Function at 0x1400583d0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x290
movaps xmmword [rax - 0x48], xmm6
mov r14, r9
mov r15, r8
mov edi, edx
mov r10d, ecx
xor r12d, r12d
lea r9, [rsp + 0x7d]
test ecx, ecx
jns 0x140058450
neg r10d
dec r9
mov eax, 0xcccccccd
mul r10d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r10b, cl
add r10b, 0x30
mov byte [r9], r10b
mov r10d, edx
test edx, edx
jne 0x140058412
dec r9
mov byte [r9], 0x2d
jmp 0x14005847a
dec r9
mov eax, 0xcccccccd
mul r10d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r10b, cl
add r10b, 0x30
mov byte [r9], r10b
mov r10d, edx
test edx, edx
jne 0x140058450
lea r8, [rsp + 0x7d]
mov rdx, r9
lea rcx, [rbp + 0x28]
call fcn.140063890
nop
mov dword [rsp + 0x30], 0xb1fff8f9
mov dword [rsp + 0x34], 0x8385b1b7
mov dword [rsp + 0x38], 0x8a909797
mov word [rsp + 0x3c], 0xb888
xor eax, eax
mov byte [rsp + 0x3e], al
mov edx, r12d
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, edx
lea eax, [rdx - 0x26]
xor byte [rsp + rcx + 0x30], al
inc edx
cmp edx, 0xe
jb 0x1400584c0
mov byte [rsp + 0x3e], 0
lea rax, [rsp + 0x30]
mov rsi, 0xffffffffffffffff
mov r9, rsi
inc r9
cmp byte [rax + r9], 0
jne 0x1400584e5
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x28]
call fcn.1400637a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140058568
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058563
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058563
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
movaps xmm6, xmmword [0x140074880]
mov rbx, qword [0x1400cb4f8]
mov dword [rsp + 0x30], 3
movups xmm0, xmmword [rbx + 0x38d8]
movups xmmword [rsp + 0x34], xmm0
lea rcx, [rbx + 0x47e8]
lea rdx, [rsp + 0x30]
call fcn.14001d580
movups xmmword [rbx + 0x38d8], xmm6
movss xmm0, dword [0x1400745cc]
movss dword [rsp + 0x30], xmm0
movss xmm1, dword [0x14007451c]
movss dword [rsp + 0x34], xmm1
lea rbx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rbx, qword [rbp - 0x78]
mov rcx, qword [0x1400cb4f8]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rdx, rbx
mov rcx, qword [rcx + 0x3ea0]
call fcn.140006d00
mov edx, eax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.14000ae20
mov rcx, qword [0x1400cb4f8]
mov rax, qword [rcx + 0x3ea0]
mov byte [rax + 0xb0], 1
mov rax, qword [rcx + 0x3ea0]
movss xmm6, dword [0x140074614]
cmp byte [rax + 0xb3], 0
jne 0x14005865b
mov qword [rsp + 0x30], 0
movaps xmm1, xmm6
lea rcx, [rsp + 0x30]
call fcn.1400146d0
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x140058668
mov rdx, qword [r15]
mov rcx, r14
call fcn.140032290
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140014a10
mov rbx, qword [0x1400cb4f8]
movss xmm1, dword [rbx + 0x381c]
movss xmm0, dword [rbx + 0x3820]
mov dword [rsp + 0x30], 0xb
movss dword [rsp + 0x34], xmm1
movss dword [rsp + 0x38], xmm0
lea rcx, [rbx + 0x47f8]
lea rdx, [rsp + 0x30]
call fcn.14001d490
mov qword [rbx + 0x381c], 0x41200000
mov rbx, qword [0x1400cb4f8]
movss xmm0, dword [rbx + 0x3824]
mov dword [rsp + 0x30], 0xc
movss dword [rsp + 0x34], xmm0
lea rcx, [rbx + 0x47f8]
lea rdx, [rsp + 0x30]
call fcn.14001d490
mov dword [rbx + 0x3824], 0x40a00000
movaps xmm6, xmmword [0x140074930]
mov rbx, qword [0x1400cb4f8]
mov dword [rsp + 0x30], 0x15
movups xmm0, xmmword [rbx + 0x39f8]
movups xmmword [rsp + 0x34], xmm0
lea rcx, [rbx + 0x47e8]
lea rdx, [rsp + 0x30]
call fcn.14001d580
movups xmmword [rbx + 0x39f8], xmm6
movaps xmm6, xmmword [0x140074980]
mov rbx, qword [0x1400cb4f8]
mov eax, 0x16
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rbx + 0x3a08]
movups xmmword [rsp + 0x34], xmm0
lea rcx, [rbx + 0x47e8]
lea rdx, [rsp + 0x30]
