Function at 0x1401612f0
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg r11, rsi
mov qword [rsp + 0x10], r11
xchg rsi, r11
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
push 0x36c54164
mov qword [rsp], r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r15, rdx
mov rdx, r15
xchg r15, rdx
xor edx, edx
mov r8d, 0x2a3f24f9
add r8d, 0x371cc79b
xor r8d, 0x3d991868
add r8d, 0x1460fe2
xor r8d, 0x59070d62
xor r8d, 0x369e0b0f
sub r8d, 0x96fc02a
xor r8d, 0x5c4ed778
xor r8d, 0x746e97fb
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x6314c158
xor edx, 0x2b2bff1
xor edx, 0x1e97f30d
sub edx, 0x46051d9a
xor edx, 0x427d6a7b
sub edx, 0x275c8f63
sub edx, 0x4cf2e94a
sub edx, 0x701a0c0
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff7202cf52
sub rsi, 0x86fc191
xor rsi, 0x3bfd4949
sub rsi, 0x76f8e46
add rsi, 0x16271500
sub rsi, 0x4cebbca
xor rsi, 0x98a0a2f
xor rsi, 0x109a1a6f
add rsi, 0x7fffffff
add rsi, 0x3ab8e0c8
xchg rbx, r8
mov r8, rsi
xchg rbx, r8
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161437
movabs r14, 0x7fffffff348a936b
add r14, 0x476fbb04
sub r14, 0x1a2670b7
sub r14, 0x339f6624
sub r14, 0x19b85ce
sub r14, 0x25d2f7cd
add r14, 0x2b466630
add r14, 0x7fffffff
add r14, 0x4df39fd6
cmp rbx, r14
ja 0x140161a46
mov qword [rsp + 0x68], 0x268bde39
add qword [rsp + 0x68], 0x28470a15
add qword [rsp + 0x68], 0x251b882b
sub qword [rsp + 0x68], 0x5587dfbf
add qword [rsp + 0x68], 0x4c9ac74b
sub qword [rsp + 0x68], 0x6b0157fe
cmp rbx, 8
jae 0x1401614fa
xchg rdx, rbx
mov qword [rsp + 0x60], rdx
xchg rdx, rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161586
xchg r14, rax
mov r14, rbx
xchg r14, rax
or rax, 7
cmp rax, r14
ja 0x14016153f
xchg rbp, rax
mov r14, rbp
xchg rbp, rax
mov ecx, 0x5c27b63b
xor ecx, 0x6661b121
xor ecx, 0x34746616
add ecx, 0xd9240e7
sub ecx, 0xc06aadd
xor ecx, 0xfbdf71c
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f960
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rbx
xchg rbp, r14
mov qword [rsp + 0x68], rbp
xchg rbp, r14
add rbx, rbx
xchg r8, r13
mov r13, rbx
xchg r8, r13
lea rdx, [rbp]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x49
xor byte [rbp + 0x258], 5
sub byte [rbp + 0x258], 0x48
sub byte [rbp + 0x258], 4
xor byte [rbp + 0x258], 0x44
add byte [rbp + 0x258], 0x1f
add byte [rbp + 0x258], 0x93
mov dword [rbp + 0x25a], 0x3d8900d4
add dword [rbp + 0x25a], 0x39e71d98
add dword [rbp + 0x25a], 0x3e5b2e9
add dword [rbp + 0x25a], 0x2e6c0f4
sub dword [rbp + 0x25a], 0x518d6611
add dword [rbp + 0x25a], 0x2041fae
xor dword [rbp + 0x25a], 0x69dd78ca
sub dword [rbp + 0x25a], 0x1e2a90c9
sub dword [rbp + 0x25a], 0x2942a2fd
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 2
add byte [rbp + 0x258], 2
sub byte [rbp + 0x258], 2
xor byte [rbp + 0x258], 0x17
add byte [rbp + 0x258], 0x34
xor byte [rbp + 0x258], 0x74
sub byte [rbp + 0x258], 0x20
add byte [rbp + 0x258], 0xd
sub byte [rbp + 0x258], 0x2a
lea rax, [rbp + 0x25a]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161679
xchg r14, r9
mov r9, qword [rsp + 0x60]
xchg r9, r14
xchg r9, rcx
mov r9, qword [rsp + 0x68]
xchg rcx, r9
xchg r8, rcx
mov rax, r8
xchg rcx, r8
sub rax, r14
cmp rdi, rax
ja 0x1401616f0
lea rax, [r14 + rdi]
xchg rdx, rax
mov qword [rsp + 0x60], rdx
xchg rdx, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x14016171e
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg r8, rdi
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
xchg r8, rdx
mov r8, rdi
xchg rdx, r8
lea rcx, [rsp + 0x50]
call fcn.140034ff0
nop
xchg r12, r14
mov rax, r14
xchg r14, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x58
sub byte [rbp + rax + 0x25a], 0x1a
sub byte [rbp + rax + 0x25a], 0x27
add byte [rbp + rax + 0x25a], 0x47
xor byte [rbp + rax + 0x25a], 0x72
xor byte [rbp + rax + 0x25a], 0x51
xor byte [rbp + rax + 0x25a], 0x7d
inc rax
cmp rax, 2
jb 0x14016172c
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161771
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r8, rax
mov r8, rcx
xchg r8, rax
sub rax, rdi
cmp rsi, rax
ja 0x1401617d7
lea rax, [rdi + rsi]
xchg r15, rax
mov qword [rsp + 0x60], r15
xchg r15, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
mov rdx, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140161800
mov qword [rsp + 0x20], rsi
xchg rdx, r15
mov r9, rdx
xchg rdx, r15
movzx r8d, byte [rbp + 0x250]
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140034ff0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
xchg rbp, rdx
movups xmmword [rdx - 0x5c], xmm0
xchg rbp, rdx
xchg rbp, r15
movups xmmword [r15 - 0x4c], xmm0
xchg rbp, r15
xchg r11, rbp
movups xmmword [r11 - 0x3c], xmm0
xchg rbp, r11
movups xmmword [rbp - 0x2c], xmm0
xchg r10, rbp
movups xmmword [r10 - 0x1c], xmm0
xchg r10, rbp
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
xchg r8, rax
mov qword [rbp - 0x80], r8
xchg r8, rax
mov dword [rbp + 0x250], 0x124ca2d0
xor dword [rbp + 0x250], 0x557ae7de
xor dword [rbp + 0x250], 0x56b45017
add dword [rbp + 0x250], 0x2b82e1d6
xor dword [rbp + 0x250], 0x35519597
xor dword [rbp + 0x250], 0x4ffbd3d8
xor dword [rbp + 0x250], 0x62c520
sub dword [rbp + 0x250], 0x371b71f0
xor dword [rbp + 0x250], 0x10b10391
mov dword [rbp - 0x70], 0x72120929
xor dword [rbp - 0x70], 0x593d3df4
sub dword [rbp - 0x70], 0x224614e1
xor dword [rbp - 0x70], 0x3cea397c
sub dword [rbp - 0x70], 0x220f17bd
sub dword [rbp - 0x70], 0x11f40e5b
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xchg r8, rax
mov qword [rsp + 0x40], r8
xchg r8, rax
xchg r12, r8
mov qword [rsp + 0x38], r8
xchg r12, r8
xchg r12, rdi
mov qword [rsp + 0x30], rdi
xchg rdi, r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xchg rcx, r15
mov r15, qword [rsp + 0x78]
xchg r15, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x70496fda
sub edx, 0x6a4d8192
xor edx, 0x30406175
add edx, 0xc3af5bb
xor edx, 0x118e56ce
sub edx, 0x447a46fc
xor edx, 0xf40174c5
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg r10, rcx
mov r10, qword [rsp + 0x70]
xchg rcx, r10
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xchg rbx, rcx
mov rbx, qword [rsp + 0x70]
xchg rbx, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
xchg rdx, rdi
mov rdi, qword [rsp + 0x68]
xchg rdi, rdx
cmp rdx, 8
jb 0x1401619f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg r11, rcx
mov rax, r11
xchg r11, rcx
cmp rdx, 0x1000
jb 0x1401619f4
sub rdx, 0xffffffffffffffd9
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x1401619f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcb00
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
xchg r8, rsi
mov r8, qword [r11 + 0x38]
xchg rsi, r8
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
xchg qword [rsp], r12
add rsp, 8
push rax
xchg qword [rsp + 8], rdi
pop rax
add rsp, 8
nop
xchg qword [rsp], rbp
add rsp, 8
ret
call fcn.14002f920
int3