Function at 0x140001860
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x430
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov qword [r11 + 8], rbx
xor esi, esi
mov qword [r11 + 0x10], rdi
movaps xmmword [r11 - 0x38], xmm8
xorps xmm8, xmm8
movsd qword [rsp + 0x38], xmm8
mov dword [rsp + 0x30], esi
mov eax, dword [rsp + 0x30]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movsd xmm7, qword [0x140023640]
movd xmm0, dword [rsp + 0x30]
cvtdq2pd xmm0, xmm0
call fcn.140018650
movaps xmm6, xmm0
movd xmm0, dword [rsp + 0x30]
cvtdq2pd xmm0, xmm0
call fcn.1400180d0
movsd xmm1, qword [rsp + 0x38]
mulsd xmm0, xmm6
addsd xmm0, xmm1
movsd qword [rsp + 0x38], xmm0
movsd xmm0, qword [rsp + 0x38]
comisd xmm8, xmm0
jbe 0x140001902
movsd xmm0, qword [rsp + 0x38]
andps xmm0, xmm7
movsd qword [rsp + 0x38], xmm0
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp eax, 0x64
jl 0x1400018b1
movaps xmm7, xmmword [rsp + 0x410]
mov ecx, 0x190
movaps xmm6, xmmword [rsp + 0x420]
call qword [sym.imp.mfc140.dll_Ordinal_1485]
xor edx, edx
mov r8d, 0x190
mov rcx, rax
mov rbx, rax
lea rdi, [rax + 0x190]
call fcn.1400192c0
movaps xmm8, xmmword [rsp + 0x400]
mov eax, esi
cmp rbx, rdi
je 0x14000196f
mov rdx, rbx
nop dword [rax]
mov ecx, eax
inc eax
mov dword [rdx], ecx
add rdx, 4
cmp rdx, rdi
jne 0x140001960
mov r8, rsi
mov rcx, rbx
mov rdx, rbx
cmp rbx, rdi
ja 0x1400019fb
cmp dword [0x140027050], 2
jl 0x1400019fb
cmp rbx, rdi
mov rcx, 0xfffffffffffffffc
mov eax, 0x18c
cmova rax, rcx
mov rcx, rbx
add rax, rbx
cmp rbx, rax
jbe 0x1400019fb
cmp rbx, rdi
mov eax, 0x60
cmova rax, rsi
movdqu xmm0, xmmword [rcx]
add r8, 0x10
pmulld xmm0, xmm0
movdqu xmmword [rdx], xmm0
movdqu xmm0, xmmword [rcx + 0x10]
pmulld xmm0, xmm0
movdqu xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
pmulld xmm0, xmm0
movdqu xmmword [rdx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
add rcx, 0x40
pmulld xmm0, xmm0
movdqu xmmword [rdx + 0x30], xmm0
add rdx, 0x40
cmp r8, rax
jne 0x1400019b0
cmp rcx, rdi
je 0x140001a21
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx]
imul eax, eax
mov dword [rcx + rdx], eax
add rcx, 4
cmp rcx, rdi
jne 0x140001a10
mov rdi, qword [rsp + 0x448]
test rbx, rbx
je 0x140001a3b
mov edx, 0x190
mov rcx, rbx
call fcn.140001d60
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x190
call fcn.1400192c0
mov rbx, qword [rsp + 0x440]
mov dword [rsp + 0x30], esi
mov eax, dword [rsp + 0x30]
nop dword [rax]
mov dword [rsp + 0x38], esi
mov eax, dword [rsp + 0x38]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
add ecx, eax
mov edx, dword [rsp + 0x30]
movsxd rax, dword [rsp + 0x38]
xor edx, ecx
mov dword [rsp + rax*4 + 0x40], edx
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp eax, 0x64
jl 0x140001a70
movsxd rax, dword [rsp + 0x30]
mov eax, dword [rsp + rax*4 + 0x40]
test al, 1
jne 0x140001abd
movsxd rax, dword [rsp + 0x30]
mov edx, dword [rsp + rax*4 + 0x40]
movsxd rax, dword [rsp + 0x30]
neg edx
mov dword [rsp + rax*4 + 0x40], edx
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp eax, 0x64
jl 0x140001a60
call fcn.140001520
test eax, eax
jne 0x140001ae2
lea ecx, [rax + 1]
call fcn.140008628
int3
lea rdx, section..didast
lea rcx, [0x140023608]
call fcn.140001010
lea rdx, [0x140024ae0]
lea rcx, [0x140023608]
call fcn.140001010
call fcn.140001250
xor edx, edx
lea rcx, [rsp + 0x2e0]
mov r8d, 0x104
call fcn.1400192c0
movabs rax, 0x206c656420632f
lea rcx, [rsp + 0x1d8]
xor edx, edx
mov qword [rsp + 0x1d0], rax
mov r8d, 0xfc
call fcn.1400192c0
mov r8d, 0x104
lea rdx, [rsp + 0x2e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x1d0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140001b70
lea r8, [rsp + 0x2e0]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001b90
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x1d0]
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call fcn.140008628
int3