call fcn.14001d580
movups xmmword [rbx + 0x3a08], xmm6
movaps xmm6, xmmword [0x140074b80]
mov rbx, qword [0x1400cb4f8]
mov dword [rsp + 0x30], 0x17
movups xmm0, xmmword [rbx + 0x3a18]
movups xmmword [rsp + 0x34], xmm0
lea rcx, [rbx + 0x47e8]
lea rdx, [rsp + 0x30]
call fcn.14001d580
movups xmmword [rbx + 0x3a18], xmm6
mov qword [rsp + 0x30], 0
mov dword [rbp + 0x1d0], 0xa5aeb8
mov edx, r12d
nop
movsxd rcx, edx
lea eax, [rdx - 0x26]
xor byte [rbp + rcx + 0x1d0], al
inc edx
cmp edx, 3
jb 0x1400587c0
mov byte [rbp + 0x1d3], 0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1d0]
call fcn.140032ad0
test al, al
je 0x140058ed6
lea rcx, [rbp + 0x48]
call fcn.140054190
nop
lea rcx, [rbp - 0x18]
call fcn.140057900
mov rbx, rax
lea rax, [0x1400cb638]
cmp rax, rbx
je 0x14005888e
mov rdx, qword [0x1400cb650]
cmp rdx, 0x10
jb 0x140058853
mov rcx, qword [0x1400cb638]
inc rdx
cmp rdx, 0x1000
jb 0x14005884e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400588c0
mov rcx, r8
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [0x1400cb648], xmm0
mov byte [0x1400cb638], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x1400cb638], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x1400cb648], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1400588cc
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400588c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400588c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
lea r12, [rbp + 0x48]
mov r13, qword [rbp + 0x48]
cmp qword [rbp + 0x60], 0x10
cmovae r12, r13
movabs rbx, 0x7fffffffffffffff
mov r14, qword [rbp + 0x58]
cmp r14, rbx
ja 0x140058fb9
mov qword [rsp + 0x60], 0xf
cmp r14, 0x10
jae 0x140058932
mov qword [rsp + 0x58], r14
mov r8d, 0x10
mov rdx, r12
lea rcx, [rsp + 0x48]
call sub.VCRUNTIME140.dll_memmove
jmp 0x1400589c6
mov rax, r14
or rax, 0xf
cmp rax, rbx
jbe 0x14005896e
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140063fd0
mov rcx, rax
test rax, rax
je 0x140058e0e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400589a8
mov rbx, rax
cmp rax, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14005899a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140058fbf
jmp 0x14005894c
test rcx, rcx
je 0x1400589a6
call fcn.140063fd0
jmp 0x1400589a8
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], rbx
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x158]
call fcn.140053e40
mov rbx, rax
lea r9, [rsp + 0x7d]
test edi, edi
jns 0x140058a30
neg edi
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x1400589f0
dec r9
mov byte [r9], 0x2d
jmp 0x140058a58
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x140058a30
lea r8, [rsp + 0x7d]
mov rdx, r9
lea rcx, [rbp - 0x18]
call fcn.140063890
nop
movdqa xmm0, xmmword [0x140074e10]
movdqu xmmword [rbp + 0x68], xmm0
movdqa xmm1, xmmword [0x140074d20]
movdqu xmmword [rbp + 0x78], xmm1
movdqa xmm0, xmmword [0x140074c20]
movdqu xmmword [rbp + 0x88], xmm0
movdqa xmm1, xmmword [0x140074840]
movdqu xmmword [rbp + 0x98], xmm1
movdqa xmm0, xmmword [0x140074bf0]
movdqu xmmword [rbp + 0xa8], xmm0
movdqa xmm1, xmmword [0x140074c60]
movdqu xmmword [rbp + 0xb8], xmm1
movdqa xmm0, xmmword [str.jRqNGg]
movdqu xmmword [rbp + 0xc8], xmm0
movdqa xmm1, xmmword [0x140074760]
movdqu xmmword [rbp + 0xd8], xmm1
movdqa xmm0, xmmword [0x140074750]
movdqu xmmword [rbp + 0xe8], xmm0
movdqa xmm1, xmmword [0x140074830]
movdqu xmmword [rbp + 0xf8], xmm1
movdqa xmm0, xmmword [0x140074f00]
movdqu xmmword [rbp + 0x108], xmm0
movdqa xmm1, xmmword [0x140074fa0]
movdqu xmmword [rbp + 0x118], xmm1
movdqa xmm0, xmmword [0x140074f70]
movdqu xmmword [rbp + 0x128], xmm0
movdqa xmm1, xmmword [0x140074e70]
