Function at 0x14000d52c
Capabilities:
Encode data using xor
Execute command
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
xor esi, esi
mov dword [rbp + 0x110], esi
movups xmm0, xmmword [0x140012c58]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [0x140012c68]
movups xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [0x140012c78]
movups xmmword [rsp + 0x50], xmm0
movsd xmm1, qword [0x140012c88]
movsd qword [rsp + 0x60], xmm1
mov eax, dword [0x140012c90]
mov dword [rsp + 0x68], eax
movzx eax, word [0x140012c94]
mov word [rsp + 0x6c], ax
mov al, byte [0x140012c96]
mov byte [rsp + 0x6e], al
mov edi, esi
lea r8, [rsp + 0x30]
mov ebx, 0x8d3dcb09
lea r13d, [rsi + 1]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, 0x33
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x3f
jl 0x14000d5b5
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
lea rax, [rsp + 0x30]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x14000d5f0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000eea4
nop
lea rax, [rsp + 0x30]
mov qword [rbp + 0x118], rax
mov r14, qword [rbp - 0x80]
lea r15, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae r15, qword [rsp + 0x70]
call fcn.14000f950
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov dword [rbp + 0x110], 4
test r14, r14
je 0x14000d73f
cmp r14, 0x7fffffff
ja 0x14000e026
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.14000f978
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000e02c
movsxd rcx, ebx
mov r8, qword [rsp + 0x40]
cmp rcx, r8
ja 0x14000d6b8
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov word [rax + rcx*2], si
jmp 0x14000d70b
mov rdx, rcx
sub rdx, r8
mov rax, qword [rsp + 0x48]
sub rax, r8
cmp rdx, rax
ja 0x14000d6fe
mov qword [rsp + 0x40], rcx
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r9, qword [rsp + 0x30]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14000d6f3
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x14000d70b
mov r9, rdx
lea rcx, [rsp + 0x30]
call fcn.14000efb4
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r9, qword [rsp + 0x30]
mov dword [rsp + 0x20], ebx
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.14000f978
shr rax, 0x20
test eax, eax
jne 0x14000e01e
mov ebx, 0x8d3dcb09
lea rcx, [rsp + 0x30]
call fcn.14000a948
mov dil, al
lea rcx, [rsp + 0x30]
call fcn.14000e0a8
test dil, dil
jne 0x14000d801
lea rdx, [rbp + 0x110]
call fcn.14000e034
mov r9, rax
cmp byte [rax + 7], sil
je 0x14000d79b
mov edi, esi
mov r8, rax
mov eax, ebx
mul edi
shr edx, 5
movsx ecx, dl
imul edx, ecx, 0x3a
mov al, dil
sub al, dl
add al, 0x33
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 8
jl 0x14000d779
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, 0x3b6
lea rdx, [rbp - 0x70]
call fcn.14000e044
mov r9, rax
cmp byte [rax + 0x82], sil
je 0x14000d7eb
mov edi, esi
mov r8, rax
mov eax, 0x8d3dcb09
mul edi
shr edx, 5
movsx ecx, dl
imul edx, ecx, 0x3a
mov al, dil
sub al, dl
add al, 0x33
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x83
jl 0x14000d7c3
mov rcx, r9
call fcn.140001020
sub rbx, r13
jne 0x14000d7a9
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movups xmm0, xmmword [0x140012c00]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [0x140012c10]
movups xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [0x140012c20]
movups xmmword [rsp + 0x50], xmm0
mov eax, dword [0x140012c30]
mov dword [rsp + 0x60], eax
mov edi, esi
lea r8, [rsp + 0x30]
mov r14b, 0x33
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x34
jl 0x14000d839
lea rcx, [rsp + 0x30]
call fcn.140001020
lea rcx, [rbp - 0x70]
lea rdx, str.dZR
mov eax, 2
lea r15d, [rax + 0x7e]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
add rcx, r15
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
add rdx, r15
sub rax, 1
jne 0x14000d87a
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [rdx + 0x20]
mov dword [rcx + 0x20], eax
mov al, byte [rdx + 0x24]
mov byte [rcx + 0x24], al
mov edi, esi
lea r8, [rbp - 0x70]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x125
jl 0x14000d8e4
lea rcx, [rbp - 0x70]
call fcn.140001020
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000ce8c
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [0x140013310]
movups xmmword [rsp + 0x30], xmm0
movsd xmm1, qword [0x140013320]
movsd qword [rsp + 0x40], xmm1
mov eax, dword [0x140013328]
mov dword [rsp + 0x48], eax
movzx eax, word [0x14001332c]
mov word [rsp + 0x4c], ax
cmp byte [0x14001332d], sil
je 0x14000d991
mov edi, esi
lea r8, [rsp + 0x30]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x1e
jl 0x14000d96e
lea rcx, [rsp + 0x30]
call fcn.140001020
call fcn.14000ba9c
cmp eax, 0x45
jne 0x14000dacb
movups xmm0, xmmword [0x1400136d0]
movups xmmword [rsp + 0x30], xmm0
mov al, byte [0x1400136e0]
mov byte [rsp + 0x40], al
mov edi, esi
lea r8, [rsp + 0x30]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x11
jl 0x14000d9c6
lea rcx, [rsp + 0x30]
call fcn.140001020
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movups xmm0, xmmword [0x140013100]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [0x140013110]
movups xmmword [rsp + 0x40], xmm1
mov eax, dword [0x140013120]
mov dword [rsp + 0x50], eax
movzx eax, word [0x140013124]
mov word [rsp + 0x54], ax
mov al, byte [0x140013126]
mov byte [rsp + 0x56], al
mov edi, esi
