Function at 0x1401574a0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
xchg r9, rsi
mov qword [rsp + 0x10], r9
xchg r9, rsi
nop
push r10
mov qword [rsp], rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x2070]
mov eax, 0x6ab355d9
xor eax, 0x733b613c
add eax, 0x329ecd81
sub eax, 0x160c3e37
add eax, 0x2c48a8b1
sub eax, 0x25c86b66
xor eax, 0x602e4a04
sub eax, 0xc1452ae
sub eax, 0x50a0d760
call fcn.1401fcf20
sub rsp, rax
xchg r13, r15
mov r13, rdx
xchg r13, r15
xchg rsi, r12
mov rsi, rcx
xchg rsi, r12
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157e1c
xchg r12, rdx
mov rcx, r12
xchg r12, rdx
call fcn.1400704f0
cmp rax, 3
jb 0x140157caf
lea edx, [rsi + 1]
mov rcx, r15
call fcn.14004e1c0
mov dl, 0x44
add dl, 0x27
add dl, 0x13
sub dl, 0x6b
add dl, 0x13
sub dl, 2
xor dl, 0x36
xor dl, 0x13
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007df50
test al, al
je 0x140157caf
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
xchg r10, rcx
mov r10, qword [r12]
xchg rcx, r10
call fcn.140163dc0
nop
xchg rcx, rdi
mov rcx, qword [r12]
xchg rcx, rdi
lea rcx, [rdi + 0x308]
call fcn.14007eb10
mov rbx, rax
lea edx, [rsi + 2]
xchg r9, r15
mov rcx, r9
xchg r15, r9
call fcn.14004e1c0
lea rdx, [rbp - 0x80]
xchg r8, rax
mov rcx, r8
xchg r8, rax
call fcn.14007e560
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.1400528b0
nop
mov rcx, rax
call fcn.140176380
xchg rbx, r10
mov r10, rax
xchg rbx, r10
lea rcx, [rbp - 0x20]
call fcn.14007b3f0
xchg r9, r14
mov r14, rbx
xchg r14, r9
xchg r8, rbp
mov rbp, rax
xchg r8, rbp
lea edx, [rsi + 0x40]
xchg rdi, r10
mov rcx, r10
xchg rdi, r10
call fcn.14016e6a0
nop
lea rcx, [rbp + 0x28]
call fcn.140029b70
nop
lea rcx, [rbp - 0x80]
call fcn.14004c600
xchg rcx, r14
mov r14, r15
xchg rcx, r14
call fcn.1400704f0
cmp rax, 4
jb 0x140157ca6
mov rcx, qword [r12]
sub rcx, 0x77a80b1d
add rcx, 0x77a80e25
call fcn.14007eb10
mov rbx, rax
lea edx, [rsi + 3]
xchg r15, rbp
mov rcx, rbp
xchg rbp, r15
call fcn.14004e1c0
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14007e560
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg r15, rbx
mov rcx, r15
xchg r15, rbx
call fcn.1400528b0
nop
lea rcx, [rsp + 0x60]
call fcn.14004c600
lea rcx, [rbp - 0x60]
call fcn.1401792f0
cmp rax, 8
jb 0x140157a31
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call 0x140179310
nop
mov dword [rbp + 0x20b0], 0x2d2c54ae
add dword [rbp + 0x20b0], 0x30d8136
xor dword [rbp + 0x20b0], 0x527026b2
sub dword [rbp + 0x20b0], 0x3e7e4e2a
xor dword [rbp + 0x20b0], 0x6cb1a374
sub dword [rbp + 0x20b0], 0x4f7a0657
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140176380
xchg rdx, rcx
mov rcx, rax
xchg rcx, rdx
lea rcx, [rbp + 0x10]
call fcn.14007ac50
xchg rsi, rax
mov rbx, rsi
xchg rsi, rax
mov dword [rbp + 0x20b0], 0x4618d860
sub dword [rbp + 0x20b0], 0x3830d0ef
xor dword [rbp + 0x20b0], 0x3c7bc690
xor dword [rbp + 0x20b0], 0x3f2c1da1
xor dword [rbp + 0x20b0], 0x7568ace4
sub dword [rbp + 0x20b0], 0x7bd770a1
mov dword [rsp + 0x40], 0x7e56f7e2
xor dword [rsp + 0x40], 0x42d49aeb
sub dword [rsp + 0x40], 0x281708d9
add dword [rsp + 0x40], 0x3d9cf782
sub dword [rsp + 0x40], 0x3725854e
add dword [rsp + 0x40], 0x4602df21
xor dword [rsp + 0x40], 0x6cd4e4da
add dword [rsp + 0x40], 0x6f04b8f3
add dword [rsp + 0x40], 0x7bc0eca4
mov dword [rsp + 0x4a], 0x21d4bef1
add dword [rsp + 0x4a], 0x497aa26a
sub dword [rsp + 0x4a], 0x4d742000
add dword [rsp + 0x4a], 0x3686aa8a
add dword [rsp + 0x4a], 0x1dd5f765
xor dword [rsp + 0x4a], 0x328dc952
sub dword [rsp + 0x4a], 0x72c40b8
xor dword [rsp + 0x4a], 0xc6f31612
mov dword [rsp + 0x4e], 0x1d9e7368
add dword [rsp + 0x4e], 0xe8f11d8
add dword [rsp + 0x4e], 0x50b1d1ab
xor dword [rsp + 0x4e], 0x5c0b1103
sub dword [rsp + 0x4e], 0x17420385
add dword [rsp + 0x4e], 0x2c99868e
xor dword [rsp + 0x4e], 0x300689db
add dword [rsp + 0x4e], 0xf94dbc54
mov dword [rsp + 0x44], 0x6decca46
xor dword [rsp + 0x44], 0x7fde22db
sub dword [rsp + 0x44], 0x33ff4f2
xor dword [rsp + 0x44], 0x516db117
sub dword [rsp + 0x44], 0x3460cd11
add dword [rsp + 0x44], 0x1f0c1413
add dword [rsp + 0x44], 0xacac6d38
mov dword [rsp + 0x52], 0x187a7252
add dword [rsp + 0x52], 0x6209152e
sub dword [rsp + 0x52], 0x68ef9708
sub dword [rsp + 0x52], 0x8a6f2b6
add dword [rsp + 0x52], 0x55030270
xor dword [rsp + 0x52], 0xa2b4ff4f
mov dword [rsp + 0x56], 0x49b428a0
add dword [rsp + 0x56], 0x899276e
add dword [rsp + 0x56], 0x19b6b154
sub dword [rsp + 0x56], 0x1a0ff278
add dword [rsp + 0x56], 0x27b6bdb0
sub dword [rsp + 0x56], 0x502b4d40
xor dword [rsp + 0x56], 0x491b9100
add dword [rsp + 0x56], 0x9ed510df
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x24
xor byte [rsp + rdx + 0x40], 0x2c
add byte [rsp + rdx + 0x40], 0x42
add byte [rsp + rdx + 0x40], 0x27
sub byte [rsp + rdx + 0x40], 0x6f
xor byte [rsp + rdx + 0x40], 0x4d
sub byte [rsp + rdx + 0x40], 0x4f
inc rdx
cmp rdx, 8
jb 0x1401578f2
mov dword [rbp + 0x20b0], 0x1a9dcd40
xor dword [rbp + 0x20b0], 0x43529000
sub dword [rbp + 0x20b0], 0x11de18b5
add dword [rbp + 0x20b0], 0x219d4258
xor dword [rbp + 0x20b0], 0x2c71f659
add dword [rbp + 0x20b0], 0x39e2bc93
sub dword [rbp + 0x20b0], 0x57291d3e
xor dword [rbp + 0x20b0], 0x28b91008
movups xmm0, xmmword [rsp + 0x40]
xchg rbp, rdx
movaps xmmword [rdx - 0x40], xmm0
xchg rbp, rdx
movsd xmm1, qword [rsp + 0x50]
xchg rdx, rbp
movsd qword [rdx - 0x30], xmm1
xchg rbp, rdx
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c2b0
nop
mov r14d, 0x1fdef70d
xor r14d, 0x7bda0583
sub r14d, 0x2ad3b305
xor r14d, 0x28c9e301
add r14d, 0x2d4b3039
sub r14d, 0x38b26d05
add r14d, 0x762dbfe9
xor r14d, 0xd7504f7
sub r14d, 0x71ca5b43
mov dword [rbp + 0x20b0], r14d
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
xchg r15, rbx
mov rcx, r15
xchg r15, rbx
call fcn.14007b370
test al, al
je 0x140157a31
mov bl, 0x17
add bl, 0x17
xor bl, 0x4e
xor bl, 0x4e
sub bl, 0x1e
sub bl, 0xf
jmp 0x140157a33
xor bl, bl
test r14b, 8
je 0x140157a52
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007b070
nop
test r14b, 4
je 0x140157aa0
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
mov rax, rsi
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x18
sub byte [rsp + rax + 0x4a], 0xd
add byte [rsp + rax + 0x4a], 0x6e
sub byte [rsp + rax + 0x4a], 0x6c
add byte [rsp + rax + 0x4a], 0x2f
sub byte [rsp + rax + 0x4a], 0x3c
inc rax
cmp rax, 0x10
jb 0x140157a75
test r14b, 2
je 0x140157abf
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007b070
nop
test r14b, 1
je 0x140157add
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029b70
test bl, bl
je 0x140157c9c
lea rcx, [rbp - 0x60]
call fcn.140176380
xchg r8, rax
mov rax, r8
xchg r8, rax
mov dword [rsp + 0x30], 0x631a6dcd
xor dword [rsp + 0x30], 0x2b42adb8
xor dword [rsp + 0x30], 0x7c53268e
xor dword [rsp + 0x30], 0xde2ea60
add dword [rsp + 0x30], 0x28b1f526
sub dword [rsp + 0x30], 0x19ba6fc2
xor dword [rsp + 0x30], 0x1ecba036
sub dword [rsp + 0x30], 0x38be46eb
add dword [rsp + 0x30], 0xd98a0c18
mov dword [rsp + 0x36], 0x81ff6da
sub dword [rsp + 0x36], 0x308bbc7
add dword [rsp + 0x36], 0x3695b8e6
add dword [rsp + 0x36], 0x1e843815
xor dword [rsp + 0x36], 0x5181587d
add dword [rsp + 0x36], 0x2ecb13e3
xor dword [rsp + 0x36], 0x766a52de
add dword [rsp + 0x36], 0xb36924f1
mov dword [rsp + 0x3a], 0x33a5c5b9
add dword [rsp + 0x3a], 0x3fbc5d48
sub dword [rsp + 0x3a], 0x5825ac63
add dword [rsp + 0x3a], 0x3600f43f
xor dword [rsp + 0x3a], 0x79e798cb
add dword [rsp + 0x3a], 0x8ce6664
add dword [rsp + 0x3a], 0xcdcfa6f5
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rdi, rax
mov rdi, rsi
xchg rdi, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x14
add byte [rsp + rax + 0x30], 0x38
xor byte [rsp + rax + 0x30], 0x24
xor byte [rsp + rax + 0x30], 0x20
add byte [rsp + rax + 0x30], 0x2a
sub byte [rsp + rax + 0x30], 0x6b
add byte [rsp + rax + 0x30], 0xe
add byte [rsp + rax + 0x30], 0x42
sub byte [rsp + rax + 0x30], 0x57
inc rax
cmp rax, 4
jb 0x140157bca
mov dword [rsp + 0x28], 0x2446b7c2
sub dword [rsp + 0x28], 0x270140e
add dword [rsp + 0x28], 0x1939c3e1
add dword [rsp + 0x28], 0x1a1d639f
sub dword [rsp + 0x28], 0x4d1a498d
add dword [rsp + 0x28], 0x4de758e9
xor dword [rsp + 0x28], 0x55fada91
xchg rsi, rdx
mov qword [rsp + 0x20], rdx
xchg rdx, rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x45
add byte [rsp + rsi + 0x36], 0x1d
xor byte [rsp + rsi + 0x36], 0x3b
xor byte [rsp + rsi + 0x36], 0x45
add byte [rsp + rsi + 0x36], 1
sub byte [rsp + rsi + 0x36], 0xb
sub byte [rsp + rsi + 0x36], 0x12
inc rsi
cmp rsi, 8
jb 0x140157c6c
lea rcx, [rbp - 0x60]
call fcn.140029b70
nop
lea rcx, [rbp - 0x20]
jmp 0x140157e17
mov r9d, 0x13e07c1d
add r9d, 0x33d837b7
add r9d, 0x1015fdd3
add r9d, 0x2c67068
sub r9d, 0x57223b38
xor r9d, 0x77b910c8
xor r9d, 0x3aebca6
xor r9d, 0x4eaf678c
add r9d, 0xc635d2ca
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
mov rcx, qword [r12]
call fcn.140163dc0
nop
mov r9d, 0x47316b6b
xor r9d, 0x1174a66b
sub r9d, 0xc02af6a
sub r9d, 0x1343c732
add r9d, 0x2eed946c
sub r9d, 0x3de6b13a
add r9d, 0xd7f9c669
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
mov rcx, qword [r12]
call fcn.140163dc0
nop
xor edx, edx
mov r8d, 0x45712dfd
add r8d, 0x261348ca
sub r8d, 0x49f78b4a
add r8d, 0x1dad0237
xor r8d, 0x4ff3b26a
sub r8d, 0xe7a91d2
xor r8d, 0x62952951
sub r8d, 0xdac75d
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
add rcx, 0x560
call fcn.14007b7e0
xchg r11, rax
mov rbx, r11
xchg r11, rax
lea rcx, [rsp + 0x60]
call fcn.14007b7e0
xchg r8, rbp
mov rbp, rbx
xchg rbp, r8
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140086dc0
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b3f0
lea r9, [rbp + 0x70]
xchg r8, rax
mov rax, r8
xchg r8, rax
mov edx, 0x56670b8c
add edx, 0x13ddd363
sub edx, 0x403b2e4f
add edx, 0x1f324e0e
xor edx, 0x46376b60
xor edx, 0xf0c958e
xchg rcx, r8
mov r8, rbx
xchg rcx, r8
call fcn.14016e6a0
nop
lea rcx, [rsp + 0x60]
call fcn.14007b070
nop
lea rcx, [rbp - 0x80]
call fcn.14007b070
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3