Function at 0x14006a270
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0xc0], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.RtlGetVersion
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14006a6fe
lea rcx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x11c
call rax
movdqa xmm0, xmmword [str.C3_f_b]
xor ebx, ebx
movdqa xmm1, xmmword [0x1400883d0]
mov ecx, ebx
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x40], 0x89
movdqu xmmword [rsp + 0x30], xmm1
mov byte [rsp + 0x42], 1
nop word [rax + rax]
lea eax, [rcx + 0x63]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x21
jb 0x14006a300
mov r9d, dword [rbp - 0x54]
lea rcx, [rsp + 0x20]
mov r8d, dword [rbp - 0x58]
mov edx, dword [rbp - 0x5c]
mov byte [rsp + 0x42], bl
call fcn.140012350
mov ecx, dword [rbp - 0x5c]
mov eax, dword [rbp - 0x54]
cmp ecx, 0xa
jne 0x14006a51f
cmp dword [rbp - 0x58], ebx
jne 0x14006a528
cmp eax, 0x47ba
jne 0x14006a385
movdqa xmm0, xmmword [0x1400881c0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a370
jmp 0x14006a500
cmp eax, 0x47bb
jne 0x14006a3c5
movdqa xmm0, xmmword [0x1400881c0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a3b0
jmp 0x14006a500
cmp eax, 0x4a61
jne 0x14006a405
movdqa xmm0, xmmword [0x1400881c0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a3f0
jmp 0x14006a500
cmp eax, 0x4a62
jne 0x14006a445
movdqa xmm0, xmmword [0x140088150]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a430
jmp 0x14006a500
cmp eax, 0x4a63
jne 0x14006a482
movdqa xmm0, xmmword [0x1400881d0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a470
jmp 0x14006a500
cmp eax, 0x4a64
jne 0x14006a4c2
movdqa xmm0, xmmword [0x140088170]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a4b0
jmp 0x14006a500
cmp eax, 0x4a65
jne 0x14006a528
movdqa xmm0, xmmword [0x140088190]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x79
mov byte [rsp + 0x32], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x63]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x11
jb 0x14006a4f0
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x32], 0
call fcn.140012350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006a74f
cmp ecx, 0xb
je 0x14006a685
cmp eax, 0x55f0
je 0x14006a685
cmp eax, 0x585d
je 0x14006a60c
cmp eax, 0x5867
je 0x14006a591
movdqa xmm0, xmmword [0x140087ae0]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x1f060616
mov dword [rsp + 0x34], 0x731618
mov byte [rsp + 0x38], 1
call fcn.14006a7d0
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x1400881a0]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1400882d0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140088330]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x1400883b0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x86d6cd83
mov dword [rbp - 0x6c], 0xd9c6c4c4
mov dword [rbp - 0x68], 0xa4cac2c2
mov word [rbp - 0x64], 0x100
call fcn.14006a7a0
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x140088180]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x140088410]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140088490]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x140088280]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0xc585d7ca
mov dword [rbp - 0x6c], 0xc3dac7cb
mov dword [rbp - 0x68], 0xa7cbc5
mov byte [rbp - 0x64], 1
call fcn.14006a770
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [0x140088160]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x140088410]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x140088490]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x140088280]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0xc585d7ca
mov dword [rbp - 0x6c], 0xc3dac7cb
mov dword [rbp - 0x68], 0xa7cbc5
mov byte [rbp - 0x64], 1
call fcn.14006a770
mov rcx, rax
call fcn.140012350
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movdqa xmm0, xmmword [str.A5_n_n]
xor ebx, ebx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x1c1c51
mov dword [rsp + 0x34], 0xd183055
mov dword [rsp + 0x38], 0x76551e17
mov word [rsp + 0x3c], 0x100
nop dword [rax]
lea eax, [rbx + 0x61]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x1c
jb 0x14006a730
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x3d], 0
call fcn.140012350
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14006ce00
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rbp
ret