Function at 0x140071b80
Capabilities:
Encode data using xor
Execute command
Manipulate console buffer
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x14009a0c0]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
lea r8, [rbp + 0x17]
mov rbx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx]
mov edx, 0xa3e5bc
lea r9d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [rbx]
lea r9d, [rsi + 1]
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], rsi
mov edx, 0xa3e5bc
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0x17]
cmp al, 0x14
je 0x140071c24
nop dword [rax]
cmp al, 0x42
je 0x140071c24
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbx]
lea r8, [rbp + 0x17]
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov edx, 0xa3e5bc
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rbp + 0x17]
cmp al, 0x14
jne 0x140071bf0
mov rcx, qword [rbx]
lea r8, [0x14009b8d0]
mov r9d, 8
mov qword [rsp + 0x20], rsi
mov edx, 0x102fb439
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [0x14009a140]
mov r9d, reloc.WS2_32.dll_listen
mov qword [rsp + 0x20], rsi
mov edx, 0x1016353f
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbx]
lea r8, [rbp + 0x17]
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov edx, 0xa3e5bc
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movdqa xmm0, xmmword [0x14008be10]
mov rcx, rsi
movdqa xmm1, xmmword [0x14008be30]
movdqu xmmword [rbp - 0x59], xmm0
mov dword [rbp - 0x29], 0xdaff9188
movdqa xmm0, xmmword [0x14008bcd0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x25], 0xbd97c6da
movdqu xmmword [rbp - 0x49], xmm1
mov word [rbp - 0x21], 0x100
nop
lea eax, [rcx - 0x80]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x38
jb 0x140071cc0
lea rcx, [rbp - 0x59]
mov byte [rbp - 0x20], sil
call fcn.140001ac0
movdqa xmm0, xmmword [0x14008bd10]
mov rcx, rsi
movdqa xmm1, xmmword [0x14008bd40]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm0, xmmword [0x14008bd50]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm1, xmmword [0x14008bb90]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmmword [rbp - 0x29], xmm1
mov byte [rbp - 0x19], 1
nop dword [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x3f
jb 0x140071d20
lea rcx, [rbp - 0x59]
mov byte [rbp - 0x19], sil
call fcn.140001ac0
movdqa xmm0, xmmword [0x14008bdb0]
mov rcx, rsi
movdqa xmm1, xmmword [0x14008bd70]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm0, xmmword [0x14008bd90]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm1, xmmword [0x14008bd80]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm0, xmmword [0x14008bcf0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [0x14008bd00]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmmword [rbp - 9], xmm1
mov dword [rbp + 7], 0x100ebce
nop word [rax + rax]
lea eax, [rcx - 0x80]
xor byte [rbp + rcx - 0x59], al
inc rcx
cmp rcx, 0x62
jb 0x140071da0
lea rcx, [rbp - 0x59]
mov byte [rbp + 0xa], sil
call fcn.140001ac0
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
movabs rdi, 0x165a0bc00
add rdi, rax
mov rcx, qword [rbx]
lea r8, [rbp + 0x17]
mov r9d, 1
mov qword [rsp + 0x20], rsi
mov edx, 0xa3e5bc
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0x17], 0x2c
je 0x140071f92
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
cmp rax, rdi
je 0x140071e04
jl 0x140071dd0
mov dword [rbp + 0x1f], 0x3eee3ec7
mov rcx, rsi
mov dword [rbp + 0x23], 0x3ee73eed
mov r8d, 0x3e80
mov dword [rbp + 0x27], 0x3ecb3ea4
mov dword [rbp + 0x2b], 0x3ef03ee3
mov dword [rbp + 0x2f], 0x3ea83efb
mov word [rbp + 0x33], si
mov byte [rbp + 0x35], 1
nop dword [rax + rax]
lea eax, [r8 + rcx]
xor word [rbp + rcx*2 + 0x1f], ax
inc rcx
cmp rcx, 0xa
jb 0x140071e40
mov byte [rbp + 0x35], sil
mov rcx, rsi
mov dword [rbp - 0x59], 0x3eee3ed9
mov dword [rbp - 0x55], 0x3ea33ef7
mov dword [rbp - 0x51], 0x3ee43ee7
mov dword [rbp - 0x4d], 0x3ea73ee8
mov dword [rbp - 0x49], 0x3ee63ee6
mov dword [rbp - 0x45], 0x3eab3efd
mov dword [rbp - 0x41], 0x3ee33ee9
mov dword [rbp - 0x3d], 0x3eed3eef
mov dword [rbp - 0x39], 0x3ef43efc
mov dword [rbp - 0x35], 0x3ef03eb2
mov dword [rbp - 0x31], 0x3ef03efc
mov dword [rbp - 0x2d], 0x3ee33ef7
mov dword [rbp - 0x29], 0x3eb73eeb
mov word [rbp - 0x25], si
mov byte [rbp - 0x23], 1
nop dword [rax]
lea eax, [r8 + rcx]
xor word [rbp + rcx*2 - 0x59], ax
inc rcx
cmp rcx, 0x1a
jb 0x140071ec0
mov r9d, 0x41040
mov byte [rbp - 0x23], sil
lea r8, [rbp + 0x1f]
xor ecx, ecx
lea rdx, [rbp - 0x59]
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xfffffff5
mov dword [rbp - 0x69], esi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rbp + 0x1f]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx ecx, word [rbp + 0x1f]
lea rax, [rbp + 0x3f]
movsx r8d, word [rbp + 0x21]
mov ebx, esi
imul r8d, ecx
mov r9d, ebx
mov dl, reloc.WLDAP32.dll_Ordinal_32
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
movsx eax, word [rbp + 0x1f]
mov edx, 7
movsx r8d, word [rbp + 0x21]
mov r9d, ebx
imul r8d, eax
mov rcx, rdi
lea rax, [rbp + 0x3f]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140070900
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
movdqa xmm0, xmmword [0x14008bdd0]
lea rcx, [rbp + 0x1f]
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp + 0x2f], 0xfbe1faf3
mov dword [rbp + 0x33], 0xf2b8e1fb
mov dword [rbp + 0x37], 0xb4bafce0
mov word [rbp + 0x3b], 0xda
mov byte [rbp + 0x3d], 1
call fcn.140001eb0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3