Function at 0x140003b88
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x378]
sub rsp, 0x470
mov rax, qword [0x14016e040]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov dword [rbp + 0x100], 0x94808785
mov dword [rbp + 0x104], 0xdf978d8a
mov dword [rbp + 0x108], 0x918b97
xor r14d, r14d
lea edx, [r14 + 1]
mov byte [rbp + 0x10c], dl
mov ecx, r14d
lea r8d, [r14 + 0x16]
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x100], al
add rcx, rdx
cmp rcx, 0xb
jb 0x140003bed
mov byte [rbp + 0x10c], r14b
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
movdqa xmm0, xmmword [0x140154e60]
movdqu xmmword [rbp + 0x248], xmm0
mov word [rbp + 0x258], 0x9f
mov byte [rbp + 0x25a], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x248], al
add rcx, rdx
cmp rcx, 0x11
jb 0x140003c37
mov byte [rbp + 0x25a], r14b
lea rax, [rbp + 0x248]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x110], 0x9b9c889e
mov dword [rbp + 0x114], 0xdf878a87
mov dword [rbp + 0x118], 0x918b97
mov byte [rbp + 0x11c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x110], al
add rcx, rdx
cmp rcx, 0xb
jb 0x140003c86
mov byte [rbp + 0x11c], r14b
lea rax, [rbp + 0x110]
mov qword [rsp + 0x50], rax
mov dword [rbp + 0x180], 0x82989e8b
mov dword [rbp + 0x184], 0x829e9a9c
mov dword [rbp + 0x188], 0x908c96dc
mov word [rbp + 0x18c], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x180], al
add rcx, rdx
cmp rcx, 0xc
jb 0x140003cd8
mov byte [rbp + 0x18d], r14b
lea rax, [rbp + 0x180]
mov qword [rsp + 0x58], rax
mov dword [rbp + 0x1b0], 0x82989e8b
mov dword [rbp + 0x1b4], 0x829e9a9c
mov dword [rbp + 0x1b8], 0x8d91dd91
mov word [rbp + 0x1bc], __WSAFDIsSet
mov byte [rbp + 0x1be], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x1b0], al
add rcx, rdx
cmp rcx, 0xd
jb 0x140003d30
mov byte [rbp + 0x1be], r14b
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x60], rax
mov dword [rbp + 0x120], 0x8880828c
mov dword [rbp + 0x124], 0xdf9e8083
mov dword [rbp + 0x128], 0x918b97
mov byte [rbp + 0x12c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x120], al
add rcx, rdx
cmp rcx, 0xb
jb 0x140003d7f
mov byte [rbp + 0x12c], r14b
lea rax, [rbp + 0x120]
mov qword [rsp + 0x68], rax
mov dword [rbp + 0x130], 0x8e83999a
mov dword [rbp + 0x134], 0xdf9e8083
mov dword [rbp + 0x138], 0x918b97
mov byte [rbp + 0x13c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x130], al
add rcx, rdx
cmp rcx, 0xb
jb 0x140003dce
mov byte [rbp + 0x13c], r14b
lea rax, [rbp + 0x130]
mov qword [rsp + 0x70], rax
mov dword [rbp + 0xa0], 0x808b8e98
mov dword [rbp + 0xa4], 0x94de8181
mov dword [rbp + 0xa8], 0x100968a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0xa0], al
add rcx, rdx
cmp rcx, 0xa
jb 0x140003e17
mov byte [rbp + 0xab], r14b
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x78], rax
mov dword [rbp + 0x140], 0x8e83999a
mov dword [rbp + 0x144], 0xdf80978b
mov dword [rbp + 0x148], 0x918b97
mov byte [rbp + 0x14c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x140], al
add rcx, rdx
cmp rcx, 0xb
jb 0x140003e66
mov byte [rbp + 0x14c], r14b
lea rax, [rbp + 0x140]
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x80], 0x9c8d8f83
mov dword [rbp + 0x84], 0x94888ac0
mov word [rbp + 0x88], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x80], al
add rcx, rdx
cmp rcx, 8
jb 0x140003ead
mov byte [rbp + 0x89], r14b
lea rax, [rbp + 0x80]
mov qword [rbp - 0x78], rax
mov dword [rbp + 0xb0], 0x9c8d8f83
mov dword [rbp + 0xb4], 0x94dedbd8
mov dword [rbp + 0xb8], 0x100968a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0xb0], al
add rcx, rdx
cmp rcx, 0xa
jb 0x140003ef5
mov byte [rbp + 0xbb], r14b
lea rax, [rbp + 0xb0]
mov qword [rbp - 0x70], rax
mov dword [rbp + 0x70], 0xc38d8f83
mov dword [rbp + 0x74], 0x95978b
mov byte [rbp + 0x78], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x70], al
add rcx, rdx
cmp rcx, 7
jb 0x140003f30
mov byte [rbp + 0x78], r14b
lea rax, [rbp + 0x70]
mov qword [rbp - 0x68], rax
mov dword [rbp + 0x90], 0xdb8d8f83
mov dword [rbp + 0x94], 0x8995c1da
mov word [rbp + 0x98], reloc.WS2_32.dll___WSAFDIsSet
mov byte [rbp + 0x9a], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x90], al
add rcx, rdx
cmp rcx, 9
jb 0x140003f74
mov byte [rbp + 0x9a], r14b
lea rax, [rbp + 0x90]
mov qword [rbp - 0x60], rax
movdqa xmm0, xmmword [0x140154f10]
movdqu xmmword [rbp + 0x1e8], xmm0
mov dword [rbp + 0x1f8], 0x98849ed4
mov word [rbp + 0x1fc], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x1e8], al
add rcx, rdx
cmp rcx, 0x14
jb 0x140003fc1
mov byte [rbp + 0x1fd], r14b
lea rax, [rbp + 0x1e8]
mov qword [rbp - 0x58], rax
mov dword [rbp + 0x1c0], 0x889e82bd
mov dword [rbp + 0x1c4], 0x8391879d
mov dword [rbp + 0x1c8], 0x8d91dd99
mov word [rbp + 0x1cc], __WSAFDIsSet
mov byte [rbp + 0x1ce], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x1c0], al
add rcx, rdx
cmp rcx, 0xd
jb 0x140004018
mov byte [rbp + 0x1ce], r14b
lea rax, [rbp + 0x1c0]
mov qword [rbp - 0x50], rax
mov dword [rbp + 0x150], 0x9d819e8e
mov dword [rbp + 0x154], 0xdf808e8d
mov dword [rbp + 0x158], 0x918b97
mov byte [rbp + 0x15c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x150], al
add rcx, rdx
cmp rcx, 0xb
jb 0x140004066
mov byte [rbp + 0x15c], r14b
lea rax, [rbp + 0x150]
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [0x140154fd0]
movdqu xmmword [rbp + 0x308], xmm0
mov word [rbp + 0x318], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x308], al
add rcx, rdx
cmp rcx, 0x10
jb 0x1400040a9
mov byte [rbp + 0x319], r14b
lea rax, [rbp + 0x308]
mov qword [rbp - 0x40], rax
mov dword [rbp + 0x190], 0x829c86a3
mov dword [rbp + 0x194], 0xb4a29b9c
mov dword [rbp + 0x198], 0x8d91ddb1
mov word [rbp + 0x19c], __WSAFDIsSet
mov byte [rbp + 0x19e], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x190], al
add rcx, rdx
cmp rcx, 0xd
jb 0x140004100
mov byte [rbp + 0x19e], r14b
lea rax, [rbp + 0x190]
mov qword [rbp - 0x38], rax
mov dword [rbp + 0x160], 0x82b8aeba
mov dword [rbp + 0x164], 0xdf838381
mov dword [rbp + 0x168], 0x918b97
mov byte [rbp + 0x16c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x160], al
add rcx, rdx
cmp rcx, 0xb
jb 0x14000414e
mov byte [rbp + 0x16c], r14b
lea rax, [rbp + 0x160]
mov qword [rbp - 0x30], rax
mov dword [rbp + 0xc0], 0x899e84a6
mov dword [rbp + 0xc4], 0x94deaabe
mov dword [rbp + 0xc8], 0x100968a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0xc0], al
add rcx, rdx
cmp rcx, 0xa
jb 0x140004196
mov byte [rbp + 0xcb], r14b
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x28], rax
movdqa xmm0, xmmword [0x140155000]
