Function at 0x1400027b0
Capabilities:
Encode data using xor
Execute command
Get system information on windows
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x130
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x14008c0c0]
xor rax, rsp
mov qword [rbp], rax
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], r13
mov edx, 1
mov ecx, edx
mov r9d, edx
mov r8d, edx
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov rbx, rax
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_CreateIconIndirect]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
movups xmm3, xmmword [0x140080318]
movups xmmword [rsp + 0x48], xmm3
movsd xmm0, qword [0x140080328]
movsd qword [rsp + 0x58], xmm0
movzx eax, word [0x140080330]
mov word [rsp + 0x60], ax
mov ecx, r13d
movdqa xmm7, xmmword [0x140080440]
mov edi, dword [reloc.WS2_32.dll_accept]
cmp edi, 2
jl 0x140002b0e
movdqa xmm4, xmmword [0x140080460]
movdqa xmm5, xmmword [str.9999]
movdqa xmm6, xmmword [0x140080450]
movdqa xmm2, xmmword [0x1400803d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd eax, xmm3
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x48], xmm2
movdqa xmm2, xmmword [0x1400803e0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rsp + 0x4c]
xorps xmm2, xmm0
movd dword [rsp + 0x4c], xmm2
movdqa xmm3, xmmword [0x1400803f0]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movd xmm0, dword [rsp + 0x50]
xorps xmm3, xmm0
movd dword [rsp + 0x50], xmm3
movdqa xmm2, xmmword [0x140080400]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rsp + 0x54]
xorps xmm2, xmm0
movd dword [rsp + 0x54], xmm2
movdqa xmm3, xmmword [0x140080410]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm6
movd xmm0, dword [rsp + 0x58]
xorps xmm3, xmm0
movd dword [rsp + 0x58], xmm3
movdqa xmm2, xmmword [0x140080420]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm6
movd xmm0, dword [rsp + 0x5c]
xorps xmm2, xmm0
movd dword [rsp + 0x5c], xmm2
mov ecx, Ordinal_26
mov eax, ecx
lea r8, [rsp + 0x48]
add r8, rax
nop dword [rax + rax]
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x39
movzx eax, cl
sub al, dl
add al, 0x30
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1a
jl 0x140002b20
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140002b76
lea rdx, str.Invalid_handle
jmp 0x140002bbd
mov qword [rbp - 0x60], 0x54
mov qword [rbp - 0x58], 0xe0000
mov dword [rbp - 0x50], 0x190
lea r8, [0x140080288]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [rbp - 0x60]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
test eax, eax
jne 0x140002bd9
lea rdx, str.Error_setting_font
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004b50
lea rdx, [0x140004d30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
mov r9d, 3
mov r8b, 0xe1
mov edx, 0xd9d3f3
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
lea r8, [0x140002700]
mov edx, 0xfffffffc
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongW]
btr eax, 0x13
mov r8d, eax
mov edx, 0xfffffff0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowLongW]
lea rcx, [0x14008d230]
call fcn.140017720
mov qword [0x14008d4b8], r13
lea rax, [0x14008d4a8]
cmp qword [0x14008d4c0], 0xf
cmova rax, qword [0x14008d4a8]
mov byte [rax], r12b
mov qword [0x14008d1f8], r13
lea rax, [0x14008d1e8]
cmp qword [0x14008d200], 0xf
cmova rax, qword [0x14008d1e8]
mov byte [rax], r12b
mov qword [0x14008d4d8], r13
lea rax, [0x14008d4c8]
cmp qword [0x14008d4e0], 0xf
cmova rax, qword [0x14008d4c8]
mov byte [rax], r12b
mov qword [0x14008d1d8], r13
lea rax, [0x14008d1c8]
cmp qword [0x14008d1e0], 0xf
cmova rax, qword [0x14008d1c8]
mov byte [rax], r12b
mov qword [0x14008d218], r13
lea rax, [0x14008d208]
cmp qword [0x14008d220], 0xf
cmova rax, qword [0x14008d208]
mov byte [rax], r12b
lea rcx, [0x1400802b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x140004e50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400802b8]
call fcn.140004b50
mov rcx, rax
lea rdx, [0x140004e80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rax
lea rdx, [0x1400802b4]
call fcn.140004b50
lea rdx, [rsp + 0x30]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140004eb0
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [str.S_A3]
mov dword [rsp + 0x34], eax
cmp byte [0x1400803b7], r12b
je 0x140002e32
mov r8d, r13d
cmp edi, 2
jl 0x140002df3
movdqa xmm3, xmmword [0x1400803d0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140080460]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140080460]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.9999]
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140080450]
movd xmm0, eax
xorps xmm3, xmm0
movd dword [rsp + 0x34], xmm3
jmp 0x140002e32
lea r9, [rsp + 0x34]
nop dword [rax + rax]
mov eax, 0x1f7047dd
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x39
movzx eax, r8b
sub al, cl
add al, 0x30
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x140002e00
lea rcx, [rsp + 0x34]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
nop
call fcn.1400022f0
test eax, eax
je 0x140002e50
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
je 0x140002e50
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rbx, qword [rbp - 0x58]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov rsi, r13
mov qword [rsp + 0x58], r13
or r12d, 1
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x34], r12d
cmp rbx, qword [rbp - 0x50]
jae 0x14000308c
mov rdi, qword [rsp + 0x50]
movabs r12, 0x1000000000001001
nop word [rax + rax]
mov r9d, Ordinal_50
lea r8, [rsp + 0x68]
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp rax, 0x30
jne 0x140002fab
cmp dword [rbp - 0x78], 0x1000
jne 0x140002fa0
mov eax, dword [rbp - 0x74]
add eax, 0xfffffffc
cmp eax, 0x3c
ja 0x140002fa0
bt r12, rax
jae 0x140002fa0
mov rcx, qword [rbp - 0x80]
call fcn.14006d1d0
mov r14, rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x80]
mov r8, r14
mov rdx, qword [rsp + 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x140002f98
mov rbx, r13
mov ecx, dword [0x140080210]
nop
cmp dword [rbx + r14], ecx
jne 0x140002f88
mov rcx, qword [rsp + 0x68]
add rcx, rbx
mov qword [rsp + 0x40], rcx
cmp rdi, rsi
je 0x140002f66
mov qword [rdi], rcx
add rdi, 8
mov qword [rsp + 0x50], rdi
jmp 0x140002f82
lea r8, [rsp + 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1400059b0
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov ecx, dword [0x140080210]
inc rbx
mov rax, qword [rbp - 0x68]
add rax, 0xfffffffffffffffc
cmp rbx, rax
jbe 0x140002f40
mov rcx, r14
call fcn.14006ce3c
mov rbx, qword [rsp + 0x68]
add rbx, qword [rbp - 0x80]
jmp 0x140002fb1
mov eax, dword [rbp - 0x5c]
add rbx, rax
cmp rbx, qword [rbp - 0x50]
jb 0x140002ec0
mov r12d, dword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
cmp r14, rdi
je 0x140003091
mov edx, 0x1f4
mov ecx, 0x258
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, [0x1400802b0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movsx r12d, byte [rsp + 0x30]
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov ebx, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov esi, eax
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14000317c
nop dword [rax]
call fcn.1400022f0
test eax, eax
je 0x14000319b
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400030e3
cmp byte [0x14008d1c0], 0
jne 0x1400030ea
cmp byte [0x14008d1c1], 0
sete byte [0x14008d1c1]
mov byte [0x14008d1c0], 1
mov rbx, r14
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x140080214]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, rdi
jne 0x140003063
jmp 0x1400030ea
mov r14, qword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and r12d, 0xfffffffe
test r14, r14
je 0x140002e50
sub rsi, r14
and rsi, 0xfffffffffffffff8
mov rax, r14
cmp rsi, 0x1000
jb 0x1400030d3
add rsi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400031a4
mov rdx, rsi
mov rcx, r14
call fcn.14006ce3c
jmp 0x140002e50
mov byte [0x14008d1c0], 0
mov ecx, esi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003149
cmp byte [0x14008d1c0], 0
jne 0x140003150
cmp byte [0x14008d1c1], 0
sete byte [0x14008d1c1]
mov byte [0x14008d1c0], 1
mov rbx, r14
nop dword [rax + rax]
mov qword [rsp + 0x20], r13
mov r9d, 4
lea r8, [0x14008020c]
mov rdx, qword [rbx]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add rbx, 8
cmp rbx, rdi
jne 0x140003120
jmp 0x140003150
mov byte [0x14008d1c0], 0
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov ebx, eax
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov esi, eax
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140003020
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.140002740
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3