Function at 0x140006510
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x14000e008]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp ecx, 2
je 0x140006600
mov rdx, qword [rdx]
lea rcx, [rbp + 0x17]
call fcn.140002840
movzx eax, word [0x1400099d0]
mov word [rbp - 9], ax
cmp byte [0x1400099d1], 0
je 0x140006569
mov byte [rbp - 9], 0x31
xor byte [rbp - 8], 0x35
lea r8, [rbp + 0x17]
cmp qword [rbp + 0x2f], 0x10
cmovae r8, qword [rbp + 0x17]
mov eax, dword [str._ESY8]
mov dword [rbp - 1], eax
movzx eax, byte [0x1400099d8]
mov byte [rbp - 1], 0x6f
xor byte [rbp], 0x35
xor byte [rbp + 1], 0x36
xor byte [rbp + 2], 0x37
xor al, 0x38
mov byte [rbp + 3], al
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 9]
lea rdx, [rbp - 1]
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14000680d
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400065f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006df4
jmp 0x14000680d
mov rax, qword [0x1400099c8]
mov qword [rbp - 1], rax
cmp byte [0x1400099cf], 0
je 0x14000676d
xor ecx, ecx
cmp dword [0x14000e018], 2
jl 0x140006733
movdqa xmm4, xmmword [0x140009aa0]
mov eax, 5
movd xmm6, eax
mov eax, 0x1f
movd xmm5, eax
movdqa xmm2, xmmword [0x140009a00]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140009a40]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140009a50]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140009a70]
movd xmm0, dword [rbp - 1]
pxor xmm2, xmm0
movd dword [rbp - 1], xmm2
movdqa xmm3, xmmword [0x140009a10]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140009a40]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140009a50]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140009a70]
movd xmm0, dword [rbp + 3]
pxor xmm2, xmm0
movd dword [rbp + 3], xmm2
jmp 0x14000676d
lea r8, [rbp - 1]
nop word [rax + rax]
mov eax, 0x24924925
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x38
movzx eax, cl
sub al, dl
add al, 0x34
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 8
jl 0x140006740
lea rax, [rbp - 1]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140006780
call fcn.1400068a8
lea rcx, [rbp - 1]
mov qword [rbp + 7], rcx
mov qword [rbp + 0xf], rbx
lea r8, [rbp + 7]
mov edx, eax
lea rcx, [rbp + 0x17]
call fcn.140001920
nop
lea rcx, [rbp + 0x17]
cmp qword [rbp + 0x2f], 8
cmovae rcx, qword [rbp + 0x17]
call fcn.140006c04
shr rax, 0x20
test eax, eax
jne 0x140006834
mov rdx, qword [rbp + 0x2f]
cmp rdx, 8
jb 0x140006808
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006803
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006df4
call fcn.140005bb0
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140006d90
mov rbx, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbp
ret
lea r8, [rbp + 0x17]
mov edx, eax
call fcn.1400064a0
int3