Function at 0x1400577a0
Capabilities:
Acquire debug privileges
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r15
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1400faad8]
xor rax, rsp
mov qword [rbp + 0xa0], rax
xor r15d, r15d
xor ecx, ecx
mov dword [rbp - 0x30], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp - 0x30]
mov edx, 0x1000
mov rcx, rax
lea r8d, [r15 + 4]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x1000
lea rcx, [0x1400fc180]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.SeSecurityPrivilege
call fcn.140056760
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.SeDebugPrivilege
call fcn.140056760
xor ecx, ecx
mov dword [rbp - 0x30], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9, [rbp - 0x30]
mov edx, 0x1000
mov rcx, rax
lea r8d, [r15 + 4]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, 0x1000
lea rdx, [0x1400fc180]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [0x140056a20]
mov dword [rbp - 0x80], 0x50
xor ecx, ecx
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x7c], 0x40
mov qword [rbp - 0x70], r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x80]
mov rax, qword [str.Arien]
xorps xmm1, xmm1
mov qword [rbp - 0x40], rax
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmmword [rbp - 0x50], xmm1
call qword [sym.imp.USER32.dll_RegisterClassExA]
mov rax, qword [rbp - 0x68]
mov r9d, 0x80000000
mov r8, qword [str.Arien]
xor ecx, ecx
mov rdx, qword [rbp - 0x40]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
lea ecx, [r15 + 0x20]
mov qword [0x140104180], rax
call sub.d3d9.dll_Direct3DCreate9
mov qword [0x1401041d0], rax
mov rcx, rax
test rax, rax
je 0x140057e58
lea rdx, [0x140104188]
mov qword [0x140104190], r15
mov qword [rsp + 0x30], rdx
lea r12, [0x140104190]
mov qword [0x14010419c], r15
lea r8d, [r15 + 1]
mov dword [0x1401041a4], r15d
mov r9, rbx
mov qword [0x1401041ac], r15
xor edx, edx
mov dword [0x1401041b4], r15d
mov qword [0x1401041c4], r15
mov dword [0x1401041b8], 1
mov dword [0x1401041a8], 1
mov dword [0x140104198], r15d
mov dword [0x1401041bc], 1
mov dword [0x1401041c0], 0x50
mov dword [0x1401041cc], 1
mov rax, qword [rax]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x40
call qword [rax + 0x80]
test eax, eax
js 0x140057e51
mov rcx, qword [0x140104180]
xor edx, edx
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rdi
mov qword [rsp + 0x200], r14
movaps xmmword [rsp + 0x1c0], xmm6
movaps xmmword [rsp + 0x1b0], xmm7
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x140104180]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call fcn.14000b920
call fcn.140019360
mov r14, rax
or dword [rax], 0x400
mov qword [rax + 0x18], r15
call fcn.140019a10
test dword [r14], 0x400
je 0x140057a80
mov dword [rax + 0xc], r15d
mov dword [rax + 0xf0], 0x3f800000
mov rcx, qword [0x140104180]
call fcn.140042550
mov rcx, qword [0x140104188]
call fcn.140040e40
movss xmm2, dword [0x1400788b4]
lea rdx, str.C:WindowsFontsVerdana.ttf
mov rcx, qword [r14 + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x20], r15
call fcn.14002e420
lea rcx, [rbp + 0x10]
call fcn.14002d360
movss xmm3, dword [0x14007896c]
lea rax, [rbp + 0x10]
mov byte [rbp + 0x58], 1
lea rbx, [0x1400e7530]
mov byte [rbp + 0x30], 1
lea rdx, [0x140080a60]
mov rcx, qword [r14 + 0xa0]
mov r8d, 0x3934b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.14002e760
movss xmm3, dword [0x1400e7580]
lea rdx, [0x140080a60]
mov rcx, qword [r14 + 0xa0]
mov r8d, 0x3934b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
call fcn.14002e760
mov rbx, qword [r14 + 0xa0]
mov rcx, rbx
call fcn.1400315a0
movss xmm3, dword [0x140078970]
lea rdx, [0x1400b9db0]
mov qword [rsp + 0x28], rax
mov r8d, 0x2ce4b
mov rcx, rbx
mov qword [rsp + 0x20], r15
call fcn.14002e760
movss xmm7, dword [0x140078864]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm6, xmm6
nop dword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x28]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140057bb7
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x140057d92
cmp byte [0x1401041f0], 1
je 0x140057ea2
cmp byte [0x1401041f1], 2
je 0x140057ea2
cmp byte [0x1401041f2], 3
je 0x140057ea2
mov rdi, qword [0x1401041d8]
mov rsi, qword [0x1401041e0]
cmp rdi, rsi
je 0x140057c12
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, rbx
cmp rax, 0x7530
ja 0x140057edf
add rdi, 8
cmp rdi, rsi
jne 0x140057bf1
call fcn.140041020
call fcn.140042910
call fcn.140020280
cmp dword [0x1401042dc], r15d
jne 0x140057c91
movss xmm0, dword [0x1400fa948]
ucomiss xmm0, xmm6
mov rax, qword [0x140104188]
mov qword [0x1401042d0], rax
jp 0x140057c85
jne 0x140057c85
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetWindowRect]
movd xmm0, dword [rsp + 0x68]
movd xmm1, dword [rsp + 0x6c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [0x1400fa940], xmm0
movss dword [0x1400fa944], xmm1
mov dword [0x1401042dc], 1
jmp 0x140057c96
call fcn.140056bb0
call fcn.140016160
mov rcx, qword [0x140104188]
mov r9d, 3
mov dword [rsp + 0x30], r15d
xor r8d, r8d
movss dword [rsp + 0x28], xmm7
xor edx, edx
mov dword [rsp + 0x20], r15d
mov rax, qword [rcx]
call qword [rax + 0x158]
mov rcx, qword [0x140104188]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x140057cfc
call fcn.1400222f0
call fcn.140018e20
mov rcx, rax
call fcn.140041120
mov rcx, qword [0x140104188]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [r14], 0x400
je 0x140057d13
call fcn.1400292e0
xor edx, edx
xor ecx, ecx
call fcn.140022f80
mov rcx, qword [0x140104188]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140057d89
mov rcx, qword [0x140104188]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp eax, 0x88760869
jne 0x140057d89
call fcn.140040ee0
mov rcx, qword [0x140104188]
mov rdx, r12
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, 0x8876086c
jne 0x140057d84
mov r8d, 0x34
lea rdx, str.C:UsersSmellonDownloadsSkidware_V2_loader_1_Skidware_V2_loaderMain.h
lea rcx, [0x140072078]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.1400409b0
cmp byte [0x1400fa430], r15b
je 0x140057d9e
cmp dword [rbp - 0x20], 0x12
jne 0x140057b80
jmp 0x140057da5
mov dword [rbp - 0x20], 0x12
call fcn.140041dc0
call fcn.140043070
xor ecx, ecx
call fcn.14000bdf0
mov rcx, qword [0x140104188]
test rcx, rcx
je 0x140057dcf
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x140104188], r15
mov rcx, qword [0x1401041d0]
test rcx, rcx
je 0x140057de8
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [0x1401041d0], r15
mov rcx, qword [0x140104180]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassA]
movaps xmm6, xmmword [rsp + 0x1c0]
xor eax, eax
mov r14, qword [rsp + 0x200]
mov rdi, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x1f0]
movaps xmm7, xmmword [rsp + 0x1b0]
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14006d620
mov rbx, qword [rsp + 0x208]
add rsp, 0x1d0
pop r15
pop r12
pop rbp
ret
mov rcx, qword [0x1401041d0]
mov rdx, qword [0x140104188]
test rdx, rdx
je 0x140057e7b
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x10]
mov rcx, qword [0x1401041d0]
mov qword [0x140104188], r15
test rcx, rcx
je 0x140057e8d
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov qword [0x1401041d0], r15
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov eax, 1
jmp 0x140057e2d
movdqa xmm0, xmmword [0x1400e75c0]
lea rcx, [rsp + 0x60]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x68742068
mov dword [rsp + 0x74], 0x72702065
mov dword [rsp + 0x78], 0x6172676f
mov word [rsp + 0x7c], 0x2e6d
mov byte [rsp + 0x7e], r15b
call fcn.140001e00
int3
xor ecx, ecx
call fcn.140001e00
int3