Function at 0x14000b3c0
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
call fcn.14000c190
mov dword [rbp + 0x67], 0x2b3b35
mov byte [rbp + 0x6b], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x14000b400
mov byte [rbp + 0x6b], bl
lea rcx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
cmp byte [0x140095b28], bl
jne 0x14000b432
mov edx, 0x4b0
mov ecx, edx
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov edx, 4
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x140072440]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x47464901
mov word [rbp - 0x25], Ordinal_79
mov byte [rbp - 0x23], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx - 0x39], al
inc rcx
cmp rcx, 0x15
jb 0x14000b480
mov byte [rbp - 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x39]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000b4b0
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x21]
call fcn.140002fa0
mov dword [rbp - 1], reloc.WLDAP32.dll_Ordinal_50
lea rsi, [rbp - 0x21]
mov r14, qword [rbp - 0x21]
mov r13, qword [rbp - 9]
cmp r13, 0xf
cmova rsi, r14
lea rcx, [rbp - 0x21]
cmova rcx, r14
mov r12, qword [rbp - 0x11]
add r12, rcx
cmp rsi, r12
je 0x14000b52c
mov qword [rbp + 0x67], reloc.WLDAP32.dll_Ordinal_50
nop dword [rax]
movzx edx, byte [rsi]
mov rcx, r15
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x67]
call fcn.1400045c0
inc rsi
cmp rsi, r12
jne 0x14000b500
cmp r13, 0xf
jbe 0x14000b563
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000b55b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b6b7
mov rcx, r14
call fcn.14006d208
mov edx, 2
mov rcx, qword [0x1400958a0]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x67], 0x2b3b35
mov byte [rbp + 0x6b], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 0x56]
xor byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 3
jb 0x14000b5a0
mov byte [rbp + 0x6b], 0
lea rcx, [rbp + 0x67]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r14, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqa xmm0, xmmword [0x1400726a0]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x100
nop dword [rax + rax]
lea eax, [rbx + 0x56]
xor byte [rbp + rbx - 0x39], al
inc rbx
cmp rbx, 0x10
jb 0x14000b5e0
mov byte [rbp - 0x28], 0
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x39]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000b607
mov r8, rdi
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.140002fa0
mov dword [rbp + 0x27], reloc.WLDAP32.dll_Ordinal_50
lea rbx, [rbp + 7]
mov rdi, qword [rbp + 7]
mov r15, qword [rbp + 0x1f]
cmp r15, 0xf
cmova rbx, rdi
lea rcx, [rbp + 7]
cmova rcx, rdi
mov rsi, qword [rbp + 0x17]
add rsi, rcx
cmp rbx, rsi
je 0x14000b68c
mov qword [rbp + 0x67], reloc.WLDAP32.dll_Ordinal_50
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r14
call fcn.1400029a0
lea rdx, [0x140004280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x67]
call fcn.1400045c0
inc rbx
cmp rbx, rsi
jne 0x14000b660
cmp r15, 0xf
jbe 0x14000b6c6
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000b6be
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14006d208
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret