Function at 0x14003e390
Capabilities:
Create pipe
Create process on windows
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3100]
mov eax, 0x3200
call fcn.140049920
sub rsp, rax
movaps xmmword [rsp + 0x31f0], xmm6
movaps xmmword [rsp + 0x31e0], xmm7
movaps xmmword [rsp + 0x31d0], xmm8
mov r15, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
xor esi, esi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x48], rsi
mov dword [rbp - 8], 0x18
mov dword [rbp + 8], 1
mov qword [rbp], rsi
xor r9d, r9d
lea r8, [rbp - 8]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14003ebef
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
mov dword [rbp + 0xa4], eax
mov dword [rbp + 0x50], 0x68
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xa8], rax
psrldq xmm0, 8
movd eax, xmm0
bts eax, 8
mov dword [rbp + 0x8c], eax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov rdx, qword [r14 + 0x10]
mov qword [rbp - 0x50], rdx
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rdx
cmp rax, 1
jb 0x14003ec25
cmp qword [r14 + 0x18], 8
jb 0x14003e4a5
mov r14, qword [r14]
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rdx + 1]
mov qword [rsp + 0x60], rax
mov ebx, 7
lea rdi, [rbp - 0x78]
cmp rax, rbx
jbe 0x14003e571
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x14003e4ea
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
add rcx, rcx
jmp 0x14003e51a
mov ecx, 0xa
cmp rbx, rcx
cmovb rbx, rcx
lea r8, [rbx + 1]
movabs rcx, 0x7fffffffffffffff
cmp r8, rcx
ja 0x14003ec1f
lea rcx, [r8 + r8]
cmp rcx, 0x1000
jb 0x14003e552
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003ec1f
mov rcx, rax
call fcn.140048f68
test rax, rax
je 0x14003e54b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbp - 0x50]
jmp 0x14003e56d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003e56a
call fcn.140048f68
mov rdi, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbp - 0x50]
jmp 0x14003e56d
mov rdi, rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rbx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbx + rdi], ax
mov rax, qword [rbp - 0x50]
mov word [rdi + rax*2 + 2], si
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x14003e5ae
mov r12, qword [r12]
mov rdx, r12
lea rcx, [rbp - 0x78]
call fcn.140046ef0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14003e62a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e625
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e625
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048c18
movdqa xmm0, xmmword [0x140170c80]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], si
cmp qword [r13 + 0x18], 8
jb 0x14003e646
mov r13, qword [r13]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003e8b7
movups xmm0, xmmword [str.zH_I_o2._76f]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [0x140170a68]
movups xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [0x140170a78]
movups xmmword [rbp + 0x30], xmm0
movzx eax, byte [0x140170a88]
mov byte [rbp + 0x40], al
cmp dword [0x14017a008], 2
jl 0x14003e814
movdqa xmm5, xmmword [0x140170cd0]
movdqa xmm4, xmmword [0x1401710c0]
mov eax, 4
movd xmm6, eax
movdqa xmm7, xmmword [str.1111]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp + 0x14]
mov edx, dword [rsp + 0x60]
nop dword [rax + rax]
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140170d40]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140170d40]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
mov eax, esi
lea rcx, [rcx + 8]
cmp esi, 0x30
jl 0x14003e710
cmp eax, 0x31
jge 0x14003e84d
movsxd rax, esi
lea r8, [rbp + 0x10]
add r8, rax
nop
mov eax, 0x5397829d
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x31
jl 0x14003e820
lea r9, [rbp + 0x10]
mov edx, 3
mov r8d, 0xbb8
lea rcx, [rbp + 0x10c0]
call fcn.14003bc00
mov rax, qword [0x14017a050]
cmp rax, qword [0x14017a058]
je 0x14003e8a0
mov r8d, 0x2010
lea rdx, [rbp + 0x10c0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x14017a050], 0x2010
xor dil, dil
jmp 0x14003eba8
lea r8, [rbp + 0x10c0]
mov rdx, rax
call fcn.1400486a0
xor dil, dil
jmp 0x14003eba8
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov ebx, 0xf
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x60], 0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rsi
mov r14d, ebx
mov qword [rbp - 0x60], rbx
mov byte [rbp - 0x78], 0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movups xmm6, xmmword [rbp - 0x68]
test eax, eax
je 0x14003ea20
nop dword [rax]
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14003ea20
mov edi, esi
nop
mov eax, edi
movzx r9d, byte [rbp + rax + 0xc0]
cmp r9b, 0xa
jne 0x14003e9af
cmp r14, 0x10
jb 0x14003e979
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e974
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eb5e
call fcn.140048c18
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x78], xmm0
movups xmm6, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x68], xmm6
mov ebx, 0xf
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r14, xmm0
jmp 0x14003e9eb
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
jae 0x14003e9dc
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rbx, 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003e9e6
lea rcx, [rsp + 0x60]
call fcn.140047b20
mov rbx, qword [rsp + 0x78]
inc edi
cmp edi, dword [rsp + 0x50]
jb 0x14003e930
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003e920
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x70], 0
je 0x14003eaca
lea rax, [rsp + 0x60]
cmp r15, rax
je 0x14003eb20
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14003eaab
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14003eaa6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003eb5e
mov rcx, r8
call fcn.140048c18
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [r15 + 0x10], xmm1
mov ebx, 0xf
mov byte [rsp + 0x60], 0
jmp 0x14003eb20
lea rax, [rbp - 0x78]
cmp r15, rax
je 0x14003eb20
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14003eb09
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14003eb04
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003eb5e
mov rcx, r8
call fcn.140048c18
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm6
mov r14d, 0xf
mov byte [rbp - 0x78], 0
cmp dword [rbp - 0x80], 0
sete dil
cmp r14, 0x10
jb 0x14003eb6b
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003eb65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003eb65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140048c18
nop
cmp rbx, 0x10
jb 0x14003eba8
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003eba2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003eba2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048c18
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14003ebeb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ebe6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ebe6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048c18
movzx eax, dil
lea r11, [rsp + 0x3200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003ba80
int3
call fcn.14003bb20
int3