Function at 0x140001540
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1380]
mov eax, 0x1480
call fcn.140003d10
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1370], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, str.Telegraph2
mov qword [rbp - 0x80], rax
lea rax, str.VPNterri2
mov qword [rbp - 0x78], rax
lea rax, str.NvidiaUpscaleImageAI2
mov qword [rbp - 0x70], rax
lea rax, str.Joni2
mov qword [rbp - 0x68], rax
lea rax, str.Amega2
mov qword [rbp - 0x60], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1364], 0xffffffff
mov dword [rbp - 0x1c], eax
mov edx, 1
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x1c], eax
inc rdx
cmp rdx, 0x270
jb 0x1400015e0
mov dword [rbp - 0x20], 0x270
lea rcx, [rbp - 0x20]
call fcn.140002b70
mov ecx, eax
lea rcx, [rcx + rcx*4]
test ecx, ecx
jne 0x140001634
nop dword [rax]
lea rcx, [rbp - 0x20]
call fcn.140002b70
mov ecx, eax
lea rcx, [rcx + rcx*4]
cmp ecx, 1
jb 0x140001620
shr rcx, 0x20
mov eax, 0x80000000
sub rcx, rax
xor rcx, 0xffffffff80000000
mov rcx, qword [rbp + rcx*8 - 0x80]
call fcn.140001280
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
xor r12d, r12d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 4
mov dword [rsp + 0x58], 0xc4
mov dword [rsp + 0x5c], 0x178
mov dword [rsp + 0x60], 0x244
mov dword [rsp + 0x64], 0x338
mov dword [rsp + 0x68], 0x3b4
mov dword [rsp + 0x6c], 0x3b8
mov dword [rsp + 0x70], 0x1784
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], r12
mov ecx, 0x20
call fcn.140002d40
mov rsi, rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x38], rax
lea rdi, [rsp + 0x50]
movabs r13, 0x7ffffffffffffff
nop dword [rax]
mov r9, rdi
mov r8, rsi
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x38]
call fcn.1400028b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x40], xmm0
cmp byte [rsp + 0x40], 0
jne 0x140001768
cmp qword [rbp - 0x30], r13
je 0x140001858
mov rbx, qword [rbp - 0x38]
lea rax, [rbp - 0x38]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r12
mov ecx, 0x20
call fcn.140002d40
mov r8, rax
mov eax, dword [rdi]
mov dword [r8 + 0x1c], eax
mov qword [r8], rbx
mov qword [r8 + 8], rbx
mov qword [r8 + 0x10], rbx
mov word [r8 + 0x18], 0
mov qword [rbp - 0x40], r12
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x38]
call fcn.140002630
add rdi, 4
lea rax, [rsp + 0x74]
cmp rdi, rax
jne 0x1400016e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
lea rcx, [rbp - 0x58]
call fcn.1400012e0
nop
mov r14, qword [rbp - 0x38]
mov rbx, qword [r14]
mov r15, qword [rbp - 0x58]
cmp rbx, r14
je 0x140001888
nop
lea r9, [rbx + 0x1c]
mov r8, r15
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call fcn.1400028b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x40], xmm0
cmp byte [rsp + 0x40], 0
jne 0x14000182a
cmp qword [rbp - 0x50], r13
je 0x1400018f9
mov rdi, qword [rbp - 0x58]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], r12
mov ecx, 0x20
call fcn.140002d40
mov r8, rax
mov eax, dword [rbx + 0x1c]
mov dword [r8 + 0x1c], eax
mov qword [r8], rdi
mov qword [r8 + 8], rdi
mov qword [r8 + 0x10], rdi
mov word [r8 + 0x18], 0
mov qword [rbp - 0x40], r12
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x58]
call fcn.140002630
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000185e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001853
nop
cmp rbx, qword [rax + 0x10]
jne 0x140001853
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140001840
mov rbx, rax
jmp 0x14000187f
call fcn.140001180
nop
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000187f
nop word [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140001870
cmp rbx, r14
jne 0x1400017a0
movabs r15, 0x4e94914f0000
movabs r14, 0xb2f4fc0794908cf3
movabs rsi, 0x431bde82d7b634db
movabs rbx, 0x7fffffffffffffff
movabs rdi, 0x7ffffffffd9da5ff
lea rcx, [rsp + 0x78]
call fcn.1400011a0
mov rax, qword [rsp + 0x78]
cmp rax, rdi
lea rdi, [rax + 0x2625a00]
jl 0x1400018d8
mov rdi, rbx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400018ff
imul rax, rcx, 0x64
jmp 0x14000196e
call fcn.140001180
int3
cmp rbx, 0x16e3600
jne 0x140001953
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul r8, rdx, 0x3b9aca00
imul rax, rdx, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, r14
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rax, r8
jmp 0x14000196e
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x1400019bd
mov rcx, rdi
sub rcx, rax
cmp rcx, r15
jle 0x14000198f
mov edx, 0x5265c00
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400018d8
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400019b1
inc edx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400018d8
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
shr r14d, 0xf
and r14b, 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
lea rcx, [rbp - 0x48]
call fcn.1400012e0
nop
mov rsi, qword [rbp - 0x58]
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x140001b5c
mov r8d, dword [rdi + 0x1c]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140001a4b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x19], 0
je 0x140001b2d
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x140001a43
nop dword [rax]
cmp rdi, qword [rax + 0x10]
jne 0x140001a43
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140001a30
mov rdi, rax
jmp 0x140001b4f
mov r8, qword [rbp - 0x38]
mov rax, qword [r8 + 8]
mov rcx, r8
cmp byte [rax + 0x19], 0
jne 0x140001a77
mov edx, dword [rdi + 0x1c]
nop
cmp dword [rax + 0x1c], edx
jae 0x140001a6b
mov rax, qword [rax + 0x10]
jmp 0x140001a71
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001a60
cmp byte [rcx + 0x19], 0
jne 0x140001a85
mov eax, dword [rcx + 0x1c]
cmp dword [rdi + 0x1c], eax
jae 0x140001a88
mov rcx, r8
cmp rcx, r8
jne 0x140001a14
lea rdx, str.Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400023c0
mov rcx, rax
mov edx, dword [rdi + 0x1c]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._has_ended__removing_from_whitelist.
call fcn.1400023c0
mov rcx, rax
lea rdx, [0x1400025a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, rdi
mov rbx, qword [rdi + 0x10]
cmp byte [rbx + 0x19], 0
je 0x140001af7
mov rbx, qword [rdi + 8]
cmp byte [rbx + 0x19], 0
jne 0x140001b0f
cmp rax, qword [rbx + 0x10]
jne 0x140001b0f
mov rax, rbx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
je 0x140001ae2
jmp 0x140001b0f
mov rcx, qword [rbx]
cmp byte [rcx + 0x19], 0
jne 0x140001b0f
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140001b00
mov rdx, rdi
lea rcx, [rbp - 0x58]
call fcn.140001ec0
mov edx, 0x20
mov rcx, rax
call fcn.140002d7c
mov rdi, rbx
jmp 0x140001b4f
mov rdi, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140001b4f
nop dword [rax]
mov rdi, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140001b40
mov rsi, qword [rbp - 0x58]
cmp rdi, rsi
jne 0x1400019f5
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rcx]
cmp byte [rbx + 0x19], 0
jne 0x140001dfd
nop dword [rax]
mov rax, qword [rsi + 8]
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x140001b97
mov edx, dword [rbx + 0x1c]
cmp dword [rax + 0x1c], edx
jae 0x140001b8b
mov rax, qword [rax + 0x10]
jmp 0x140001b91
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001b80
cmp byte [rcx + 0x19], 0
jne 0x140001ba5
mov eax, dword [rcx + 0x1c]
cmp dword [rbx + 0x1c], eax
jae 0x140001ba8
mov rcx, rsi
cmp rcx, rsi
jne 0x140001d96
mov edi, dword [rbx + 0x1c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test r14b, r14b
je 0x140001cb2
lea rdx, str.Threat_detected:_PID
call fcn.1400023c0
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str.__terminating...
call fcn.1400023c0
mov rcx, rax
lea rdx, [0x1400025a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edi, dword [rbx + 0x1c]
mov r8d, edi
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140001c57
lea rdx, str.Failed_to_open_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400023c0
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._for_termination.
call fcn.1400023c0
mov rcx, rax
lea rdx, [0x1400025a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140001d92
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x140001c76
lea rdx, str.Failed_to_terminate_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
jmp 0x140001c84
lea rdx, str.Terminated_process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400023c0
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400025a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001d92
lea rdx, str.New_process_detected__adding_to_whitelist:_PID
call fcn.1400023c0
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x1400025a0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rsi, qword [rbp - 0x58]
mov rax, qword [rsi + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r12d
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x140001d29
mov edx, dword [rbx + 0x1c]
nop word [rax + rax]
mov qword [rsp + 0x30], rax
cmp dword [rax + 0x1c], edx
jae 0x140001d15
mov dword [rsp + 0x38], r12d
mov rax, qword [rax + 0x10]
jmp 0x140001d23
mov dword [rsp + 0x38], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140001d00
cmp byte [rcx + 0x19], 0
jne 0x140001d37
mov eax, dword [rcx + 0x1c]
cmp dword [rbx + 0x1c], eax
jae 0x140001d96
cmp qword [rbp - 0x50], r13
je 0x140001e4a
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r12
mov ecx, 0x20
call fcn.140002d40
mov r8, rax
mov eax, dword [rbx + 0x1c]
mov dword [r8 + 0x1c], eax
mov qword [r8], rsi
mov qword [r8 + 8], rsi
mov qword [r8 + 0x10], rsi
mov word [r8 + 0x18], 0
mov qword [rsp + 0x28], r12
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x58]
call fcn.140002630
mov rsi, qword [rbp - 0x58]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x140001dc8
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140001dc3
nop word [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140001dc3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140001db0
mov rbx, rax
jmp 0x140001def
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x140001def
nop dword [rax]
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140001de0
cmp byte [rbx + 0x19], 0
je 0x140001b70
mov rcx, qword [rbp - 0x48]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x140001e3b
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x48]
call fcn.1400025e0
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140002d7c
cmp byte [rbx + 0x19], 0
je 0x140001e10
mov rcx, qword [rbp - 0x48]
mov edx, 0x20
call fcn.140002d7c
jmp 0x140001892
call fcn.140001180
int3