Function at 0x14000c440
Capabilities:
Create thread
Encode data using xor
Execute command
Move file
Set console window title
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x288]
sub rsp, 0x360
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14008f088]
xor rax, rsp
mov qword [rbp + 0x240], rax
xor esi, esi
mov r12d, esi
mov dword [rsp + 0x40], esi
lea edx, [rsi + 0xa]
lea rcx, [rsp + 0x50]
call fcn.14000ac60
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 4
jb 0x14000c4ca
lea rax, [rdx + 4]
mov qword [rcx + 0x10], rax
mov rax, rcx
cmp r8, 0x10
jb 0x14000c4bc
mov rax, qword [rcx]
mov dword [rax + rdx], 0x6578652e
mov byte [rax + rdx + 4], 0
jmp 0x14000c4ed
mov qword [rsp + 0x20], 4
lea r9, str..exe
movzx r8d, byte [rsp + 0x48]
mov edx, 4
call fcn.140004d30
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
or r12d, 1
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000c56a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c565
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c565
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
movdqa xmm0, xmmword [0x1400737e0]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea r13, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae r13, qword [rbp + 0xb0]
mov r8d, 0x104
lea rdx, [rbp + 0x130]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rsi
lea rax, [rbp + 0x130]
mov rbx, 0xffffffffffffffff
mov r14, rbx
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x14000c5d0
movabs rdi, 0x7fffffffffffffff
cmp r14, rdi
ja 0x14000ccdb
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
cmp r14, 0x10
jae 0x14000c626
mov qword [rbp + 0xa0], r14
mov r8, r14
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x90]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14 + 0x90], 0
jmp 0x14000c690
mov r15, r14
or r15, 0xf
cmp r15, rdi
jbe 0x14000c637
mov r15, rdi
jmp 0x14000c643
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp r15, rax
cmovb r15, rax
mov rdx, r15
add rdx, 1
cmovb rdx, rbx
lea rcx, [rbp + 0x90]
call fcn.1400097d0
mov rbx, rax
mov qword [rbp + 0x90], rax
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], r15
mov r8, r14
lea rdx, [rbp + 0x130]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
mov rbx, 0xffffffffffffffff
or r12d, 2
lea rcx, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae rcx, qword [rbp + 0x90]
mov rdx, r13
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14000c6f8
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c6f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c6f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
lea rcx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0x10
cmovae rcx, qword [rbp + 0xb0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, str.MODE_CON_COLS50_LINES12
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140073560]
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or r12d, 4
mov dword [rsp + 0x40], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x80]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x80], r15
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 0x70], rax
mov byte [rbp + 0xc], 0
mov byte [rbp + 1], 0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x10], rsi
mov rax, qword [0x14008f9c8]
mov qword [rbp + 4], rax
mov qword [rbp - 8], rsi
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
lea rdx, str.Config.ini
lea rcx, [rbp - 0x70]
call fcn.140009af0
xor r8d, r8d
test rax, rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
je 0x14000c802
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x14000c810
add rcx, rax
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rax, qword [rbp - 0x80]
movsxd rdx, dword [rax + 4]
lea rcx, [rbp - 0x80]
add rcx, rdx
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x14000c84e
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.An_error_occurred
lea rdx, str._Unable_to_open_file_Config.txt
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140003060
call fcn.14000b110
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r14, rax
lea rdx, [rbp + 0x110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov r9d, 2
mov r8b, 0xe4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea rdx, [rbp + 0xd0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [rbp + 0xdc]
mov r9d, dword [rbp + 0xd4]
sub ecx, r9d
mov eax, dword [rbp + 0xd8]
mov r8d, dword [rbp + 0xd0]
sub eax, r8d
mov dword [rsp + 0x30], reloc.WLDAP32.dll_Ordinal_32
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
lea rcx, str.C0ntact_Clarity__qualityshop.xdnz.xyz
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
lea rcx, [0x14008f710]
call fcn.140018c60
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
movdqa xmm1, xmmword [0x1400737e0]
movdqu xmmword [rbp + 0x100], xmm1
mov byte [rbp + 0xf0], 0
lea rdx, [0x140073574]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
movdqa xmm0, xmmword [0x1400738a0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140073be0]
movdqu xmmword [rsp + 0x60], xmm1
mov word [rsp + 0x70], Ordinal_60
mov byte [rsp + 0x72], 1
mov rdx, rsi
nop word [rax + rax]
lea eax, [rdx - 5]
xor byte [rsp + rdx + 0x50], al
inc rdx
cmp rdx, 0x21
jb 0x14000c960
mov byte [rsp + 0x72], 0
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
lea rdx, [rbp + 0xf0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140004420
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x50]
call fcn.1400055b0
mov rdx, rax
lea rcx, [0x14008f710]
call fcn.14001a650
mov ecx, 8
call fcn.14006eb10
test rax, rax
je 0x14000c9d4
lea rcx, [0x140006c80]
mov qword [rax], rcx
jmp 0x14000c9d7
mov rax, rsi
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0xe8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140001510]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0xe0], rax
test rax, rax
je 0x14000cce1
mov edx, 7
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp byte [0x14008f920], 0
jne 0x14000ca93
mov edx, 4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp + 0x90], 0x8aaedcf1
mov dword [rbp + 0x94], 0x7174749e
mov dword [rbp + 0x98], 0x1002439
lea rcx, [rbp + 0x90]
call fcn.140009960
mov rdx, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004690
mov rcx, rax
lea rdx, [0x14008f928]
call fcn.140004670
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x40], 0x8e9098
mov byte [rsp + 0x44], 1
lea eax, [rsi - 5]
xor byte [rsp + rsi + 0x40], al
inc rsi
cmp rsi, 3
jb 0x14000caa0
mov byte [rsp + 0x44], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.1400083e0
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14000cae1
imul rax, rax, 0x64
jmp 0x14000cafc
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffffbd3e27f
cmp rax, rcx
jge 0x14000cb12
lea rdi, [rax + 0x42c1d80]
movabs rsi, 0x311cdad160000
movabs r14, 0x112e0be826d694b3
movsd xmm6, qword [0x140072f60]
nop
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x14000cb4c
imul rbx, rax, 0x64
jmp 0x14000cb68
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
cmp rdi, rbx
je 0x14000cbce
jl 0x14000cbce
call sub.MSVCP140.dll__Xtime_get_ticks
imul rcx, rax, 0x64
mov rax, rdi
sub rax, rbx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x14000cb91
add rcx, rsi
jmp 0x14000cb94
add rcx, rax
mov rax, r14
imul rcx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0x90], rdx
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov dword [rbp + 0x98], ecx
lea rcx, [rbp + 0x90]
call sub.MSVCP140.dll__Thrd_sleep
jmp 0x14000cb30
cmp dword [rbp + 0xe8], 0
je 0x14000cbde
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x14000cc23
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cc1d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
nop
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x80], r15
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp - 0x70]
call fcn.140005d80
lea rcx, [rbp - 0x68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x14000cca4
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc9f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000cc9f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006eb4c
xor eax, eax
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14006ec60
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140009770
nop
mov dword [rbp + 0xe8], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3