Function at 0x140161100
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg rbx, r13
mov qword [rsp + 0x10], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
push rcx
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r9, rdx
mov r15, r9
xchg rdx, r9
xor edx, edx
mov r8d, 0x5bd86aa8
sub r8d, 0x2aaf4fdf
add r8d, 0x36d0c3b0
sub r8d, 0x3d3f7b0f
add r8d, 0x54e1e390
sub r8d, 0x6fecffbc
sub r8d, 0xfaf4534
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x36e0f850
xor edx, 0x68deebc0
xor edx, 0x4472a7f4
xor edx, 0x34c30f66
xor edx, 0x1c9f6be3
sub edx, 0x31bd3152
add edx, 0x9272ea2
add edx, 0x21618c8a
sub edx, 0x2adc59b7
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
xchg r12, rcx
mov qword [rsp + 0x60], rcx
xchg r12, rcx
xchg r12, r11
mov qword [rsp + 0x68], r11
xchg r12, r11
lea rax, [rbp]
nop
movabs rsi, 0xffffffff54bfec3f
add rsi, 0x25995a44
add rsi, 0x24212fc
sub rsi, 0x56a79ebf
sub rsi, 0x41bc9b9
add rsi, 0x32f3e2dc
sub rsi, 0x29b5a54
add rsi, 0x7fffffff
add rsi, 0x2dcf8671
xchg rdx, rsi
mov rbx, rdx
xchg rdx, rsi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161246
movabs r14, 0x7fffffff715b059c
xor r14, 0x12dabe00
xor r14, 0x4644276d
add r14, 0x4fdc41c7
sub r14, 0x1fcabd74
sub r14, 0xe3c49f1
xor r14, 0x572f9fa
sub r14, 0x10345440
add r14, 0x7fffffff
xor r14, 0x4d4c2596
cmp rbx, r14
ja 0x140161876
mov qword [rsp + 0x68], 0x10e7bf5b
add qword [rsp + 0x68], 0x9a44d84
add qword [rsp + 0x68], 0x29196fb0
sub qword [rsp + 0x68], 0x3fde9c20
add qword [rsp + 0x68], 0x6c71b59e
sub qword [rsp + 0x68], 0x353fe2cb
xor qword [rsp + 0x68], 0x1f5b5a08
sub qword [rsp + 0x68], 0x25a3e943
cmp rbx, 8
jae 0x140161328
xchg rbx, r14
mov qword [rsp + 0x60], r14
xchg rbx, r14
add rbx, rbx
xchg rcx, r8
mov rcx, rbx
xchg r8, rcx
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x1401613cc
xchg rsi, rax
mov rsi, rbx
xchg rsi, rax
or rax, 7
cmp rax, r14
ja 0x140161375
xchg r12, r14
mov r12, rax
xchg r14, r12
mov ecx, 0x138a30b8
add ecx, 0x613a342b
sub ecx, 0x361c5c32
sub ecx, 0x2069f15e
add ecx, 0x1d1bc01e
xor ecx, 0x43844891
sub ecx, 0x78dd9fd6
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f9d0
xchg r15, rdi
mov r15, rax
xchg r15, rdi
xchg rsi, rax
mov qword [rsp + 0x50], rsi
xchg rsi, rax
xchg rbx, r15
mov qword [rsp + 0x60], r15
xchg r15, rbx
xchg r14, rdi
mov qword [rsp + 0x68], rdi
xchg rdi, r14
add rbx, rbx
xchg rbx, rdi
mov r8, rdi
xchg rbx, rdi
lea rdx, [rbp]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x17
sub byte [rbp + 0x258], 0x10
add byte [rbp + 0x258], 0x5d
xor byte [rbp + 0x258], 0x4a
add byte [rbp + 0x258], 0x1c
add byte [rbp + 0x258], 0x30
sub byte [rbp + 0x258], 0x2f
add byte [rbp + 0x258], 0xab
mov dword [rbp + 0x25a], 0x3f78e3d8
xor dword [rbp + 0x25a], 0x422887a0
xor dword [rbp + 0x25a], 0x53152c41
sub dword [rbp + 0x25a], 0x10f5d934
xor dword [rbp + 0x25a], 0xa5a64a
add dword [rbp + 0x25a], 0x598418d2
xor dword [rbp + 0x25a], 0x5d6673d3
xor dword [rbp + 0x25a], 0x2058d293
sub dword [rbp + 0x25a], 0xa4f43fb
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x4b
xor byte [rbp + 0x258], 0x6d
xor byte [rbp + 0x258], 0x24
add byte [rbp + 0x258], 0xf
xor byte [rbp + 0x258], 0x5b
sub byte [rbp + 0x258], 0x4a
lea rax, [rbp + 0x25a]
xchg rdi, rsi
mov rsi, rdi
xchg rsi, rdi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401614b7
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg rbx, rax
mov rbx, rcx
xchg rbx, rax
sub rax, r14
cmp rdi, rax
ja 0x14016151c
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161544
xchg r12, rdi
mov qword [rsp + 0x20], r12
xchg rdi, r12
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140035030
nop
xchg r12, rax
mov r12, rax
xchg r12, rax
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x4a
xor byte [rbp + rax + 0x25a], 0x2f
sub byte [rbp + rax + 0x25a], 0x4a
xor byte [rbp + rax + 0x25a], 0x5c
add byte [rbp + rax + 0x25a], 0x1c
sub byte [rbp + rax + 0x25a], 0x63
inc rax
cmp rax, 2
jb 0x140161550
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x14016158d
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, rdi
cmp rsi, rax
ja 0x1401615f1
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg rdx, rsi
mov rsi, r15
xchg rsi, rdx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x14016161a
mov qword [rsp + 0x20], rsi
xchg r11, r15
mov r9, r11
xchg r11, r15
movzx r8d, byte [rbp + 0x250]
xchg rdx, r11
mov r11, rsi
xchg rdx, r11
lea rcx, [rsp + 0x50]
call fcn.140035030
xorps xmm0, xmm0
xor eax, eax
xchg rbp, rcx
movups xmmword [rcx - 0x6c], xmm0
xchg rcx, rbp
xchg r10, rbp
movups xmmword [r10 - 0x5c], xmm0
xchg r10, rbp
xchg rbp, r14
movups xmmword [r14 - 0x4c], xmm0
xchg rbp, r14
xchg rcx, rbp
movups xmmword [rcx - 0x3c], xmm0
xchg rcx, rbp
xchg rbp, rbx
movups xmmword [rbx - 0x2c], xmm0
xchg rbp, rbx
xchg rbp, r8
movups xmmword [r8 - 0x1c], xmm0
xchg rbp, r8
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
xchg rbx, rax
mov qword [rbp - 0x80], rbx
xchg rbx, rax
mov dword [rbp + 0x250], 0xf5ff120
add dword [rbp + 0x250], 0x2a1d6b26
sub dword [rbp + 0x250], 0x1f31e84d
add dword [rbp + 0x250], 0x48a6e8c6
sub dword [rbp + 0x250], 0x563a2c83
sub dword [rbp + 0x250], 0xcb8303b
mov dword [rbp - 0x70], 0x7ab01575
sub dword [rbp - 0x70], 0x17035b3e
xor dword [rbp - 0x70], 0x463b9d40
sub dword [rbp - 0x70], 0x241bec85
add dword [rbp - 0x70], 0x432da0d8
add dword [rbp - 0x70], 0x3703d4d0
sub dword [rbp - 0x70], 0x3f2db48a
sub dword [rbp - 0x70], 0x1b681f26
xor dword [rbp - 0x70], 0x2116dc82
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg rdx, rax
mov qword [rsp + 0x48], rdx
xchg rdx, rax
lea rax, [rbp - 0x70]
xchg r8, rax
mov qword [rsp + 0x40], r8
xchg r8, rax
xchg r12, r14
mov qword [rsp + 0x38], r14
xchg r12, r14
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x5e83c69
xor edx, 0x490e5fe6
sub edx, 0x4299fbb2
add edx, 0x21744e17
xor edx, 0x502b736a
sub edx, 0x54c98cda
xor edx, 0x722b28ff
add edx, 0xaaf6eec4
xchg r14, rcx
mov r14, qword [rsp + 0x70]
xchg r14, rcx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg rcx, rdi
mov rdi, qword [rsp + 0x70]
xchg rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
xchg r10, rdx
mov r10, qword [rsp + 0x68]
xchg r10, rdx
cmp rdx, 8
jb 0x14016181e
lea rdx, [rdx*2 + 2]
xchg rcx, r15
mov r15, qword [rsp + 0x50]
xchg rcx, r15
xchg r9, rax
mov r9, rcx
xchg r9, rax
cmp rdx, 0x1000
jb 0x140161819
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x140161819
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fc804
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
xchg r8, rsi
mov r8, qword [r11 + 0x38]
xchg rsi, r8
mov rsp, r11
push rcx
push rcx
push rcx
xchg qword [rsp + 0x18], r15
pop rcx
pop rcx
pop rcx
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f990
int3