Function at 0x14009e260
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x78], rdi
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_139]
call fcn.14009a7e0
call fcn.14007a410
call fcn.14004f5e0
call fcn.14009b470
xor ecx, ecx
call fcn.140053b40
mov ecx, 1
mov dword [0x140265598], eax
call fcn.140053b40
mov dword [0x1402654f0], eax
call fcn.14009bf70
call fcn.14009dc70
call fcn.14009d840
call fcn.14009b8d0
lea rdx, [rsp + 0x70]
call fcn.14009d210
mov edi, dword [0x140164090]
xor ebx, ebx
mov rcx, rax
cmp byte [rax + 3], bl
je 0x14009e3a4
cmp edi, 2
jl 0x14009e35d
movdqa xmm3, xmmword [0x140150d30]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x140150ef0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x140150ef0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x140150d50]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140150da0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.5555555555555555]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x14009e3a4
mov r9, rcx
mov r8d, ebx
nop dword [rax]
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x35
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x14009e370
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov r10, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x30]
call fcn.14009e650
mov r9, rax
cmp byte [rax + 0x16], bl
je 0x14009e55f
mov ecx, ebx
cmp edi, 2
jl 0x14009e521
movdqa xmm0, xmmword [str.5555555555555555]
mov rdx, rax
movdqa xmm5, xmmword [0x140150d30]
movdqa xmm4, xmmword [0x140150ef0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x140150d50]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140150da0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 8], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140150da0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
cmp ecx, 0x10
jl 0x14009e410
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x17
jge 0x14009e55f
movsxd r8, ecx
add r8, r9
nop word [rax + rax]
mov eax, 0xa0a0a0a1
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x33
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x17
jl 0x14009e530
mov rdx, r9
mov rcx, r10
call fcn.14009f930
lea rdx, [rsp + 0x70]
mov r8, rax
call fcn.14009e680
mov rdi, qword [rsp + 0x78]
movzx ecx, byte [rax + 1]
test cl, cl
je 0x14009e58d
xor byte [rax], 0x35
xor cl, 0x36
mov byte [rax + 1], cl
mov rdx, rax
mov rcx, r8
call fcn.14009f930
cmp qword [0x1402654c8], rbx
jne 0x14009e5f6
lea rdx, [rsp + 0x20]
call fcn.14009e690
movzx ecx, byte [rax + 0xa]
test cl, cl
je 0x14009e5e0
xor byte [rax], 0x35
xor byte [rax + 1], 0x36
xor byte [rax + 2], 0x37
xor byte [rax + 3], 0x38
xor byte [rax + 4], 0x39
xor byte [rax + 5], 0x3a
xor byte [rax + 6], 0x3b
xor byte [rax + 7], 0x3c
xor byte [rax + 8], 0x3d
xor byte [rax + 9], 0x3e
xor cl, 0x3f
mov byte [rax + 0xa], cl
mov rdx, rax
xor ecx, ecx
call fcn.140053b50
mov qword [0x1402654c8], rax
test rax, rax
je 0x14009e5a1
cmp byte [0x14026544d], bl
je 0x14009e60b
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ebx, 5
jmp 0x14009e611
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, ebx
mov rcx, rax
call fcn.140053b60
call fcn.14009dae0
call fcn.14009d3d0
call fcn.14009e6c0
call fcn.14007a330
call fcn.140079540
call fcn.140099f50
call qword [sym.imp.SecureEngineSDK64.dll_Ordinal_539]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3