Function at 0x14002be10
Capabilities:
Create thread
Encode data using xor
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1400cf028]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor ebx, ebx
mov r8d, 0x55555556
mov eax, r8d
imul dword [0x1400dc838]
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
movd xmm1, edx
cvtdq2ps xmm1, xmm1
mov eax, r8d
imul dword [0x1400dc83c]
mov eax, edx
shr eax, 0x1f
add edx, eax
movd xmm0, edx
cvtdq2ps xmm0, xmm0
mov rax, qword [0x1400dc650]
movss dword [rax + 0x47c8], xmm0
movss dword [rax + 0x47cc], xmm1
lea edi, [rbx + 1]
mov dword [rax + 0x47b0], edi
or dword [rax + 0x47a8], 3
mov qword [rax + 0x47b8], rbx
mov qword [rax + 0x47c0], rbx
mov dword [rax + 0x47ac], edi
mov eax, dword [str.xSYM9]
mov dword [rbp - 0x39], eax
mov al, byte [0x1400c889c]
mov byte [rbp - 0x35], al
mov r8d, ebx
lea r9, [rbp - 0x39]
mov esi, 0x29e4129f
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 5
jl 0x14002becc
xor edx, edx
mov r8d, 0x87
lea rcx, [rbp - 0x39]
call fcn.14000ab68
mov eax, dword [0x1400dc83c]
cdq
and edx, 7
add eax, edx
sar eax, 3
sub eax, 0xa
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov rcx, qword [0x1400dc650]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], dil
mov rax, qword [rcx + 0x3ed0]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm0, xmm1
movss dword [rax + 0x100], xmm0
mov byte [rax + 0x141], dil
movups xmm0, xmmword [str.cNYoVU_YO]
movups xmmword [rbp - 0x19], xmm0
movsd xmm0, qword [0x1400c8ae0]
movsd qword [rbp - 9], xmm0
mov eax, dword [0x1400c8ae8]
mov dword [rbp - 1], eax
mov al, byte [0x1400c8aec]
mov byte [rbp + 3], al
mov r8d, ebx
lea r9, [rbp - 0x19]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1d
jl 0x14002bf90
lea rdx, [rbp - 0x19]
lea rcx, [0x1400d3270]
call fcn.140028288
call fcn.140029988
call fcn.140029cbc
call fcn.140029988
mov eax, dword [0x1400dc83c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 0xf
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov rcx, qword [0x1400dc650]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], dil
mov rax, qword [rcx + 0x3ed0]
movss xmm0, dword [rax + 0x20]
subss xmm0, dword [rax + 0x84]
addss xmm0, xmm1
movss dword [rax + 0x100], xmm0
mov byte [rax + 0x141], dil
mov dword [rbp - 0x19], 0x42fa0000
mov dword [rbp - 0x15], 0x41c80000
mov eax, dword [str.fFXW_:]
mov dword [rbp - 0x39], eax
movzx eax, word [0x1400c8b34]
mov word [rbp - 0x35], ax
mov r8d, ebx
lea r9, [rbp - 0x39]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 6
jl 0x14002c05a
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140028974
test al, al
je 0x14002c13a
mov byte [0x1400dc649], dil
mov byte [0x1400dc64b], dil
cmp byte [0x1400d3268], bl
je 0x14002c5a9
call fcn.14002af6c
mov byte [0x1400dc64b], bl
mov byte [0x1400dc64c], dil
mov ecx, 8
call fcn.14002d590
lea rcx, [0x14002b8b4]
mov qword [rax], rcx
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14002d534]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x39], rax
test rax, rax
je 0x14002c59a
cmp dword [rbp - 0x31], ebx
je 0x14002c591
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x19], xmm0
lea rcx, [rbp - 0x19]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14002c591
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
call fcn.140029988
mov rcx, qword [0x1400dc650]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], dil
mov r8, qword [rcx + 0x3ed0]
movss xmm1, dword [r8 + 0x20]
subss xmm1, dword [r8 + 0x84]
mov eax, dword [0x1400dc83c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 0xf
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [r8 + 0x100], xmm1
mov byte [r8 + 0x141], dil
mov dword [rbp - 0x19], 0x42fa0000
mov dword [rbp - 0x15], 0x41c80000
movsd xmm0, qword [str.fSCLPTO]
movsd qword [rbp - 0x39], xmm0
mov al, byte [0x1400c8970]
mov byte [rbp - 0x31], al
mov r8d, ebx
lea r9, [rbp - 0x39]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 9
jl 0x14002c1c2
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140028974
test al, al
je 0x14002c20d
cmp byte [0x1400dc64a], bl
sete byte [0x1400dc64a]
call fcn.140029988
mov rcx, qword [0x1400dc650]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], dil
mov r8, qword [rcx + 0x3ed0]
movss xmm1, dword [r8 + 0x20]
subss xmm1, dword [r8 + 0x84]
mov eax, dword [0x1400dc83c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 0xf
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [r8 + 0x100], xmm1
mov byte [r8 + 0x141], dil
mov dword [rbp - 0x19], 0x42fa0000
mov dword [rbp - 0x15], 0x41c80000
movups xmm0, xmmword [str.vR_R]
movups xmmword [rbp - 0x39], xmm0
mov eax, dword [0x1400c8b48]
mov dword [rbp - 0x29], eax
cmp byte [0x1400c8b4b], bl
je 0x14002c2c8
mov r8d, ebx
lea r9, [rbp - 0x39]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x14
jl 0x14002c29b
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140028974
test al, al
je 0x14002c2de
call fcn.14002bc5c
call fcn.140029988
mov rcx, qword [0x1400dc650]
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], dil
mov r8, qword [rcx + 0x3ed0]
movss xmm1, dword [r8 + 0x20]
subss xmm1, dword [r8 + 0x84]
mov eax, dword [0x1400dc83c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 0xf
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [r8 + 0x100], xmm1
mov byte [r8 + 0x141], dil
mov dword [rbp - 0x19], 0x42fa0000
mov dword [rbp - 0x15], 0x41c80000
movups xmm0, xmmword [0x1400c89c8]
movups xmmword [rbp - 0x39], xmm0
mov al, byte [0x1400c89d8]
mov byte [rbp - 0x29], al
mov r8d, ebx
lea r9, [rbp - 0x39]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x11
jl 0x14002c364
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.140028974
test al, al
je 0x14002c415
movups xmm0, xmmword [str.FBVJM]
movups xmmword [rbp + 7], xmm0
movsd xmm0, qword [0x1400c8b10]
movsd qword [rbp + 0x17], xmm0
mov eax, dword [0x1400c8b18]
mov dword [rbp + 0x1f], eax
movzx eax, word [0x1400c8b1c]
mov word [rbp + 0x23], ax
mov al, byte [0x1400c8b1e]
mov byte [rbp + 0x25], al
mov r8d, ebx
lea r9, [rbp + 7]
mov eax, esi
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0x1f
jl 0x14002c3de
lea rcx, [rbp + 7]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x1400dc650]
mov rcx, qword [rax + 0x3ed0]
movss xmm6, dword [rcx + 0x104]
subss xmm6, dword [rcx + 0x24]
addss xmm6, dword [rcx + 0x88]
call fcn.140029cbc
mov r8, qword [0x1400dc650]
mov rax, qword [r8 + 0x3ed0]
mov byte [rax + 0xb8], dil
mov rcx, qword [r8 + 0x3ed0]
movss xmm1, dword [rcx + 0x24]
subss xmm1, dword [rcx + 0x88]
mov eax, dword [0x1400dc838]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
addss xmm0, dword [0x1400c8d48]
addss xmm1, xmm0
movss dword [rcx + 0x104], xmm1
mov byte [rcx + 0x141], dil
mov rax, qword [r8 + 0x3ed0]
mov byte [rax + 0xb8], dil
mov rcx, qword [r8 + 0x3ed0]
movss xmm1, dword [rcx + 0x20]
subss xmm1, dword [rcx + 0x84]
mov eax, dword [0x1400dc83c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, 0xf
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [rcx + 0x100], xmm1
mov byte [rcx + 0x141], dil
movups xmm0, xmmword [str.xWS_]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [0x1400c8790]
movups xmmword [rbp + 0x17], xmm1
movsd xmm0, qword [0x1400c87a0]
movsd qword [rbp + 0x27], xmm0
movzx eax, word [0x1400c87a8]
mov word [rbp + 0x2f], ax
mov al, byte [0x1400c87aa]
mov byte [rbp + 0x31], al
lea r8, [rbp + 7]
mov eax, esi
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x37
mov al, bl
sub al, dl
add al, 0x35
xor byte [r8], al
add ebx, edi
add r8, rdi
cmp ebx, 0x2b
jl 0x14002c520
lea rdx, [rbp + 7]
lea rcx, [0x1400d3270]
call fcn.140028288
call fcn.14002b084
call fcn.14002b3a4
call fcn.14000cc08
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14002d570
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x31], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.14002af6c
mov byte [0x1400dc64b], bl
mov byte [0x1400dc64c], dil
mov ecx, 8
call fcn.14002d590
lea rcx, [0x14002b8b4]
mov qword [rax], rcx
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14002d534]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x39], rax
test rax, rax
je 0x14002c62f
cmp dword [rbp - 0x31], ebx
je 0x14002c626
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x19], xmm0
lea rcx, [rbp - 0x19]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14002c626
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
jmp 0x14002c13a
mov ecx, edi
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x31], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3