Function at 0x140009880
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor edi, edi
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
movdqa xmm0, xmmword [0x1400dd430]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x46491250
mov word [rsp + 0x54], Ordinal_79
mov byte [rsp + 0x56], 1
mov eax, edi
nop dword [rax + rax]
lea ecx, [rax + 0x2b]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x15
jb 0x1400098f0
mov byte [rsp + 0x56], dil
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x55]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140005840
nop
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdx, qword [rsp + 0x58]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rcx, [rbp - 0x80]
call fcn.1400042d0
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x80], r15
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x7c], edx
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1400099b1
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400099ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400099ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c2600
lea rcx, [rsp + 0x38]
call fcn.140001cc0
movabs rax, 0x7ffffffffa0a1efe
mov rbx, qword [rsp + 0x38]
cmp rbx, rax
jg 0x1400099d8
add rbx, 0x5f5e100
jmp 0x1400099e2
movabs rbx, 0x7fffffffffffffff
movabs rsi, 0x4e94914effff
movabs r14, 0x431bde82d7b634db
lea rcx, [rsp + 0x38]
call fcn.140001cc0
mov rax, qword [rsp + 0x38]
cmp rbx, rax
je 0x140009a4f
jl 0x140009a4f
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jg 0x140009a43
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140009a3a
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400099f6
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400099f6
movdqa xmm0, xmmword [str._MEDY_]
movdqu xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x1400dd2a0]
movdqu xmmword [rsp + 0x68], xmm1
mov byte [rsp + 0x78], 1
lea eax, [rdi + 0x2b]
xor byte [rsp + rdi + 0x58], al
inc rdi
cmp rdi, 0x1f
jb 0x140009a70
mov byte [rsp + 0x78], 0
lea rcx, [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx - 0x80], r15
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp - 0x78]
call fcn.140004260
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x28]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400c20c0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret