Function at 0x1400575a0
Capabilities:
Create thread
Encode data using xor
Enumerate processes
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
xor edi, edi
mov dword [rsp + 0x60], 0x41414d5d
mov ecx, edi
mov dword [rsp + 0x64], 0x465f515d
mov dword [rsp + 0x68], 0x1003433
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0xb]
xor byte [rsp + rcx + 0x60], al
inc rcx
cmp rcx, 0xa
jb 0x140056980
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x6b], dil
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
xorps xmm0, xmm0
mov qword [rsp + 0x70], 0x50
mov qword [0x1401c8208], rax
lea rcx, [rsp + 0x70]
mov rax, qword [0x1401c8230]
xorps xmm1, xmm1
mov qword [rbp - 0x50], rax
lea rax, [0x1400530e0]
mov qword [rsp + 0x78], rax
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x48], rdi
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rcx, qword [0x1401c8208]
test rcx, rcx
je 0x140056c7a
mov qword [rsp + 0x1b8], rbx
lea rdx, [0x1401c81f8]
movaps xmmword [rsp + 0x190], xmm6
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [0x1401c8208]
lea rdx, [rbp + 0xb0]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [rbp + 0xb0]
mov r9d, 0x90000000
movd xmm1, dword [0x1401c8204]
movd xmm2, dword [0x1401c8200]
mov rdx, qword [0x1401c8230]
mov qword [rsp + 0x58], rdi
mov r8, rdx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
cvtdq2ps xmm1, xmm1
mov dword [0x1401c81f8], eax
mov eax, dword [rbp + 0xb4]
mov dword [0x1401c81fc], eax
cvtdq2ps xmm2, xmm2
movss dword [0x1401c81c0], xmm1
subss xmm1, dword [0x1400da37c]
movss dword [0x1401c80d8], xmm2
subss xmm2, dword [0x1400da37c]
cvttss2si ecx, xmm1
cvttss2si eax, xmm2
mov dword [rsp + 0x38], ecx
xor ecx, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [0x1401c8938], rax
lea rdx, [0x1400d8d80]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rcx, qword [0x1401c8938]
mov edx, 0xffffffec
mov r8d, 0x800a0
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [0x1401c8938]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1401c8938]
call qword [sym.imp.USER32.dll_UpdateWindow]
call fcn.140052d40
mov rbx, qword [0x1401c80a0]
lea rdx, [0x1400d9a58]
movss xmm2, dword [0x1400da490]
xorps xmm6, xmm6
xor eax, eax
movups xmmword [rbp - 0x80], xmm6
mov rcx, qword [rbx + 0x58]
movups xmmword [rbp - 0x40], xmm6
mov qword [rbp - 0x10], rax
mov eax, 0xffff
movups xmmword [rsp + 0x70], xmm6
mov word [rbp - 0x3c], ax
movups xmmword [rbp - 0x50], xmm6
mov byte [rsp + 0x7c], 1
mov dword [rbp - 0x78], 3
mov dword [rbp - 0x74], 1
mov dword [rbp - 0x4c], 0x7f7fffff
mov dword [rbp - 0x40], 0x3f800000
call fcn.14002e7e0
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rbp - 0x80]
movaps xmmword [rbp], xmm0
movaps xmm0, xmmword [rbp - 0x50]
movaps xmmword [rbp + 0x40], xmm0
movsd xmm0, qword [rbp - 0x10]
movaps xmmword [rbp + 0x10], xmm1
movaps xmm1, xmmword [rbp - 0x40]
movsd qword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm6
movaps xmmword [rbp + 0x70], xmm6
mov rcx, qword [rbx + 0x58]
lea rax, [0x14016f7d0]
mov qword [rbp], rax
lea rdx, [rbp]
lea rax, [0x1400da048]
mov dword [rbp + 8], 0x704
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x14], 0x41880000
call fcn.14002e520
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140053240]
mov qword [0x1401c81c8], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140056520
mov rcx, qword [0x1401c80c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401c8940]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401c8160]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x1401c8938]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, qword [0x1401c8230]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x190]
mov rbx, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rbp
jmp qword [sym.imp.USER32.dll_UnregisterClassW]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
cmp qword [0x1401919a0], 0xf
lea rdi, [0x140191988]
mov r8, qword [0x140191998]
mov rcx, rdi
cmova rcx, qword [0x140191988]
test r8, r8
jne 0x1400575ed
lea rdx, [0x14006d586]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005769e
call fcn.14004bb60
lea rcx, [0x1400d9ad4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140057658
nop word [rax + rax]
lea rdx, [0x1400d9ad8]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x1400576a7
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140057630
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1401c81e4]
test eax, eax
je 0x1400579d7
cmp qword [0x1401919a0], 0xf
mov r8, qword [0x140191998]
cmova rdi, qword [0x140191988]
test r8, r8
jne 0x1400576b9
lea rdx, [0x14006d586]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400576b9
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x58]
mov dword [0x1401c81e4], eax
jmp 0x140057667
mov rax, qword gs:[0x58]
mov edx, 0x10
mov qword [rsp + 0x2e0], rsi
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1401c8a58], eax
jle 0x140057722
lea rcx, [0x1401c8a58]
call fcn.1400673dc
cmp dword [0x1401c8a58], 0xffffffff
jne 0x140057722
lea rcx, [0x14006d4a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400d9550]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1401c8a58]
mov qword [0x1401c8aa0], rax
call fcn.140067370
xor esi, esi
mov dword [rbp + 0x1d0], esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor r8d, r8d
lea edx, [rsi + 8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, 0xff
lea edx, [rsi + 8]
mov rcx, rax
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
lea r9, [rbp + 0x1d0]
lea r8d, [rsi + 0x30]
mov rdi, rax
lea ecx, [rsi + 0x42]
call qword [0x1401c8aa0]
mov ebx, dword [rbp + 0x1d0]
add ebx, 0x1f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, ebx
lea edx, [rsi + 8]
mov rcx, rax
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov r8d, dword [rbp + 0x1d0]
lea r9, [rbp + 0x1d0]
mov rdx, rax
lea ecx, [rsi + 0x42]
mov rbx, rax
call qword [0x1401c8aa0]
mov ecx, esi
test rbx, rbx
je 0x140057801
mov edx, dword [rbx]
test edx, edx
je 0x140057801
lea rax, [rbx + 0x18]
mov r8d, edx
nop dword [rax]
mov rdx, qword [rax - 0x10]
test dl, 1
je 0x1400577f7
cmp qword [rax - 8], 0x200000
jne 0x1400577f7
test rcx, rcx
jne 0x1400577f7
cmp dword [rax], 0x546e6f43
jne 0x1400577f7
mov rcx, rdx
and rcx, 0xfffffffffffffffe
add rax, 0x18
sub r8, 1
jne 0x1400577d0
mov eax, dword [0x1401c81e4]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rsi
mov r9d, 0x10
mov dword [rsp + 0x40], eax
mov edx, 0x176d0b4
lea rax, [rbp + 0x1d8]
mov qword [0x1401c80e8], rcx
mov qword [0x1401c81b0], rcx
mov rcx, qword [0x1401c81e8]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x1d8], rsi
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rsi
call qword [0x1401c87d8]
lea rcx, [0x1400d9ad4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp qword [0x1401c8490], 0xf
lea rdi, [0x1401c8478]
jbe 0x140057885
mov rdi, qword [0x1401c8478]
mov rsi, qword [0x1401c8488]
mov rcx, rdi
add rsi, rcx
mov rdx, rdi
cmp rdx, rsi
je 0x1400579c0
mov qword [rsp + 0x2a8], r12
movabs r12, 0x7fffffffffffffff
mov qword [rsp + 0x2a0], r13
movabs r13, 0x7ffffffffd050f7f
mov qword [rsp + 0x298], r14
movabs r14, 0x4e94914f0000
mov qword [rsp + 0x290], r15
movabs r15, 0x431bde82d7b634db
nop word [rax + rax]
movzx edx, byte [rdi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005cc30
lea rcx, [rbp + 0x1d8]
call fcn.1400496d0
mov rbx, qword [rbp + 0x1d8]
cmp rbx, r13
jge 0x140057920
add rbx, 0x2faf080
jmp 0x140057923
mov rbx, r12
lea rcx, [rbp + 0x1d0]
call fcn.1400496d0
mov rax, qword [rbp + 0x1d0]
cmp rax, rbx
jge 0x140057994
nop dword [rax + rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jl 0x140057952
mov ecx, 0x5265c00
jmp 0x140057977
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140057975
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x1d0]
call fcn.1400496d0
mov rax, qword [rbp + 0x1d0]
cmp rax, rbx
jl 0x140057940
inc rdi
cmp rdi, rsi
jne 0x1400578f0
mov r15, qword [rsp + 0x290]
mov r14, qword [rsp + 0x298]
mov r13, qword [rsp + 0x2a0]
mov r12, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop rdi
pop rbx
pop rbp
jmp 0x140056940
lea rcx, [0x1400d9ad4]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.color_c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401c8820]
call fcn.14005b760
lea rcx, [0x1401c8820]
mov rdi, rax
call fcn.14005b750
mov rbx, rax
cmp rax, rdi
je 0x140057a52
mov dword [rbp + 0x1d0], 0x32
nop
movzx edx, byte [rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14005cc30
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x1d8]
call fcn.14005d570
mov rcx, rax
call fcn.14005d580
inc rbx
cmp rbx, rdi
jne 0x140057a20
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3