Function at 0x14006a5f0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0xc0], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006aa7e
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x11c
call rax
movdqa xmm0, xmmword [0x140088220]
xor ebx, ebx
movdqa xmm1, xmmword [0x140088080]
mov ecx, ebx
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x40], 9
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x42], 1
nop word [rax + rax]
lea eax, [rcx - 0x1d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x21
jb 0x14006a680
mov r9d, dword [rbp - 0x54]
lea rcx, [rsp + 0x20]
mov r8d, dword [rbp - 0x58]
mov edx, dword [rbp - 0x5c]
mov byte [rsp + 0x42], bl
call fcn.140012350
mov ecx, dword [rbp - 0x5c]
mov eax, dword [rbp - 0x54]
cmp ecx, 0xa
jne 0x14006a89f
cmp dword [rbp - 0x58], ebx
jne 0x14006a8a8
cmp eax, 0x47ba
jne 0x14006a705
movdqa xmm0, xmmword [0x140088340]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a6f0
jmp 0x14006a880
cmp eax, 0x47bb
jne 0x14006a745
movdqa xmm0, xmmword [0x140088340]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a730
jmp 0x14006a880
cmp eax, 0x4a61
jne 0x14006a785
movdqa xmm0, xmmword [0x140088340]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a770
jmp 0x14006a880
cmp eax, 0x4a62
jne 0x14006a7c5
movdqa xmm0, xmmword [0x1400882d0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a7b0
jmp 0x14006a880
cmp eax, 0x4a63
jne 0x14006a802
movdqa xmm0, xmmword [0x140088350]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a7f0
jmp 0x14006a880
cmp eax, 0x4a64
jne 0x14006a842
movdqa xmm0, xmmword [0x1400882f0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a830
jmp 0x14006a880
cmp eax, 0x4a65
jne 0x14006a8a8
movdqa xmm0, xmmword [0x140088310]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0xf9
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x1d]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a870
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x32], 0
call fcn.140012350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006aacf
cmp ecx, 0xb
je 0x14006aa05
cmp eax, 0x55f0
je 0x14006aa05
cmp eax, 0x585d
je 0x14006a98c
cmp eax, 0x5867
je 0x14006a911
movdqa xmm0, xmmword [0x140088250]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x9f868696
mov dword [rsp + 0x34], 0xf39698
mov byte [rsp + 0x38], 1
call fcn.14006ab50
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x140088320]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1400879a0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140088010]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x140088070]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x6564d03
mov dword [rbp - 0x6c], 0x59464444
mov dword [rbp - 0x68], 0x244a4242
mov word [rbp - 0x64], 0x100
call fcn.14006ab20
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x140088300]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1400880b0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140088120]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [str.pzad8_5_vzAU]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x4505574a
mov dword [rbp - 0x6c], 0x435a474b
mov dword [rbp - 0x68], 0x274b45
mov byte [rbp - 0x64], 1
call fcn.14006aaf0
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x1400882e0]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1400880b0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140088120]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [str.pzad8_5_vzAU]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x4505574a
mov dword [rbp - 0x6c], 0x435a474b
mov dword [rbp - 0x68], 0x274b45
mov byte [rbp - 0x64], 1
call fcn.14006aaf0
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x140088440]
xor ebx, ebx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xfbe1e3ac
mov dword [rsp + 0x34], 0xe6fdd7b0
mov dword [rsp + 0x38], 0x9db8f1fa
mov word [rsp + 0x3c], 0x100
nop dword [rax]
lea eax, [rbx + 0x7c]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x1c
jb 0x14006aab0
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x3d], 0
call fcn.140012350
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14006d260
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rbp
ret