Function at 0x140161b50
Capabilities:
Create process on windows
Encode data using xor
Get common file path

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rsi
push rbp
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
lea rbp, [rsp - 0x210]
sub rsp, 0x310
xchg r12, rdx
mov r15, r12
xchg rdx, r12
xor edx, edx
mov r8d, 0x7d68fcbb
xor r8d, 0x6c8d12d4
add r8d, 0x546d5fd8
sub r8d, 0x5be6342b
add r8d, 0xe2b88f
add r8d, 0x3dc3c4e9
xor r8d, 0x27192300
add r8d, 0xd0f6b
xor r8d, 0x6e17c1f5
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
mov edx, 0x39cae83c
sub edx, 0x19556136
xor edx, 0x51511de8
sub edx, 0x1028ac1f
xor edx, 0x27f8bc6e
xor edx, 0x470353a5
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor r12d, r12d
mov qword [rsp + 0x60], r12
xchg r14, r12
mov qword [rsp + 0x68], r14
xchg r12, r14
lea rax, [rbp]
nop
movabs rsi, 0xffffffff1f4ffba6
add rsi, 0x211c1a73
sub rsi, 0xd49120f
sub rsi, 0x1c88d843
add rsi, 0x3c1851b
add rsi, 0xada82f9
add rsi, 0x2e612a83
add rsi, 0x7fffffff
add rsi, 0x2c68a1a2
xchg rbx, r14
mov r14, rsi
xchg rbx, r14
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], r12w
jne 0x140161c81
movabs r14, 0x7fffffff0e3bedc9
add r14, 0x26009621
sub r14, 0xf5ef613
sub r14, 0x20c7c202
xor r14, 0x2ef8f3f1
xor r14, 0x5fd9b61c
sub r14, 0x628b38d3
add r14, 0x7fffffff
add r14, 0x6d56aa9a
cmp rbx, r14
ja 0x14016228f
mov qword [rsp + 0x68], 0x3bfb7e39
xor qword [rsp + 0x68], 0x8a2ee36
add qword [rsp + 0x68], 0x25352e9b
add qword [rsp + 0x68], 0x2b84fa3
xor qword [rsp + 0x68], 0x6bc2c4d5
sub qword [rsp + 0x68], 0x432f86d
xor qword [rsp + 0x68], 0xcdd3966
sub qword [rsp + 0x68], 0x41ea845
sub qword [rsp + 0x68], 0x1c714301
cmp rbx, 8
jae 0x140161d65
xchg rbp, rbx
mov qword [rsp + 0x60], rbp
xchg rbp, rbx
add rbx, rbx
xchg rbp, r8
mov rbp, rbx
xchg rbp, r8
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x50], r12w
jmp 0x140161dff
mov rax, rbx
or rax, 7
cmp rax, r14
ja 0x140161dae
xchg r12, r14
mov r12, rax
xchg r12, r14
mov ecx, 0x288749be
sub ecx, 0xdd963d6
add ecx, 0x5178d209
sub ecx, 0x1ee6e18b
sub ecx, 0x23a03339
sub ecx, 0x18c2780e
sub ecx, 0x10dd2b15
cmp rax, rcx
cmovb r14, rcx
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x50]
call fcn.14002f870
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
mov qword [rsp + 0x50], rax
xchg r13, rbx
mov qword [rsp + 0x60], r13
xchg r13, rbx
xchg r10, r14
mov qword [rsp + 0x68], r10
xchg r10, r14
add rbx, rbx
xchg rdx, r8
mov rdx, rbx
xchg rdx, r8
lea rdx, [rbp]
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov word [rbx + rdi], r12w
mov byte [rbp + 0x258], 0x54
xor byte [rbp + 0x258], 0x7f
xor byte [rbp + 0x258], 0x1d
add byte [rbp + 0x258], 0x31
xor byte [rbp + 0x258], 0x7e
xor byte [rbp + 0x258], 0x5e
xor byte [rbp + 0x258], 0xb1
mov dword [rbp + 0x25a], 0x3cd0466
add dword [rbp + 0x25a], 0x28a3e07e
add dword [rbp + 0x25a], 0x3b02d950
sub dword [rbp + 0x25a], 0x571e96ad
xor dword [rbp + 0x25a], 0x715a6eae
xor dword [rbp + 0x25a], 0x3ab07616
sub dword [rbp + 0x25a], 0x150a77a
sub dword [rbp + 0x25a], 0x5a6d985f
movzx edx, word [rbp + 0x25a]
movzx ecx, byte [rbp + 0x258]
add cx, dx
mov word [rbp + 0x25a], cx
mov byte [rbp + 0x258], 0x74
sub byte [rbp + 0x258], 0x3c
add byte [rbp + 0x258], 0x2e
sub byte [rbp + 0x258], 0x22
sub byte [rbp + 0x258], 0x44
add byte [rbp + 0x258], 0
lea rax, [rbp + 0x25a]
mov rdi, rsi
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140161ed3
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
sub rax, r14
cmp rdi, rax
ja 0x140161f3c
lea rax, [r14 + rdi]
xchg r11, rax
mov qword [rsp + 0x60], r11
xchg r11, rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + r14*2]
lea r8, [rdi + rdi]
lea rdx, [rbp + 0x25a]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [r14 + rdi]
mov word [rbx + rax*2], r12w
jmp 0x140161f6a
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
lea r9, [rbp + 0x25a]
movzx r8d, byte [rbp + 0x250]
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
lea rcx, [rsp + 0x50]
call fcn.140034dd0
nop
mov rax, r12
nop dword [rax + rax]
mov byte [rbp + rax + 0x25a], 3
add byte [rbp + rax + 0x25a], 0x1f
xor byte [rbp + rax + 0x25a], 0x26
xor byte [rbp + rax + 0x25a], 0x76
sub byte [rbp + rax + 0x25a], 0xd
sub byte [rbp + rax + 0x25a], 0x65
add byte [rbp + rax + 0x25a], 0x7c
sub byte [rbp + rax + 0x25a], 0x7c
inc rax
cmp rax, 2
jb 0x140161f72
inc rsi
cmp word [r15 + rsi*2], 0
jne 0x140161fbf
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xchg r10, rcx
mov rax, r10
xchg rcx, r10
sub rax, rdi
cmp rsi, rax
ja 0x140162029
lea rax, [rdi + rsi]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x50]
lea rcx, [rbx + rdi*2]
lea r8, [rsi + rsi]
xchg rdi, r15
mov rdx, rdi
xchg rdi, r15
call sub.VCRUNTIME140.dll_memmove
lea rax, [rdi + rsi]
mov word [rbx + rax*2], r12w
jmp 0x140162052
mov qword [rsp + 0x20], rsi
xchg r15, r12
mov r9, r12
xchg r15, r12
movzx r8d, byte [rbp + 0x250]
xchg rdx, rcx
mov rcx, rsi
xchg rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140034dd0
xorps xmm0, xmm0
xor eax, eax
xchg r12, rbp
movups xmmword [r12 - 0x6c], xmm0
xchg rbp, r12
xchg rbp, r12
movups xmmword [r12 - 0x5c], xmm0
xchg r12, rbp
movups xmmword [rbp - 0x4c], xmm0
xchg rbp, r15
movups xmmword [r15 - 0x3c], xmm0
xchg r15, rbp
xchg r12, rbp
movups xmmword [r12 - 0x2c], xmm0
xchg rbp, r12
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], eax
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rax
mov dword [rbp + 0x250], 0x9f6aefb
xor dword [rbp + 0x250], 0x69fd2a52
sub dword [rbp + 0x250], 0x7bdf727
xor dword [rbp + 0x250], 0x78b7bc86
add dword [rbp + 0x250], 0x518f8f8a
add dword [rbp + 0x250], 0x2294c51
xor dword [rbp + 0x250], 0x74b30cde
mov dword [rbp - 0x70], 0x2191b9ad
sub dword [rbp - 0x70], 0x1da5ce60
xor dword [rbp - 0x70], 0x70d7b57a
sub dword [rbp - 0x70], 0x486d4f97
xor dword [rbp - 0x70], 0x5436fe4
sub dword [rbp - 0x70], 0x2f8c60dc
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x70]
xchg rsi, rax
mov qword [rsp + 0x48], rsi
xchg rsi, rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x40], rax
xchg r8, r12
mov qword [rsp + 0x38], r8
xchg r12, r8
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xchg rcx, r9
mov r9, qword [rsp + 0x78]
xchg r9, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x64dfc07a
xor edx, 0x2613ef4
sub edx, 0x7a5a69d
sub edx, 0x225bd12c
add edx, 0x33e952d3
sub edx, 0x6745f1b1
add edx, 0x3d050e04
xor edx, 0x2382afc6
add edx, 0x9a18a5d2
xchg rcx, r12
mov r12, qword [rsp + 0x70]
xchg rcx, r12
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xchg rcx, r12
mov r12, qword [rsp + 0x70]
xchg r12, rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x250]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x14016223c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140162237
nop
sub rdx, 0x192868ac
add rdx, 0x192868d3
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
jbe 0x140162237
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fd29c
mov eax, ebx
lea r11, [rsp + 0x310]
xchg r15, rbx
mov r15, qword [r11 + 0x30]
xchg rbx, r15
mov rsi, qword [r11 + 0x38]
mov rsp, r11
nop
xchg qword [rsp], r15
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
mov rbp, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call fcn.14002f830
int3