, rax
je 0x140041d44
mov qword [rbp - 0x70], 7
mov rdx, r15
mov qword [rbp - 0x78], 1
mov dword [rsp + 0x78], 0x22
inc rdx
cmp word [rsi + rdx*2], 0
jne 0x140041b80
cmp rdx, 6
ja 0x140041bb1
lea rbx, [rdx + 1]
lea r8, [rdx + rdx]
mov qword [rbp - 0x78], rbx
mov rdx, rsi
lea rcx, [rsp + 0x7a]
call fcn.14009b450
mov word [rsp + rbx*2 + 0x78], r14w
jmp 0x140041bc6
mov r9, rsi
mov qword [rsp + 0x20], rdx
xor r8d, r8d
lea rcx, [rsp + 0x78]
call fcn.1400833f0
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x140041bfa
lea rax, [rcx + 1]
cmp rdx, 7
mov qword [rbp - 0x78], rax
lea rax, [rsp + 0x78]
cmova rax, qword [rsp + 0x78]
mov dword [rax + rcx*2], 0x22
jmp 0x140041c1b
xor r8d, r8d
mov qword [rsp + 0x20], 1
lea r9, [0x1400a7118]
lea rcx, [rsp + 0x78]
lea edx, [r8 + 1]
call fcn.1400833f0
mov rbx, qword [rbp - 0x58]
cmp rbx, qword [rbp - 0x50]
je 0x140041cea
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], r14
lea r14, [rsp + 0x78]
cmp qword [rbp - 0x70], 7
mov rsi, qword [rbp - 0x78]
cmova r14, qword [rsp + 0x78]
cmp rsi, rdi
ja 0x1400422a6
mov qword [rbx + 0x18], 7
cmp rsi, 7
ja 0x140041c7a
mov qword [rbx + 0x10], rsi
movups xmm0, xmmword [r14]
movups xmmword [rbx], xmm0
add qword [rbp - 0x58], 0x20
xor r14d, r14d
jmp 0x140041cfb
mov rdi, rsi
movabs rax, 0x7ffffffffffffffe
or rdi, 7
cmp rdi, rax
jbe 0x140041c95
mov rdi, rax
jmp 0x140041ca2
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rax, [rdi + 1]
mov rcx, rbx
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.1400831f0
lea r8, [rsi*2 + 2]
mov qword [rbx], rax
mov rdx, r14
mov qword [rbx + 0x10], rsi
mov rcx, rax
mov qword [rbx + 0x18], rdi
call fcn.14009b450
add qword [rbp - 0x58], 0x20
movabs rdi, 0x7ffffffffffffffe
xor r14d, r14d
jmp 0x140041cfb
lea r8, [rsp + 0x78]
mov rdx, rbx
lea rcx, [rbp - 0x60]
call fcn.140083c60
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140041e69
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400422a0
jmp 0x140041e64
mov rbx, r15
nop word [rax + rax]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140041d50
cmp rbx, rdi
ja 0x1400422ac
cmp rbx, 7
ja 0x140041d90
mov qword [rbp - 0x78], rbx
lea rcx, [rsp + 0x78]
add rbx, rbx
mov qword [rbp - 0x70], 7
mov r8, rbx
mov rdx, rsi
call fcn.14009b450
mov word [rsp + rbx + 0x78], r14w
jmp 0x140041df9
mov r14, rbx
or r14, 7
cmp r14, rdi
jbe 0x140041da1
mov r14, rdi
jmp 0x140041dae
cmp r14, 0xa
mov eax, 0xa
cmovb r14, rax
lea rax, [r14 + 1]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x78]
call fcn.1400831f0
mov qword [rbp - 0x78], rbx
mov rdx, rsi
add rbx, rbx
mov qword [rsp + 0x78], rax
mov r8, rbx
mov qword [rbp - 0x70], r14
mov rcx, rax
mov rdi, rax
call fcn.14009b450
xor r14d, r14d
mov word [rbx + rdi], r14w
movabs rdi, 0x7ffffffffffffffe
mov rdx, qword [rbp - 0x58]
cmp rdx, qword [rbp - 0x50]
je 0x140041e1a
movups xmm0, xmmword [rsp + 0x78]
movups xmm1, xmmword [rbp - 0x78]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add qword [rbp - 0x58], 0x20
jmp 0x140041e69
lea r8, [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.1400839c0
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140041e69
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041e64
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004229a
call fcn.14008540c
inc r13d
add r12, 8
cmp r13d, dword [rbp - 0x68]
jl 0x140041b40
lea rdx, [0x1400a7114]
lea rcx, [rsp + 0x78]
call fcn.140082820
mov rax, qword [rbp - 0x58]
cmp qword [rbp - 0x60], rax
je 0x140041f24
xor edx, edx
lea rcx, [rbp + 0x70]
mov r8d, 0xf8
call fcn.14009baf0
lea rcx, [rbp + 0x70]
call fcn.140082510
mov rbx, qword [rbp - 0x60]
nop word [rax + rax]
mov rdx, rbx
add rbx, 0x20
cmp qword [rdx + 0x18], 7
mov r8, qword [rdx + 0x10]
jbe 0x140041ed5
mov rdx, qword [rdx]
lea rcx, [rbp + 0x80]
call fcn.140083700
