Function at 0x140009bb0
Capabilities:
Create thread
Delete file
Encode data using xor
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rbp + 0x530], rax
xor ebx, ebx
lea rcx, str.Helper
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
movdqa xmm0, xmmword [0x1400ac130]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], 1
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xf
jb 0x140009c10
mov byte [rsp + 0x40], bl
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
call fcn.140005af0
mov ecx, 8
call fcn.1400811f4
lea rcx, [0x1400057c0]
mov qword [rax], rcx
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0x60]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14000f100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x58], rax
test rax, rax
je 0x14000a5e6
mov qword [rbp + 0x30], rbx
call fcn.140005af0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rbx
mov qword [rbp + 0x100], rbx
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Typical_Spoofer
lea rcx, [rbp + 0xe8]
call fcn.1400035e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], rbx
mov qword [rbp + 0xe0], rbx
mov r8d, 0xa
lea rdx, str.HF2DcRnfve
lea rcx, [rbp + 0xc8]
call fcn.1400035e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], rbx
mov qword [rbp + 0xc0], rbx
mov r8d, 0x40
lea rdx, str.0f3bd1e3a85457f678fjfd4a4e1e38af4e6f663e529acd922ancaf300aaf8086
lea rcx, [rbp + 0xa8]
call fcn.1400035e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov qword [rbp + 0x98], rbx
mov qword [rbp + 0xa0], rbx
mov r8d, 3
lea rdx, [0x140096fb4]
lea rcx, [rbp + 0x88]
call fcn.1400035e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], rbx
mov r8d, Ordinal_32
lea rdx, str.https:__keyauth.win_api_1.2_
lea rcx, [rbp + 0x68]
call fcn.1400035e0
nop
xor edx, edx
mov r8d, 0x278
lea rcx, [rbp + 0x2b0]
call sub.VCRUNTIME140.dll_memset
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x38]
call fcn.14000c2d0
mov r15, rax
lea rax, [rbp + 0x148]
mov qword [rbp - 0x38], rax
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x148]
call fcn.14000c2d0
mov r14, rax
lea rax, [rbp + 0x128]
mov qword [rbp - 0x30], rax
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x128]
call fcn.14000c2d0
mov rsi, rax
lea rax, [rbp + 0x108]
mov qword [rbp - 0x28], rax
lea rdx, [rbp + 0xc8]
lea rcx, [rbp + 0x108]
call fcn.14000c2d0
mov rdi, rax
lea rdx, [rbp + 0xe8]
lea rcx, [rbp - 0x20]
call fcn.14000c2d0
nop
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140002af0
nop
call fcn.140005af0
mov ecx, dword [0x1400bcb6c]
mov eax, dword [0x1400bcb70]
add ecx, eax
mov dword [0x1400bcb70], ecx
mov ecx, dword [0x1400bcb74]
mov eax, dword [0x1400bcb70]
imul ecx, eax
mov dword [0x1400bcb6c], ecx
mov eax, dword [0x1400bcb6c]
sar eax, 2
add eax, 4
mov dword [0x1400bcb74], eax
mov ecx, dword [0x1400bcb74]
mov eax, dword [0x1400bcb70]
xor ecx, eax
mov eax, dword [0x1400bcb6c]
or eax, ecx
mov dword [0x1400bcb70], eax
call fcn.140006ac0
mov ecx, dword [0x1400bcb6c]
mov eax, dword [0x1400bcb70]
add ecx, eax
mov dword [0x1400bcb70], ecx
mov ecx, dword [0x1400bcb74]
mov eax, dword [0x1400bcb70]
imul ecx, eax
mov dword [0x1400bcb6c], ecx
mov eax, dword [0x1400bcb6c]
sar eax, 2
add eax, 4
mov dword [0x1400bcb74], eax
mov ecx, dword [0x1400bcb74]
mov eax, dword [0x1400bcb70]
xor ecx, eax
mov eax, dword [0x1400bcb6c]
or eax, ecx
mov dword [0x1400bcb70], eax
call fcn.140005af0
lea rax, [0x1400bce98]
cmp qword [0x1400bceb0], 0x10
cmovae rax, qword [0x1400bce98]
mov qword [rsp + 0x70], rax
mov rax, qword [0x1400bcea8]
mov qword [rsp + 0x78], rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea rdx, [rsp + 0x70]
lea rcx, [rbp]
call fcn.14000f130
nop
lea rcx, [rbp]
call fcn.1400041b0
movzx edi, al
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140009f82
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009f7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140080f50
test dil, dil
je 0x14000a093
mov rax, qword [str._q_t_]
movsxd rcx, dword [rax + 4]
lea rdi, str._q_t_
add rcx, rdi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
call fcn.14000eb40
lea rcx, [0x1400bb210]
call fcn.14000c7e0
test rax, rax
jne 0x140009fdd
mov rax, qword [str._q_t_]
movsxd rcx, dword [rax + 4]
add rcx, rdi
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
movdqa xmm0, xmmword [0x1400ad0d0]
movdqu xmmword [rbp], xmm0
movdqa xmm1, xmmword [0x1400acca0]
movdqu xmmword [rbp + 0x10], xmm1
mov dword [rbp + 0x20], 0x766a6661
mov dword [rbp + 0x24], 0x283d63
mov byte [rbp + 0x28], 1
nop dword [rax]
lea eax, [rbx - 0x1e]
xor byte [rbp + rbx], al
inc rbx
cmp rbx, 0x27
jb 0x14000a010
mov byte [rbp + 0x28], 0
lea rdx, [rbp]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d2b0
lea rdx, [0x1400bb7d0]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rdx, qword [0x1400bb7d0]
mov r8, qword [0x1400bb7e0]
mov rcx, rax
call fcn.14000ed30
call fcn.140005af0
lea rdx, [0x1400bb7d0]
lea rcx, [rbp]
call fcn.14000c2d0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14002aef0
call fcn.140005af0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000a160
lea rcx, str.Helper
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
lea rdx, reloc.WS2_32.dll_ioctlsocket
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d2b0
lea rdx, [0x14000d7e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov dword [rsp + 0x50], 0x868dafc2
mov dword [rsp + 0x54], 0x8c9b8983
mov dword [rsp + 0x58], 0x100cbd0
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x1e]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 0xa
jb 0x14000a0f0
mov byte [rsp + 0x5b], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000d2b0
call fcn.140005af0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.14000d830
call fcn.140005af0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140005af0
lea rdx, [0x1400bb7d0]
lea rcx, [rbp]
call fcn.14000c2d0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14002aef0
call fcn.140005af0
cmp byte [rbp + 0x4c0], 0
jne 0x14000a1fa
call fcn.140005ed0
movdqa xmm0, xmmword [0x1400ad150]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x9a9d8081
mov dword [rsp + 0x44], 0x100d998
lea rcx, [rsp + 0x30]
call fcn.140005720
mov rdx, rax
lea rcx, [rbp]
call fcn.140003560
nop
mov edx, 0x46
lea rcx, [rbp]
call fcn.140005e30
movdqa xmm0, xmmword [0x1400ad1a0]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xdb958793
mov dword [rbp + 0x14], 0x8b8e85
mov byte [rbp + 0x18], 1
lea rcx, [rbp]
call fcn.140009b80
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov byte [0x1400bcb68], 1
lea rdx, [0x1400bb7d0]
lea rcx, [rbp - 0x70]
call fcn.14000c2d0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14002aef0
cmp byte [rbp + 0x4c0], 0
je 0x14000a5dd
call fcn.140005ed0
movdqa xmm0, xmmword [0x1400ad030]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xdb9a9c9b
mov word [rsp + 0x64], 0x100
lea rcx, [rsp + 0x50]
call fcn.140005ac0
mov rdx, rax
lea rcx, [rbp]
call fcn.140003560
nop
mov edx, 0x46
lea rcx, [rbp]
call fcn.140005e30
mov edx, 0x108
lea rcx, [rbp + 0x1a0]
call fcn.140002ae0
lea rcx, [rbp + 0x1a0]
call fcn.14000a7c0
nop
lea rcx, [rbp + 0x1a0]
call fcn.14000d800
lea rcx, [rbp + 0x1a0]
call fcn.14000a780
