Function at 0x140075070
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x738]
sub rsp, 0x830
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1406b92c0]
xor rax, rsp
mov qword [rbp + 0x710], rax
xor r14d, r14d
mov dword [rbp + 0x630], 0x109f8a59
mov dword [rbp + 0x634], 0xa794375
mov dword [rbp + 0x638], 0xc6f7f1fc
mov dword [rbp + 0x63c], 0x168348a8
mov dword [rbp + 0x640], 0xe7718a4b
mov dword [rbp + 0x644], 0x9b634877
mov dword [rbp + 0x648], 0x52efd433
mov dword [rbp + 0x64c], 0x645f01f
mov dword [rbp + 0x650], 0xa2695ca3
mov dword [rbp + 0x654], 0x5c5b7087
mov dword [rbp + 0x658], 0x68cf6251
mov dword [rbp + 0x65c], 0xeccbfe75
mov dword [rbp + 0x660], 0x9f8fd2d1
mov dword [rbp + 0x664], 0x83615cb0
mov dword [rbp + 0x668], 0xcecda97f
mov dword [rbp + 0x66c], 0xda21dccb
mov dword [rbp + 0x670], 0xd6a5d8ef
mov dword [rbp + 0x674], 0x42a1d4eb
mov dword [rbp + 0x678], 0x364d7057
mov dword [rbp + 0x67c], 0x5e213c6b
mov dword [rbp + 0x680], 0xf7afe471
mov dword [rbp + 0x684], 0x5ea51008
mov dword [rbp + 0x688], 0x4acae9bb
mov dword [rbp + 0x68c], 0xc4954077
mov dword [rbp + 0x690], 0xba390739
mov dword [rbp + 0x694], 0x4e2c8097
mov dword [rbp + 0x698], 0x35193ff9
mov dword [rbp + 0x69c], 0xd4343bfd
mov dword [rbp + 0x6a0], 0xee2142e9
mov dword [rbp + 0x6a4], 0x1cf366fd
mov dword [rbp + 0x6a8], 0x96daa23a
mov dword [rbp + 0x6ac], 0x1a1114ab
mov dword [rbp + 0x6b0], 0x9e975877
mov dword [rbp + 0x6b4], 0x82cc8645
mov dword [rbp + 0x6b8], 0x1f655897
mov dword [rbp + 0x6bc], 0x8c854430
mov dword [rbp + 0x6c0], 0xf2b5ec33
mov dword [rbp + 0x6c4], 0x2a83b068
mov dword [rbp + 0x6c8], 0xb05fcfe1
mov dword [rbp + 0x6cc], 0x860b767d
mov dword [rbp + 0x6d0], 0x55e98409
mov dword [rbp + 0x6d4], 0x61fb7b0d
mov dword [rbp + 0x6d8], 0x909ffa5a
mov dword [rbp + 0x6dc], 0x94d3bef5
mov dword [rbp + 0x6e0], 0x857d2f9
mov dword [rbp + 0x6e4], 0x6964dcd3
mov dword [rbp + 0x6e8], 0x388d574a
mov dword [rbp + 0x6ec], 0x62d344d3
mov dword [rbp + 0x6f0], 0x53df2c1
mov dword [rbp + 0x6f4], 0x53f36cfd
mov dword [rbp + 0x6f8], 0xf6fd4164
mov dword [rbp + 0x6fc], 0xba59c8eb
mov dword [rbp + 0x700], 0xd017586f
mov byte [rbp + 0x704], 0xb1
mov ecx, r14d
lea rdx, [rbp + 0x630]
nop dword [rax]
movzx eax, byte [rdx]
dec al
xor al, 0xb2
sub al, cl
dec al
ror al, 3
add al, cl
neg al
xor al, 0xab
add al, cl
mov byte [rdx], al
inc ecx
lea rdx, [rdx + 1]
cmp ecx, 0xd5
jb 0x1400752d0
mov dword [rbp + 0x570], 0x32333021
mov dword [rbp + 0x574], 0xcdcae238
mov dword [rbp + 0x578], 0xd815080c
mov dword [rbp + 0x57c], 0x19461d19
mov dword [rbp + 0x580], 0x33332640
mov dword [rbp + 0x584], 0x41f9201d
mov dword [rbp + 0x588], 0x3b064538
mov dword [rbp + 0x58c], 0x49443c39
mov dword [rbp + 0x590], 0x100c0d01
mov dword [rbp + 0x594], 0xdfea1711
mov dword [rbp + 0x598], 0xe0e0dedb
mov dword [rbp + 0x59c], 0xecebe5e3
mov dword [rbp + 0x5a0], 0xaaa70302
mov dword [rbp + 0x5a4], 0xae0d07a5
mov dword [rbp + 0x5a8], 0xb26111e
mov dword [rbp + 0x5ac], 0x1c14120f
mov dword [rbp + 0x5b0], 0x37383117
mov dword [rbp + 0x5b4], 0x3a33313a
mov dword [rbp + 0x5b8], 0x3b3d3929
mov dword [rbp + 0x5bc], 0x62223046
mov dword [rbp + 0x5c0], 0x691f786a
mov dword [rbp + 0x5c4], 0x717985d4
mov dword [rbp + 0x5c8], 0x6e7a7d71
mov dword [rbp + 0x5cc], 0x7431728c
mov dword [rbp + 0x5d0], 0xe77eccca
mov dword [rbp + 0x5d4], 0x949199f5
mov dword [rbp + 0x5d8], 0x9d9d9b9a
mov dword [rbp + 0x5dc], 0xffb9efa6
mov dword [rbp + 0x5e0], 0xc8c5cd04
mov dword [rbp + 0x5e4], 0x1320c0bd
mov dword [rbp + 0x5e8], 0x32dd1bd2
mov dword [rbp + 0x5ec], 0xdbdf012a
mov dword [rbp + 0x5f0], 0x74767382
mov dword [rbp + 0x5f4], 0x5e7d8d7a
mov dword [rbp + 0x5f8], 0x7b8a846e
mov dword [rbp + 0x5fc], 0x998c8984
mov dword [rbp + 0x600], 0xb562b659
mov dword [rbp + 0x604], 0x776d60bb
mov dword [rbp + 0x608], 0xbf6968bb
mov dword [rbp + 0x60c], 0x7c7c757d
mov dword [rbp + 0x610], 0xa856a3a3
mov dword [rbp + 0x614], 0xaf60a44d
mov dword [rbp + 0x618], 0x5f68adaa
mov dword [rbp + 0x61c], 0x6eb45f69
mov dword [rbp + 0x620], 0x84272484
mov dword [rbp + 0x624], 0xd494d4d6
mov dword [rbp + 0x628], 0x8eda9caf
mov dword [rbp + 0x62c], 0x8ea9958f
mov edx, r14d
lea r8, [rbp + 0x570]
movzx eax, dl
add al, al
sub al, byte [r8]
xor al, 0x7c
mov ecx, reloc.WS2_32.dll_WSAStartup
sub cl, al
xor cl, dl
neg cl
xor cl, 0x93
mov eax, Ordinal_60
sub al, cl
sub al, dl
not al
xor al, dl
mov byte [r8], al
inc edx
lea r8, [r8 + 1]
cmp edx, 0xc0
jb 0x1400754e0
mov dword [rbp + 0x4a0], 0x17dde711
mov dword [rbp + 0x4a4], 0x2d8b6313
mov dword [rbp + 0x4a8], 0x93f12723
mov dword [rbp + 0x4ac], 0x35f34549
mov dword [rbp + 0x4b0], 0xf93d033b
mov dword [rbp + 0x4b4], 0xf5c15751
mov dword [rbp + 0x4b8], 0x49ab35eb
mov dword [rbp + 0x4bc], 0xf5f7ef49
mov dword [rbp + 0x4c0], 0xd3c7d5d1
mov dword [rbp + 0x4c4], 0x494bd119
mov dword [rbp + 0x4c8], 0xa38fa345
mov dword [rbp + 0x4cc], 0xb35d55a5
mov dword [rbp + 0x4d0], 0x4745415f
mov dword [rbp + 0x4d4], 0xbf949641
mov dword [rbp + 0x4d8], 0x2a36bd9a
mov dword [rbp + 0x4dc], 0xf49a3030
mov dword [rbp + 0x4e0], 0xe2dceae8
mov dword [rbp + 0x4e4], 0xfe9290d8
mov dword [rbp + 0x4e8], 0x224a4c98
mov dword [rbp + 0x4ec], 0x239e2e24
mov dword [rbp + 0x4f0], 0x293d2d6d
mov dword [rbp + 0x4f4], 0xcd299477
mov dword [rbp + 0x4f8], 0x61dddd7d
mov dword [rbp + 0x4fc], 0xdf33db02
mov dword [rbp + 0x500], 0x551d4147
mov dword [rbp + 0x504], 0xffb2c85d
mov dword [rbp + 0x508], 0x470296ba
mov dword [rbp + 0x50c], 0xdaaca87a
mov dword [rbp + 0x510], 0x94bcc8c6
mov dword [rbp + 0x514], 0x16ba38c4
mov dword [rbp + 0x518], 0x30a498ca
mov dword [rbp + 0x51c], 0x9c8ce894
mov dword [rbp + 0x520], 0x1208886c
mov dword [rbp + 0x524], 0x707c906a
mov dword [rbp + 0x528], 0x289a9c98
mov dword [rbp + 0x52c], 0x102a70ce
mov dword [rbp + 0x530], 0xda802084
mov dword [rbp + 0x534], 0xf6f0fc3a
mov dword [rbp + 0x538], 0xa6a46cc6
mov dword [rbp + 0x53c], 0x52928cec
mov dword [rbp + 0x540], 0x9ce6c2f2
mov dword [rbp + 0x544], 0xa0fc985e
mov dword [rbp + 0x548], 0x26a0e5e
mov dword [rbp + 0x54c], 0x58588c52
mov dword [rbp + 0x550], 0x40bea0a0
mov dword [rbp + 0x554], 0x7676b891
mov dword [rbp + 0x558], 0x376c9b62
mov dword [rbp + 0x55c], 0x958d108f
mov dword [rbp + 0x560], 0x7e00e7e9
mov word [rbp + 0x564], 0xfbd9
mov byte [rbp + 0x566], WSAStartup
mov edx, r14d
lea r8, [rbp + 0x4a0]
nop word [rax + rax]
movzx ecx, dl
xor cl, byte [r8]
add cl, 0x25
xor cl, 0xb2
add cl, dl
neg cl
xor cl, 0xdf
mov eax, 1
sub al, cl
xor al, 0x8e
ror al, 1
add al, dl
mov byte [r8], al
inc edx
lea r8, [r8 + 1]
cmp edx, 0xc7
jb 0x140075720
lea rcx, [rbp + 0x100]
call fcn.140075dc0
nop
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x98]
call fcn.140014f30
nop
lea rdx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0xf
cmova rdx, qword [rbp + 0x98]
mov r8, qword [rbp + 0xa8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140039c30
lea rdx, [0x1400166a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x58]
call fcn.140055f50
nop
lea rdx, [rbp - 0x78]
mov rcx, rax
call fcn.1400542b0
nop
mov r8d, 4
lea rdx, str.NPI
mov rcx, rax
call fcn.140015c40
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rbp - 0x78]
call fcn.1400159a0
nop
lea rcx, [rbp - 0x58]
call fcn.140015930
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rax, qword [rbp + 0x40]
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x68], rax
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400190f0
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
call fcn.14028ecb0
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140075cdf
lea rcx, [rsp + 0x48]
call fcn.140015930
lea rcx, [rbp + 0x98]
mov rbx, qword [rbp + 0x98]
mov rdi, qword [rbp + 0xb0]
cmp rdi, 0xf
cmova rcx, rbx
mov qword [rsp + 0x20], 2
lea r9, [0x1405046f0]
xor r8d, r8d
mov rdx, qword [rbp + 0xa8]
call fcn.140017370
cmp rax, 0xffffffffffffffff
jne 0x1400758f0
lea rcx, [rbp + 0x98]
cmp rdi, 0xf
cmova rcx, rbx
mov qword [rsp + 0x20], 2
lea r9, [0x1405046f4]
xor r8d, r8d
mov rdx, qword [rbp + 0xa8]
call fcn.140017370
cmp rax, 0xffffffffffffffff
lea rdx, [rbp + 0x570]
je 0x1400758f7
lea rdx, [rbp + 0x630]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x140075916
lea rcx, [rbp + 0xd8]
call fcn.1400055c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
lea rax, [rbp + 0x4a0]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140075950
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xb8]
call fcn.1400055c0
nop
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rcx, qword [rbp + 0x50]
sub rax, rcx
cmp rax, 0x1b
jb 0x140075cf5
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r9, qword [rbp + 0x40]
mov qword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_27
lea rax, str._nvidiaProfileInspector.exe
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x40]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x78]
call fcn.1400182e0
nop
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0xb8]
call fcn.1400583a0
nop
lea rcx, [rbp + 0x78]
call fcn.1400159a0
mov rax, rdi
mov rcx, qword [rbp + 0x50]
sub rax, rcx
cmp rax, 0xa
jb 0x140075cfb
lea r9, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r9, qword [rbp + 0x40]
mov qword [rsp + 0x30], 0xa
lea rax, str.dylow.nip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x40]
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x78]
call fcn.1400182e0
nop
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0xd8]
call fcn.1400583a0
nop
lea rcx, [rbp + 0x78]
call fcn.1400159a0
mov rax, rdi
mov rcx, qword [rbp + 0x50]
sub rax, rcx
cmp rax, 6
jb 0x140075d01
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rax, qword [rbp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 6
lea r9, str.cd__d
lea r8, [rbp + 0x40]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.1400182e0
nop
mov r8d, gethostname
lea rdx, str.__nvidiaProfileInspector.exe__silentImport_dylow.nip
lea rcx, [rsp + 0x68]
call fcn.140015c40
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm6
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x68]
call fcn.1400159a0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov dword [rbp - 0x30], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp - 0x2c], 0x40
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
lea rax, str.cmd.exe
mov qword [rbp - 0x18], rax
movq rcx, xmm6
sub rdi, rcx
cmp rdi, 3
jb 0x140075d07
lea rax, [rbp + 0x78]
cmp qword [rbp + 0x90], 0xf
cmova rax, qword [rbp + 0x78]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 3
lea r9, [0x1404fb758]
lea r8, [rbp + 0x78]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400182e0
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 0xf
cmova rax, qword [rsp + 0x48]
mov qword [rbp - 0x10], rax
lea rcx, [rsp + 0x48]
call fcn.1400159a0
mov qword [rbp - 8], r14
mov dword [rbp], r14d
mov qword [rbp + 8], r14
lea rcx, [rbp - 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rax, qword [rbp + 0x40]
mov qword [rbp + 0x60], rax
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140075bd0
mov qword [rbp + 0x68], rbx
xor r8d, r8d
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.1400190f0
nop
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rcx, qword [rsp + 0x48]
call fcn.14028f3e8
mov rdx, rax
shr rdx, 0x20
movzx ecx, al
mov qword [rbp + 0x70], rcx
mov dword [rbp + 0x60], edx
lea rax, [0x140705840]
mov qword [rbp + 0x68], rax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x60], xmm0
cmp edx, 0x91
jne 0x140075c44
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.140055cb0
cmp dword [rbp + 0x60], 0
jne 0x140075cc9
lea rcx, [rsp + 0x48]
call fcn.140015930
nop
lea rcx, [rbp + 0x78]
call fcn.1400159a0
nop
lea rcx, [rbp + 0xb8]
call fcn.1400159a0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400159a0
nop
lea rcx, [rbp + 0x40]
call fcn.1400159a0
nop
lea rcx, [rbp + 0x98]
call fcn.1400159a0
nop
lea rcx, [rbp + 0x100]
call fcn.14006bb90
mov rcx, qword [rbp + 0x710]
xor rcx, rsp
call fcn.14028f750
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x60]
lea rcx, str.remove_all
call fcn.1400547e0
nop
shr rdx, 0x20
lea r8, [rsp + 0x48]
lea rcx, str.create_directory
call fcn.140002800
nop
call fcn.140001840
int3
call fcn.140001840
int3
call fcn.140001840
nop
call fcn.140001840
int3