movdqu xmmword [rbp + 0x138], xmm1
mov dword [rbp + 0x148], 0xd7d6e1e3
mov dword [rbp + 0x14c], 0xa0e6d1c7
mov dword [rbp + 0x150], 0xabb1acaf
mov word [rbp + 0x154], 0xfab2
xor eax, eax
mov byte [rbp + 0x156], al
xor r12d, r12d
mov edx, r12d
nop dword [rax]
movsxd rcx, edx
lea eax, [rdx - 0x26]
xor byte [rbp + rcx + 0x68], al
inc edx
cmp edx, 0xee
jb 0x140058b80
mov byte [rbp + 0x156], r12b
lea rax, [rbp + 0x68]
mov r9, rsi
inc r9
cmp byte [rax + r9], r12b
jne 0x140058ba2
lea r8, [rbp + 0x68]
lea rcx, [rbp - 0x18]
call fcn.1400637a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov dword [rsp + 0x30], 0xb0b3b8fc
mov dword [rsp + 0x34], 0x958ebab3
mov word [rsp + 0x38], 0xdf
mov edx, r12d
nop
movsxd rcx, edx
lea eax, [rdx - 0x26]
xor byte [rsp + rcx + 0x30], al
inc edx
cmp edx, 9
jb 0x140058c00
mov byte [rsp + 0x39], 0
lea rax, [rsp + 0x30]
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x140058c20
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x38]
call fcn.140062dd0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x1400cb638]
lea rcx, [rbp - 0x58]
call fcn.140062d40
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r9, rbx
lea r8, [rsp + 0x68]
lea rcx, [rbp + 8]
call fcn.1400635a0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140058ce9
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058ce3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058ce3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140058d27
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058d22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058d22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp - 0x48], xmm0
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140058d76
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058d71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058d71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140058dc5
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058dc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058dc0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x170]
cmp rdx, 0x10
jb 0x140058e1a
inc rdx
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058e15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058e15
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
lea r8, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae r8, qword [rbp + 8]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [0x1400cb54e], 1
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140058e87
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058e82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058e82
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], 0
mov rax, qword [rbp + 0x60]
cmp rax, 0x10
jb 0x140058ed6
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140058ece
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058ece
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.140063c10
mov ecx, 2
call fcn.140003e40
mov ecx, 3
call fcn.140003bc0
call fcn.14000b090
mov ecx, 1
call fcn.140003bc0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140058f38
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058f33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058f33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x140058f7f
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140058f7a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140058fb2
mov rcx, r8
call fcn.140063c10
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rbx, qword [rsp + 0x2d8]
movaps xmm6, xmmword [rsp + 0x280]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14003e100
nop
call fcn.14003e040
int3