Function at 0x140002ef0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate pe sections
Enumerate processes
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1110]
mov eax, 0x1210
call fcn.140008ef0
sub rsp, rax
lea rcx, str.taskkill__F__IM__GameCenter.exe
call fcn.140012cd0
lea rcx, str.taskkill__F__IM_Game.exe
call fcn.140012cd0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14003c4ec]
call fcn.140012cd0
call fcn.1400029c0
movzx edi, al
lea r15, vtable.cLicenseEx.0
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x48]
mov qword [rbp + 0x1150], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
lea rax, vtable.cSerialEx.0
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
call fcn.1400023e0
mov dword [rbp - 0x80], eax
mov qword [rbp - 0x70], 0
mov dword [rbp - 0x68], eax
lea rax, vtable.cGenerator.0
mov qword [rsp + 0x40], rax
xor ebx, ebx
lea rsi, str.zima
lea r14, str.3030323534363330
nop dword [rax]
mov rax, qword [rbx + rsi]
mov qword [rbp - 0x78], rax
lea rcx, [rsp + 0x40]
call fcn.1400024c0
mov rdx, qword [rbp - 0x70]
test rdx, rdx
je 0x140002ffd
mov rcx, qword [rbx + r14]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140002fe6
call fcn.14002f980
test eax, eax
je 0x14000310e
add rbx, 0x10
cmp rbx, 0x140
jb 0x140002fc0
lea rdx, str._____License_no_Active_______n
lea rax, vtable.cKeyEx.0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
call fcn.140005120
test dil, dil
je 0x14000367c
lea rdx, str.____DataTimes:_OK_n
call fcn.140005120
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14003c4ec]
call fcn.140012cd0
lea rdx, str.Russian
xor ecx, ecx
call fcn.140012c84
lea rdx, str._n____
call fcn.140005120
mov rcx, rax
call fcn.140005400
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [0x140042e20]
mov qword [0x14004d820], rax
lea rdx, str._n_n__________________________________________
call fcn.140005120
mov rcx, rax
call fcn.140005400
mov ecx, 0x18
call fcn.140008898
mov rsi, rax
mov qword [rbp + 0x1150], rax
xor r15d, r15d
mov qword [rax], r15
mov dword [rax + 8], r15d
lea rax, str.sihost.exe
mov qword [rsi + 0x10], rax
nop dword [rax + rax]
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400030de
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], r15
mov dword [rsi + 8], r15d
mov rdi, qword [rsi + 0x10]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000311a
mov dword [rsi + 8], r15d
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400030d0
lea rdx, str.____IsLicenses:_OK_n
jmp 0x140003011
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp - 0x1c]
call fcn.14002f5d0
mov dword [rbp - 0x20], 0x130
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140003160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsi + 8], r15d
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400030d0
lea rax, [rbp + 0xc]
mov r8, rdi
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003183
inc rax
test ecx, ecx
jne 0x140003170
test edx, edx
je 0x140003198
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp - 0x18]
mov dword [rsi + 8], r8d
test r8d, r8d
je 0x1400031c3
xor edx, edx
mov ecx, 0x438
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsi], rax
test rax, rax
jne 0x1400031d3
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400030d0
mov r12, qword [0x14004d820]
cmp dword [rsi + 8], r15d
je 0x140003637
movzx eax, word [r12]
mov ecx, 0x5a4d
cmp ax, cx
jne 0x140003674
mov edx, eax
lea rcx, str.____Mz:__x_n
call fcn.140001310
movsxd r14, dword [r12 + 0x3c]
add r14, r12
mov eax, 0x8664
cmp word [r14 + 4], ax
jne 0x140003674
mov r8d, dword [r14 + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r13, rax
test rax, rax
je 0x140003674
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp - 0x60], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rax
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
mov r8, r12
mov rdx, rax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003674
movzx ebx, word [r14 + 0x14]
add rbx, 0x28
mov edi, r15d
cmp word [r14 + 6], di
je 0x1400032e3
add rbx, r14
mov eax, dword [rbx]
test eax, eax
je 0x1400032d4
mov r9d, eax
mov r8d, dword [rbx + 4]
add r8, r12
mov edx, dword [rbx - 4]
add rdx, r13
mov qword [rsp + 0x20], r15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003674
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jne 0x1400032a8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
lea r8d, [rdx + 0x38]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov qword [rbp + 0x1158], rax
test rax, rax
je 0x140003674
mov qword [rsp + 0x20], r15
mov r9d, 0x38
lea r8, [rbp - 0x60]
mov rdx, rax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003674
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x1000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
mov qword [rbp + 0x1160], rax
test rax, rax
je 0x140003674
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
lea r8, [0x140001370]
mov rdx, rax
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140003674
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rbx
mov r9, rdi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140003674
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, rdi
lea rcx, str.____Thread_created_at:__p__waiting_for_return..._n
call fcn.1400012b0
nop
mov dword [rbp + 0x1150], r15d
lea rdx, [rbp + 0x1150]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x1150], 0x103
jne 0x14000366c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], r15
lea r9d, [rax + 0x38]
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x58]
cmp rbx, 0x404040
je 0x14000366c
cmp rbx, 0x606060
je 0x14000366c
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
mov rbx, qword [rbp + 0x1158]
je 0x1400033d0
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x110]
call fcn.14002f5d0
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
lea r8, [rbp + 0x110]
mov rdx, r13
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400034a6
lea rcx, str.WARNING_:_Cant_clear_HEADER_n
call fcn.1400012b0
mov ecx, 0x100000
call fcn.1400129a0
mov r15, rax
test rax, rax
je 0x140003674
xor edx, edx
mov r8d, 0x100000
mov rcx, rax
call fcn.14002f5d0
movzx ebx, word [r14 + 0x14]
add rbx, 0x18
add rbx, r14
xor edi, edi
cmp word [r14 + 6], di
je 0x1400035d6
lea rdx, [0x14003c160]
lea r8, str..rsrc
lea r9, str..reloc
nop word [rax + rax]
cmp dword [rbx + 0x10], 0
je 0x1400035c3
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x140003525
cmp rcx, 7
jne 0x140003510
jmp 0x140003564
xor ecx, ecx
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140003546
cmp rcx, 6
jne 0x140003530
jmp 0x140003564
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
cmp al, byte [r9 + rcx - 1]
jne 0x1400035c3
cmp rcx, 7
jne 0x140003550
mov rdx, rbx
lea rcx, str.____Processing__s_removal_n
call fcn.1400012b0
mov r9d, dword [rbx + 0x10]
mov edx, dword [rbx + 0xc]
add rdx, r13
mov qword [rsp + 0x20], 0
mov r8, r15
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x1400035ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rbx
lea rcx, str._n____Clear_section__s:_0x_x_n
call fcn.1400012b0
lea r9, str..reloc
lea r8, str..rsrc
lea rdx, [0x14003c160]
inc edi
add rbx, 0x28
movzx eax, word [r14 + 6]
cmp edi, eax
jne 0x140003500
mov r9d, 0x40
lea r8, [0x14003c1b8]
lea rdx, [0x14003c1d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, r12
call fcn.140008890
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1160]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x1158]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x18
mov rcx, rsi
call fcn.140008890
mov ecx, 0x9c40
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov rbx, qword [rsp + 0x1268]
add rsp, 0x1210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call fcn.14000f4b8
int3
xor ecx, ecx
call fcn.14000f4b8
int3
lea rdx, str._____The_software_has_run_out_of_time______n
call fcn.140005120
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.14000f4b8
int3