Function at 0x140161a70
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r15, rdx
mov rdx, r15
xchg r15, rdx
xor edx, edx
mov r8d, 0x3abcf4de
add r8d, 0x2784ee39
xor r8d, 0x318f0d3e
xor r8d, 0x52df86b3
add r8d, 0x67342271
sub r8d, 0x68458901
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x53a9055f
xor edx, 0x3616d06b
xor edx, 0x628dec13
xor edx, 0x30228fc7
add edx, 0x3ef3fcff
sub edx, 0x42f13f4b
xor edx, 0x33137590
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
xchg r12, r14
mov qword [rsp + 0x60], r14
xchg r14, r12
mov qword [rsp + 0x68], r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff23baa361
xor rsi, 0x30a90f9b
sub rsi, 0x3c9137d
xor rsi, 0xce6a483
add rsi, 0x180aabd9
add rsi, 0x7fffffff
xor rsi, 0x64491629
mov rbx, rsi
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161b7b
movabs r14, 0x7fffffff0e58b826
xor r14, 0x200b730a
add r14, 0x4b646be4
sub r14, 0x4fc480fd
add r14, 0x456a3e4b
xor r14, 0x6051a46f
add r14, 0x7fffffff
add r14, 0x70f3afce
cmp rbx, r14
ja 0x140162185
mov qword [rsp + 0x68], 0x43001b50
xor qword [rsp + 0x68], 0xa003759
add qword [rsp + 0x68], 0x2000750c
xor qword [rsp + 0x68], 0x4902f7c9
xor qword [rsp + 0x68], 0x3f5a4db1
xor qword [rsp + 0x68], 0x1f581b6a
cmp rbx, 8
jae 0x140161c37
mov qword [rsp + 0x60], rbx
add rbx, rbx
xchg rbx, r8
mov rbx, r8
xchg rbx, r8
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161cd7
xchg rdi, rax
mov rdi, rbx
xchg rdi, rax
or rax, 7
cmp rax, r14
ja 0x140161c7e
mov r14, rax
mov ecx, 0x692ac355
add ecx, 0x739f745
sub ecx, 0x17cb00c7
xor ecx, 0x2361cca3
sub ecx, 0xae8e341
sub ecx, 0x191e04ca
sub ecx, 0x57f18d5b
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f920
xchg rdx, rdi
mov rdx, rax
xchg rdi, rdx
xchg rcx, rax
mov qword [rsp + 0x50], rcx
xchg rcx, rax
xchg rbx, rcx
mov qword [rsp + 0x60], rcx
xchg rbx, rcx
xchg rsi, r14
mov qword [rsp + 0x68], rsi
xchg r14, rsi
add rbx, rbx
xchg rbx, rbp
mov r8, rbp
xchg rbx, rbp
lea rdx, [rbp]
xchg r15, rcx
mov r15, rax
xchg r15, rcx
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x5b
add byte [rbp + 0x258], 0x11
sub byte [rbp + 0x258], 0x24
sub byte [rbp + 0x258], 0x25
sub byte [rbp + 0x258], 0x12
xor byte [rbp + 0x258], 0xf
add byte [rbp + 0x258], 0xd8
mov dword [rbp + 0x25a], 0x542d0210
add dword [rbp + 0x25a], 0x1aa0c743
sub dword [rbp + 0x25a], 0x2e452d1a
add dword [rbp + 0x25a], 0x26be3c60
add dword [rbp + 0x25a], 0x59fc74c
sub dword [rbp + 0x25a], 0x3738f0fc
sub dword [rbp + 0x25a], 0x35acaf83
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x2f
xor byte [rbp + 0x258], 0x35
add byte [rbp + 0x258], 0x55
add byte [rbp + 0x258], 0xe
sub byte [rbp + 0x258], 0x76
add byte [rbp + 0x258], 0x35
sub byte [rbp + 0x258], 0x18
add byte [rbp + 0x258], 0x44
sub byte [rbp + 0x258], 0x68
lea rax, [rbp + 0x25a]
xchg rdi, r14
mov r14, rsi
xchg r14, rdi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161dbc
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r14, rax
mov r14, rcx
xchg r14, rax
sub rax, r14
cmp rdi, rax
ja 0x140161e21
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161e4f
xchg rdi, r9
mov qword [rsp + 0x20], r9
xchg rdi, r9
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
lea rcx, [rsp + 0x50]
call fcn.140034ef0
nop
xchg r12, rbx
mov rax, rbx
xchg rbx, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x75
sub byte [rbp + rax + 0x25a], 0x6e
add byte [rbp + rax + 0x25a], 0x14
add byte [rbp + rax + 0x25a], 0x50
xor byte [rbp + rax + 0x25a], 0x77
add byte [rbp + rax + 0x25a], 0x51
sub byte [rbp + rax + 0x25a], 0x6d
inc rax
cmp rax, 2
jb 0x140161e5d
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161ea2
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
sub rax, rdi
cmp rsi, rax
ja 0x140161f0a
lea rax, [rdi + rsi]
xchg rcx, rax
mov qword [rsp + 0x60], rcx
xchg rcx, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg rcx, r15
mov rdx, rcx
xchg rcx, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140161f39
xchg r15, rsi
mov qword [rsp + 0x20], r15
xchg r15, rsi
xchg r15, r9
mov r15, r9
xchg r15, r9
movzx r8d, byte [rbp + 0x250]
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
lea rcx, [rsp + 0x50]
call fcn.140034ef0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x6c], xmm0
xchg r10, rbp
movups xmmword [r10 - 0x5c], xmm0
xchg r10, rbp
xchg rbp, rsi
movups xmmword [rsi - 0x4c], xmm0
xchg rbp, rsi
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
xchg r10, rax
mov qword [rbp - 0x80], r10
xchg r10, rax
mov dword [rbp + 0x250], 0x4d5cb004
add dword [rbp + 0x250], 0xc6eec87
add dword [rbp + 0x250], 0x116fd848
sub dword [rbp + 0x250], 0x1bf7c824
sub dword [rbp + 0x250], 0x18cc4cac
add dword [rbp + 0x250], 0x79650f6
add dword [rbp + 0x250], 0xd641b1b
add dword [rbp + 0x250], 0x2035c5a0
xor dword [rbp + 0x250], 0x6ba791b5
mov dword [rbp - 0x70], 0x47c2b019
add dword [rbp - 0x70], 0x235a8438
xor dword [rbp - 0x70], 0x1f69de7
sub dword [rbp - 0x70], 0x30ab7daa
sub dword [rbp - 0x70], 0x19bda4b9
add dword [rbp - 0x70], 0x2be45e40
sub dword [rbp - 0x70], 0x2e7ae033
sub dword [rbp - 0x70], 0x1dec04f8
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xchg r11, rax
mov qword [rsp + 0x40], r11
xchg r11, rax
mov qword [rsp + 0x38], r12
xchg rdi, r12
mov qword [rsp + 0x30], rdi
xchg r12, rdi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x859efc
xor edx, 0x7726ceb1
sub edx, 0x2f465702
xor edx, 0x79212fd0
xor edx, 0x743baae2
add edx, 0x5996d84
add edx, 0xb5201602
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
xchg rcx, r13
mov r13, qword [rsp + 0x70]
xchg rcx, r13
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xchg rcx, r10
mov r10, qword [rsp + 0x70]
xchg rcx, r10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14016211e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
cmp rdx, 0x1000
jb 0x140162119
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140162119
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcba8
mov eax, ebx
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
xchg rsi, rbp
mov rbp, qword [r11 + 0x38]
xchg rsi, rbp
mov rsp, r11
nop
add rsp, 8
xchg qword [rsp - 8], r15
push rbx
push rcx
push rdx
push rbx
push rcx
xchg qword [rsp + 0x28], r14
add rsp, 0x30
nop
xchg qword [rsp], r12
add rsp, 8
push rbx
push rdx
push rcx
push rcx
push rdx
push rax
push rbx
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rbx
pop rax
pop rdx
pop rcx
pop rcx
pop rdx
pop rbx
add rsp, 8
push rcx
push rbx
push rcx
push rbx
xchg qword [rsp + 0x20], rbp
pop rbx
pop rcx
pop rbx
pop rcx
add rsp, 8
ret
call fcn.14002f8e0
int3