Function at 0x1401610e0
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r15, rdx
mov rdx, r15
xchg rdx, r15
xor edx, edx
mov r8d, 0x6f883781
xor r8d, 0x36335ade
sub r8d, 0x2c255a81
sub r8d, 0x2043844e
sub r8d, 0x96f858c
sub r8d, 0x3e306fa
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x2316c902
xor edx, 0x1d2fae44
xor edx, 0x1ed1a79c
add edx, 0x4a7a6c51
sub edx, 0x41d5b6f3
xor edx, 0x60a80bc9
xor edx, 0x2e8520f3
sub edx, 0x67a05bfe
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
xchg r12, r15
mov qword [rsp + 0x60], r15
xchg r12, r15
xchg rbx, r12
mov qword [rsp + 0x68], rbx
xchg r12, rbx
lea rax, [rbp]
nop
movabs rsi, 0xffffffff52975c01
sub rsi, 0x1b4ec9be
sub rsi, 0x2423452c
add rsi, 0x35b3d1ea
xor rsi, 0x65b3239a
add rsi, 0x467cc3fb
add rsi, 0x7fffffff
xor rsi, 0xc18ff6a
mov rbx, rsi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161204
movabs r14, 0x7fffffff0293228d
add r14, 0x7041823b
sub r14, 0x70030d6a
xor r14, 0x520a2936
add r14, 0x2aa7b261
xor r14, 0x11aaabfc
xor r14, 0x730565a8
add r14, 0x7fffffff
xor r14, 0x66d34162
cmp rbx, r14
ja 0x140161824
mov qword [rsp + 0x68], 0x3c445f26
xor qword [rsp + 0x68], 0x571e7104
sub qword [rsp + 0x68], 0x57a52383
xor qword [rsp + 0x68], 0x4e0a9285
add qword [rsp + 0x68], 0x189627aa
sub qword [rsp + 0x68], 0x56051776
sub qword [rsp + 0x68], 0x2050a847
cmp rbx, 8
jae 0x1401612d0
mov qword [rsp + 0x60], rbx
add rbx, rbx
xchg r8, rbx
mov rbx, r8
xchg r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161376
xchg rbx, rsi
mov rax, rsi
xchg rsi, rbx
or rax, 7
cmp rax, r14
ja 0x14016132b
xchg rsi, r14
mov rsi, rax
xchg rsi, r14
mov ecx, 0x4a4c630
add ecx, 0x36c30d3d
sub ecx, 0x2a7165fd
sub ecx, 0x5f4e647
add ecx, 0x678de88c
add ecx, 0x5f0fa82
sub ecx, 0x6ab9bd4d
add ecx, 0x3d23ffc2
xor ecx, 0x4aeaaca6
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f870
mov rdi, rax
xchg rdx, rax
mov qword [rsp + 0x50], rdx
xchg rdx, rax
mov qword [rsp + 0x60], rbx
xchg r12, r14
mov qword [rsp + 0x68], r12
xchg r14, r12
add rbx, rbx
xchg r10, rbx
mov r8, r10
xchg rbx, r10
lea rdx, [rbp]
xchg r13, rax
mov rcx, r13
xchg r13, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x1c
add byte [rbp + 0x258], 8
add byte [rbp + 0x258], 0x52
xor byte [rbp + 0x258], 0x6c
xor byte [rbp + 0x258], 0x7c
sub byte [rbp + 0x258], 0x4b
xor byte [rbp + 0x258], 0x51
add byte [rbp + 0x258], 0xa
add byte [rbp + 0x258], 0xa2
mov dword [rbp + 0x25a], 0x61bc291d
add dword [rbp + 0x25a], 0x1690a0b5
sub dword [rbp + 0x25a], 0x701aae3e
add dword [rbp + 0x25a], 0x58d1f3ee
xor dword [rbp + 0x25a], 0x2e071b3a
sub dword [rbp + 0x25a], 0x4f021552
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x43
sub byte [rbp + 0x258], 0x42
add byte [rbp + 0x258], 0x47
sub byte [rbp + 0x258], 8
xor byte [rbp + 0x258], 0x16
add byte [rbp + 0x258], 4
sub byte [rbp + 0x258], 0x5a
lea rax, [rbp + 0x25a]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14016144b
mov r14, qword [rsp + 0x60]
xchg r13, rcx
mov r13, qword [rsp + 0x68]
xchg r13, rcx
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
sub rax, r14
cmp rdi, rax
ja 0x1401614ba
lea rax, [r14 + rdi]
xchg r12, rax
mov qword [rsp + 0x60], r12
xchg r12, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x1401614dc
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140034f70
nop
xchg r11, rax
mov r11, r12
xchg r11, rax
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x70
xor byte [rbp + rax + 0x25a], 0x1c
sub byte [rbp + rax + 0x25a], 0x14
xor byte [rbp + rax + 0x25a], 0x20
sub byte [rbp + rax + 0x25a], 0x75
xor byte [rbp + rax + 0x25a], 0x6f
sub byte [rbp + rax + 0x25a], 0x1f
add byte [rbp + rax + 0x25a], 0x11
sub byte [rbp + rax + 0x25a], 0x5e
inc rax
cmp rax, 2
jb 0x1401614e8
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x14016153d
xchg rdi, rbx
mov rbx, qword [rsp + 0x60]
xchg rdi, rbx
xchg rcx, r12
mov r12, qword [rsp + 0x68]
xchg r12, rcx
xchg rdi, rcx
mov rax, rdi
xchg rcx, rdi
sub rax, rdi
cmp rsi, rax
ja 0x1401615b3
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg rdx, r15
mov r15, rdx
xchg rdx, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x1401615d0
mov qword [rsp + 0x20], rsi
mov r9, r15
movzx r8d, byte [rbp + 0x250]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140034f70
xorps xmm0, xmm0
xor eax, eax
xchg rbp, r14
movups xmmword [r14 - 0x6c], xmm0
xchg r14, rbp
xchg rbp, rdi
movups xmmword [rdi - 0x5c], xmm0
xchg rbp, rdi
xchg rbp, rdi
movups xmmword [rdi - 0x4c], xmm0
xchg rbp, rdi
xchg rbp, r12
movups xmmword [r12 - 0x3c], xmm0
xchg r12, rbp
movups xmmword [rbp - 0x2c], xmm0
xchg r9, rbp
movups xmmword [r9 - 0x1c], xmm0
xchg rbp, r9
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x6b0d084e
sub dword [rbp + 0x250], 0x2ad8d9d7
sub dword [rbp + 0x250], 0x2d88019e
add dword [rbp + 0x250], 0x201a6394
xor dword [rbp + 0x250], 0x2587dd1e
xor dword [rbp + 0x250], 0x42a02ba0
sub dword [rbp + 0x250], 0x1b827ddb
sub dword [rbp + 0x250], 0x3a5ee8f7
mov dword [rbp - 0x70], 0x5587b3a0
sub dword [rbp - 0x70], 0x48f818e5
add dword [rbp - 0x70], 0x131872d2
add dword [rbp - 0x70], 0x587d0ca9
xor dword [rbp - 0x70], 0xca790c3
sub dword [rbp - 0x70], 0x5b5077c2
add dword [rbp - 0x70], 0x33e56de9
xor dword [rbp - 0x70], 0x4d178174
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xchg r12, r10
mov qword [rsp + 0x38], r10
xchg r12, r10
xchg rbp, r12
mov qword [rsp + 0x30], rbp
xchg r12, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xchg rcx, rsi
mov rsi, qword [rsp + 0x78]
xchg rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x5360c6da
xor edx, 0x3a0c6d17
xor edx, 0x5a43180c
add edx, 0x313491e
add edx, 0x2d451f5
xor edx, 0x19b4fa5d
add edx, 0xdf5c4b76
xchg rdx, rcx
mov rdx, qword [rsp + 0x70]
xchg rdx, rcx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg r8, rcx
mov r8, qword [rsp + 0x70]
xchg r8, rcx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
xchg rbx, rdx
mov rbx, qword [rsp + 0x68]
xchg rbx, rdx
cmp rdx, 8
jb 0x1401617d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
cmp rdx, 0x1000
jb 0x1401617d3
nop
add rdx, 0x679babd4
sub rdx, 0x679babad
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
sub rax, 0xfffffffff511bfb0
add rax, 0xfffffffff511bfa8
cmp rax, 0x1f
jbe 0x1401617d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcb70
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
nop
xchg qword [rsp], r15
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
xchg qword [rsp], r12
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f830
int3