Function at 0x140094ce0
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x1dcb1ecc
mov qword [rsp], r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg rdx, rdi
mov r14, rdi
xchg rdx, rdi
xor edx, edx
mov r8d, 0x5e867469
xor r8d, 0x5e867663
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x615ab31e
sub edx, 0x615ab21a
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r15d, r15d
mov qword [rsp + 0x50], r15
xchg r15, r10
mov qword [rsp + 0x60], r10
xchg r10, r15
mov qword [rsp + 0x68], 0x299f9429
sub qword [rsp + 0x68], 0x299f9422
mov word [rsp + 0x50], r15w
lea rax, [rbp]
nop
movabs rsi, 0xffffffff55f79a40
add rsi, 0x7fffffff
xor rsi, 0x2a0865c0
xchg r9, rsi
mov r8, r9
xchg rsi, r9
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140094da8
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.14000f4a0
nop
mov byte [rbp + 0x258], 0x5b
add byte [rbp + 0x258], 0x63
mov dword [rbp + 0x25a], 0x292f0830
sub dword [rbp + 0x25a], 0x292e0892
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x63
sub byte [rbp + 0x258], 0x63
lea rax, [rbp + 0x25a]
xchg r9, rdx
mov r9, rsi
xchg rdx, r9
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140094e1e
mov rcx, qword [rsp + 0x60]
xchg r8, rdi
mov rdi, qword [rsp + 0x68]
xchg r8, rdi
xchg r8, rcx
mov rax, rcx
xchg r8, rcx
sub rax, rcx
cmp rdx, rax
ja 0x140094e8d
lea rdi, [rcx + rdx]
xchg rdi, rcx
mov qword [rsp + 0x60], rcx
xchg rcx, rdi
lea rbx, [rsp + 0x50]
cmp r8, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi*2], r15w
jmp 0x140094eb2
xchg rdx, r10
mov qword [rsp + 0x20], r10
xchg r10, rdx
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
lea rcx, [rsp + 0x50]
call fcn.140012150
nop
xchg r15, rax
mov r15, rax
xchg r15, rax
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x5d
xor byte [rbp + rax + 0x25a], 0x5d
inc rax
cmp rax, 2
jb 0x140094ec1
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x140094ede
xchg rbx, rcx
mov rbx, qword [rsp + 0x60]
xchg rcx, rbx
xchg rdx, rcx
mov rcx, qword [rsp + 0x68]
xchg rcx, rdx
xchg rdi, rdx
mov rax, rdi
xchg rdx, rdi
sub rax, rcx
cmp rsi, rax
ja 0x140094f56
lea rdi, [rcx + rsi]
xchg rdi, r9
mov qword [rsp + 0x60], r9
xchg rdi, r9
lea rbx, [rsp + 0x50]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rcx*2]
lea r8, [rsi + rsi]
xchg r9, r14
mov rdx, r9
xchg r14, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r15w
jmp 0x140094f85
xchg rsi, rbp
mov qword [rsp + 0x20], rbp
xchg rsi, rbp
xchg r14, r15
mov r9, r15
xchg r14, r15
movzx r8d, byte [rbp + 0x250]
xchg rdx, r11
mov r11, rsi
xchg rdx, r11
lea rcx, [rsp + 0x50]
call fcn.140012150
xorps xmm0, xmm0
xor eax, eax
xchg r15, rbp
movups xmmword [r15 - 0x6c], xmm0
xchg rbp, r15
xchg rbp, rbx
movups xmmword [rbx - 0x5c], xmm0
xchg rbp, rbx
movups xmmword [rbp - 0x4c], xmm0
xchg r15, rbp
movups xmmword [r15 - 0x3c], xmm0
xchg r15, rbp
xchg rbp, rcx
movups xmmword [rcx - 0x2c], xmm0
xchg rbp, rcx
xchg rbp, r11
movups xmmword [r11 - 0x1c], xmm0
xchg r11, rbp
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x3ccdf163
sub dword [rbp + 0x250], 0x3ccdf162
mov dword [rbp - 0x70], 0x7544013d
sub dword [rbp - 0x70], 0x754400d5
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg rbx, rax
mov qword [rsp + 0x48], rbx
xchg rbx, rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xchg rcx, r13
mov r13, qword [rsp + 0x78]
xchg r13, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x674bed31
add edx, 0x98b412ce
xchg rsi, rcx
mov rsi, qword [rsp + 0x70]
xchg rsi, rcx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg rcx, r8
mov r8, qword [rsp + 0x70]
xchg r8, rcx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400950fc
lea rdx, [rdx*2 + 2]
xchg rcx, rbx
mov rbx, qword [rsp + 0x50]
xchg rbx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400950f7
nop
sub rdx, 0x7340eb78
add rdx, 0x7340eb9f
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffffbe1a1fee
sub rax, 0xffffffffbe1a1ff6
cmp rax, 0x1f
jbe 0x1400950f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401102d0
mov eax, ebx
xchg rbx, r10
mov r10, qword [rsp + 0x340]
xchg rbx, r10
add rsp, 0x310
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r14
push rax
push rcx
push rax
push rbx
push rax
push rax
push rcx
push rbx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
push rbx
push rax
push rdx
push rcx
push rbx
push rdx
xchg qword [rsp + 0x30], rsi
add rsp, 0x38
push rcx
push rbx
push rbx
push rcx
push rbx
push rax
push rcx
push rbx
xchg qword [rsp + 0x40], rbp
pop rbx
pop rcx
pop rax
pop rbx
pop rcx
pop rbx
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]