Function at 0x1400415d0
Capabilities:
Check if file exists
Create process on windows
Encode data using xor
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rdi, rdx
mov r14, rcx
movdqa xmm0, xmmword [0x14015d3f0]
movdqu xmmword [rbp - 0x59], xmm0
mov byte [rbp - 0x49], 1
xor ecx, ecx
nop
lea eax, [rcx + 0x23]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0xf
jb 0x140041610
mov byte [rbp - 0x49], 0
lea rax, [rbp - 0x59]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140041630
mov r12, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, rbx
jb 0x1400419ad
mov qword [rbp + 0x77], r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140041668
mov rax, qword [r14]
mov qword [rbp + 0x77], rax
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
lea r13, [r12 + rbx]
mov esi, reloc.WS2_32.dll_ntohs
lea r15, [rbp - 1]
cmp r13, rsi
jbe 0x140041703
mov rsi, r13
or rsi, 0xf
cmp rsi, rcx
jbe 0x1400416c5
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14011f464
test rax, rax
je 0x14004183c
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x1400416ff
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400416ed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400419b3
jmp 0x1400416a6
test rcx, rcx
je 0x1400416fc
call fcn.14011f464
mov r15, rax
jmp 0x1400416ff
xor r15d, r15d
mov qword [rbp - 1], r15
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], rsi
mov r8, rbx
lea rdx, [rbp - 0x59]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r15 + rbx]
mov r8, r12
mov rdx, qword [rbp + 0x77]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + r13], 0
mov r8d, 0xa
lea rdx, str.___output
lea rcx, [rbp - 1]
call fcn.14004fa80
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x21], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x11], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140041781
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x21]
call fcn.14004fa80
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x31], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x41], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x31], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400417f9
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400417f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400417f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
movdqa xmm0, xmmword [0x14015d330]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x140041848
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041843
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041843
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
lea rbx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0xf
cmova rbx, qword [rbp - 0x41]
xor edx, edx
lea rcx, str._echo_off
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, eax
test eax, eax
je 0x1400418aa
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14004188e
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14004189d
test al, 0x10
je 0x1400418aa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140041881
mov rdx, qword [rbp - 0x29]
cmp rdx, 0xf
jbe 0x1400418e8
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400418e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400418e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
movdqa xmm0, xmmword [0x14015d330]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x14004192f
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14004192a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004199f
mov rcx, r8
call fcn.14011f7b8
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140041975
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140041970
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400419a6
mov rcx, r8
call fcn.14011f7b8
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14003db40
int3
call fcn.1400033e0
int3