cmp rbx, qword [rbp - 0x58]
je 0x140041f09
cmp qword [rbp - 0x70], 7
lea rdx, [rsp + 0x78]
mov r8, qword [rbp - 0x78]
lea rcx, [rbp + 0x80]
cmova rdx, qword [rsp + 0x78]
call fcn.140083700
jmp 0x140041ec0
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x88]
call fcn.140082c50
lea rcx, [rbp + 0x70]
call fcn.140021da0
jmp 0x140041f34
lea rdx, [0x1400a7110]
lea rcx, [rbp - 0x48]
call fcn.140082820
mov rdx, qword [rbp - 0x70]
cmp rdx, 7
jbe 0x140041f75
mov rcx, qword [rsp + 0x78]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041f70
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400422b2
call fcn.14008540c
cmp qword [rbp - 0x30], 7
lea rbx, [rbp - 0x48]
xorps xmm0, xmm0
mov dword [rbp], 0x68
cmova rbx, qword [rbp - 0x48]
lea rcx, [rsp + 0x50]
xor eax, eax
mov dword [rbp + 0x64], eax
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x50], al
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
movups xmmword [rbp + 0x44], xmm0
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rsp + 0x60], xmm0
call fcn.1400422c0
mov r9, rax
cmp byte [rax + 0x3f82], 0
je 0x14004202f
mov r8, r15
lea rdx, [rax + 1]
sub r8, rax
movabs r10, 0x7393dc74711e7eb
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + r8]
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
movzx ecx, dl
xor byte [rdx - 1], al
sub cl, r9b
and cl, 7
mov rax, r10
shl cl, 3
shr rax, cl
xor byte [rdx], al
add rdx, 2
lea rax, [r8 + rdx]
cmp rax, 0x3f82
jb 0x140041ff0
mov byte [r9 + 0x3f82], 0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x28], xmm0
mov r8, r15
movdqu xmmword [rbp - 0x18], xmm1
inc r8
cmp byte [r9 + r8], 0
jne 0x140042041
mov rdx, r9
lea rcx, [rbp - 0x28]
call fcn.140083260
lea rax, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp]
mov rdx, rbx
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x50], 0
call fcn.140061ef0
mov r9, rax
cmp byte [rax + 0x3f82], 0
je 0x14004212f
mov r8, r15
lea rdx, [rax + 1]
sub r8, rax
movabs r10, 0x852de5ddd9dfef83
nop word [rax + rax]
lea ecx, [rdx + r8]
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
movzx ecx, dl
xor byte [rdx - 1], al
sub cl, r9b
and cl, 7
mov rax, r10
shl cl, 3
shr rax, cl
xor byte [rdx], al
add rdx, 2
lea rax, [r8 + rdx]
cmp rax, 0x3f82
jb 0x1400420f0
mov byte [r9 + 0x3f82], 0
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x78], xmm0
movdqu xmmword [rbp - 0x78], xmm1
nop
inc r15
cmp byte [r9 + r15], 0
jne 0x140042140
mov r8, r15
lea rcx, [rsp + 0x78]
mov rdx, r9
call fcn.140083260
mov rdx, qword [rbp - 0x70]
cmp rdx, 0xf
jbe 0x140042196
mov rcx, qword [rsp + 0x78]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042191
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004229a
call fcn.14008540c
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400421d1
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400421cc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004229a
call fcn.14008540c
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140042211
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004220c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004229a
call fcn.14008540c
mov rcx, qword [rbp - 0x60]
movdqa xmm0, xmmword [0x1400a72c0]
mov word [rbp - 0x48], r14w
movdqu xmmword [rbp - 0x38], xmm0
test rcx, rcx
je 0x14004226a
mov rdx, qword [rbp - 0x58]
call fcn.140083360
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x50]
mov rax, rcx
sub rdx, rcx
and rdx, 0xffffffffffffffe0
cmp rdx, 0x1000
jb 0x140042265
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004229a
call fcn.14008540c
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140085170
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14008c230
int3
call fcn.14008c230
int3
call fcn.140001380
int3
call fcn.140001380
int3
call fcn.14008c230
int3