lea r8, [rsp + 0x30]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x27
jl 0x14000da3d
lea rcx, [rsp + 0x30]
call fcn.140001020
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000cfe0
movzx eax, word [0x1400130a0]
mov word [rbp + 0x110], ax
cmp byte [0x1400130a1], sil
je 0x14000daba
lea rdi, [rbp + 0x110]
mov eax, ebx
mul esi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, sil
sub al, cl
add al, r14b
xor byte [rdi], al
add esi, r13d
add rdi, r13
cmp esi, 2
jl 0x14000da98
lea rcx, [rbp + 0x110]
call fcn.140001020
jmp 0x14000dfc2
mov r12d, 0xa0
cmp eax, 0x19
jne 0x14000dddf
mov rax, qword [str.P_YYE]
mov qword [rbp + 0x110], rax
cmp byte [0x140012e7f], sil
je 0x14000db1d
mov edi, esi
lea r8, [rbp + 0x110]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 8
jl 0x14000dafa
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [str.PXF6]
mov dword [rbp + 0x110], eax
cmp byte [0x140013233], sil
je 0x14000db6b
mov edi, esi
lea r8, [rbp + 0x110]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 4
jl 0x14000db48
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp - 0x70]
lea rcx, [0x140000000]
lea rcx, [rcx + 0x13480]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
add rdx, r15
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, r15
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
mov eax, dword [rcx + 0x50]
mov dword [rdx + 0x50], eax
movzx eax, word [rcx + 0x54]
mov word [rdx + 0x54], ax
mov edi, esi
lea r8, [rbp - 0x70]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul edx, eax, 0x3a
mov al, dil
sub al, dl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0xd6
jl 0x14000dc08
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000ebb0
lea rdx, [0x14000ed20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x70]
lea rax, [0x140000000]
lea rax, [rax + 0x12ca0]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + r15 - 0x10], xmm1
movups xmm0, xmmword [rax + r15]
movups xmmword [rcx + r15], xmm0
movups xmm1, xmmword [rax + r15 + 0x10]
movups xmmword [rcx + r15 + 0x10], xmm1
mov edi, esi
lea r8, [rbp - 0x70]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, r12d
jl 0x14000dcbc
lea rcx, [rbp - 0x70]
call fcn.140001020
mov byte [0x14001f8e2], r13b
mov al, sil
mov byte [0x14001f8e5], al
test al, al
jne 0x14000dd39
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
movzx eax, byte [0x14001f8e5]
cmovb eax, r13d
mov byte [0x14001f8e5], al
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14001f8e2], sil
je 0x14000dd39
mov al, byte [0x14001f8e5]
jmp 0x14000dcf8
movups xmm0, xmmword [0x1400133c0]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [0x1400133d0]
movups xmmword [rsp + 0x40], xmm1
mov al, byte [0x1400133e0]
mov byte [rsp + 0x50], al
mov edi, esi
lea r8, [rsp + 0x30]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x21
jl 0x14000dd62
lea rcx, [rsp + 0x30]
call fcn.140001020
mov rax, qword [0x140012c50]
mov qword [rbp + 0x110], rax
cmp byte [0x140012c57], sil
je 0x14000ddd2
mov edi, esi
lea r8, [rbp + 0x110]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 8
jl 0x14000ddaf
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, dword [0x140013878]
mov dword [rsp + 0x40], eax
mov al, byte [0x14001387c]
movups xmm0, xmmword [str.XPB_VQW]
mov byte [rsp + 0x44], al
movups xmmword [rsp + 0x30], xmm0
mov edi, esi
lea r8, [rsp + 0x30]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x15
jl 0x14000de06
lea rcx, [rsp + 0x30]
call fcn.140001020
lea rcx, [rbp - 0x70]
lea rax, [0x140000000]
lea rax, [rax + 0x12ca0]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx + r15 - 0x10], xmm1
movups xmm0, xmmword [rax + r15]
movups xmmword [rcx + r15], xmm0
movups xmm1, xmmword [rax + r15 + 0x10]
movups xmmword [rcx + r15 + 0x10], xmm1
mov edi, esi
lea r8, [rbp - 0x70]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, r12d
jl 0x14000dea1
lea rcx, [rbp - 0x70]
call fcn.140001020
mov byte [0x14001f8e2], r13b
mov al, sil
mov byte [0x14001f8e5], al
test al, al
jne 0x14000df1e
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
movzx eax, byte [0x14001f8e5]
cmovb eax, r13d
mov byte [0x14001f8e5], al
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14001f8e2], sil
je 0x14000df1e
mov al, byte [0x14001f8e5]
jmp 0x14000dedd
movups xmm0, xmmword [0x1400133c0]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [0x1400133d0]
movups xmmword [rsp + 0x40], xmm1
mov al, byte [0x1400133e0]
mov byte [rsp + 0x50], al
mov edi, esi
lea r8, [rsp + 0x30]
mov eax, ebx
mul edi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, dil
sub al, cl
add al, r14b
xor byte [r8], al
add edi, r13d
add r8, r13
cmp edi, 0x21
jl 0x14000df47
lea rcx, [rsp + 0x30]
call fcn.140001020
mov rax, qword [0x140012c50]
mov qword [rbp + 0x110], rax
cmp byte [0x140012c57], sil
je 0x14000dfb4
lea rdi, [rbp + 0x110]
mov eax, ebx
mul esi
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, sil
sub al, cl
add al, r14b
xor byte [rdi], al
add esi, r13d
add rdi, r13
cmp esi, 8
jl 0x14000df92
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x14000e001
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dffc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dffc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
xor eax, eax
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.14000a424
int3
call fcn.14000a1ec
int3
mov ecx, eax
call fcn.14000a424
int3