Function at 0x1401575e0
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
push r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x2070]
mov eax, 0x5b486d33
sub eax, 0x562854d0
add eax, 0x322c2b59
xor eax, 0x44360b64
xor eax, 0x41373d12
sub eax, 0x324d545a
call fcn.1401fd610
sub rsp, rax
xchg rdx, rbp
mov r15, rbp
xchg rdx, rbp
xchg r8, rcx
mov r12, r8
xchg r8, rcx
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157f29
xchg r8, rdx
mov rcx, r8
xchg r8, rdx
call fcn.140070420
cmp rax, 3
jb 0x140157db6
lea edx, [rsi + 1]
xchg rdi, r15
mov rcx, rdi
xchg rdi, r15
call fcn.14004e1a0
mov dl, 0x21
add dl, 0x45
sub dl, 0x27
sub dl, 5
sub dl, 0x26
sub dl, 0x13
xchg rcx, rbx
mov rbx, rax
xchg rcx, rbx
call fcn.14007ddc0
test al, al
je 0x140157db6
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
mov rcx, qword [r12]
call fcn.140163f50
nop
xchg rcx, rdi
mov rcx, qword [r12]
xchg rdi, rcx
lea rcx, [rdi + 0x308]
call fcn.14007e960
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea edx, [rsi + 2]
xchg rbp, r15
mov rcx, rbp
xchg rbp, r15
call fcn.14004e1a0
lea rdx, [rbp - 0x80]
xchg rdx, rax
mov rcx, rdx
xchg rdx, rax
call fcn.14007e3b0
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.140052780
nop
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1401765f0
xchg rdi, rax
mov rbx, rdi
xchg rdi, rax
lea rcx, [rbp - 0x20]
call fcn.14007b310
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
xchg rdi, rax
mov r8, rdi
xchg rdi, rax
lea edx, [rsi + 0x40]
xchg rdi, rbp
mov rcx, rbp
xchg rdi, rbp
call fcn.14016e870
nop
lea rcx, [rbp + 0x28]
call fcn.140029ad0
nop
lea rcx, [rbp - 0x80]
call fcn.14004c6c0
xchg r15, r10
mov rcx, r10
xchg r15, r10
call fcn.140070420
cmp rax, 4
jb 0x140157dad
xchg r9, rcx
mov r9, qword [r12]
xchg r9, rcx
add rcx, 0x7242261f
sub rcx, 0x72422317
call fcn.14007e960
xchg rcx, rbx
mov rcx, rax
xchg rcx, rbx
lea edx, [rsi + 3]
mov rcx, r15
call fcn.14004e1a0
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14007e3b0
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.140052780
nop
lea rcx, [rsp + 0x60]
call fcn.14004c6c0
lea rcx, [rbp - 0x60]
call fcn.140179570
cmp rax, 8
jb 0x140157b68
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140179590
nop
mov dword [rbp + 0x20b0], 0x3ac68ad6
xor dword [rbp + 0x20b0], 0x6f02e3d4
sub dword [rbp + 0x20b0], 0x112dc549
xor dword [rbp + 0x20b0], 0x25c9aa22
sub dword [rbp + 0x20b0], 0x4caafff8
xor dword [rbp + 0x20b0], 0x78b188ae
sub dword [rbp + 0x20b0], 0x4f15b9f8
add dword [rbp + 0x20b0], 0x4f563a1c
sub dword [rbp + 0x20b0], 0x6c460130
xchg rcx, rbp
mov rbp, rax
xchg rbp, rcx
call fcn.1401765f0
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14007ab90
mov rbx, rax
mov dword [rbp + 0x20b0], 0x2ff86bb2
sub dword [rbp + 0x20b0], 0x23faad67
add dword [rbp + 0x20b0], 0x37d4fab8
sub dword [rbp + 0x20b0], 0x2bb0e57a
xor dword [rbp + 0x20b0], 0x48af776b
xor dword [rbp + 0x20b0], 0x1cbbefe1
sub dword [rbp + 0x20b0], 0x4c354b00
mov dword [rsp + 0x40], 0x6709ae61
xor dword [rsp + 0x40], 0x43906f73
xor dword [rsp + 0x40], 0x48325242
sub dword [rsp + 0x40], 0x2ddd320
add dword [rsp + 0x40], 0x126eaae8
add dword [rsp + 0x40], 0x7aba8bde
mov dword [rsp + 0x4a], 0x1948662b
xor dword [rsp + 0x4a], 0xcc2f081
add dword [rsp + 0x4a], 0x4aa50064
xor dword [rsp + 0x4a], 0x39e8be25
add dword [rsp + 0x4a], 0x26099982
xor dword [rsp + 0x4a], 0x7fbc3734
add dword [rsp + 0x4a], 0x544ae303
add dword [rsp + 0x4a], 0xd39039c
add dword [rsp + 0x4a], 0x9d8e233a
mov dword [rsp + 0x4e], 0x664b1f78
sub dword [rsp + 0x4e], 0x463a694a
sub dword [rsp + 0x4e], 0x28c16dd
add dword [rsp + 0x4e], 0x58c225d1
xor dword [rsp + 0x4e], 0x687f6520
xor dword [rsp + 0x4e], 0x4a88fa76
xor dword [rsp + 0x4e], 0x30454961
xor dword [rsp + 0x4e], 0x9b8eec6b
mov dword [rsp + 0x44], 0x19e307d4
sub dword [rsp + 0x44], 0x191224d7
add dword [rsp + 0x44], 0x33b46152
xor dword [rsp + 0x44], 0x5e09c35b
add dword [rsp + 0x44], 0x11e62c3d
xor dword [rsp + 0x44], 0x8a8445a7
mov dword [rsp + 0x52], 0x2d73f65a
sub dword [rsp + 0x52], 0x1b222095
sub dword [rsp + 0x52], 0xcbfac0f
add dword [rsp + 0x52], 0x284924de
xor dword [rsp + 0x52], 0x379a3550
add dword [rsp + 0x52], 0x49c3b5fb
xor dword [rsp + 0x52], 0x9b41cec2
mov dword [rsp + 0x56], 0xb3c6fe8
xor dword [rsp + 0x56], 0x5d3330bb
xor dword [rsp + 0x56], 0x3564268
sub dword [rsp + 0x56], 0x4a0975a1
xor dword [rsp + 0x56], 0x2b8ea166
add dword [rsp + 0x56], 0x1abd3c80
add dword [rsp + 0x56], 0xc3bbbbbd
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x68
xor byte [rsp + rdx + 0x40], 0x18
sub byte [rsp + rdx + 0x40], 0xd
sub byte [rsp + rdx + 0x40], 0x4b
xor byte [rsp + rdx + 0x40], 0x3e
add byte [rsp + rdx + 0x40], 0x24
xor byte [rsp + rdx + 0x40], 0x5f
sub byte [rsp + rdx + 0x40], 0x15
inc rdx
cmp rdx, 8
jb 0x140157a1e
mov dword [rbp + 0x20b0], 0x230bb271
add dword [rbp + 0x20b0], 0x3b6a328a
sub dword [rbp + 0x20b0], 0x49427b22
add dword [rbp + 0x20b0], 0x5befa1de
sub dword [rbp + 0x20b0], 0x2f87c30e
add dword [rbp + 0x20b0], 0x305a6a34
xor dword [rbp + 0x20b0], 0x40eaf0f1
xor dword [rbp + 0x20b0], 0x311f422b
movups xmm0, xmmword [rsp + 0x40]
xchg rbx, rbp
movaps xmmword [rbx - 0x40], xmm0
xchg rbp, rbx
movsd xmm1, qword [rsp + 0x50]
xchg rbp, r9
movsd qword [r9 - 0x30], xmm1
xchg rbp, r9
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c210
nop
mov r14d, 0xac6db70
xor r14d, 0xea44e59
xor r14d, 0x72752683
xor r14d, 0x38e20147
sub r14d, 0x3920885
add r14d, 0x2d51b606
sub r14d, 0x50db4858
add r14d, 0x530df149
sub r14d, 0x7ae80950
mov dword [rbp + 0x20b0], r14d
xchg rdx, rcx
mov rcx, rax
xchg rdx, rcx
xchg rcx, r12
mov r12, rbx
xchg r12, rcx
call fcn.14007b280
test al, al
je 0x140157b68
mov bl, 0x21
add bl, 0x44
sub bl, 0x35
add bl, 6
add bl, 0x41
sub bl, 0x46
sub bl, 0x30
jmp 0x140157b6a
xor bl, bl
test r14b, 8
je 0x140157b89
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007afc0
nop
test r14b, 4
je 0x140157be5
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg r12, rax
mov r12, rsi
xchg r12, rax
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x7b
sub byte [rsp + rax + 0x4a], 0x30
add byte [rsp + rax + 0x4a], 0x2a
xor byte [rsp + rax + 0x4a], 0x1d
sub byte [rsp + rax + 0x4a], 0x40
add byte [rsp + rax + 0x4a], 0x2e
sub byte [rsp + rax + 0x4a], 0x29
xor byte [rsp + rax + 0x4a], 0x2d
inc rax
cmp rax, 0x10
jb 0x140157bb0
test r14b, 2
je 0x140157c04
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007afc0
nop
test r14b, 1
je 0x140157c22
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029ad0
test bl, bl
je 0x140157da3
lea rcx, [rbp - 0x60]
call fcn.1401765f0
mov r8, rax
mov dword [rsp + 0x30], 0x2569609
add dword [rsp + 0x30], 0x5ae04cb4
sub dword [rsp + 0x30], 0x25e6dd1d
add dword [rsp + 0x30], 0x20613c03
add dword [rsp + 0x30], 0xae496e2
add dword [rsp + 0x30], 0x94611e71
mov dword [rsp + 0x36], 0x672b7e13
xor dword [rsp + 0x36], 0x621493cb
add dword [rsp + 0x36], 0x1ee70994
sub dword [rsp + 0x36], 0x1267debc
xor dword [rsp + 0x36], 0x1b8d6a6b
add dword [rsp + 0x36], 0xf5488c9e
mov dword [rsp + 0x3a], 0x565bf024
add dword [rsp + 0x3a], 0x1aa218f5
xor dword [rsp + 0x3a], 0x2bb72efc
sub dword [rsp + 0x3a], 0x3e1be9e6
add dword [rsp + 0x3a], 0x52570c2f
xor dword [rsp + 0x3a], 0x90fcb541
xor eax, eax
mov word [rsp + 0x3e], ax
mov rax, rsi
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x6a
sub byte [rsp + rax + 0x30], 0x27
sub byte [rsp + rax + 0x30], 0x1d
add byte [rsp + rax + 0x30], 0x14
sub byte [rsp + rax + 0x30], 9
add byte [rsp + rax + 0x30], 0x30
sub byte [rsp + rax + 0x30], 0x40
add byte [rsp + rax + 0x30], 0x4b
sub byte [rsp + rax + 0x30], 0x6c
inc rax
cmp rax, 4
jb 0x140157cd7
mov dword [rsp + 0x28], 0x6c38d9a3
xor dword [rsp + 0x28], 0x3f43b3d3
sub dword [rsp + 0x28], 0xe8c121a
xor dword [rsp + 0x28], 0x7fce9cde
xor dword [rsp + 0x28], 0x497cfe57
xor dword [rsp + 0x28], 0x4e676fd0
sub dword [rsp + 0x28], 0x3c3a550e
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x45
sub byte [rsp + rsi + 0x36], 0x36
add byte [rsp + rsi + 0x36], 0x4a
sub byte [rsp + rsi + 0x36], 0x3b
add byte [rsp + rsi + 0x36], 0x32
sub byte [rsp + rsi + 0x36], 7
sub byte [rsp + rsi + 0x36], 0x49
inc rsi
cmp rsi, 8
jb 0x140157d73
lea rcx, [rbp - 0x60]
call fcn.140029ad0
nop
lea rcx, [rbp - 0x20]
jmp 0x140157f24
mov r9d, 0x38224f85
sub r9d, 0x66571cd
add r9d, 0x1e560858
xor r9d, 0x3982c73c
sub r9d, 0x26d426a7
xor r9d, 0x1217db32
add r9d, 0xaf53de48
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
mov rcx, qword [r12]
call fcn.140163f50
nop
mov r9d, 0x2e0ab3e0
sub r9d, 0x2d9ecd8
xor r9d, 0x1545d9bc
xor r9d, 0x49fd31e3
sub r9d, 0x6eca7de4
add r9d, 0xf7424e8c
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg rcx, rbx
mov rbx, qword [r12]
xchg rbx, rcx
call fcn.140163f50
nop
xor edx, edx
mov r8d, 0x3809853f
sub r8d, 0x927412f
xor r8d, 0x192e9798
xor r8d, 0x6bd43df7
add r8d, 0x963e61b
xor r8d, 0x1d898de0
xor r8d, 0x4bcb219b
xor r8d, 0x333e58e1
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
xchg rcx, rsi
mov rsi, qword [r12]
xchg rsi, rcx
add rcx, 0x39ff2ba2
sub rcx, 0x39ff2642
call fcn.14007b710
xchg r15, rax
mov rbx, r15
xchg r15, rax
lea rcx, [rsp + 0x60]
call fcn.14007b710
xchg rdi, r8
mov rdi, rbx
xchg r8, rdi
xchg rcx, rax
mov rdx, rcx
xchg rcx, rax
lea rcx, [rbp + 0x70]
call fcn.140086b40
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b310
lea r9, [rbp + 0x70]
xchg r14, r8
mov r14, rax
xchg r8, r14
mov edx, 0x2790f00a
add edx, 0x2226c06c
xor edx, 0x7e3f8990
xor edx, 0x53aeedf7
xor edx, 0xa1ccde
xor edx, 0x630c1555
xor edx, 0x78b0dda
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.14016e870
nop
lea rcx, [rsp + 0x60]
call fcn.14007afc0
nop
lea rcx, [rbp - 0x80]
call fcn.14007afc0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3