Function at 0x1401571d0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg r15, rbx
mov qword [rsp + 0x10], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r14
push rdx
mov qword [rsp], r15
lea rbp, [rsp - 0x2070]
mov eax, 0x76945b0a
xor eax, 0x17d96ac5
sub eax, 0x5fecb3a6
add eax, 0x2512f008
add eax, 0x126508ad
sub eax, 0x8112740
sub eax, 0x1c8c5392
add eax, 0x4c57d87e
sub eax, 0x6092b31a
call fcn.1401fd400
sub rsp, rax
mov r15, rdx
xchg r12, rcx
mov rcx, r12
xchg rcx, r12
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157b50
xchg rcx, r15
mov r15, rdx
xchg r15, rcx
call fcn.140070170
cmp rax, 3
jb 0x1401579d0
lea edx, [rsi + 1]
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.14004e0e0
mov dl, 0x43
sub dl, 0x26
add dl, 0x21
add dl, 9
sub dl, 0x14
sub dl, 0x27
sub dl, 0xb
mov rcx, rax
call fcn.14007dce0
test al, al
je 0x1401579d0
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
xchg rcx, r14
mov r14, qword [r12]
xchg rcx, r14
call fcn.140163af0
nop
xchg rdi, r9
mov r9, qword [r12]
xchg r9, rdi
lea rcx, [rdi + 0x308]
call fcn.14007e860
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea edx, [rsi + 2]
mov rcx, r15
call fcn.14004e0e0
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.14007e2d0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg r8, rbx
mov rcx, r8
xchg r8, rbx
call fcn.140052670
nop
xchg r11, rcx
mov r11, rax
xchg r11, rcx
call fcn.140176140
xchg rbp, rax
mov rbx, rbp
xchg rbp, rax
lea rcx, [rbp - 0x20]
call fcn.14007b1a0
xchg rbx, rbp
mov r9, rbp
xchg rbx, rbp
xchg rcx, r8
mov rcx, rax
xchg rcx, r8
lea edx, [rsi + 0x40]
xchg rcx, rsi
mov rsi, rdi
xchg rsi, rcx
call fcn.14016e440
nop
lea rcx, [rbp + 0x28]
call fcn.140029bc0
nop
lea rcx, [rbp - 0x80]
call fcn.14004c6a0
xchg rcx, r13
mov r13, r15
xchg r13, rcx
call fcn.140070170
cmp rax, 4
jb 0x1401579c7
xchg rbx, rcx
mov rbx, qword [r12]
xchg rcx, rbx
neg rcx
add rcx, 0xfffffffffffffcf8
neg rcx
call fcn.14007e860
xchg rbx, rdi
mov rdi, rax
xchg rbx, rdi
lea edx, [rsi + 3]
mov rcx, r15
call fcn.14004e0e0
lea rdx, [rsp + 0x60]
xchg rsi, rax
mov rcx, rsi
xchg rsi, rax
call fcn.14007e2d0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rbx, r8
mov rcx, r8
xchg rbx, r8
call fcn.140052670
nop
lea rcx, [rsp + 0x60]
call fcn.14004c6a0
lea rcx, [rbp - 0x60]
call fcn.140179190
cmp rax, 8
jb 0x140157756
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x1401791a0
nop
mov dword [rbp + 0x20b0], 0x70af62df
xor dword [rbp + 0x20b0], 0x6dbf8d57
add dword [rbp + 0x20b0], 0x53758dcc
sub dword [rbp + 0x20b0], 0x63eb86d
sub dword [rbp + 0x20b0], 0x5c78049
sub dword [rbp + 0x20b0], 0x6480449d
xchg r11, rcx
mov r11, rax
xchg r11, rcx
call fcn.140176140
xchg r10, rdx
mov r10, rax
xchg rdx, r10
lea rcx, [rbp + 0x10]
call fcn.14007aa00
mov rbx, rax
mov dword [rbp + 0x20b0], 0x1417a3ac
xor dword [rbp + 0x20b0], 0x19d4de56
xor dword [rbp + 0x20b0], 0x4e82a817
sub dword [rbp + 0x20b0], 0x1b786f48
xor dword [rbp + 0x20b0], 0x7614b47
xor dword [rbp + 0x20b0], 0x7274b42f
add dword [rbp + 0x20b0], 0xfa2f254
xor dword [rbp + 0x20b0], 0x10fd18fa
xor dword [rbp + 0x20b0], 0x728294d8
mov dword [rsp + 0x40], 0x77058dce
xor dword [rsp + 0x40], 0xe43d45e
sub dword [rsp + 0x40], 0x1720c1f9
xor dword [rsp + 0x40], 0x5f824496
add dword [rsp + 0x40], 0x29c86131
xor dword [rsp + 0x40], 0x7d7c873
xor dword [rsp + 0x40], 0x47355e4a
