Function at 0x1400fc2d0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
xor ebx, ebx
mov dword [rbp - 0x40], 0xfff8e8e8
mov ecx, ebx
mov dword [rbp - 0x3c], 0xdac48ef2
mov word [rbp - 0x38], Ordinal_200
mov byte [rbp - 0x36], 1
nop dword [rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 9
jb 0x1400fc300
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x36], bl
call 0x140000000
test al, al
je 0x1400fc36d
vmovdqu xmm0, xmmword [0x1401ece90]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xcb83c1ca
mov rcx, rbx
mov dword [rbp - 0x2c], 0x9d91d5d7
mov dword [rbp - 0x28], 0xf09a94e7
mov word [rbp - 0x24], 0x100
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1c
jb 0x1400fc350
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x23], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x1401e89a8]
call 0x140000000
test al, al
je 0x1400fc3c0
vmovdqu ymm0, ymmword [0x1401edbe0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0x919de894
mov rcx, rbx
mov word [rbp - 0x1c], 0xf9
mov byte [rbp - 0x1a], 1
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x25
jb 0x1400fc3a0
mov byte [rbp - 0x1a], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401ece70]
vmovdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x10
jb 0x1400fc3e0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2f], bl
call 0x140000000
test al, al
je 0x1400fc440
vmovdqu ymm0, ymmword [0x1401ee7e0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xfb939b
mov rcx, rbx
mov byte [rbp - 0x1c], 1
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x23
jb 0x1400fc420
mov byte [rbp - 0x1c], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0xf9f4eed4
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc78fcef6
mov dword [rbp - 0x38], 0x100c1db
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400fc460
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], bl
call 0x140000000
test al, al
je 0x1400fc4cd
vmovdqu xmm0, xmmword [0x1401ecdf0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x80c3c5cc
mov rcx, rbx
mov dword [rbp - 0x2c], 0x92d4c8ca
mov dword [rbp - 0x28], 0x9995e09c
mov word [rbp - 0x24], 0xf1
mov byte [rbp - 0x22], 1
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1d
jb 0x1400fc4b0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x22], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401ecf10]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xc7dbdece
mov rcx, rbx
mov dword [rbp - 0x2c], 0xd79fd5cc
mov dword [rbp - 0x28], 0x100d1cb
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x1400fc500
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x25], bl
call 0x140000000
test al, al
je 0x1400fc570
vmovdqu ymm0, ymmword [0x1401ee240]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0x90d8dfd2
mov rcx, rbx
mov dword [rbp - 0x1c], 0xe2a4b8da
mov dword [rbp - 0x18], 0xe9e590ec
mov word [rbp - 0x14], 0x81
mov byte [rbp - 0x12], 1
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x1400fc550
mov byte [rbp - 0x12], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401ece60]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xd6c882d9
mov rcx, rbx
mov word [rbp - 0x2c], 0xca
mov byte [rbp - 0x2a], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x15
jb 0x1400fc5a0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2a], bl
call 0x140000000
test al, al
je 0x1400fc610
vmovdqu ymm0, ymmword [0x1401ee620]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0x919dd9c3
mov rcx, rbx
mov dword [rbp - 0x1c], 0x84eee0eb
mov word [rbp - 0x18], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x28
jb 0x1400fc5f0
mov byte [rbp - 0x17], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401ece10]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xcb83dfce
mov rcx, rbx
mov dword [rbp - 0x2c], 0x100d5d7
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x1400fc630
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x29], bl
call 0x140000000
test al, al
je 0x1400fc6a0
vmovdqu ymm0, ymmword [0x1401eda60]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0x9ed8c4de
mov rcx, rbx
mov dword [rbp - 0x1c], 0xede19490
mov word [rbp - 0x18], 0x85
mov byte [rbp - 0x16], 1
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x29
jb 0x1400fc680
mov byte [rbp - 0x16], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401ece80]
vmovdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x10
jb 0x1400fc6c0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x2f], bl
call 0x140000000
test al, al
je 0x1400fc720
vmovdqu ymm0, ymmword [0x1401ee7c0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0xfb939b
mov rcx, rbx
mov byte [rbp - 0x1c], 1
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x23
jb 0x1400fc700
