Function at 0x140001ef0
Capabilities:
Create process on windows
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x14006b060]
xor rax, rsp
mov qword [rsp + 0x108], rax
mov rsi, rdx
mov edi, ecx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Connect_to_YaoQuing_In_Korea...
call fcn.140002590
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n__1__Inject_YaoQuing_n__2__Join_Discord_Goldfish__n_n_Choose_option:
call fcn.140002590
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
lea rdx, [rsp + 0x100]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
xor ebx, ebx
cmp dword [rsp + 0x100], 2
jne 0x140001f98
mov dword [rsp + 0x28], 1
lea r8, str.https:__discord.gg_zpdjZBVeDn
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r14d, dword [reloc.WS2_32.dll_accept]
mov ebp, 4
movaps xmmword [rsp + 0x130], xmm6
lea r13, str.__AFD
movaps xmmword [rsp + 0x120], xmm7
movaps xmmword [rsp + 0x110], xmm8
lea r15d, [rbp + 0x1b]
cmp edi, 5
jne 0x1400022eb
mov qword [rsp + 0x170], r12
lea r15, str._url
lea r12, str._proc
add rsi, 8
mov ebp, edi
nop dword [rax]
mov rdx, qword [rsi - 8]
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r12 + rcx - 1]
jne 0x140002023
cmp rcx, 6
jne 0x140002000
mov rax, qword [rsi]
mov qword [str.ShooterGame.exe], rax
jmp 0x1400022cc
mov rcx, rbx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x1400022cc
cmp rcx, 5
jne 0x140002030
mov rdi, qword [rsi]
lea rcx, [rsp + 0x40]
xor edx, edx
mov r8d, 0xb9
call sub.VCRUNTIME140.dll_memset
mov ecx, ebx
cmp r14d, 2
jl 0x1400021f3
movdqa xmm5, xmmword [0x1400641b0]
lea rax, [rdi + 0xb8]
lea rdx, [rsp + 0x40]
cmp rdx, rax
ja 0x140002093
lea rax, [rsp + 0xf8]
cmp rax, rdi
jae 0x1400021f3
movdqa xmm0, xmmword [str.3333333333333333]
lea r8, [rsp + 0x44]
movdqa xmm4, xmmword [0x1400641f0]
mov eax, 4
movdqa xmm7, xmmword [str.1111]
mov rdx, rdi
movdqa xmmword [rsp + 0x30], xmm0
mov r9d, dword [rsp + 0x30]
movd xmm6, eax
mov eax, Ordinal_32
movd xmm8, eax
lea rax, [rsp + 0x44]
sub rdx, rax
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea r8, [r8 + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1400641d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r9d
paddb xmm2, xmm0
movd xmm0, dword [rdx + r8 - 8]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [r8 - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r9d
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400641d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx + r8 - 4]
pxor xmm2, xmm0
movd dword [r8 - 8], xmm2
cmp ecx, 0xb8
jl 0x1400020e0
cmp eax, 0xb9
jge 0x140002245
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
lea rax, [rsp + 0x40]
sub rdi, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor al, byte [rdi + r8 - 1]
mov byte [r8 - 1], al
cmp ecx, 0xb9
jl 0x140002210
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [rcx]
mov rax, qword [rcx + 0xb0]
lea rdx, [r13 + 0x80]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r13], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r13 + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [r13 + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [r13 + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [r13 + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [r13 + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [r13 + 0x60], xmm0
movups xmm0, xmmword [rcx + 0x80]
movups xmmword [rdx - 0x10], xmm1
movups xmm1, xmmword [rcx + 0x90]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0xa0]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
mov qword [rdx + 0x30], rax
movzx eax, byte [rcx + 0xb8]
mov byte [rdx + 0x38], al
add rsi, 8
sub rbp, 1
jne 0x140001ff0
mov r12, qword [rsp + 0x170]
mov ebp, 4
lea r15d, [rbp + 0x1b]
mov rdi, qword [str.ShooterGame.exe]
mov rcx, rdi
call fcn.140002840
mov esi, eax
mov rdx, rdi
test eax, eax
jne 0x140002314
lea rcx, str.____Cant_get__s_PID_n
call fcn.140001110
jmp 0x14000253b
mov r8d, esi
lea rcx, str.____s_PID:__d_n
call fcn.140001110
mov r8d, esi
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x140002354
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____OpenProcess_error:_0x_X_n
call fcn.140001110
jmp 0x14000253b
cmp byte [0x14006b198], bl
je 0x140002500
cmp r14d, 2
jl 0x1400024bb
movdqa xmm0, xmmword [str.3333333333333333]
lea rcx, [0x14006b0e4]
movdqa xmm5, xmmword [0x1400641b0]
movdqa xmm4, xmmword [0x1400641f0]
movdqa xmm7, xmmword [str.1111]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
movd xmm6, ebp
movd xmm8, r15d
nop dword [rax]
nop dword [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x1400641d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400641d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp ebx, 0xb8
jl 0x1400023b0
cmp eax, 0xb9
jge 0x140002500
movsxd r8, ebx
add r8, r13
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x33
xor byte [r8 - 1], al
cmp ebx, 0xb9
jl 0x1400024d0
mov rdx, r13
mov rcx, rdi
call fcn.1400012d0
test al, al
jne 0x140002526
lea rcx, str.____Injection_error_n
call fcn.140001110
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000253b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.___Injected__n
call fcn.140001110
lea rcx, str.pause
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm8, xmmword [rsp + 0x110]
xor eax, eax
movaps xmm7, xmmword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0x130]
mov rcx, qword [rsp + 0x108]
xor rcx, rsp
call fcn.14004fda0
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret