Function at 0x140002260
Capabilities:
Create thread
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 8], rax
xor esi, esi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
movabs r14, 0xb2f4fc0794908cf3
cmp rbx, 0x989680
jne 0x1400022cd
imul rbx, rcx, 0x64
jmp 0x14000233d
cmp rbx, 0x16e3600
jne 0x140002321
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rbx, rdx
shr rbx, 0x3f
add rbx, rdx
add rbx, r8
jmp 0x14000233d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
mov qword [rsp + 0x30], 0x64
lea rcx, [rsp + 0x30]
call fcn.140003ba0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], sil
mov dword [rsp + 0x40], 0xe2f2ebc1
mov dword [rsp + 0x44], 0xe4e6a9fa
mov dword [rsp + 0x48], 0xb5e0e4eb
mov word [rsp + 0x4c], 0xb0
mov ecx, esi
mov rdx, rsi
nop dword [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rdx + 0x40], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0xd
jb 0x140002390
mov byte [rsp + 0x4d], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003990
lea rdx, [rbp - 0x38]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003da0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r9, rax
cmp rdi, 0x989680
jne 0x1400023e9
imul r8, r9, 0x64
jmp 0x140002458
cmp rdi, 0x16e3600
jne 0x14000243d
mov rax, r14
imul r9
add rdx, r9
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
imul r8, rdx, 0x3b9aca00
imul rcx, rdx, 0x16e3600
sub r9, rcx
imul rcx, r9, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
add r8, rdx
jmp 0x140002458
cqo
idiv rdi
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add r8, rax
lea r9, [rbp - 0x38]
mov rdx, rbx
lea rcx, [rbp - 0x18]
call fcn.140001b00
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
movdqa xmm0, xmmword [0x140006790]
movdqu xmmword [rsp + 0x50], xmm0
xor eax, eax
mov byte [rsp + 0x60], al
mov ecx, esi
mov rdx, rsi
nop dword [rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rdx + 0x50], al
inc ecx
movsxd rdx, ecx
cmp rdx, 0x10
jb 0x1400024a0
mov byte [rsp + 0x60], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003990
lea rdx, [rbp - 0x58]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140003da0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rax
mov ecx, 0xd0
call fcn.140004890
mov rdi, rax
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0xd0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rax, vtable.std::_Associated_state_bool_.0
mov qword [rdi], rax
mov dword [rdi + 8], 1
mov byte [rdi + 0xc], 0
lea rcx, [rdi + 0x10]
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
call qword [sym.imp.MSVCP140.dll_void___cdecl___ExceptionPtrCreate_void____ptr64_]
lea rcx, [rdi + 0x20]
mov dword [rcx], esi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rsi
mov edx, 2
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [rdi + 0x70]
call qword [sym.imp.MSVCP140.dll__Cnd_init_in_situ]
mov byte [rdi + 0xb8], 0
mov dword [rdi + 0xbc], esi
mov word [rdi + 0xc0], 0
mov byte [rdi + 0xc2], 0
mov qword [rdi + 0xc8], rsi
mov qword [rbp - 0x70], rdi
mov byte [rbp - 0x68], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov byte [rbp - 0x60], 1
mov qword [rsp + 0x50], rdi
mov byte [rsp + 0x58], 1
lock inc dword [rdi + 8]
mov ecx, 0x50
call fcn.140004890
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x70]
mov qword [rbx], rax
lea rcx, [rbx + 8]
lea rdx, [rbp - 0x18]
call fcn.1400046b0
nop
lea rcx, [rbx + 0x28]
lea rdx, [rbp - 0x58]
call fcn.1400046b0
nop
lea rax, [0x140001da0]
mov qword [rbx + 0x48], rax
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x1400045f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140002892
mov ecx, 0x18
call fcn.140004890
mov rbx, rax
mov qword [rsp + 0x50], rsi
mov qword [rax], rdi
mov byte [rax + 8], 1
lea rax, [0x140002030]
mov qword [rbx + 0x10], rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x40]
call fcn.140004430
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x140004630]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140002882
cmp dword [rbp - 0x78], 0
je 0x140002876
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rbp - 0x78], eax
je 0x14000286a
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x14000285e
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x80], xmm0
cmp dword [rsp + 0x78], eax
je 0x140002876
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x78], eax
je 0x14000286a
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
jne 0x14000285e
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x30], 0xf4f3e4f4
mov word [rsp + 0x34], 0xed
mov ecx, esi
mov rdx, rsi
nop dword [rax + rax]
lea eax, [rcx - 0x7c]
xor byte [rsp + rdx + 0x30], al
inc ecx
movsxd rdx, ecx
cmp rdx, 5
jb 0x140002720
mov byte [rsp + 0x35], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
cmp dword [rsp + 0x78], 0
je 0x140002751
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rbp - 0x78], 0
je 0x14000275e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
lea rcx, [rbp - 0x70]
call fcn.1400028b0
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400027a7
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004b0c
nop
mov rdx, qword [rbp]
cmp rdx, 0xf
jbe 0x1400027e5
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004b0c
mov qword [rbp - 8], rsi
mov qword [rbp], 0xf
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140002833
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000282e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000282e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004b0c
xor eax, eax
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.140004870
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x78], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x78], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3