Function at 0x140161b80
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov r15, rdx
xor edx, edx
mov r8d, 0x482f22da
xor r8d, 0x15973d93
sub r8d, 0x43fbf1a8
xor r8d, 0x675adf75
sub r8d, 0x290b927e
sub r8d, 0x3555b164
add r8d, 0x2263ffaf
sub r8d, 0x42e9ac97
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x458f1748
sub edx, 0x161f1c25
add edx, 0x34cea91
add edx, 0xffc4eaa
add edx, 0x63b5d3a
add edx, 0x1bd72b84
sub edx, 0x64cbbc18
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff176021c3
add rsi, 0x1df55d9e
add rsi, 0x92d4c1d
add rsi, 0xeb46f18
sub rsi, 0x486427b
sub rsi, 0x3766b326
add rsi, 0x7fffffff
add rsi, 0x6eb5bb0b
mov rbx, rsi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161c92
movabs r14, 0x7fffffff3545bb25
sub r14, 0xecce51f
sub r14, 0x9f1b913
sub r14, 0x1a915bdd
add r14, 0x7b71a53c
add r14, 0x7fffffff
add r14, 0x29899ad
cmp rbx, r14
ja 0x1401622bd
mov qword [rsp + 0x68], 0xf3cbf77
xor qword [rsp + 0x68], 0x4283155c
add qword [rsp + 0x68], 0x25219272
sub qword [rsp + 0x68], 0x2a82ef0c
sub qword [rsp + 0x68], 0x4464494e
xor qword [rsp + 0x68], 0x3fa0444
cmp rbx, 8
jae 0x140161d4d
xchg rbx, rsi
mov qword [rsp + 0x60], rsi
xchg rbx, rsi
add rbx, rbx
xchg rdi, r8
mov rdi, rbx
xchg r8, rdi
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161def
mov rax, rbx
or rax, 7
cmp rax, r14
ja 0x140161da2
xchg rbp, r14
mov rbp, rax
xchg rbp, r14
mov ecx, 0x2433c319
add ecx, 0x5122b643
sub ecx, 0x39e398b
xor ecx, 0x6054331d
xor ecx, 0x8d72bcd
add ecx, 0x3dc3d301
sub ecx, 0x4cb448f1
add ecx, 0xee22180
sub ecx, 0x192cd287
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f9e0
mov rdi, rax
xchg r9, rax
mov qword [rsp + 0x50], r9
xchg r9, rax
xchg r14, rbx
mov qword [rsp + 0x60], r14
xchg rbx, r14
mov qword [rsp + 0x68], r14
add rbx, rbx
xchg r15, r8
mov r15, rbx
xchg r8, r15
lea rdx, [rbp]
xchg r13, rcx
mov r13, rax
xchg r13, rcx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x16
add byte [rbp + 0x258], 0x28
add byte [rbp + 0x258], 0x28
add byte [rbp + 0x258], 0xc
sub byte [rbp + 0x258], 0x5d
add byte [rbp + 0x258], 0x69
add byte [rbp + 0x258], 0x78
mov dword [rbp + 0x25a], 0x4dca924
add dword [rbp + 0x25a], 0x710b4acd
xor dword [rbp + 0x25a], 0x709ed69d
xor dword [rbp + 0x25a], 0x53328e3e
sub dword [rbp + 0x25a], 0x428a6386
add dword [rbp + 0x25a], 0x20645c5d
add dword [rbp + 0x25a], 0x42d013de
sub dword [rbp + 0x25a], 0x6c4701d3
xor dword [rbp + 0x25a], 0xaae4952
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 2
add byte [rbp + 0x258], 1
add byte [rbp + 0x258], 0x25
add byte [rbp + 0x258], 0x23
sub byte [rbp + 0x258], 5
sub byte [rbp + 0x258], 0x46
lea rax, [rbp + 0x25a]
xchg rsi, r9
mov rdi, r9
xchg rsi, r9
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161ed3
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r12, rcx
mov rax, r12
xchg rcx, r12
sub rax, r14
cmp rdi, rax
ja 0x140161f3e
lea rax, [r14 + rdi]
xchg rbp, rax
mov qword [rsp + 0x60], rbp
xchg rbp, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161f66
xchg rcx, rdi
mov qword [rsp + 0x20], rcx
xchg rdi, rcx
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140035080
nop
mov rax, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x54
xor byte [rbp + rax + 0x25a], 0x3b
xor byte [rbp + rax + 0x25a], 0x6a
xor byte [rbp + rax + 0x25a], 0x28
add byte [rbp + rax + 0x25a], 0x15
sub byte [rbp + rax + 0x25a], 0x3a
xor byte [rbp + rax + 0x25a], 0x14
xor byte [rbp + rax + 0x25a], 0x5c
sub byte [rbp + rax + 0x25a], 0x40
inc rax
cmp rax, 2
jb 0x140161f6e
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161fc3
mov rdi, qword [rsp + 0x60]
xchg r11, rcx
mov r11, qword [rsp + 0x68]
xchg rcx, r11
xchg rbp, rcx
mov rax, rbp
xchg rcx, rbp
sub rax, rdi
cmp rsi, rax
ja 0x140162037
lea rax, [rdi + rsi]
xchg rcx, rax
mov qword [rsp + 0x60], rcx
xchg rcx, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg r11, r15
mov rdx, r11
xchg r11, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140162060
xchg rbp, rsi
mov qword [rsp + 0x20], rbp
xchg rbp, rsi
mov r9, r15
movzx r8d, byte [rbp + 0x250]
xchg r10, rdx
mov r10, rsi
xchg rdx, r10
lea rcx, [rsp + 0x50]
call fcn.140035080
xorps xmm0, xmm0
xor eax, eax
xchg r12, rbp
movups xmmword [r12 - 0x6c], xmm0
xchg rbp, r12
xchg r8, rbp
movups xmmword [r8 - 0x5c], xmm0
xchg r8, rbp
movups xmmword [rbp - 0x4c], xmm0
xchg rbp, rsi
movups xmmword [rsi - 0x3c], xmm0
xchg rsi, rbp
xchg r15, rbp
movups xmmword [r15 - 0x2c], xmm0
xchg r15, rbp
xchg rbp, r11
movups xmmword [r11 - 0x1c], xmm0
xchg r11, rbp
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
xchg r8, rax
mov qword [rbp - 0x80], r8
xchg r8, rax
mov dword [rbp + 0x250], 0x224d3011
xor dword [rbp + 0x250], 0x4301bcb7
sub dword [rbp + 0x250], 0xf4bdcbe
sub dword [rbp + 0x250], 0x3fc294e7
xor dword [rbp + 0x250], 0x3a35dfa2
add dword [rbp + 0x250], 0x89580a
add dword [rbp + 0x250], 0x352ba891
sub dword [rbp + 0x250], 0x4b28f14b
sub dword [rbp + 0x250], 0x1297d3f2
mov dword [rbp - 0x70], 0x44d0c371
sub dword [rbp - 0x70], 0x1d8aa3d0
xor dword [rbp - 0x70], 0x717f2d9e
add dword [rbp - 0x70], 0x123b2cd6
sub dword [rbp - 0x70], 0x33691dcf
xor dword [rbp - 0x70], 0x2c1c8a82
sub dword [rbp - 0x70], 0x1917cb5c
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg rdi, rax
mov qword [rsp + 0x48], rdi
xchg rdi, rax
lea rax, [rbp - 0x70]
xchg rdi, rax
mov qword [rsp + 0x40], rdi
xchg rdi, rax
xchg r12, rbx
mov qword [rsp + 0x38], rbx
xchg r12, rbx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xf00635b
xor edx, 0x76656ede
sub edx, 0xedada80
add edx, 0x13e76d2a
sub edx, 0x6327164c
add edx, 0xe4b5761c
xchg rcx, rdx
mov rdx, qword [rsp + 0x70]
xchg rcx, rdx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg rcx, rdx
mov rdx, qword [rsp + 0x70]
xchg rdx, rcx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140162255
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg r14, rax
mov r14, rcx
xchg r14, rax
cmp rdx, 0x1000
jb 0x140162250
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xfffffffffb4116bf
sub rax, 0xfffffffffb4116c7
cmp rax, 0x1f
jbe 0x140162250
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fd468
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
push rdx
push rcx
push rbx
push rbx
push rcx
push rax
push rdx
push rax
xchg qword [rsp + 0x40], r15
pop rax
pop rdx
pop rax
pop rcx
pop rbx
pop rbx
pop rcx
pop rdx
add rsp, 8
push rdx
push rcx
push rbx
push rcx
xchg qword [rsp + 0x20], r14
pop rcx
pop rbx
pop rcx
pop rdx
add rsp, 8
push rdx
push rdx
push rax
push rax
push rbx
push rax
push rbx
xchg qword [rsp + 0x38], r12
add rsp, 0x40
push rbx
push rax
push rax
push rdx
push rax
push rdx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
nop
xchg qword [rsp], rbp
add rsp, 8
ret
call fcn.14002f9a0
int3