Function at 0x14000a57c
Capabilities:
Create thread
Encode data using xor
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov rax, qword [0x140081040]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
xor r15d, r15d
call fcn.140002210
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000afde
mov rcx, rax
call fcn.140006174
mov rcx, rbx
test rax, rax
jne 0x14000a5e6
call fcn.140002a20
jmp 0x14000b001
call fcn.140002a20
call fcn.140009f6c
mov rcx, r15
test al, al
jne 0x14000a629
movdqa xmm0, xmmword [0x140077000]
movdqu xmmword [rbp + 0x30], xmm0
mov word [rbp + 0x40], 0x13
mov al, byte [rbp + 0x30]
xor byte [rbp + rcx + 0x31], al
inc rcx
cmp rcx, 0x10
jb 0x14000a60a
mov byte [rbp + 0x41], r15b
lea rcx, [rbp + 0x31]
call fcn.140009ec0
jmp 0x14000a627
movdqa xmm0, xmmword [0x140076f20]
movdqu xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], 0xd105b14
mov word [rbp + 0x64], 0x10
mov al, byte [rbp + 0x50]
xor byte [rbp + rcx + 0x51], al
inc rcx
cmp rcx, 0x14
jb 0x14000a643
mov byte [rbp + 0x65], r15b
lea rcx, [rbp + 0x51]
call fcn.14000a0cc
mov dword [0x140095e78], eax
test eax, eax
jne 0x14000a6d9
movdqa xmm0, xmmword [0x140076fd0]
movdqu xmmword [rbp + 0x68], xmm0
movdqa xmm1, xmmword [0x140076fe0]
movdqu xmmword [rbp + 0x78], xmm1
movdqa xmm0, xmmword [str.5f_6_f_2f_F]
movdqu xmmword [rbp + 0x88], xmm0
mov dword [rbp + 0x98], 0x23346622
mov dword [rbp + 0x9c], 0x34273235
mov dword [rbp + 0xa0], 0x4c6832
mov rcx, r15
lea edx, [rax + 0x3a]
mov al, byte [rbp + 0x68]
xor byte [rbp + rcx + 0x69], al
inc rcx
cmp rcx, rdx
jb 0x14000a6b8
mov byte [rbp + 0xa3], r15b
lea rcx, [rbp + 0x69]
call fcn.140009ec0
jmp 0x14000a6d7
call fcn.140009f6c
test al, al
jne 0x14000a72f
movdqa xmm0, xmmword [0x1400770a0]
movdqu xmmword [rbp + 0x68], xmm0
movdqa xmm1, xmmword [0x1400770e0]
movdqu xmmword [rbp + 0x78], xmm1
mov word [rbp + 0x88], 0x3c
mov rcx, r15
mov al, byte [rbp + 0x68]
xor byte [rbp + rcx + 0x69], al
inc rcx
cmp rcx, 0x20
jb 0x14000a708
mov byte [rbp + 0x89], r15b
lea rcx, [rbp + 0x69]
call fcn.140009ec0
xor al, al
jmp 0x14000b003
mov cl, 0x66
mov dword [rbp + 8], 0x4093466
mov dword [rbp + 0xc], 0x1e090a
mov rax, r15
mov r12d, 6
xor byte [rbp + rax + 9], cl
inc rax
cmp rax, r12
jae 0x14000a759
mov cl, byte [rbp + 8]
jmp 0x14000a748
mov byte [rbp + 0xf], r15b
lea rdx, [rbp + 9]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x140095f18], rax
call fcn.14000a178
lea rcx, [rax + 0x10]
call fcn.14000bee4
mov rdi, rax
call fcn.14000a178
lea rcx, [rax + 0x118]
call fcn.14000bee4
lea rcx, [rax + 0x198]
call fcn.14000bee4
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rdx, [0x140009f50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rbx, rax
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.14000b768
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14000a7e6
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140006bd8
lea rdx, [0x140006a94]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov r13d, 0x1000
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x14000a845
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, r13
jb 0x14000a840
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a840
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e9f4
mov r14b, 0x60
test rdi, rdi
jne 0x14000a906
lea edx, [rdi + 0x3a]
mov dword [rbp + 0x10], 0x545f603a
mov dword [rbp + 0x14], 0x574f53
mov rax, r15
xor byte [rbp + rax + 0x11], dl
inc rax
cmp rax, r12
jae 0x14000a876
mov dl, byte [rbp + 0x10]
jmp 0x14000a865
mov byte [rbp + 0x17], r15b
movdqa xmm0, xmmword [0x140076ef0]
movdqa xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x140076f90]
