Function at 0x140161700
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, rsi
mov qword [rsp + 0x10], r14
xchg rsi, r14
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
push r12
push r14
nop
push 0x64d2db4e
mov qword [rsp], r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg rdx, r15
mov rdx, r15
xchg rdx, r15
xor edx, edx
mov r8d, 0x553f97ba
sub r8d, 0x3eabcd20
add r8d, 0x63f127ff
xor r8d, 0x24a631cc
xor r8d, 0x329664ad
sub r8d, 0x1e8270bd
sub r8d, 0x4e323531
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x57a400aa
xor edx, 0x125993ee
xor edx, 0x7716a888
xor edx, 0x2b186fae
add edx, 0x5ca7dab
add edx, 0xdbff2e1
xor edx, 0x89af028
add edx, 0x128f0c93
xor edx, 0x3876405d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
xchg rbx, r12
mov qword [rsp + 0x68], rbx
xchg rbx, r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff58971cd2
xor rsi, 0x30caf738
xor rsi, 0x51443e77
xor rsi, 0x1fb33595
add rsi, 0x3dc28b24
sub rsi, 0x11641635
sub rsi, 0x27b8939d
add rsi, 0x7fffffff
xor rsi, 0x54af3ea6
xchg rbx, r15
mov r15, rsi
xchg r15, rbx
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x14016182e
movabs r14, 0x7fffffff05d356d7
xor r14, 0x6ddc034b
sub r14, 0x62fdee4e
xor r14, 0x799829a4
xor r14, 0x4ca5bc79
xor r14, 0x2f850c02
add r14, 0x7fffffff
add r14, 0x6056016e
cmp rbx, r14
ja 0x140161e33
mov qword [rsp + 0x68], 0x772b231d
xor qword [rsp + 0x68], 0x662640fb
sub qword [rsp + 0x68], 0x3de9ce2
add qword [rsp + 0x68], 0x6fd23bba
xor qword [rsp + 0x68], 0x64d3d4c0
add qword [rsp + 0x68], 0x5705affb
xor qword [rsp + 0x68], 0x7479e497
xor qword [rsp + 0x68], 0x71a38f02
sub qword [rsp + 0x68], 0x7502ede5
cmp rbx, 8
jae 0x140161905
mov qword [rsp + 0x60], rbx
add rbx, rbx
xchg rbx, r13
mov r8, r13
xchg rbx, r13
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161997
xchg rbp, rax
mov rbp, rbx
xchg rbp, rax
or rax, 7
cmp rax, r14
ja 0x140161946
mov r14, rax
mov ecx, 0x3907bfa7
sub ecx, 0x1647093c
sub ecx, 0xaa5feed
add ecx, 0x6668a747
sub ecx, 0x7ac70e38
sub ecx, 0x3bc5083
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002fa00
xchg r12, rax
mov rdi, r12
xchg r12, rax
mov qword [rsp + 0x50], rax
xchg rbx, rcx
mov qword [rsp + 0x60], rcx
xchg rcx, rbx
xchg r14, r13
mov qword [rsp + 0x68], r13
xchg r13, r14
add rbx, rbx
xchg r13, r8
mov r13, rbx
xchg r8, r13
lea rdx, [rbp]
xchg rbx, rax
mov rcx, rbx
xchg rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x45
sub byte [rbp + 0x258], 0x3a
add byte [rbp + 0x258], 0x13
xor byte [rbp + 0x258], 0x39
sub byte [rbp + 0x258], 5
xor byte [rbp + 0x258], 0x1b
xor byte [rbp + 0x258], 0xcf
mov dword [rbp + 0x25a], 0x9f76ff2
add dword [rbp + 0x25a], 0x4536810c
sub dword [rbp + 0x25a], 0x2229c894
sub dword [rbp + 0x25a], 0x185821
xor dword [rbp + 0x25a], 0x6107440a
xor dword [rbp + 0x25a], 0x2e001e41
sub dword [rbp + 0x25a], 0x6379c66c
sub dword [rbp + 0x25a], 0x71c430
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x63
xor byte [rbp + 0x258], 0x28
add byte [rbp + 0x258], 5
xor byte [rbp + 0x258], 0x21
sub byte [rbp + 0x258], 0x56
xor byte [rbp + 0x258], 0x69
xor byte [rbp + 0x258], 0x72
lea rax, [rbp + 0x25a]
xchg rdi, r8
mov r8, rsi
xchg rdi, r8
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161a78
mov r14, qword [rsp + 0x60]
xchg rcx, r12
mov r12, qword [rsp + 0x68]
xchg r12, rcx
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
sub rax, r14
cmp rdi, rax
ja 0x140161ae3
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161b05
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140035040
nop
mov rax, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x57
sub byte [rbp + rax + 0x25a], 0x48
add byte [rbp + rax + 0x25a], 0x68
sub byte [rbp + rax + 0x25a], 0x57
add byte [rbp + rax + 0x25a], 0x19
sub byte [rbp + rax + 0x25a], 0x23
add byte [rbp + rax + 0x25a], 0x4e
sub byte [rbp + rax + 0x25a], 0x64
inc rax
cmp rax, 2
jb 0x140161b0d
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161b5a
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
sub rax, rdi
cmp rsi, rax
ja 0x140161bc0
lea rax, [rdi + rsi]
xchg rsi, rax
mov qword [rsp + 0x60], rsi
xchg rsi, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140161bef
xchg rsi, r15
mov qword [rsp + 0x20], r15
xchg r15, rsi
xchg r13, r15
mov r9, r13
xchg r15, r13
movzx r8d, byte [rbp + 0x250]
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140035040
xorps xmm0, xmm0
xor eax, eax
xchg rbp, rbx
movups xmmword [rbx - 0x6c], xmm0
xchg rbx, rbp
xchg r8, rbp
movups xmmword [r8 - 0x5c], xmm0
xchg r8, rbp
xchg r15, rbp
movups xmmword [r15 - 0x4c], xmm0
xchg r15, rbp
xchg r14, rbp
movups xmmword [r14 - 0x3c], xmm0
xchg rbp, r14
xchg rbp, rbx
movups xmmword [rbx - 0x2c], xmm0
xchg rbp, rbx
xchg r11, rbp
movups xmmword [r11 - 0x1c], xmm0
xchg r11, rbp
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x249b99c
xor dword [rbp + 0x250], 0x1504dea4
add dword [rbp + 0x250], 0x223d98a4
sub dword [rbp + 0x250], 0x250ddbee
xor dword [rbp + 0x250], 0x8db782e
add dword [rbp + 0x250], 0x33ccd612
xor dword [rbp + 0x250], 0x507331d3
mov dword [rbp - 0x70], 0x7bd4d45
xor dword [rbp - 0x70], 0x2aee9f36
xor dword [rbp - 0x70], 0x4d58de1
add dword [rbp - 0x70], 0x3ce2c9ed
sub dword [rbp - 0x70], 0x3fd98108
xor dword [rbp - 0x70], 0x57769a3
add dword [rbp - 0x70], 0x1d222187
sub dword [rbp - 0x70], 0x411ae2f3
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg r15, rax
mov qword [rsp + 0x48], r15
xchg r15, rax
lea rax, [rbp - 0x70]
xchg r13, rax
mov qword [rsp + 0x40], r13
xchg r13, rax
mov qword [rsp + 0x38], r12
xchg r12, r8
mov qword [rsp + 0x30], r8
xchg r8, r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x7bc58892
sub edx, 0x2242d3af
sub edx, 0x46bb071
add edx, 0x225362b2
sub edx, 0x3c0bb950
add edx, 0xc4a1522b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg r8, rcx
mov r8, qword [rsp + 0x70]
xchg rcx, r8
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
xchg rbx, rdx
mov rbx, qword [rsp + 0x68]
xchg rbx, rdx
cmp rdx, 8
jb 0x140161dd7
lea rdx, [rdx*2 + 2]
xchg r12, rcx
mov r12, qword [rsp + 0x50]
xchg r12, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140161dd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x140161dd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fd08c
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
xchg rsi, r10
mov r10, qword [r11 + 0x38]
xchg r10, rsi
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
push rcx
push rax
push rcx
push rbx
push rax
xchg qword [rsp + 0x28], r12
pop rax
pop rbx
pop rcx
pop rax
pop rcx
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f9c0
int3