movdqu xmmword [rbp + 0x2c0], xmm0
mov word [rbp + 0x2d0], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x2c0], al
add rcx, rdx
cmp rcx, 0x10
jb 0x1400041d9
mov byte [rbp + 0x2d1], r14b
lea rax, [rbp + 0x2c0]
mov qword [rbp - 0x20], rax
movdqa xmm0, xmmword [0x140154e50]
movdqu xmmword [rbp + 0x260], xmm0
mov word [rbp + 0x270], 0x9f
mov byte [rbp + 0x272], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x260], al
add rcx, rdx
cmp rcx, 0x11
jb 0x140004222
mov byte [rbp + 0x272], r14b
lea rax, [rbp + 0x260]
mov qword [rbp - 0x18], rax
movdqa xmm0, xmmword [0x140154650]
movdqu xmmword [rbp + 0x320], xmm0
mov byte [rbp + 0x330], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x320], al
add rcx, rdx
cmp rcx, 0xf
jb 0x140004262
mov byte [rbp + 0x330], r14b
lea rax, [rbp + 0x320]
mov qword [rbp - 0x10], rax
mov dword [rbp + 0x1a0], 0x8b858599
mov dword [rbp + 0x1a4], 0x9898b088
mov dword [rbp + 0x1a8], 0x8d91dd86
mov word [rbp + 0x1ac], __WSAFDIsSet
mov byte [rbp + 0x1ae], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x1a0], al
add rcx, rdx
cmp rcx, 0xd
jb 0x1400042b9
mov byte [rbp + 0x1ae], r14b
lea rax, [rbp + 0x1a0]
mov qword [rbp - 8], rax
mov dword [rbp + 0xd0], 0x8982829d
mov dword [rbp + 0xd4], 0x94de888c
mov dword [rbp + 0xd8], 0x100968a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0xd0], al
add rcx, rdx
cmp rcx, 0xa
jb 0x140004301
mov byte [rbp + 0xdb], r14b
lea rax, [rbp + 0xd0]
mov qword [rbp], rax
movdqa xmm0, xmmword [0x140154e70]
movdqu xmmword [rbp + 0x278], xmm0
mov word [rbp + 0x288], 0x9f
mov byte [rbp + 0x28a], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x278], al
add rcx, rdx
cmp rcx, 0x11
jb 0x14000434a
mov byte [rbp + 0x28a], r14b
lea rax, [rbp + 0x278]
mov qword [rbp + 8], rax
movdqa xmm0, xmmword [0x140154fe0]
movdqu xmmword [rbp + 0x2d8], xmm0
mov word [rbp + 0x2e8], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x2d8], al
add rcx, rdx
cmp rcx, 0x10
jb 0x14000438d
mov byte [rbp + 0x2e9], r14b
lea rax, [rbp + 0x2d8]
mov qword [rbp + 0x10], rax
movdqa xmm0, xmmword [0x140155010]
movdqu xmmword [rbp + 0x218], xmm0
mov dword [rbp + 0x228], 0x1009e82
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x218], al
add rcx, rdx
cmp rcx, 0x12
jb 0x1400043d1
mov byte [rbp + 0x22b], r14b
lea rax, [rbp + 0x218]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0xe0], 0x89ded892
mov dword [rbp + 0xe4], 0x94de888c
mov dword [rbp + 0xe8], 0x100968a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0xe0], al
add rcx, rdx
cmp rcx, 0xa
jb 0x140004419
mov byte [rbp + 0xeb], r14b
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x20], rax
mov dword [rbp + 0xf0], 0x89d8dd92
mov dword [rbp + 0xf4], 0x94de888c
mov dword [rbp + 0xf8], 0x100968a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0xf0], al
add rcx, rdx
cmp rcx, 0xa
jb 0x140004461
mov byte [rbp + 0xfb], r14b
lea rax, [rbp + 0xf0]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x170], 0x898882ac
mov dword [rbp + 0x174], 0xdf828a82
mov dword [rbp + 0x178], 0x918b97
mov byte [rbp + 0x17c], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x170], al
add rcx, rdx
cmp rcx, 0xb
jb 0x1400044af
mov byte [rbp + 0x17c], r14b
lea rax, [rbp + 0x170]
mov qword [rbp + 0x30], rax