xor dword [rsp + 0x40], 0xd16454fd
mov dword [rsp + 0x4a], 0x5c97bf33
sub dword [rsp + 0x4a], 0x4d4a4da5
xor dword [rsp + 0x4a], 0x2209d6e9
xor dword [rsp + 0x4a], 0x6f3af925
add dword [rsp + 0x4a], 0x159b87a
xor dword [rsp + 0x4a], 0xbca6e9ce
mov dword [rsp + 0x4e], 0x765c758f
xor dword [rsp + 0x4e], 0x653654b2
add dword [rsp + 0x4e], 0x4c41b1a5
sub dword [rsp + 0x4e], 0x535e2fe8
add dword [rsp + 0x4e], 0x433a5d86
add dword [rsp + 0x4e], 0xaff2fefe
mov dword [rsp + 0x44], 0x39973e28
sub dword [rsp + 0x44], 0xf8c5788
xor dword [rsp + 0x44], 0x444e077c
add dword [rsp + 0x44], 0xb46f7ad
sub dword [rsp + 0x44], 0x4b33fad7
xor dword [rsp + 0x44], 0x77ed8513
xor dword [rsp + 0x44], 0xaf4cad57
mov dword [rsp + 0x52], 0x1465f469
add dword [rsp + 0x52], 0x7a2805a
add dword [rsp + 0x52], 0x6159abd7
sub dword [rsp + 0x52], 0x405695ca
xor dword [rsp + 0x52], 0x4ce739ba
sub dword [rsp + 0x52], 0x36e4d731
sub dword [rsp + 0x52], 0x30a6f210
xor dword [rsp + 0x52], 0xf5241554
mov dword [rsp + 0x56], 0x1829e17d
sub dword [rsp + 0x56], 0x257030
xor dword [rsp + 0x56], 0x59646937
xor dword [rsp + 0x56], 0x73ecc0e9
sub dword [rsp + 0x56], 0x1b145a4c
xor dword [rsp + 0x56], 0xe841817e
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x19
add byte [rsp + rdx + 0x40], 0x65
sub byte [rsp + rdx + 0x40], 0x51
add byte [rsp + rdx + 0x40], 0x51
sub byte [rsp + rdx + 0x40], 0x46
sub byte [rsp + rdx + 0x40], 0x38
inc rdx
cmp rdx, 8
jb 0x140157611
mov dword [rbp + 0x20b0], 0x6d159e45
sub dword [rbp + 0x20b0], 0x4d6ba1ce
xor dword [rbp + 0x20b0], 0x66a05c15
xor dword [rbp + 0x20b0], 0x1868586e
xor dword [rbp + 0x20b0], 0x1adf4e9e
sub dword [rbp + 0x20b0], 0x18dfb03
sub dword [rbp + 0x20b0], 0x7316608b
add dword [rbp + 0x20b0], 0x42a0cba9
xor dword [rbp + 0x20b0], 0x49bb26aa
movups xmm0, xmmword [rsp + 0x40]
xchg rsi, rbp
movaps xmmword [rsi - 0x40], xmm0
xchg rsi, rbp
movsd xmm1, qword [rsp + 0x50]
xchg r12, rbp
movsd qword [r12 - 0x30], xmm1
xchg r12, rbp
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c0a0
nop
mov r14d, 0x5388fad9
add r14d, 0x1eeb06f2
sub r14d, 0xc839993
xor r14d, 0x1655a55c
xor r14d, 0x29b08b3f
xor r14d, 0x4270be47
add r14d, 0xfdbee4c
add r14d, 0x2c0eb573
sub r14d, 0x54509bcc
mov dword [rbp + 0x20b0], r14d
mov rdx, rax
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14007b110
test al, al
je 0x140157756
mov bl, 0x74
sub bl, 0x32
xor bl, 0x41
xor bl, 2
add bl, 0x12
sub bl, 0xc
sub bl, 6
jmp 0x140157758
xor bl, bl
test r14b, 8
je 0x140157777
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007ae40
nop
test r14b, 4
je 0x1401577d3
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r13, rax
mov r13, rsi
xchg r13, rax
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x7c
xor byte [rsp + rax + 0x4a], 0x7a
add byte [rsp + rax + 0x4a], 0x19
add byte [rsp + rax + 0x4a], 0x56
sub byte [rsp + rax + 0x4a], 0x24
add byte [rsp + rax + 0x4a], 0x1e
add byte [rsp + rax + 0x4a], 0xc
sub byte [rsp + rax + 0x4a], 0x7b
inc rax
cmp rax, 0x10
jb 0x14015779e
test r14b, 2
je 0x1401577f2
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007ae40
nop
test r14b, 1
je 0x140157810
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029bc0
test bl, bl
je 0x1401579bd
lea rcx, [rbp - 0x60]
call fcn.140176140
mov r8, rax
mov dword [rsp + 0x30], 0x76e5efe2
xor dword [rsp + 0x30], 0x28b7ddea
add dword [rsp + 0x30], 0xdd0ca0d
sub dword [rsp + 0x30], 0xcef4f38
sub dword [rsp + 0x30], 0x378e9a54
sub dword [rsp + 0x30], 0xef9278c
xor dword [rsp + 0x30], 0x120d1ed3
xor dword [rsp + 0x30], 0xfc5002d8
mov dword [rsp + 0x36], 0x14516b5f
xor dword [rsp + 0x36], 0x371f8647
sub dword [rsp + 0x36], 0x1640c980
add dword [rsp + 0x36], 0x2273a14a
xor dword [rsp + 0x36], 0xd179de4
xor dword [rsp + 0x36], 0x286c2db1
xor dword [rsp + 0x36], 0xf5808bce
mov dword [rsp + 0x3a], 0x45e74b01
add dword [rsp + 0x3a], 0x3d2c6b7
xor dword [rsp + 0x3a], 0x5a604677
add dword [rsp + 0x3a], 0x4906dcf
add dword [rsp + 0x3a], 0x4baab8f0
add dword [rsp + 0x3a], 0x9b6380e1
xor eax, eax
mov word [rsp + 0x3e], ax
xchg r14, rax
mov r14, rsi
xchg r14, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x2c
add byte [rsp + rax + 0x30], 0x2d
add byte [rsp + rax + 0x30], 0xb
sub byte [rsp + rax + 0x30], 0x2c
add byte [rsp + rax + 0x30], 0x3e
sub byte [rsp + rax + 0x30], 0x60
add byte [rsp + rax + 0x30], 0xb
xor byte [rsp + rax + 0x30], 0x29
sub byte [rsp + rax + 0x30], 8
inc rax
cmp rax, 4
jb 0x1401578e1
mov dword [rsp + 0x28], 0x2c13f763
add dword [rsp + 0x28], 0x5333f597
sub dword [rsp + 0x28], 0x55aa8438
sub dword [rsp + 0x28], 0x24369e4e
add dword [rsp + 0x28], 0x622bd4f3
xor dword [rsp + 0x28], 0x50c1fd99
xor dword [rsp + 0x28], 0x375362ff
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
xchg rsi, rdi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x6f
xor byte [rsp + rsi + 0x36], 0x1c
xor byte [rsp + rsi + 0x36], 0x37
add byte [rsp + rsi + 0x36], 0x14
sub byte [rsp + rsi + 0x36], 0x4a
add byte [rsp + rsi + 0x36], 0x6a
sub byte [rsp + rsi + 0x36], 0x44
add byte [rsp + rsi + 0x36], 0x13
sub byte [rsp + rsi + 0x36], 0x47
inc rsi
cmp rsi, 8
jb 0x140157983
lea rcx, [rbp - 0x60]
call fcn.140029bc0
nop
lea rcx, [rbp - 0x20]
jmp 0x140157b4b
mov r9d, 0x630a0f39
xor r9d, 0x625b0d73
add r9d, 0x5d4785d4
add r9d, 0x3c7838e
xor r9d, 0x118240e5
xor r9d, 0x432c6901
sub r9d, 0x2d881c17
add r9d, 0x3526ec63
add r9d, 0xc7930d6b
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
xchg rcx, r13
mov r13, qword [r12]
xchg rcx, r13
call fcn.140163af0
nop
mov r9d, 0x75572e15
add r9d, 0x9e09a2f
xor r9d, 0x65c9d63b
add r9d, 0x54966c53
xor r9d, 0x4504816b
sub r9d, 0x146d56c7
add r9d, 0x1c624741
sub r9d, 0x13c8b7e4
add r9d, 0xe143bbb0
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg rcx, rdx
mov rdx, qword [r12]
xchg rcx, rdx
call fcn.140163af0
nop
xor edx, edx
mov r8d, 0x55cda7f0
xor r8d, 0x2916cbe3
sub r8d, 0x6cedd9bd
add r8d, 0x50d056be
sub r8d, 0x54460b86
xor r8d, 0xc77fd8e
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
sub rcx, 0x3e1fe5ec
add rcx, 0x3e1feb4c
call fcn.14007b5c0
xchg rdi, rax
mov rbx, rdi
xchg rdi, rax
lea rcx, [rsp + 0x60]
call fcn.14007b5c0
mov r8, rbx
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140086a60
xchg r10, rbx
mov r10, qword [r12]
xchg r10, rbx
lea rcx, [rbp - 0x80]
call fcn.14007b1a0
lea r9, [rbp + 0x70]
xchg r8, rax
mov rax, r8
xchg r8, rax
mov edx, 0x74fbd429
xor edx, 0x7a2d7597
add edx, 0xf418c6d
xor edx, 0x676ca2a
add edx, 0x4a9324cf
sub edx, 0x63020890
xchg r15, rcx
mov r15, rbx
xchg rcx, r15
call fcn.14016e440
nop
lea rcx, [rsp + 0x60]
call fcn.14007ae40
nop
lea rcx, [rbp - 0x80]
call fcn.14007ae40
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3