mov byte [rbp - 0x1c], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401ece50]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xcb83dece
mov rcx, rbx
mov dword [rbp - 0x2c], 0x100d5d7
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x16
jb 0x1400fc740
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x29], bl
call 0x140000000
test al, al
je 0x1400fc7b0
vmovdqu ymm0, ymmword [0x1401eda80]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0x9ed8c4de
mov rcx, rbx
mov dword [rbp - 0x1c], 0xede19490
mov word [rbp - 0x18], 0x85
mov byte [rbp - 0x16], 1
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x29
jb 0x1400fc790
mov byte [rbp - 0x16], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu xmm0, xmmword [0x1401eceb0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0xc2c9c2ca
mov rcx, rbx
mov dword [rbp - 0x2c], 0xd79fc2ca
mov dword [rbp - 0x28], 0x100d1cb
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x1400fc7e0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x25], bl
call 0x140000000
test al, al
je 0x1400fc850
vmovdqu ymm0, ymmword [0x1401ee560]
vmovdqu ymmword [rbp - 0x40], ymm0
mov dword [rbp - 0x20], 0x90cfd9d7
mov rcx, rbx
mov dword [rbp - 0x1c], 0xe2a4b8da
mov dword [rbp - 0x18], 0xe9e590ec
mov word [rbp - 0x14], 0x81
mov byte [rbp - 0x12], 1
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x2d
jb 0x1400fc830
mov byte [rbp - 0x12], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
vmovdqu ymm0, ymmword [0x1401ee180]
vmovdqu ymmword [rbp - 0x40], ymm0
mov word [rbp - 0x20], 0xde
mov rcx, rbx
mov byte [rbp - 0x1e], 1
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x1400fc870
mov byte [rbp - 0x1e], bl
lea rcx, [rbp - 0x40]
vzeroupper
call 0x140000000
test al, al
je 0x1400fc8e0
vmovdqu ymm0, ymmword [0x1401ed8a0]
vmovdqu xmm1, xmmword [0x1401eced0]
vmovdqu ymmword [rbp - 0x40], ymm0
vmovdqu xmmword [rbp - 0x20], xmm1
mov dword [rbp - 0x10], 0x88e2ec9f
mov rcx, rbx
mov word [rbp - 0xc], 0x100
nop dword [rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x34
jb 0x1400fc8c0
mov byte [rbp - 0xb], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0xdaf8f2d4
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc7d7c9ed
mov dword [rbp - 0x38], 0xc3ddc18d
mov word [rbp - 0x34], 0x100
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x1400fc900
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x33], bl
call 0x140000000
test al, al
je 0x1400fc960
vmovdqu ymm0, ymmword [0x1401ecf60]
vmovdqu ymmword [rbp - 0x40], ymm0
mov byte [rbp - 0x20], 1
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1f
jb 0x1400fc940
mov byte [rbp - 0x20], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0xeaeee9c9
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc7c8ccdc
mov dword [rbp - 0x38], 0xc38bd0cd
mov dword [rbp - 0x34], 0x100cddf
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xe
jb 0x1400fc980
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x31], bl
call 0x140000000
test al, al
je 0x1400fc9e0
vmovdqu ymm0, ymmword [0x1401edaa0]
vmovdqu ymmword [rbp - 0x40], ymm0
mov word [rbp - 0x20], 0xfd
mov rcx, rbx
mov byte [rbp - 0x1e], 1
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x21
jb 0x1400fc9c0
mov byte [rbp - 0x1e], bl
lea rcx, [rbp - 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0xeefca9e9
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc78fd8fa
mov dword [rbp - 0x38], 0x100c1db
nop dword [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400fca00
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], bl
call 0x140000000
test al, al
je 0x1400fca6d
vmovdqu xmm0, xmmword [0x1401ece40]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x80d5c9db
mov rcx, rbx
mov dword [rbp - 0x2c], 0x92d4c8ca
mov dword [rbp - 0x28], 0x9995e09c
mov word [rbp - 0x24], 0xf1
mov byte [rbp - 0x22], 1
nop
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1d
jb 0x1400fca50
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x22], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov dword [rbp - 0x40], 0xece9fbed
mov rcx, rbx
mov dword [rbp - 0x3c], 0xc78fd9fe
mov dword [rbp - 0x38], 0x100c1db
nop word [rax + rax]
lea eax, [rcx - 0x65]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400fca90
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x35], bl
call 0x140000000
test al, al
je 0x1400fcafe
vmovdqu xmm0, xmmword [0x1401ecea0]
vmovdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x80d4cdd9
mov dword [rbp - 0x2c], 0x92d4c8ca
mov dword [rbp - 0x28], 0x9995e09c
mov word [rbp - 0x24], 0xf1
mov byte [rbp - 0x22], 1
nop dword [rax]
lea eax, [rbx - 0x65]
xor byte [rbp + rbx - 0x40], al
inc rbx
cmp rbx, 0x1d
jb 0x1400fcae0
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x22], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret