Function at 0x140058230
Capabilities:
Accept command line arguments
Create process on windows
Encode data using xor
Enumerate gui resources
Enumerate processes
Execute command
Link many functions at runtime
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x140073040]
xor rax, rsp
mov qword [rbp + 0x260], rax
call fcn.140056a40
xor ebx, ebx
cmp qword [0x140073ad8], rbx
jne 0x140058343
nop
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, [rbp + 0x20]
mov r8d, 0x238
call fcn.140059e84
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400582dc
lea rdx, [0x14006a310]
lea rcx, [rbp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rdi
test eax, eax
je 0x14005840e
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400582b2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea rdx, [rsp + 0x60]
mov dword [0x140073b48], eax
lea rcx, [0x1400553c0]
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140058321
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x140058321
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140058324
mov rax, rbx
mov ecx, 1
mov qword [0x140073ad8], rax
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [0x140073ad8], rbx
je 0x140058270
lea rcx, [0x14006a30c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140058ba9
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140058ba9
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x140073a88], rax
test rax, rax
je 0x140058ba9
lea rcx, str.win32u.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x140073ad0], rax
test rax, rax
je 0x140058ba9
mov rcx, qword [0x140073a88]
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14005841c
mov rcx, qword [0x140073ad0]
lea rdx, str.NtUserSendInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x14005841c
lea rcx, str.The_input_was_not_initialized
call fcn.1400131d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x28]
jmp 0x1400582e7
movups xmm0, xmmword [rcx]
mov qword [rsp + 0x390], rsi
mov esi, ebx
movups xmmword [0x140073b78], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [0x140073b88], xmm1
mov eax, dword [rcx + 0x18]
mov dword [0x140073b90], eax
movzx eax, word [rcx + 0x1c]
mov word [0x140073b94], ax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x70]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14005855c
mov rcx, qword [rsp + 0x70]
lea rax, [rbp - 0x54]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x58]
lea edx, [r9 + 0x16]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400584a2
mov edi, dword [rbp - 0x54]
mov esi, 1
jmp 0x1400584aa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x140058564
cmp dword [rbp - 0x58], ebx
jne 0x14005856c
lea rcx, [rsp + 0x60]
call fcn.1400537a0
test eax, eax
jne 0x140058b89
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x50], rcx
mov r8, rax
lea rcx, [rbp - 0x50]
xor edx, edx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x140058547
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140058564
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x140058b89
mov rcx, qword [0x140073a88]
lea rdx, str.CreateWindowInBand
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073a70], rax
test rax, rax
jne 0x1400585b0
mov rcx, qword [0x140073ad0]
lea rdx, str.CreateWindowInBand
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073a70], rax
test rax, rax
je 0x140058b89
mov rcx, qword [0x140073a88]
lea rdx, str.NtUserRegisterErrorReportingDialog
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073b40], rax
mov r8, rax
test rax, rax
jne 0x140058616
mov rcx, qword [0x140073ad0]
lea rdx, str.NtUserRegisterErrorReportingDialog
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073b40], rax
mov r8, rax
test rax, rax
jne 0x140058616
lea rcx, str.The_driver_was_not_initialized
call fcn.1400131d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movsxd rax, dword [0x140073b48]
lea rdi, [rsp + 0x78]
mov qword [rbp - 0x80], rax
xor ecx, ecx
xorps xmm0, xmm0
mov qword [rsp + 0x78], 1
xor eax, eax
mov qword [rbp - 0x68], rbx
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x60], rbx
rep stosb byte [rdi], al
lea rcx, [rsp + 0x78]
call r8
mov rax, qword [rbp - 0x60]
mov qword [0x140073b50], rax
test rax, rax
jne 0x14005867d
lea rcx, str.The_driver_couldnt_get_the_base_address
call fcn.1400131d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movaps xmmword [rsp + 0x370], xmm6
call fcn.140055a70
mov r9, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x78]
call fcn.140058bd0
mov esi, dword [0x140073088]
mov r8, rax
cmp byte [rax + 0x1b], bl
je 0x14005882c
mov ecx, ebx
cmp esi, 2
jl 0x1400587f2
movdqa xmm0, xmmword [str.3333333333333333]
mov rdx, rax
movdqa xmm5, xmmword [0x14006a7c0]
movdqa xmm4, xmmword [0x14006a8f0]
movdqa xmm6, xmmword [0x14006a7e0]
movdqa xmmword [rsp + 0x60], xmm0
mov edi, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14006a820]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edi
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edi
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14006a820]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x18
jl 0x1400586f0
cmp ecx, 0x1c
jge 0x14005882c
movsxd rdi, ecx
add rdi, r8
nop dword [rax + rax]
mov eax, 0x51eb851f
lea rdi, [rdi + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [rdi - 1], al
cmp ecx, 0x1c
jl 0x140058800
mov rdx, r8
mov rcx, r9
call fcn.140050640
call fcn.140055a40
lea rdx, [rsp + 0x60]
call fcn.140058c00
mov r9, rax
cmp byte [rax + 0xb], bl
je 0x14005898e
mov edi, ebx
cmp esi, 2
jl 0x14005895a
movdqa xmm2, xmmword [0x14006a7c0]
mov edi, 8
movdqa xmm4, xmmword [0x14006a8f0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14006a7d0]
movdqa xmm0, xmm2
mov eax, dword [str.3333333333333333]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14006a7e0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14006a820]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [r9]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [r9], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14006a7e0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, eax
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14006a820]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [r9 + 4]
xorps xmm2, xmm0
movd dword [r9 + 4], xmm2
movsxd r8, edi
add r8, r9
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, dil
inc edi
sub al, cl
add al, 0x33
xor byte [r8 - 1], al
cmp edi, 0xc
jl 0x140058960
mov rcx, r9
call fcn.140055c40
movsxd rdx, dword [0x140073b48]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___void_const____ptr64____ptr64]
mov rcx, rax
lea rdx, [0x140050810]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, [rsp + 0x78]
call fcn.140058c20
mov r8, rax
cmp byte [rax + 0x12], bl
je 0x140058b4c
cmp esi, 2
jl 0x140058b14
movdqa xmm0, xmmword [str.3333333333333333]
mov rcx, rax
movdqa xmm5, xmmword [0x14006a7c0]
movdqa xmm4, xmmword [0x14006a8f0]
movdqa xmm6, xmmword [0x14006a7e0]
movdqa xmmword [rsp + 0x60], xmm0
mov edx, dword [rsp + 0x60]
nop word [rax + rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
mov eax, ebx
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14006a820]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14006a820]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp ebx, 0x10
jl 0x140058a10
cmp eax, 0x13
jge 0x140058b4c
movsxd rdi, ebx
add rdi, r8
nop word [rax + rax]
mov eax, 0x51eb851f
lea rdi, [rdi + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, bl
inc ebx
sub al, cl
add al, 0x33
xor byte [rdi - 1], al
cmp ebx, 0x13
jl 0x140058b20
mov rcx, r8
call fcn.140055c40
call fcn.140055de0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140053de0
call fcn.140053b10
call fcn.140055430
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm6, xmmword [rsp + 0x370]
lea rcx, str.The_gui_was_not_initialized
call fcn.1400131d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.The_librarys_was_not_initialized
call fcn.1400131d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3