Function at 0x7ff6bb0076b0
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x13a70]
mov eax, 0x13b70
call fcn.7ff6bb0318b0
sub rsp, rax
movaps xmmword [rsp + 0x13b60], xmm6
movaps xmmword [rsp + 0x13b50], xmm7
movaps xmmword [rsp + 0x13b40], xmm8
mov rax, qword [0x7ff6bb0bb010]
xor rax, rsp
mov qword [rbp + 0x13a30], rax
mov r12, rdx
xor ebx, ebx
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov rcx, rax
lea edx, [rbx + 0xf]
call qword [sym.imp.kernel32.dll_SetThreadPriority]
movups xmm0, xmmword [0x7ff6bb0a4d20]
movups xmmword [rsp + 0x68], xmm0
mov eax, dword [0x7ff6bb0a4d30]
mov dword [rsp + 0x78], eax
movzx eax, word [0x7ff6bb0a4d34]
mov word [rsp + 0x7c], ax
movzx eax, byte [0x7ff6bb0a4d36]
mov byte [rsp + 0x7e], al
mov r8d, ebx
lea r14d, [rbx + 5]
lea r15d, [rbx + 0x1f]
mov esi, dword [0x7ff6bb0bb018]
cmp esi, 2
jl 0x7ff6bb0078b1
movdqa xmm5, xmmword [0x7ff6bb0ac370]
movdqa xmm4, xmmword [0x7ff6bb0ac860]
movd xmm6, r14d
movdqa xmm7, xmmword [0x7ff6bb0ac3a0]
movd xmm8, r15d
movdqa xmm0, xmmword [0x7ff6bb0ac460]
movdqa xmmword [rbp + 0x170], xmm0
lea rcx, [rsp + 0x6c]
mov edx, dword [rbp + 0x170]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x7ff6bb0ac420]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x7ff6bb0ac420]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x7ff6bb0077a2
cmp r8d, 0x17
jge 0x7ff6bb0078f3
movsxd rax, r8d
lea r9, [rsp + 0x68]
add r9, rax
nop dword [rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
sub al, cl
add al, 0x35
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x17
jl 0x7ff6bb0078c0
movups xmm0, xmmword [0x7ff6bb0a4108]
movups xmmword [rsp + 0x30], xmm0
mov eax, dword [0x7ff6bb0a4118]
mov dword [rsp + 0x40], eax
cmp word [0x7ff6bb0a411a], bx
je 0x7ff6bb007952
mov eax, 0x6e
mov word [rsp + 0x30], ax
xor word [rsp + 0x32], 0x36
xor word [rsp + 0x34], 0x37
xor word [rsp + 0x36], 0x38
xor word [rsp + 0x38], 0x39
xor word [rsp + 0x3a], 0x3a
xor word [rsp + 0x3c], 0x3b
xor word [rsp + 0x3e], 0x3c
xor word [rsp + 0x40], 0x3d
xor word [rsp + 0x42], 0x3e
lea rcx, [rsp + 0x30]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rdi, rax
mov dword [rbp + 0x180], 1
call qword [sym.imp.kernel32.dll_GetCurrentThread]
mov rcx, rax
mov r9d, 4
lea r8, [rbp + 0x180]
lea edx, [r9 + 0xe]
call rdi
mov r9d, eax
test eax, eax
jns 0x7ff6bb007b62
lea rdx, [rbp + 0x88]
call fcn.7ff6bb0081b0
mov rcx, rax
cmp byte [rax + 0x33], bl
je 0x7ff6bb007b4e
cmp esi, 2
jl 0x7ff6bb007b0e
movdqa xmm5, xmmword [0x7ff6bb0ac370]
movdqa xmm4, xmmword [0x7ff6bb0ac860]
movd xmm6, r14d
movdqa xmm7, xmmword [0x7ff6bb0ac3a0]
movd xmm8, r15d
movdqa xmm0, xmmword [0x7ff6bb0ac460]
movdqa xmmword [rbp + 0x170], xmm0
mov rdx, rax
mov r8d, dword [rbp + 0x170]
nop dword [rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x7ff6bb0ac420]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
pxor xmm2, xmm0
movd dword [rdx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x7ff6bb0ac420]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx + 4]
pxor xmm2, xmm0
movd dword [rdx + 4], xmm2
add ebx, 8
mov eax, ebx
lea rdx, [rdx + 8]
cmp ebx, 0x30
jl 0x7ff6bb007a00
cmp eax, 0x34
jge 0x7ff6bb007b4e
movsxd r8, ebx
add r8, rcx
nop dword [rax]
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, bl
sub al, dl
add al, 0x35
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x34
jl 0x7ff6bb007b20
mov edx, r9d
call fcn.7ff6bafc15c0