movdqa xmm0, xmmword [0x140154ff0]
movdqu xmmword [rbp + 0x2f0], xmm0
mov word [rbp + 0x300], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x2f0], al
add rcx, rdx
cmp rcx, 0x10
jb 0x1400044f2
mov byte [rbp + 0x301], r14b
lea rax, [rbp + 0x2f0]
mov qword [rbp + 0x38], rax
movdqa xmm0, xmmword [0x140154f50]
movdqu xmmword [rbp + 0x290], xmm0
movdqa xmm1, xmmword [0x140154890]
movdqu xmmword [rbp + 0x2a0], xmm1
mov dword [rbp + 0x2b0], 0x646e2b38
mov dword [rbp + 0x2b4], 0x743e267a
mov dword [rbp + 0x2b8], 0x100766a
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x290], al
add rcx, rdx
cmp rcx, 0x2a
jb 0x14000455a
mov byte [rbp + 0x2bb], r14b
lea rax, [rbp + 0x290]
mov qword [rbp + 0x40], rax
movdqa xmm0, xmmword [0x140155020]
movdqu xmmword [rbp + 0x230], xmm0
mov dword [rbp + 0x240], 0x1009e82
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x230], al
add rcx, rdx
cmp rcx, 0x12
jb 0x14000459e
mov byte [rbp + 0x243], r14b
lea rax, [rbp + 0x230]
mov qword [rbp + 0x48], rax
movdqa xmm0, xmmword [0x140155190]
movdqu xmmword [rbp + 0x200], xmm0
mov dword [rbp + 0x210], 0x99839f
mov byte [rbp + 0x214], dl
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x200], al
add rcx, rdx
cmp rcx, 0x13
jb 0x1400045e8
mov byte [rbp + 0x214], r14b
lea rax, [rbp + 0x200]
mov qword [rbp + 0x50], rax
movdqa xmm0, xmmword [0x140155090]
movdqu xmmword [rbp + 0x1d0], xmm0
mov dword [rbp + 0x1e0], 0x98d2cfcc
mov dword [rbp + 0x1e4], 0x1009a86
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x1d0], al
add rcx, rdx
cmp rcx, r8
jb 0x140004636
mov byte [rbp + 0x1e7], r14b
lea rax, [rbp + 0x1d0]
mov qword [rbp + 0x58], rax
movdqu xmmword [rbp + 0x338], xmm0
movdqa xmm0, xmmword [0x140154d40]
movdqu xmmword [rbp + 0x348], xmm0
mov word [rbp + 0x358], 0x100
mov rcx, r14
mov al, cl
sub al, r8b
xor byte [rbp + rcx + 0x338], al
add rcx, rdx
cmp rcx, 0x20
jb 0x140004680
mov byte [rbp + 0x359], r14b
lea rax, [rbp + 0x338]
mov qword [rbp + 0x60], rax
lea rsi, [rsp + 0x40]
lea rdi, [rbp + 0x68]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], r14
mov ecx, 0x128
call fcn.140118c10
mov rbx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x128]
mov qword [rsp + 0x30], rcx
sub rdi, rsi
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
sar rdi, 3
lea rax, [rbx + rdi*8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], r14
lea rcx, [rsp + 0x38]
call fcn.140014df0
nop
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
cmp rbx, rdi
je 0x140004738
mov rcx, qword [rbx]
call fcn.1400035c0
test al, al
jne 0x140004771
add rbx, 8
cmp rbx, rdi
jne 0x14000471e
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400047a8
mov rdx, qword [rsp + 0x30]
sub rdx, rbx
and rdx, 0xfffffffffffffff8
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400047a0
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400047a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, str.color_4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor r9d, r9d
lea r8, str.COOKED
lea rdx, str.Heisenberg_commands_ur_efforts_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, rbx
call fcn.140118f64
xor eax, eax
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140118ad0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret