Function at 0x140002320
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor ebx, ebx
lea edi, [rbx + 0xa]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movdqa xmm0, xmmword [0x14005f570]
movdqu xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x14005f560]
movdqu xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x10], pe_nt_image_headers64
mov ecx, ebx
lea eax, [rcx - 0x15]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0x20
jb 0x140002380
mov byte [rbp - 0xf], bl
lea r9, [rbp + 0x30]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140003470
nop
lea rdi, [rbp - 0x50]
mov r14, qword [rbp - 0x50]
mov r13, qword [rbp - 0x38]
cmp r13, 0x10
cmovae rdi, r14
lea rcx, [rbp - 0x50]
cmovae rcx, r14
mov r15, qword [rbp - 0x40]
add r15, rcx
movabs r12, 0x7fffffffffffffff
cmp rdi, r15
je 0x14000246f
movabs r13, 0x7ffffffffc6c78ff
nop dword [rax]
movzx edx, byte [rdi]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002eb0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rsi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rsi, 0x989680
jne 0x14000242a
imul rax, rax, 0x64
jmp 0x140002445
cqo
idiv rsi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rsi
add rax, rcx
cmp rax, r13
jge 0x140002456
add rax, 0x3938700
mov qword [rbp + 0x30], rax
jmp 0x14000245a
mov qword [rbp + 0x30], r12
lea rcx, [rbp + 0x30]
call fcn.140003a00
inc rdi
cmp rdi, r15
jne 0x1400023f0
mov r13, qword [rbp - 0x38]
cmp r13, 0x10
jb 0x1400024a9
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400024a1
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400520f0
mov esi, reloc.WS2_32.dll_ntohs
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rdi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rdi, 0x989680
jne 0x1400024e3
imul rax, rax, 0x64
jmp 0x140002501
cqo
idiv rdi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x14000251e
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x30], rcx
jmp 0x140002522
mov qword [rbp + 0x30], r12
lea rcx, [rbp + 0x30]
call fcn.140003a00
lea rcx, [0x14005f50c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov edx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp - 0x60], 0x848385e1
mov dword [rbp - 0x5c], 0xd285938a
mov dword [rbp - 0x58], 0xc4d4de
mov byte [rbp - 0x54], 1
mov rdi, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rbx
nop dword [rax + rax]
lea eax, [rdx - 0x15]
xor byte [rbp + rdx - 0x60], al
inc rdx
cmp rdx, 0xb
jb 0x140002590
mov byte [rbp - 0x54], 0
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140003070
lea rdx, [0x140003240]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x60], 0x878284a8
mov dword [rbp - 0x5c], 0xcb958c
mov byte [rbp - 0x58], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x15]
xor byte [rbp + rbx - 0x60], al
inc rbx
cmp rbx, 7
jb 0x1400025e0
mov byte [rbp - 0x58], 0
lea rdx, [rbp - 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003070
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret