Function at 0x14003e3b0
Capabilities:
Create pipe
Create process on windows
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3100]
mov eax, 0x3200
call fcn.140049770
sub rsp, rax
movaps xmmword [rsp + 0x31f0], xmm6
movaps xmmword [rsp + 0x31e0], xmm7
movaps xmmword [rsp + 0x31d0], xmm8
mov r15, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
xor esi, esi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x48], rsi
mov dword [rbp - 8], 0x18
mov dword [rbp + 8], 1
mov qword [rbp], rsi
xor r9d, r9d
lea r8, [rbp - 8]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
je 0x14003ec1f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x54], xmm0
movups xmmword [rbp + 0x64], xmm0
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
mov dword [rbp + 0xa4], eax
mov dword [rbp + 0x50], 0x68
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xa8], rax
psrldq xmm0, 8
movd eax, xmm0
bts eax, 8
mov dword [rbp + 0x8c], eax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rax
mov rdx, qword [r14 + 0x10]
mov qword [rbp - 0x50], rdx
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, rdx
cmp rax, 1
jb 0x14003ec55
cmp qword [r14 + 0x18], 8
jb 0x14003e4c5
mov r14, qword [r14]
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rdx + 1]
mov qword [rsp + 0x60], rax
mov ebx, 7
lea rdi, [rbp - 0x78]
cmp rax, rbx
jbe 0x14003e591
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x14003e50a
mov rbx, rcx
movabs rcx, 0x7fffffffffffffff
add rcx, rcx
jmp 0x14003e53a
mov ecx, 0xa
cmp rbx, rcx
cmovb rbx, rcx
lea r8, [rbx + 1]
movabs rcx, 0x7fffffffffffffff
cmp r8, rcx
ja 0x14003ec4f
lea rcx, [r8 + r8]
cmp rcx, 0x1000
jb 0x14003e572
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003ec4f
mov rcx, rax
call fcn.140048db8
test rax, rax
je 0x14003e56b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbp - 0x50]
jmp 0x14003e58d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14003e58a
call fcn.140048db8
mov rdi, rax
mov rax, qword [rsp + 0x60]
mov rdx, qword [rbp - 0x50]
jmp 0x14003e58d
mov rdi, rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rbx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r14
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, 0x20
mov word [rbx + rdi], ax
mov rax, qword [rbp - 0x50]
mov word [rdi + rax*2 + 2], si
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x14003e5ce
mov r12, qword [r12]
mov rdx, r12
lea rcx, [rbp - 0x78]
call fcn.140046d00
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14003e64a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e645
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e645
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048a68
movdqa xmm0, xmmword [0x140170c20]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], si
cmp qword [r13 + 0x18], 8
jb 0x14003e666
mov r13, qword [r13]
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003e8e9
movups xmm0, xmmword [str.tJ_OYmLP_10d]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [0x1401709d0]
movups xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [0x1401709e0]
movups xmmword [rbp + 0x30], xmm0
movzx eax, byte [0x1401709f0]
mov byte [rbp + 0x40], al
cmp dword [0x140179008], 2
jl 0x14003e83c
movdqa xmm5, xmmword [0x140170c70]
movdqa xmm4, xmmword [0x140171080]
mov eax, 5
movd xmm6, eax
movdqa xmm7, xmmword [str.::::]
mov eax, 0x1f
movd xmm8, eax
movdqa xmm0, xmmword [str.7777777777777777]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rbp + 0x14]
mov edx, dword [rsp + 0x60]
nop dword [rax + rax]
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140170ce0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140170ce0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
mov eax, esi
lea rcx, [rcx + 8]
cmp esi, 0x30
jl 0x14003e730
cmp eax, 0x31
jge 0x14003e87f
movsxd rax, esi
lea r8, [rbp + 0x10]
add r8, rax
nop word [rax + rax]
mov eax, 0x8d3dcb09
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, sil
sub al, cl
add al, 0x37
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x31
jl 0x14003e850
lea r9, [rbp + 0x10]
mov edx, 3
mov r8d, 0xbb8
lea rcx, [rbp + 0x10c0]
call fcn.14003bc00
mov rax, qword [0x140179050]
cmp rax, qword [0x140179058]
je 0x14003e8d2
mov r8d, 0x2010
lea rdx, [rbp + 0x10c0]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
add qword [0x140179050], 0x2010
xor dil, dil
jmp 0x14003ebd8
lea r8, [rbp + 0x10c0]
mov rdx, rax
call fcn.1400484f0
xor dil, dil
jmp 0x14003ebd8
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov ebx, 0xf
mov qword [rsp + 0x78], rbx
mov byte [rsp + 0x60], 0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rsi
mov r14d, ebx
mov qword [rbp - 0x60], rbx
mov byte [rbp - 0x78], 0
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
movups xmm6, xmmword [rbp - 0x68]
test eax, eax
je 0x14003ea50
nop
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x14003ea50
mov edi, esi
nop
mov eax, edi
movzx r9d, byte [rbp + rax + 0xc0]
cmp r9b, 0xa
jne 0x14003e9df
cmp r14, 0x10
jb 0x14003e9a9
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e9a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003eb8e
call fcn.140048a68
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x78], xmm0
movups xmm6, xmmword [rsp + 0x70]
movups xmmword [rbp - 0x68], xmm6
mov ebx, 0xf
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rsi
mov byte [rsp + 0x60], 0
movdqa xmm0, xmm6
psrldq xmm0, 8
movq r14, xmm0
jmp 0x14003ea1b
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
jae 0x14003ea0c
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rbx, 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14003ea16
lea rcx, [rsp + 0x60]
call fcn.140047970
mov rbx, qword [rsp + 0x78]
inc edi
cmp edi, dword [rsp + 0x50]
jb 0x14003e960
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0xc0]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14003e950
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp - 0x80]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x70], 0
je 0x14003eafa
lea rax, [rsp + 0x60]
cmp r15, rax
je 0x14003eb50
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14003eadb
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14003ead6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003eb8e
mov rcx, r8
call fcn.140048a68
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [r15 + 0x10], xmm1
mov ebx, 0xf
mov byte [rsp + 0x60], 0
jmp 0x14003eb50
lea rax, [rbp - 0x78]
cmp r15, rax
je 0x14003eb50
mov rdx, qword [r15 + 0x18]
cmp rdx, 0x10
jb 0x14003eb39
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14003eb34
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003eb8e
mov rcx, r8
call fcn.140048a68
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm6
mov r14d, 0xf
mov byte [rbp - 0x78], 0
cmp dword [rbp - 0x80], 0
sete dil
cmp r14, 0x10
jb 0x14003eb9b
lea rdx, [r14 + 1]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003eb95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003eb95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140048a68
nop
cmp rbx, 0x10
jb 0x14003ebd8
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ebd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ebd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048a68
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14003ec1b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ec16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003ec16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140048a68
movzx eax, dil
lea r11, [rsp + 0x3200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003ba80
int3
call fcn.14003bb20
int3