call fcn.140005ed0
nop
lea rcx, [rbp + 0x1a0]
call fcn.14000a600
nop
lea rcx, [rbp]
call fcn.14000c1b0
lea rdx, [0x140006190]
lea rcx, [rbp + 0x168]
call fcn.14000d1e0
nop
movdqa xmm0, xmmword [0x1400ad3c0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0xc1c6c2c1
mov dword [rbp - 0x7c], 0xcbcdc1c3
mov dword [rbp - 0x78], 0xc8c4cfc8
mov dword [rbp - 0x74], 0x100cbcf
lea rcx, [rsp + 0x70]
call fcn.140005100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
lea rdx, [rbp + 0x38]
test ax, ax
jne 0x14000a531
movdqa xmm0, xmmword [0x1400ad330]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x9981979d
mov dword [rsp + 0x64], 0xd7d68493
mov word [rsp + 0x68], Ordinal_217
mov byte [rsp + 0x6a], 1
lea rcx, [rsp + 0x50]
call fcn.14000bdf0
nop
mov edx, 0x46
lea rcx, [rbp + 0x38]
call fcn.140005e30
call fcn.140005ed0
mov dword [rsp + 0x30], 0x95b7c3c2
mov dword [rsp + 0x34], 0x808e8889
mov dword [rsp + 0x38], 0xc3c28c84
mov word [rsp + 0x3c], 0xc0
mov byte [rsp + 0x3e], 1
lea rdx, [rbp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.14000be60
nop
mov edx, 0x46
lea rcx, [rbp + 0x148]
call fcn.140005e30
call fcn.140005ed0
call fcn.140007090
lea rcx, [rbp - 0x70]
call fcn.140005f10
mov rbx, rax
movdqa xmm0, xmmword [0x1400ad410]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x60], Ordinal_211
mov byte [rsp + 0x62], 1
lea rcx, [rsp + 0x50]
call fcn.1400050d0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x128]
call fcn.14000d0b0
nop
lea rcx, [rbp - 0x70]
call fcn.14000c1b0
mov edx, reloc.WLDAP32.dll_Ordinal_50
lea rcx, [rbp + 0x128]
call fcn.140005e30
call fcn.140005ed0
mov edx, Ordinal_27
lea rcx, [rbp]
call fcn.140002ae0
lea rdx, str.697416
lea rcx, [rbp - 0x20]
call fcn.140003560
mov r8, rax
lea rdx, [rbp]
lea rcx, [rbp + 0x2b0]
call fcn.140026f30
nop
lea rcx, [rbp]
call fcn.140012040
movdqa xmm0, xmmword [0x1400ad3c0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xc1c6c2c1
mov dword [rsp + 0x44], 0xcbcdc1c3
mov dword [rsp + 0x48], 0xc8c4cfc8
mov dword [rsp + 0x4c], 0x100cbcf
lea rcx, [rsp + 0x30]
call fcn.140005100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea rcx, [rbp - 0x70]
call fcn.140005f10
mov rbx, rax
movdqa xmm0, xmmword [0x1400ad420]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], Ordinal_211
mov byte [rsp + 0x42], 1
lea rcx, [rsp + 0x30]
call fcn.1400050d0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.14000d0b0
nop
lea rcx, [rbp - 0x70]
call fcn.14000c1b0
mov edx, reloc.WLDAP32.dll_Ordinal_50
lea rcx, [rbp + 0x108]
call fcn.140005e30
call fcn.140005ed0
nop
lea rcx, [rbp + 0x108]
call fcn.14000c1b0
nop
lea rcx, [rbp]
call fcn.14000a720
nop
lea rcx, [rbp + 0x128]
call fcn.14000c1b0
nop
lea rcx, [rbp + 0x148]
call fcn.14000c1b0
nop
jmp 0x14000a57c
movdqa xmm0, xmmword [0x1400ad170]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x1400ace00]
movdqu xmmword [rbp - 0x60], xmm1
movdqa xmm0, xmmword [0x1400ac720]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x100
lea rcx, [rbp - 0x70]
call fcn.14000a6e0
nop
mov edx, 0x46
lea rcx, [rbp + 0x38]
call fcn.140005e30
call fcn.140005ed0
nop
lea rcx, [rbp + 0x38]
call fcn.14000c1b0
movdqa xmm0, xmmword [0x1400ad240]
movdqu xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0x939b9c82
mov dword [rbp + 0x14], 0xd9d69393
mov dword [rbp + 0x18], 0x100dbda
lea rdx, [rbp + 0x178]
lea rcx, [rbp]
call fcn.14000a6a0
nop
mov edx, reloc.WLDAP32.dll_Ordinal_60
lea rcx, [rbp + 0x178]
call fcn.140005e30
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov dword [rbp + 0x60], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3