Function at 0x140065000
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x1400e4180]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x4a
lea rdx, str.Get_MpPreference__Select_Object__ExpandProperty_DisableRealtimeMonitoring
lea rcx, [rsp + 0x50]
call fcn.14000cc80
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140064cb0
lea rbx, [rsp + 0x70]
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
cmp rbp, 0xf
cmova rbx, rdi
mov rax, qword [rsp + 0x80]
cmp rax, 5
jb 0x1400650da
lea rsi, [rax + rbx]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x46
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400650da
nop
cmp dword [rax], 0x736c6146
jne 0x1400650be
cmp byte [rax + 4], 0x65
je 0x140065118
inc rax
lea r8, [rsi - 4]
sub r8, rax
mov edx, 0x46
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400650b0
cmp rbp, 0xf
jbe 0x1400652f5
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400652ec
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400652ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400650da
lea rdx, [rsp + 0x20]
call fcn.1400653a0
mov r8, rax
movzx eax, byte [rax + 5]
test al, al
je 0x140065154
xor byte [r8], 0x31
xor byte [r8 + 1], 0x32
xor byte [r8 + 2], 0x33
xor byte [r8 + 3], 0x34
xor byte [r8 + 4], 0x35
xor al, 0x36
mov byte [r8 + 5], al
lea rdx, [rsp + 0x28]
call fcn.140065370
mov r11, rax
cmp byte [rax + 0x22], 0
je 0x1400652d2
xor r9d, r9d
cmp dword [0x1400e41d0], 2
jl 0x140065297
movdqa xmm5, xmmword [0x1400cfe20]
movdqa xmm4, xmmword [0x1400d0350]
movdqa xmm6, xmmword [str.1111]
movdqa xmm0, xmmword [0x1400cff40]
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, rax
movdqa xmm7, xmmword [0x1400cfef0]
mov edx, dword [rsp + 0x50]
movd xmm2, r9d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r9 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add r9d, 8
lea rcx, [rcx + 8]
cmp r9d, 0x20
jl 0x1400651b0
cmp r9d, 0x23
jge 0x1400652d2
movsxd r10, r9d
add r10, r11
nop dword [rax]
mov eax, 0x5397829d
imul r9d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r9b
xor byte [r10], cl
inc r9d
lea r10, [r10 + 1]
cmp r9d, 0x23
jl 0x1400652a0
mov r9d, 0x10
mov rdx, r11
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rdi
call fcn.140092a14
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140065335
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140065330
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140065330
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140092a14
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140092760
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret