Function at 0x140002e60
Capabilities:
Create thread
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov rcx, qword [0x14003e740]
call fcn.140001e10
test al, al
jne 0x140002fb5
mov byte [rbp - 0x19], 0xd0
mov byte [rbp - 0x18], 0xf9
movzx eax, byte [rbp - 0x19]
mov r9d, ebx
movabs rdi, 0xd36b413cf5ec52f5
mov r11, rdi
lea rax, [rbp - 0x19]
sub r11, rax
lea r10d, [rbx + 0xf]
lea rdx, [rbp - 0x19]
add rdx, r9
movsx r8, byte [rdx]
mov rcx, r9
and ecx, r10d
cmp rcx, r10
cmovae rcx, r10
shl cl, 2
mov rax, rdi
shr rax, cl
and al, r10b
add dl, r11b
xor al, dl
xor al, r8b
mov byte [rbp + r9 - 0x19], al
inc r9
cmp r9, 2
jb 0x140002ec2
mov byte [rbp + 0x3f], 0xcf
mov byte [rbp + 0x40], 0xd2
mov byte [rbp + 0x41], 0xc8
mov byte [rbp + 0x42], 0xcb
mov byte [rbp + 0x43], 0xdf
mov byte [rbp + 0x44], 0xd6
mov byte [rbp + 0x45], 0xc2
mov byte [rbp + 0x46], 0x99
mov byte [rbp + 0x47], 0xde
mov byte [rbp + 0x48], 0xd6
mov byte [rbp + 0x49], 0xd3
mov byte [rbp + 0x4a], 0xd3
mov byte [rbp + 0x4b], 0xc4
mov byte [rbp + 0x4c], 0xc7
mov byte [rbp + 0x4d], 0xd9
mov byte [rbp + 0x4e], 0xba
movzx eax, byte [rbp + 0x3f]
movabs r11, 0x67f87d1dd85292ad
mov r9, r11
lea rax, [rbp + 0x3f]
sub r9, rax
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbp + 0x3f]
add rdx, rbx
movsx r8, byte [rdx]
mov rcx, rbx
and ecx, r10d
cmp rcx, r10
cmovae rcx, r10
shl cl, 2
mov rax, r11
shr rax, cl
and al, r10b
add dl, r9b
xor al, dl
xor al, r8b
mov byte [rbp + rbx + 0x3f], al
inc rbx
cmp rbx, 0x10
jb 0x140002f60
xor r9d, r9d
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0x3f]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 8
call fcn.140030460
lea rcx, [0x140002e40]
mov qword [rax], rcx
mov qword [rbp + 7], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140003130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x1400030f2
mov qword [rbp + 7], rbx
cmp dword [rbp - 1], 0
je 0x1400030e6
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1400030e6
xorps xmm0, xmm0
movaps xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp - 9], xmm0
mov rcx, qword [0x14003e740]
call fcn.1400021c0
call fcn.140002850
mov byte [rbp + 0x37], 0x70
mov byte [rbp + 0x38], 0x67
mov byte [rbp + 0x39], 0x7a
mov byte [rbp + 0x3a], 0x7e
mov byte [rbp + 0x3b], 0x60
mov byte [rbp + 0x3c], 5
movzx eax, byte [rbp + 0x37]
movabs r11, 0xff70a6a864fc5805
mov r9, r11
lea rax, [rbp + 0x37]
sub r9, rax
mov r10d, 0xf
nop word [rax + rax]
lea rdx, [rbp + 0x37]
add rdx, rbx
movsx r8, byte [rdx]
mov rcx, rbx
and ecx, r10d
cmp rcx, r10
cmovae rcx, r10
shl cl, 2
mov rax, r11
shr rax, cl
and al, r10b
add dl, r9b
xor al, dl
xor al, r8b
mov byte [rbp + rbx + 0x37], al
inc rbx
cmp rbx, 6
jb 0x140003080
lea rcx, [rbp + 0x37]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140030440
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 1], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3