mov ecx, 1
call qword [sym.imp.ucrtbase.dll_exit]
int3
lea r13, [0x7ff6bb155660]
lea rsi, [0x7ff6bb1555c0]
cmp byte [0x7ff6bb13fd3b], 0
je 0x7ff6bb008123
cmp byte [0x7ff6bb13fd3e], 0
jne 0x7ff6bb008123
mov byte [rbp + 0x170], 0
xor edx, edx
lea rcx, [rbp + 0x178]
call fcn.7ff6bb019c50
nop
lea rax, [rbp + 0x58]
mov qword [rbp + 0x50], rax
mov dword [rbp + 0x118], 0x2ca024d1
mov dword [rbp + 0x11c], 0x890c8187
mov dword [rbp + 0x120], 0x14e41105
mov byte [rbp + 0x124], 0x3f
xor eax, eax
mov word [rbp + 0x125], ax
mov byte [rbp + 0x127], al
mov r8d, 0x2ca024d1
lea rdx, [rbp + 0x11c]
lea rcx, [rbp + 0x68]
call fcn.7ff6bb008460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
lea rax, [rbp + 0x154]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff6bb007c20
lea rdx, [rbp + 0x154]
lea rcx, [rsp + 0x48]
call fcn.7ff6bb01c440
nop
xor eax, eax
mov qword [rbp - 0x58], rax
mov byte [rbp - 0x60], 3
lea ecx, [rax + 0x20]
call fcn.7ff6bb030a60
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [rax + 0x10], xmm1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], 0
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x60]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 1
xor eax, eax
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x40], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
lea ecx, [rax + 0x20]
call fcn.7ff6bb030a60
mov rdi, rax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdi
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [r8 + r13], 0
jne 0x7ff6bb007cd0
mov rdx, r13
mov rcx, rdi
call fcn.7ff6bb01c440
mov qword [rbp + 0x158], rbx
mov qword [rbp - 0x38], rdi
lea rax, [rbp - 0x40]
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x28], 1
xor eax, eax
mov qword [rbp - 0x18], rax
mov byte [rbp - 0x20], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
lea ecx, [rax + 0x20]
call fcn.7ff6bb030a60
mov rdi, rax
lea rax, [rbp + 0x169]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdi
lea rdx, [0x7ff6bb13e2e0]
mov rcx, rdi
call fcn.7ff6bb018940
mov qword [rbp + 0x158], rbx
mov qword [rbp - 0x18], rdi
lea rax, [rbp - 0x20]
mov qword [rbp - 0x10], rax
mov byte [rbp - 8], 1
xor eax, eax
mov qword [rbp + 8], rax
mov byte [rbp], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
lea ecx, [rax + 0x20]
call fcn.7ff6bb030a60
mov rdi, rax
lea rax, [rbp + 0x16a]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rdi
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rsi + r8], 0
jne 0x7ff6bb007da0
mov rdx, rsi
mov rcx, rdi
call fcn.7ff6bb01c440
mov qword [rbp + 0x158], rbx
mov qword [rbp + 8], rdi
lea rax, [rbp]
mov qword [rbp + 0x10], rax
mov byte [rbp + 0x18], 1
lea rax, [rbp - 0x60]
mov qword [rbp + 0x20], rax
lea rax, [rbp + 0x20]
mov qword [rbp + 0x28], rax
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x58]
call fcn.7ff6bb0168e0
mov rdi, rax
mov dword [rbp + 0x138], 0x2ca024d1
movdqa xmm0, xmmword [0x7ff6bb0ac410]
movdqu xmmword [rbp + 0x13c], xmm0
mov r8d, 0x2ca024d1
lea rdx, [rbp + 0x13c]
lea rcx, [rsp + 0x68]
call fcn.7ff6bb0081e0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
mov eax, dword [rax + 0x10]
mov dword [rbp + 0x160], eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
lea rax, [rbp + 0x154]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x7ff6bb007e50
lea rdx, [rbp + 0x154]
lea rcx, [rbp - 0x80]
call fcn.7ff6bb01c440
nop
movzx eax, byte [rbp + 0x170]
test al, al
jne 0x7ff6bb007e95
mov byte [rbp + 0x170], 1
call fcn.7ff6bb01c000
mov rcx, rax
mov qword [rbp + 0x178], rax
movzx eax, byte [rbp + 0x170]
jmp 0x7ff6bb007e9c
mov rcx, qword [rbp + 0x178]
cmp al, 1
jne 0x7ff6bb008147
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x78]
call fcn.7ff6bb01c6f0
mov r8, qword [rax]
movzx ecx, byte [r8 + 0x40]
movzx eax, byte [rdi]
mov byte [r8 + 0x40], al
mov byte [rdi], cl
lea rcx, [rdi + 8]
mov rax, qword [r8 + 0x48]
mov rdx, qword [rcx]
mov qword [r8 + 0x48], rdx
mov qword [rcx], rax
movzx edx, byte [rdi]
call fcn.7ff6bb0197c0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x7ff6bb007f18
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bb007f13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bb008132
call fcn.7ff6bb030750
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
lea r9, [fcn.7ff6bb0085f0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp - 0x60]
call fcn.7ff6bb030680
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x170]
call fcn.7ff6bb016600
nop
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rax, qword [rsp + 0x48]
mov qword [rbp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x38], rax
lea rdx, [rbp + 0x30]
mov rcx, r12
call fcn.7ff6bb01bba0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x7ff6bb007fbc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6bb007fb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bb008139
call fcn.7ff6bb030750
lea rax, [rbp + 0x190]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], 0x13898
lea rdx, [rbp + 0x40]
mov rcx, r12
call fcn.7ff6bb01bc90
mov dword [rbp + 0x128], 0x36a024d1
mov dword [rbp + 0x12c], 0x5ef68b90
mov dword [rbp + 0x130], 0x35ee6845
mov byte [rbp + 0x134], 0x44
xor eax, eax
mov word [rbp + 0x135], ax
mov byte [rbp + 0x137], al
mov r8d, 0x36a024d1
lea rdx, [rbp + 0x12c]
lea rcx, [rsp + 0x30]
call fcn.7ff6bb008460
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
lea rax, [rbp + 0x154]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x7ff6bb008050
lea rdx, [rbp + 0x154]
lea rcx, [rsp + 0x48]
call fcn.7ff6bb01c440
lea rcx, [rbp + 0x190]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x7ff6bb008080
lea rcx, [rsp + 0x48]
mov rsi, qword [rsp + 0x60]
cmp rsi, 0x10
setae r15b
mov rdi, qword [rsp + 0x48]
cmovae rcx, rdi
mov r8, qword [rsp + 0x58]
cmp r8, rax
jne 0x7ff6bb0080c3
lea rdx, [rbp + 0x190]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x7ff6bb0080c3
mov r14b, 1
jmp 0x7ff6bb0080c6
xor r14b, r14b
test r15b, r15b
je 0x7ff6bb0080f8
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x7ff6bb0080f0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x7ff6bb008140
mov rcx, rdi
call fcn.7ff6bb030750
mov byte [0x7ff6bb121717], r14b
mov ecx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
nop
movzx edx, byte [rbp + 0x170]
lea rcx, [rbp + 0x178]
call fcn.7ff6bb0197c0
jmp 0x7ff6bb007b69
xor edx, edx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_Beep]
jmp 0x7ff6bb007b70
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rbp + 0x170]
call fcn.7ff6bb019da0
mov rdx, rax
lea rcx, [rbp + 0xf8]
call fcn.7ff6bb018900
nop
mov r8, rax
lea rdx, [0x7ff6bb0a3e08]
lea rcx, [rbp + 0x88]
call fcn.7ff6bb01b8b0
nop
mov r8, rax
mov edx, 0x131
lea rcx, [rbp + 0xc0]
call fcn.7ff6bb0064e0
lea rdx, [0x7ff6bb0b6e68]
lea rcx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll__CxxThrowException
int3