Function at 0x140009250
Capabilities:
Create thread
Encode data using xor
Set console window title
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
xor ecx, ecx
call fcn.1400314e4
mov rcx, rax
call fcn.140029320
movzx ebx, byte [rbp + 0x67]
lea r13, [0x140068d00]
movzx edi, byte [rbp + 0x67]
mov r12d, 0xa
movzx esi, byte [rbp + 0x67]
movzx r14d, byte [rbp + 0x67]
movzx r15d, byte [rbp + 0x67]
call fcn.140009110
mov rdx, qword [0x140068e10]
mov r8, qword [0x140068e18]
cmp rdx, r8
jae 0x1400092e6
lea rcx, [rdx + 1]
cmp r8, 0x10
mov qword [0x140068e10], rcx
lea rcx, [0x140068e00]
cmovae rcx, qword [0x140068e00]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x1400092ff
movzx r9d, al
lea rcx, [0x140068e00]
movzx r8d, bl
mov edx, 1
call fcn.140018940
call fcn.140009110
mov rdx, qword [0x140068d50]
mov r8, qword [0x140068d58]
cmp rdx, r8
jae 0x14000933f
lea rcx, [rdx + 1]
cmp r8, 0x10
mov qword [0x140068d50], rcx
lea rcx, [0x140068d40]
cmovae rcx, qword [0x140068d40]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x140009358
movzx r9d, al
lea rcx, [0x140068d40]
movzx r8d, dil
mov edx, 1
call fcn.140018940
call fcn.140009110
mov rdx, qword [0x140068d10]
mov r8, qword [0x140068d18]
cmp rdx, r8
jae 0x140009394
lea rcx, [rdx + 1]
cmp r8, 0x10
mov qword [0x140068d10], rcx
mov rcx, r13
cmovae rcx, qword [0x140068d00]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x1400093a9
movzx r9d, al
movzx r8d, sil
mov edx, 1
mov rcx, r13
call fcn.140018940
call fcn.140009110
mov rdx, qword [0x140068db0]
mov r8, qword [0x140068db8]
cmp rdx, r8
jae 0x1400093e9
lea rcx, [rdx + 1]
cmp r8, 0x10
mov qword [0x140068db0], rcx
lea rcx, [0x140068da0]
cmovae rcx, qword [0x140068da0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x140009402
movzx r9d, al
lea rcx, [0x140068da0]
movzx r8d, r14b
mov edx, 1
call fcn.140018940
call fcn.140009110
mov rdx, qword [0x140068d70]
mov r8, qword [0x140068d78]
cmp rdx, r8
jae 0x140009442
lea rcx, [rdx + 1]
cmp r8, 0x10
mov qword [0x140068d70], rcx
lea rcx, [0x140068d60]
cmovae rcx, qword [0x140068d60]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x14000945b
movzx r9d, al
lea rcx, [0x140068d60]
movzx r8d, r15b
mov edx, 1
call fcn.140018940
sub r12, 1
jne 0x1400092a6
xor edi, edi
mov dword [rbp + 0x67], 0xe6ef1350
mov ecx, edi
mov word [rbp + 0x6b], 0x100
nop word [rax + rax]
lea eax, [rcx + 0x7e]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 4
jb 0x140009480
mov rbx, 0xffffffffffffffff
mov byte [rbp + 0x6c], dil
mov r8, rbx
lea rax, [rbp + 0x67]
inc r8
cmp byte [rax + r8], dil
jne 0x1400094a2
lea rdx, [rbp + 0x67]
mov rcx, r13
call fcn.14000f490
mov rcx, rdi
mov dword [rbp + 0x67], 0xeef31550
mov word [rbp + 0x6b], 0xec
mov byte [rbp + 0x6d], 1
nop dword [rax + rax]
lea eax, [rcx + 0x7e]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 5
jb 0x1400094d0
mov byte [rbp + 0x6d], dil
lea rax, [rbp + 0x67]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], dil
jne 0x1400094f0
mov r8, rbx
lea rdx, [rbp + 0x67]
lea rcx, [0x140068d60]
call fcn.14000f490
cmp qword [0x140068e18], 0x10
lea rcx, [0x140068e00]
cmovae rcx, qword [0x140068e00]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movdqa xmm0, xmmword [0x14005f5d0]
mov rcx, rdi
movdqa xmm1, xmmword [0x14005f670]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rbp - 0x69], 0xe5c5dbfc
movdqu xmmword [rbp - 0x79], xmm1
mov dword [rbp - 0x65], 0xf9e9f5
mov byte [rbp - 0x61], 1
nop dword [rax]
lea eax, [rcx + 0x7e]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0x27
jb 0x140009560
lea rdx, [rsp + 0x30]
mov byte [rbp - 0x61], dil
lea rcx, [0x140069bf0]
call fcn.140014120
mov rcx, rax
call fcn.1400144d0
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400055d0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140005780]
mov qword [0x14006b3a8], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14006b3b8], rax
call fcn.1400065b0
test al, al
jne 0x1400096ec
movdqa xmm0, xmmword [0x14005f730]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x14005f5f0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x14005f630]
movdqa xmmword [rbp - 0x79], xmm1
movdqa xmm1, xmmword [0x14005f660]
movdqa xmmword [rbp - 0x69], xmm0
movdqa xmmword [rbp - 0x59], xmm1
mov dword [rbp - 0x49], 0xa9b4d0cc
mov dword [rbp - 0x45], 0xb1a1adec
mov word [rbp - 0x41], 0x9b
mov byte [rbp - 0x3f], 1
call fcn.140009010
mov rdx, rax
lea rcx, [0x140069bf0]
call fcn.140014120
mov rcx, rax
call fcn.14000bc10
lea rcx, [0x140068e00]
call fcn.14000bf10
movdqa xmm0, xmmword [0x14005f340]
lea rcx, [rbp - 0x39]
movdqa xmm1, xmmword [0x14005f380]
mov r8, rax
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x14005f2a0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x14005f4b0]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x14005f290]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x14005f610]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0xce87b8f0
mov dword [rbp + 0x2b], 0xb783828a
mov dword [rbp + 0x2f], 0xad8da384
mov dword [rbp + 0x33], 0x100a1bd
call fcn.140009040
mov rdx, rax
mov r9d, 0x10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.1400058b0
call fcn.140006980
lea r11, [rsp + 0xf0]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret