Function at 0x1800014b0
Capabilities:
Create thread
Encode data using xor
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r14d, r14d
mov dword [rbp + 0x28], r14d
cmp edx, 1
jne 0x180001a17
call qword [sym.imp.KERNEL32.dll_AllocConsole]
nop
mov qword [rbp - 0x40], r14
mov r15d, 0xf
mov qword [rbp - 0x28], r15
mov byte [rbp - 0x40], r14b
mov qword [rbp - 0x30], 2
xor eax, eax
mov word [rbp - 0x40], ax
mov byte [rbp - 0x3e], al
lea rax, [rbp - 0x40]
mov byte [rax], 0x77
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rax, qword [rbp - 0x40]
mov byte [rax + 1], r14b
mov qword [rbp - 8], r15
mov byte [rbp - 0x20], r14b
mov qword [rbp - 0x10], 8
xor ecx, ecx
mov qword [rbp - 0x20], rcx
mov byte [rbp - 0x18], cl
lea rax, [rbp - 0x20]
mov byte [rax], 0x43
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 1], 0x4f
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 2], 0x4e
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 3], 0x4f
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 4], 0x55
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 5], 0x54
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 6], 0x24
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rax, qword [rbp - 0x20]
mov byte [rax + 7], cl
lea rsi, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rsi, qword [rbp - 0x40]
lea rdi, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdi, qword [rbp - 0x20]
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rbx, rax
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r9, rbx
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18000163f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000163a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000163a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800119ac
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r15
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x180001689
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001684
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800119ac
movdqa xmm0, xmmword [str.gXEP_XH]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x5c447511
mov dword [rbp - 0x2c], 0x31435441
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r15
mov byte [rbp - 0x20], 0
mov dword [rbp + 0x28], 4
mov edx, 0x18
mov r9d, edx
lea rcx, [rbp - 0x20]
call fcn.180001b90
mov rdx, r14
nop
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x40]
xor al, 0x31
mov byte [rcx + rdx], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x3f]
xor al, 0x31
mov byte [rcx + rdx + 1], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x3e]
xor al, 0x31
mov byte [rcx + rdx + 2], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x3d]
xor al, 0x31
mov byte [rcx + rdx + 3], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x3c]
xor al, 0x31
mov byte [rcx + rdx + 4], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x3b]
xor al, 0x31
mov byte [rcx + rdx + 5], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x3a]
xor al, 0x31
mov byte [rcx + rdx + 6], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x39]
xor al, 0x31
mov byte [rcx + rdx + 7], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x38]
xor al, 0x31
mov byte [rcx + rdx + 8], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x37]
xor al, 0x31
mov byte [rcx + rdx + 9], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x36]
xor al, 0x31
mov byte [rcx + rdx + 0xa], al
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
movzx eax, byte [rbp + rdx - 0x35]
xor al, 0x31
mov byte [rcx + rdx + 0xb], al
add rdx, 0xc
cmp rdx, 0x18
jb 0x1800016d0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x18000185c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180001857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001857
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800119ac
movdqa xmm0, xmmword [0x1800146e0]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x6166357b
mov dword [rbp - 0x2c], 0x70616774
mov word [rbp - 0x28], 0x1f71
mov byte [rbp - 0x26], 0x15
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x10], r14
mov qword [rbp - 8], r15
mov byte [rbp - 0x20], 0
mov dword [rbp + 0x28], 8
mov edx, 0x1b
mov r9d, edx
lea rcx, [rbp - 0x20]
call fcn.180001b90
mov rax, r14
nop dword [rax]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x40]
xor cl, 0x15
mov byte [rdx + rax], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x3f]
xor cl, 0x15
mov byte [rdx + rax + 1], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x3e]
xor cl, 0x15
mov byte [rdx + rax + 2], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x3d]
xor cl, 0x15
mov byte [rdx + rax + 3], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x3c]
xor cl, 0x15
mov byte [rdx + rax + 4], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x3b]
xor cl, 0x15
mov byte [rdx + rax + 5], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x3a]
xor cl, 0x15
mov byte [rdx + rax + 6], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x39]
xor cl, 0x15
mov byte [rdx + rax + 7], cl
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
movzx ecx, byte [rbp + rax - 0x38]
xor cl, 0x15
mov byte [rdx + rax + 8], cl
add rax, 9
cmp rax, 0x1b
jb 0x1800018b0
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rcx, qword [rbp - 0x20]
call fcn.180001010
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1800019f9
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800019f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800019f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800119ac
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, [0x180001230]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret