Function at 0x140028bd0
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x14025e900]
xor rax, rsp
mov qword [rsp + 0xc0], rax
call fcn.140026e30
test al, al
je 0x1400297fe
mov qword [rsp + 0xf0], rbx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0xe0], rdi
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0xd0], xmm6
call fcn.140004610
mov edi, dword [0x14025e950]
xor ebx, ebx
mov r10, rax
cmp byte [rax + 0x36], bl
je 0x140028db1
mov r8d, ebx
cmp edi, 2
jl 0x140028d77
movdqa xmm0, xmmword [str.0000000000000000]
mov rcx, rax
movdqa xmm5, xmmword [0x14012fd60]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x30
jl 0x140028c70
cmp r8d, 0x37
jge 0x140028db1
movsxd r9, r8d
add r9, r10
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x37
jl 0x140028d80
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call fcn.140004730
mov rcx, rax
cmp byte [rax + 3], bl
je 0x140028e91
cmp edi, 2
jl 0x140028e56
movdqa xmm3, xmmword [0x14012fd60]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x14012fef0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x14012fef0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x14012fd80]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.0000000000000000]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x140028e91
mov r9, rcx
mov r8d, ebx
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x140028e60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004740
mov r10, rax
cmp byte [rax + 0x3e], bl
je 0x140029031
mov r8d, ebx
cmp edi, 2
jl 0x140028ff7
movdqa xmm0, xmmword [str.0000000000000000]
mov rcx, rax
movdqa xmm5, xmmword [0x14012fd60]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x38
jl 0x140028ef0
cmp r8d, 0x3f
jge 0x140029031
movsxd r9, r8d
add r9, r10
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x3f
jl 0x140029000
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call fcn.140004790
mov rcx, rax
cmp byte [rax + 3], bl
je 0x140029111
cmp edi, 2
jl 0x1400290d6
movdqa xmm3, xmmword [0x14012fd60]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x14012fef0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x14012fef0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x14012fd80]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.0000000000000000]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x140029111
mov r9, rcx
mov r8d, ebx
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x1400290e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1400047a0
mov r10, rax
cmp byte [rax + 0x3a], bl
je 0x1400292b1
mov r8d, ebx
cmp edi, 2
jl 0x140029277
movdqa xmm0, xmmword [str.0000000000000000]
mov rcx, rax
movdqa xmm5, xmmword [0x14012fd60]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x38
jl 0x140029170
cmp r8d, 0x3b
jge 0x1400292b1
movsxd r9, r8d
add r9, r10
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x3b
jl 0x140029280
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call fcn.1400047f0
mov rcx, rax
cmp byte [rax + 3], bl
je 0x140029391
cmp edi, 2
jl 0x140029356
movdqa xmm3, xmmword [0x14012fd60]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x14012fef0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x14012fef0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x14012fd80]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.0000000000000000]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x140029391
mov r9, rcx
mov r8d, ebx
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x140029360
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004800
mov r10, rax
cmp byte [rax + 0x2d], bl
je 0x140029531
mov r8d, ebx
cmp edi, 2
jl 0x1400294f7
movdqa xmm0, xmmword [str.0000000000000000]
mov rcx, rax
movdqa xmm5, xmmword [0x14012fd60]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp r8d, 0x28
jl 0x1400293f0
cmp r8d, 0x2e
jge 0x140029531
movsxd r9, r8d
add r9, r10
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x2e
jl 0x140029500
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call fcn.140004840
mov rcx, rax
cmp byte [rax + 3], bl
je 0x140029611
cmp edi, 2
jl 0x1400295d6
movdqa xmm3, xmmword [0x14012fd60]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x14012fef0]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x14012fef0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 4
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x14012fd80]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.0000000000000000]
xorps xmm2, xmm0
movd dword [rax], xmm2
jmp 0x140029611
mov r9, rcx
mov r8d, ebx
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, dl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x1400295e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rsp + 0x24]
lea rcx, [rsp + 0x20]
call fcn.140004460
mov r10, rax
movzx eax, byte [rax + 1]
test al, al
je 0x14002963b
xor byte [r10], 0x30
xor al, 0x31
mov byte [r10 + 1], al
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140004850
mov r11, rax
cmp byte [rax + 0x7d], bl
je 0x1400297cd
cmp edi, 2
jl 0x140029792
movdqa xmm0, xmmword [str.0000000000000000]
mov rcx, rax
movdqa xmm5, xmmword [0x14012fd60]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmmword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x30]
nop dword [rax]
movd xmm2, ebx
lea eax, [rbx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ebx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 8], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012fda0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
cmp ebx, 0x78
jl 0x140029690
cmp ebx, 0x7e
jge 0x1400297cd
movsxd r8, ebx
add r8, r11
nop dword [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, bl
inc ebx
sub al, cl
add al, 0x30
xor byte [r8 - 1], al
cmp ebx, 0x7e
jl 0x1400297a0
xor r9d, r9d
mov r8, r10
mov rdx, r11
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
movaps xmm6, xmmword [rsp + 0xd0]
mov rdi, qword [rsp + 0xe0]
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14012a5c0
add rsp, 0xe8
ret