Function at 0x1401611d0
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r11
mov qword [rsp + 0x10], r11
xchg rsi, r11
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
push 0xf46fd52
mov qword [rsp], r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov r15, rdx
xor edx, edx
mov r8d, 0x177b278f
add r8d, 0x4474befa
xor r8d, 0x75ad7d2c
add r8d, 0x48979554
sub r8d, 0x612a523e
sub r8d, 0x15afdcb1
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x2c1daa3c
add edx, 0x2aa99c1e
add edx, 0x2822fbf6
sub edx, 0x701a3005
add edx, 0x3bcf16b
xor edx, 0x128d02b2
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
xchg r12, r15
mov qword [rsp + 0x60], r15
xchg r12, r15
mov qword [rsp + 0x68], r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff3c8c3496
xor rsi, 0x343c05aa
add rsi, 0x5ea6ba57
xor rsi, 0x4257ca46
add rsi, 0x2dd3a844
sub rsi, 0x38a94c0c
add rsi, 0x2127adab
add rsi, 0x23f6637a
add rsi, 0x7fffffff
add rsi, 0x20b670ce
xchg rsi, rbx
mov rsi, rbx
xchg rsi, rbx
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1401612f8
movabs r14, 0x7fffffff316b4d27
add r14, 0x476b6e89
sub r14, 0x3a382e74
sub r14, 0x109cbe8a
xor r14, 0x260692a0
xor r14, 0x200aa520
xor r14, 0x1e79ad66
add r14, 0x7fffffff
xor r14, 0x498babad
cmp rbx, r14
ja 0x140161901
mov qword [rsp + 0x68], 0x485878f9
sub qword [rsp + 0x68], 0x2fd6fafc
sub qword [rsp + 0x68], 0xd89aa14
add qword [rsp + 0x68], 0x389d3fd6
sub qword [rsp + 0x68], 0x9f71002
xor qword [rsp + 0x68], 0x21e1ac8a
sub qword [rsp + 0x68], 0x187faf30
cmp rbx, 8
jae 0x1401613be
mov qword [rsp + 0x60], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x14016144e
mov rax, rbx
or rax, 7
cmp rax, r14
ja 0x140161401
xchg r14, r15
mov r15, rax
xchg r15, r14
mov ecx, 0x3b836e02
add ecx, 0x2d3c4a65
xor ecx, 0x626efc87
xor ecx, 0x5e98cfc7
sub ecx, 0x27b5520d
sub ecx, 0x2c943910
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f880
mov rdi, rax
xchg rdi, rax
mov qword [rsp + 0x50], rdi
xchg rdi, rax
xchg rbx, rcx
mov qword [rsp + 0x60], rcx
xchg rcx, rbx
xchg r14, rdx
mov qword [rsp + 0x68], rdx
xchg r14, rdx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
xchg r13, rcx
mov r13, rax
xchg r13, rcx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x18
add byte [rbp + 0x258], 0x46
xor byte [rbp + 0x258], 0x73
add byte [rbp + 0x258], 0x14
xor byte [rbp + 0x258], 0x48
add byte [rbp + 0x258], 0x19
add byte [rbp + 0x258], 0x2e
sub byte [rbp + 0x258], 9
xor byte [rbp + 0x258], 0xb1
mov dword [rbp + 0x25a], 0x6837d0ca
sub dword [rbp + 0x25a], 0x3d1d44a
add dword [rbp + 0x25a], 0xc443756
xor dword [rbp + 0x25a], 0x2b23552c
xor dword [rbp + 0x25a], 0x76809351
sub dword [rbp + 0x25a], 0x1ec8ca37
xor dword [rbp + 0x25a], 0xac91aa5
add dword [rbp + 0x25a], 0x18ad554
sub dword [rbp + 0x25a], 0x61207bf
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x5b
add byte [rbp + 0x258], 0x21
sub byte [rbp + 0x258], 0xb
sub byte [rbp + 0x258], 0x30
sub byte [rbp + 0x258], 0x13
sub byte [rbp + 0x258], 0x2e
lea rax, [rbp + 0x25a]
xchg r11, rsi
mov rdi, r11
xchg r11, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161540
xchg r14, rsi
mov rsi, qword [rsp + 0x60]
xchg r14, rsi
xchg rcx, rdi
mov rdi, qword [rsp + 0x68]
xchg rdi, rcx
xchg rcx, r14
mov rax, r14
xchg r14, rcx
sub rax, r14
cmp rdi, rax
ja 0x1401615b7
lea rax, [r14 + rdi]
xchg r11, rax
mov qword [rsp + 0x60], r11
xchg r11, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x1401615e5
xchg rdi, rsi
mov qword [rsp + 0x20], rsi
xchg rsi, rdi
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
lea rcx, [rsp + 0x50]
call fcn.140034e50
nop
xchg r8, rax
mov r8, r12
xchg r8, rax
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x6c
xor byte [rbp + rax + 0x25a], 0x18
xor byte [rbp + rax + 0x25a], 0x12
sub byte [rbp + rax + 0x25a], 0x21
sub byte [rbp + rax + 0x25a], 0x33
sub byte [rbp + rax + 0x25a], 0x12
inc rax
cmp rax, 2
jb 0x1401615f1
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x14016162e
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r15, rax
mov r15, rcx
xchg r15, rax
sub rax, rdi
cmp rsi, rax
ja 0x140161696
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg r15, rdx
mov r15, rdx
xchg r15, rdx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x1401616bf
xchg rsi, r9
mov qword [rsp + 0x20], r9
xchg rsi, r9
xchg r15, r9
mov r15, r9
xchg r9, r15
movzx r8d, byte [rbp + 0x250]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140034e50
xorps xmm0, xmm0
xor eax, eax
xchg r10, rbp
movups xmmword [r10 - 0x6c], xmm0
xchg rbp, r10
xchg r9, rbp
movups xmmword [r9 - 0x5c], xmm0
xchg rbp, r9
xchg r14, rbp
movups xmmword [r14 - 0x4c], xmm0
xchg r14, rbp
xchg rdi, rbp
movups xmmword [rdi - 0x3c], xmm0
xchg rbp, rdi
xchg rdx, rbp
movups xmmword [rdx - 0x2c], xmm0
xchg rbp, rdx
xchg rbp, r8
movups xmmword [r8 - 0x1c], xmm0
xchg r8, rbp
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
xchg rdx, rax
mov qword [rbp - 0x80], rdx
xchg rdx, rax
mov dword [rbp + 0x250], 0x6acb8407
xor dword [rbp + 0x250], 0x70da557b
sub dword [rbp + 0x250], 0x12204153
xor dword [rbp + 0x250], 0x5605bb1d
sub dword [rbp + 0x250], 0x50593b52
xor dword [rbp + 0x250], 0x2dbec454
sub dword [rbp + 0x250], 0x1e46bec2
xor dword [rbp + 0x250], 0xddd6cf5
mov dword [rbp - 0x70], 0x518c5a8e
add dword [rbp - 0x70], 0x18209c07
sub dword [rbp - 0x70], 0x5fb72f81
add dword [rbp - 0x70], 0x1483ff7f
sub dword [rbp - 0x70], 0x101f9d01
sub dword [rbp - 0x70], 0xe5a292a
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xchg rcx, rax
mov qword [rsp + 0x40], rcx
xchg rcx, rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xchg rcx, rsi
mov rsi, qword [rsp + 0x78]
xchg rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x6c5e0f4e
sub edx, 0x67594720
xor edx, 0x5afb0f4b
sub edx, 0x5c8fdf88
xor edx, 0x39009cba
add edx, 0x3a424478
xor edx, 0x8b4e4020
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg rdi, rcx
mov rdi, qword [rsp + 0x70]
xchg rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
xchg rdx, r12
mov r12, qword [rsp + 0x68]
xchg rdx, r12
cmp rdx, 8
jb 0x1401618a1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg r11, rax
mov r11, rcx
xchg r11, rax
cmp rdx, 0x1000
jb 0x14016189c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14016189c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcb88
mov eax, ebx
lea r11, [rsp + 0x310]
xchg rbx, rcx
mov rcx, qword [r11 + 0x30]
xchg rbx, rcx
mov rsi, qword [r11 + 0x38]
mov rsp, r11
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
push rcx
push rcx
push rcx
xchg qword [rsp + 0x18], r12
pop rcx
pop rcx
pop rcx
add rsp, 8
push rcx
push rbx
xchg qword [rsp + 0x10], rdi
pop rbx
pop rcx
add rsp, 8
push rbx
push rdx
push rcx
push rdx
xchg qword [rsp + 0x20], rbp
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f840
int3