Function at 0x140009350
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xe0
mov edi, dword [0x140092308]
xor esi, esi
movaps xmmword [rax - 0x18], xmm6
mov ebx, esi
movdqa xmm6, xmmword [0x140063bb0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x140063ba0]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x140063b90]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [str.3333]
movaps xmmword [rax - 0x58], xmm10
lea rax, str..kdstinker
movdqa xmm10, xmmword [0x140063b70]
mov qword [rsp + 0x50], rax
lea rax, str..NiGgEr
mov qword [rsp + 0x58], rax
lea rax, str..KsDumper
mov qword [rsp + 0x60], rax
lea rax, str..kprocesshacker
mov qword [rsp + 0x68], rax
nop
mov rcx, qword [rsp + rbx*8 + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1400095aa
lea rcx, str.start_cmd__c_START_CMD__C__COLOR_C__TITLE_Protection__ECHO_KsDumper_Detected.__TIMEOUT_10__nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movups xmm1, xmmword [0x140064328]
movups xmm0, xmmword [str._TESPVW]
movups xmmword [rsp + 0x80], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x70], xmm0
test al, al
je 0x14000959f
cmp edi, 2
jl 0x140009561
movdqa xmmword [rsp + 0x40], xmm7
lea rcx, [rsp + 0x74]
mov r8d, dword [rsp + 0x40]
mov edx, esi
nop dword [rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm10
add edx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm6
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movd dword [rcx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm10
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm6
pmuldq xmm1, xmm6
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edx, 0x20
jl 0x140009470
jmp 0x14000959f
lea r8, [rsp + 0x70]
mov ecx, esi
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x20
jl 0x140009570
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
inc rbx
cmp rbx, 4
jl 0x1400093e0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop rdi
ret