movdqa xmmword [rbp + 0x100], xmm1
movdqa xmm0, xmmword [0x140076f50]
movdqa xmmword [rbp + 0x110], xmm0
movdqa xmm1, xmmword [0x140076f70]
movdqa xmmword [rbp + 0x120], xmm1
mov dword [rbp + 0x130], 0x57041902
mov word [rbp + 0x134], 0x7c
mov rcx, r15
mov al, byte [rbp + 0xf0]
xor byte [rbp + rcx + 0xf1], al
inc rcx
cmp rcx, 0x44
jb 0x14000a8d0
mov byte [rbp + 0x135], r15b
mov r9d, 0x10
lea r8, [rbp + 0x11]
lea rdx, [rbp + 0xf1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rbx, qword [rsp + 0x50]
test rbx, rbx
jne 0x14000a9be
mov al, 0x32
mov dword [rbp + 0x18], 0x5c576832
mov dword [rbp + 0x1c], 0x5f475b
mov rcx, r15
xor byte [rbp + rcx + 0x19], al
inc rcx
cmp rcx, r12
jae 0x14000a938
mov al, byte [rbp + 0x18]
jmp 0x14000a927
mov byte [rbp + 0x1f], r15b
movdqa xmm0, xmmword [0x140076fb0]
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmm1, xmmword [0x140076fa0]
movdqa xmmword [rbp + 0x150], xmm1
movdqa xmm0, xmmword [0x140076f80]
movdqa xmmword [rbp + 0x160], xmm0
movdqa xmm1, xmmword [0x1400770b0]
movdqa xmmword [rbp + 0x170], xmm1
mov word [rbp + 0x180], 0x73
mov rcx, r15
mov al, byte [rbp + 0x140]
xor byte [rbp + rcx + 0x141], al
inc rcx
cmp rcx, 0x40
jb 0x14000a988
mov byte [rbp + 0x181], r15b
mov r9d, 0x10
lea r8, [rbp + 0x19]
lea rdx, [rbp + 0x141]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [0x140095ee8], rbx
mov dword [rbp + 0x20], 0x10c3060
mov dword [rbp + 0x24], 0x13120519
mov byte [rbp + 0x28], r15b
mov rax, r15
xor byte [rbp + rax + 0x21], r14b
inc rax
cmp rax, 7
jae 0x14000a9ee
mov r14b, byte [rbp + 0x20]
jmp 0x14000a9da
mov byte [rbp + 0x28], r15b
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r15
mov qword [rbp + 0xe0], r15
lea rax, [rbp + 0x21]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x14000aa12
lea rdx, [rbp + 0x21]
lea rcx, [rbp + 0xc8]
call fcn.140001c50
nop
lea r8, [rbp + 0xc8]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.14000ba8c
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0xf
jbe 0x14000aa7f
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, r13
jb 0x14000aa7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000abbb
call fcn.14005e9f4
mov rbx, qword [rbp - 0x20]
test rbx, rbx
jne 0x14000ab2d
mov cl, 0x6b
mov dword [rbp], 0x50e316b
mov dword [rbp + 4], 0x61e02
mov rax, r15
xor byte [rbp + rax + 1], cl
inc rax
cmp rax, r12
jae 0x14000aab0
mov cl, byte [rbp]
jmp 0x14000aa9f
mov byte [rbp + 7], r15b
movdqa xmm0, xmmword [0x140076f40]
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x140076f30]
movdqa xmmword [rbp + 0x1a0], xmm1
movdqa xmm0, xmmword [0x1400770c0]
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x140076f00]
movdqa xmmword [rbp + 0x1c0], xmm1
mov rcx, r15
mov al, byte [rbp + 0x190]
xor byte [rbp + rcx + 0x191], al
inc rcx
cmp rcx, 0x3e
jb 0x14000aaf7
mov byte [rbp + 0x1cf], r15b
mov r9d, 0x10
lea r8, [rbp + 1]
lea rdx, [rbp + 0x191]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], 9
mov qword [rbp + 0xc0], 0xf
movsd xmm0, qword [str.Workspace]
movsd qword [rbp + 0xa8], xmm0
mov al, byte [0x140072db8]
mov byte [rbp + 0xb0], al
mov byte [rbp + 0xb1], r15b
lea r8, [rbp + 0xa8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14000ba8c
nop
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x14000abc7
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, r13
jb 0x14000abc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000abc2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005e9f4
mov rax, qword [rsp + 0x70]
mov qword [0x140095f10], rax
mov qword [0x140095ed8], rbx
mov qword [0x140095f20], rdi
mov rcx, qword [0x140095ee8]
add rcx, 0x160
call fcn.14000bee4
lea rcx, [rbx + 0x100]
mov qword [rbp - 0x60], r15
mov ebx, 8
mov r8d, ebx
lea rdx, [rbp - 0x60]
call fcn.140009fb4
mov rax, qword [rbp - 0x60]
mov qword [0x140095f08], rax
mov ecx, ebx
call fcn.14005e9b0
lea rcx, [fcn.140009804]
mov qword [rax], rcx
mov qword [rbp - 0x80], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea rdi, [0x14000c4ec]
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x14000afd0
cmp dword [rbp - 0x28], r15d
je 0x14000afc4
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000afc4
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov ecx, ebx
call fcn.14005e9b0
lea rcx, [0x140009630]
mov qword [rax], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x40], rax
test rax, rax
je 0x14000afb6
cmp dword [rbp - 0x38], r15d
je 0x14000afaa
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000afaa
xorps xmm0, xmm0
movaps xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm0
lea eax, [rbx - 7]
xchg byte [0x140095ebc], al
mov ecx, ebx
call fcn.14005e9b0
lea rcx, [0x140012aa4]
mov qword [rax], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x14000af9c
mov qword [rbp - 0x18], rax
cmp dword [rbp - 0x68], r15d
je 0x14000af90
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000af90
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov ecx, ebx
call fcn.14005e9b0
lea rcx, [0x1400093ac]
mov qword [rax], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14000af82
cmp dword [rbp - 0x78], r15d
je 0x14000af76
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000af76
lea ecx, [rbx + 0x10]
call fcn.14005e9b0
lea rcx, [rbp - 0x18]
mov qword [rax], rcx
lea rcx, [rbp - 0x70]
mov qword [rax + 8], rcx
lea rcx, [0x140012da8]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14000c514]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x50], rax
test rax, rax
je 0x14000af68
cmp dword [rbp - 0x48], r15d
je 0x14000af5c
movaps xmm0, xmmword [rbp - 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000af5c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
mov ecx, ebx
call fcn.14005e9b0
lea rcx, [0x14005c824]
mov qword [rax], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rbp + 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14000c4ec]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14000af4e
cmp dword [rbp + 0x28], r15d
je 0x14000af42
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000af42
mov qword [rsp + 0x70], 1
lea rcx, [rsp + 0x70]
call fcn.140009c20
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x140095f18]
sete byte [0x140095ed6]
mov cl, 0x19
mov dword [rbp], 0x7b764b19
mov dword [rbp + 4], 0x617675
mov rax, r15
xor byte [rbp + rax + 1], cl
inc rax
cmp rax, r12
jae 0x14000af24
mov cl, byte [rbp]
jmp 0x14000af13
mov byte [rbp + 7], r15b
lea rdx, [rbp + 1]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000aee2
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x28], r15d
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x48], r15d
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x78], r15d
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r15d
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x38], r15d
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x28], r15d
mov ecx, r12d
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, str._Zenium_:_0x01
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140006924
lea rdx, [0x140006a94]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov al, 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14005e990
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret