Function at 0x140001ce0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1380]
mov eax, 0x1480
call fcn.140004300
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1370], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, str.Telegraph2
mov qword [rbp - 0x80], rax
lea rax, str.VPNterri2
mov qword [rbp - 0x78], rax
lea rax, str.NvidiaUpscaleImageAI2
mov qword [rbp - 0x70], rax
lea rax, str.Joni2
mov qword [rbp - 0x68], rax
lea rax, str.Amega2
mov qword [rbp - 0x60], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1364], 0xffffffff
mov dword [rbp - 0x1c], eax
mov edx, 1
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x1c], eax
inc rdx
cmp rdx, 0x270
jb 0x140001d80
mov dword [rbp - 0x20], 0x270
lea rcx, [rbp - 0x20]
call fcn.140003160
mov ecx, eax
lea rcx, [rcx + rcx*4]
test ecx, ecx
jne 0x140001dd4
nop dword [rax]
lea rcx, [rbp - 0x20]
call fcn.140003160
mov ecx, eax
lea rcx, [rcx + rcx*4]
cmp ecx, 1
jb 0x140001dc0
shr rcx, 0x20
mov eax, 0x80000000
sub rcx, rax
xor rcx, 0xffffffff80000000
mov rcx, qword [rbp + rcx*8 - 0x80]
call fcn.1400012c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xc4
mov dword [rsp + 0x5c], 0x178
mov dword [rsp + 0x60], 0x244
mov dword [rsp + 0x64], 0x338
mov dword [rsp + 0x68], 0x3b4
mov dword [rsp + 0x6c], 0x3b8
mov dword [rsp + 0x70], 0x1784
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov ecx, 0x20
call fcn.140003330
mov rsi, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x38], rax
lea rdi, [rsp + 0x50]
movabs r13, 0x7ffffffffffffff
nop dword [rax]
mov r9, rdi
mov r8, rsi
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x38]
call fcn.140002ea0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x40], xmm0
cmp byte [rsp + 0x40], 0
jne 0x140001f08
cmp qword [rbp - 0x30], r13
je 0x140001ff8
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r12
mov ecx, 0x20
call fcn.140003330
mov r8, rax
mov eax, dword [rdi]
mov dword [r8 + 0x1c], eax
mov qword [r8], rbx
mov qword [r8 + 8], rbx
mov qword [r8 + 0x10], rbx
mov word [r8 + 0x18], 0
mov qword [rbp - 0x40], r12
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x38]
call fcn.140002c20
add rdi, 4
lea rax, [rsp + 0x74]
cmp rdi, rax
jne 0x140001e80
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
lea rcx, [rbp - 0x58]
call fcn.140001ad0
nop
mov r14, qword [rbp - 0x38]
mov rbx, qword [r14]
mov r15, qword [rbp - 0x58]
cmp rbx, r14
je 0x140002028
nop
lea r9, [rbx + 0x1c]
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.140002ea0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x40], xmm0
cmp byte [rsp + 0x40], 0
jne 0x140001fca
cmp qword [rbp - 0x50], r13
je 0x140002099
mov rdi, qword [rbp - 0x58]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r12
mov ecx, 0x20
call fcn.140003330
mov r8, rax
mov eax, dword [rbx + 0x1c]
mov dword [r8 + 0x1c], eax
mov qword [r8], rdi
mov qword [r8 + 8], rdi
mov qword [r8 + 0x10], rdi
mov word [r8 + 0x18], 0
mov qword [rbp - 0x40], r12
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x58]
call fcn.140002c20
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140001ffe
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001ff3
nop
cmp rbx, qword [rax + 0x10]
jne 0x140001ff3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140001fe0
mov rbx, rax
jmp 0x14000201f
call fcn.1400011c0
nop
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000201f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140002010
cmp rbx, r14
jne 0x140001f40
movabs r15, 0x4e94914f0000
movabs r14, 0xb2f4fc0794908cf3
movabs rsi, 0x431bde82d7b634db
movabs rbx, 0x7fffffffffffffff
movabs rdi, 0x7ffffffffd9da5ff
lea rcx, [rsp + 0x78]
call fcn.1400011e0
mov rax, qword [rsp + 0x78]
cmp rax, rdi
lea rdi, [rax + 0x2625a00]
jl 0x140002078
mov rdi, rbx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x14000209f
imul rax, rcx, 0x64
jmp 0x14000210e
call fcn.1400011c0
int3
cmp rbx, 0x16e3600
jne 0x1400020f3
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x14000210e
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x14000215d
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jle 0x14000212f
mov edx, 0x5265c00
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140002078
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140002151
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140002078
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
shr r14d, 0xf
and r14b, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rcx, [rbp - 0x48]
call fcn.140001ad0
nop
mov rsi, qword [rbp - 0x58]
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x1400022cc
mov r8d, dword [rdi + 0x1c]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x1400021eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000229d
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x1400021e3
nop dword [rax]
cmp rdi, qword [rax + 0x10]
jne 0x1400021e3
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400021d0
mov rdi, rax
jmp 0x1400022bf
mov r8, qword [rbp - 0x38]
mov rax, qword [r8 + 8]
mov rcx, r8
cmp byte [rax + 0x19], 0
jne 0x140002217
mov edx, dword [rdi + 0x1c]
nop
cmp dword [rax + 0x1c], edx
jae 0x14000220b
mov rax, qword [rax + 0x10]
jmp 0x140002211
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002200
cmp byte [rcx + 0x19], 0
jne 0x140002225
mov eax, dword [rcx + 0x1c]
cmp dword [rdi + 0x1c], eax
jae 0x140002228
mov rcx, r8
cmp rcx, r8
jne 0x1400021b4
mov rax, rdi
mov rbx, qword [rdi + 0x10]
cmp byte [rbx + 0x19], 0
je 0x140002259
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x14000227f
cmp rax, qword [rbx + 0x10]
jne 0x14000227f
mov rax, rbx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
je 0x140002244
jmp 0x14000227f
mov rcx, qword [rbx]
cmp byte [rcx + 0x19], 0
jne 0x14000227f
nop dword [rax]
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140002270
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140002540
mov edx, 0x20
mov rcx, rax
call fcn.14000336c
mov rdi, rbx
jmp 0x1400022bf
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400022bf
nop dword [rax]
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400022b0
mov rsi, qword [rbp - 0x58]
cmp rdi, rsi
jne 0x140002195
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rcx]
cmp byte [rbx + 0x19], 0
jne 0x14000248d
nop dword [rax]
mov rax, qword [rsi + 8]
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x140002307
mov edx, dword [rbx + 0x1c]
cmp dword [rax + 0x1c], edx
jae 0x1400022fb
mov rax, qword [rax + 0x10]
jmp 0x140002301
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400022f0
cmp byte [rcx + 0x19], 0
jne 0x140002315
mov eax, dword [rcx + 0x1c]
cmp dword [rbx + 0x1c], eax
jae 0x140002318
mov rcx, rsi
cmp rcx, rsi
jne 0x140002426
test r14b, r14b
je 0x140002373
mov r8d, dword [rbx + 0x1c]
xor edx, edx
mov ecx, 0x401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140002422
mov rcx, rax
call fcn.1400014c0
mov rcx, rdi
test al, al
je 0x14000235d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002422
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002422
mov rax, qword [rsi + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r12d
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x1400023b9
mov edx, dword [rbx + 0x1c]
nop dword [rax]
mov qword [rsp + 0x30], rax
cmp dword [rax + 0x1c], edx
jae 0x1400023a5
mov dword [rsp + 0x38], r12d
mov rax, qword [rax + 0x10]
jmp 0x1400023b3
mov dword [rsp + 0x38], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002390
cmp byte [rcx + 0x19], 0
jne 0x1400023c7
mov eax, dword [rcx + 0x1c]
cmp dword [rbx + 0x1c], eax
jae 0x140002426
cmp qword [rbp - 0x50], r13
je 0x1400024da
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r12
mov ecx, 0x20
call fcn.140003330
mov r8, rax
mov eax, dword [rbx + 0x1c]
mov dword [r8 + 0x1c], eax
mov qword [r8], rsi
mov qword [r8 + 8], rsi
mov qword [r8 + 0x10], rsi
mov word [r8 + 0x18], 0
mov qword [rsp + 0x28], r12
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x58]
call fcn.140002c20
mov rsi, qword [rbp - 0x58]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140002458
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002453
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140002453
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140002440
mov rbx, rax
jmp 0x14000247f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000247f
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140002470
cmp byte [rbx + 0x19], 0
je 0x1400022e0
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x1400024cb
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.140002bd0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14000336c
cmp byte [rbx + 0x19], 0
je 0x1400024a0
mov rcx, qword [rbp - 0x48]
mov edx, 0x20
call fcn.14000336c
jmp 0x140002032
call fcn.1400011c0
int3