Function at 0x7ff6051c3ee0
Capabilities:
Authenticate hmac
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x7ff60566c600]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.7ff6051b3c30
movdqa xmm0, xmmword [0x7ff605631f40]
movdqu xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x7ff605631fd0]
movdqu xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x7ff6056329a0]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x4f4e594a
mov dword [rsp + 0x74], 0x525355
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x41], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x42], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x43], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x44], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x45], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x46], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x47], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x48], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x49], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x4a], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x4b], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x4c], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x4d], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x4e], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x4f], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x50], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x52], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x53], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x54], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x55], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x56], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x57], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x58], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x59], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x5a], al
movzx eax, byte [rsp + 0x40]
xor byte [rsp + rcx + 0x5b], al
add rcx, 0x1b
cmp rcx, 0x36
jb 0x7ff6051c3f60
mov byte [rsp + 0x77], bl
lea rdx, [rsp + 0x41]
lea rcx, [rsp + 0x98]
call fcn.7ff6051b4010
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rbx
mov r8d, 4
lea rdx, [0x7ff60562fd48]
lea rcx, [rsp + 0x78]
call fcn.7ff605163830
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x98]
call fcn.7ff6051c8dc0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.7ff6051cefa0
mov rcx, qword [0x7ff60574b138]
lea r9, [0x7ff60574b128]
cmp qword [0x7ff60574b140], 0xf
cmova r9, qword [0x7ff60574b128]
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x7ff6051c40f2
mov rax, qword [rax]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.7ff6051cfdf0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.7ff605162330
cmp rbx, 0xffffffffffffffff
je 0x7ff6051c4225
mov byte [rsp + 0x30], 0x1e
mov al, 0x6b
mov cl, 0x6e
mov dl, 0x3e
mov r8b, 0x6a
mov r9b, 0x71
movzx r10d, dl
mov r11b, 0x7a
mov bl, 0x7f
movzx edi, r8b
mov sil, 0x7b
movzx r14d, dl
mov r15b, 0x3f
xor r12d, r12d
xor al, 0x1e
mov byte [rsp + 0x31], al
xor cl, 0x1e
mov byte [rsp + 0x32], cl
xor dl, 0x1e
mov byte [rsp + 0x33], dl
xor r8b, 0x1e
mov byte [rsp + 0x34], r8b
xor r9b, 0x1e
mov byte [rsp + 0x35], r9b
xor r10b, 0x1e
mov byte [rsp + 0x36], r10b
xor r11b, 0x1e
mov byte [rsp + 0x37], r11b
xor bl, 0x1e
mov byte [rsp + 0x38], bl
xor dil, 0x1e
mov byte [rsp + 0x39], dil
xor sil, 0x1e
mov byte [rsp + 0x3a], sil
xor r14b, 0x1e
mov byte [rsp + 0x3b], r14b
xor r15b, 0x1e
mov byte [rsp + 0x3c], r15b
mov byte [rsp + 0x3d], r12b
lea rax, [rsp + 0x31]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r12b
jne 0x7ff6051c41b5
mov rax, qword [0x7ff60574b160]
cmp rbx, rax
ja 0x7ff6051c41fa
lea rdi, [0x7ff60574b148]
cmp rax, 0xf
cmova rdi, qword [0x7ff60574b148]
mov qword [0x7ff60574b158], rbx
mov r8, rbx
lea rdx, [rsp + 0x31]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [rdi + rbx], r12b
jmp 0x7ff6051c420e
lea r9, [rsp + 0x31]
mov rdx, rbx
lea rcx, [0x7ff60574b148]
call fcn.7ff6051657a0
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
mov byte [0x7ff60566c769], r12b
jmp 0x7ff6051c44c4
mov byte [rsp + 0x30], 0x16
mov al, 0x79
mov cl, 0x63
mov dl, 0x62
mov r8b, 0x72
mov r9b, 0x77
movzx r10d, dl
mov r11b, 0x73
movzx ebx, r8b
mov dil, 0x37
xor esi, esi
xor al, 0x16
mov byte [rsp + 0x31], al
xor cl, 0x16
mov byte [rsp + 0x32], cl
xor dl, 0x16
mov byte [rsp + 0x33], dl
xor r8b, 0x16
mov byte [rsp + 0x34], r8b
xor r9b, 0x16
mov byte [rsp + 0x35], r9b
xor r10b, 0x16
mov byte [rsp + 0x36], r10b
xor r11b, 0x16
mov byte [rsp + 0x37], r11b
xor bl, 0x16
mov byte [rsp + 0x38], bl
xor dil, 0x16
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
lea rax, [rsp + 0x31]
mov rbx, 0xffffffffffffffff
mov rsi, rbx
inc rsi
cmp byte [rax + rsi], 0
jne 0x7ff6051c42a2
mov rax, qword [0x7ff60574b160]
cmp rsi, rax
ja 0x7ff6051c42e7
lea rdi, [0x7ff60574b148]
cmp rax, 0xf
cmova rdi, qword [0x7ff60574b148]
mov qword [0x7ff60574b158], rsi
mov r8, rsi
lea rdx, [rsp + 0x31]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [rdi + rsi], 0
jmp 0x7ff6051c42fb
lea r9, [rsp + 0x31]
mov rdx, rsi
lea rcx, [0x7ff60574b148]
call fcn.7ff6051657a0
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
movdqa xmm1, xmmword [0x7ff6056327e0]
movdqu xmmword [rsp + 0x78], xmm1
mov cl, 0x47
mov dl, 0x46
mov r8b, 0x5c
mov r10b, 0x5a
mov r11b, 0x5b
mov dil, 0x15
mov sil, 0x5d
mov r14b, 0x50
movzx r15d, cl
movzx r12d, r14b
movzx r13d, dil
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r9d, xmm1
xor al, r9b
mov byte [rsp + 0x79], al
xor byte [rsp + 0x7a], r9b
xor byte [rsp + 0x7b], r9b
xor byte [rsp + 0x7c], r9b
xor byte [rsp + 0x7d], r9b
xor byte [rsp + 0x7e], r9b
xor byte [rsp + 0x7f], r9b
xor byte [rsp + 0x80], r9b
xor byte [rsp + 0x81], r9b
xor byte [rsp + 0x82], r9b
xor byte [rsp + 0x83], r9b
xor byte [rsp + 0x84], r9b
xor byte [rsp + 0x85], r9b
xor byte [rsp + 0x86], r9b
xor byte [rsp + 0x87], r9b
xor cl, r9b
mov byte [rsp + 0x88], cl
xor dl, r9b
mov byte [rsp + 0x89], dl
xor r8b, r9b
mov byte [rsp + 0x8a], r8b
xor r10b, r9b
mov byte [rsp + 0x8b], r10b
xor r11b, r9b
mov byte [rsp + 0x8c], r11b
xor dil, r9b
mov byte [rsp + 0x8d], dil
xor sil, r9b
mov byte [rsp + 0x8e], sil
xor r14b, r9b
mov byte [rsp + 0x8f], r14b
xor r15b, r9b
mov byte [rsp + 0x90], r15b
xor r12b, r9b
mov byte [rsp + 0x91], r12b
xor r13b, r9b
mov byte [rsp + 0x92], r13b
mov al, 0x14
xor al, r9b
mov byte [rsp + 0x93], al
mov byte [rsp + 0x94], 0
lea rax, [rsp + 0x79]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff6051c4440
mov rax, qword [0x7ff60574b160]
cmp rbx, rax
ja 0x7ff6051c4485
cmp rax, 0xf
lea rdi, [0x7ff60574b148]
cmova rdi, qword [0x7ff60574b148]
mov qword [0x7ff60574b158], rbx
mov r8, rbx
lea rdx, [rsp + 0x79]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy_1
mov byte [rdi + rbx], 0
jmp 0x7ff6051c4499
lea r9, [rsp + 0x79]
mov rdx, rbx
lea rcx, [0x7ff60574b148]
call fcn.7ff6051657a0
mov ecx, 0x3e8
call qword [sym.imp.kernel32.dll_Sleep]
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x7ff60562ffa0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.shell32.dll_ShellExecuteW]
nop
movzx edx, byte [rsp + 0x98]
lea rcx, [rsp + 0xa0]
call fcn.7ff6051cb2c0
nop
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.7ff60542acb0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret