Function at 0x1400112f3
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
jmp 0x140017520
push rbp
push rdi
sub rsp, 0x238
lea rbp, [rsp + 0x30]
lea rcx, [0x14002b0f6]
call fcn.140011442
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov r9d, 0x34
lea r8, str.MALWARE_WARNING___
lea rdx, str.Run_GDI_only_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x14001757a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9d, 0x34
lea r8, str.THIS_IS_YOUR_LAST_WARNING___
lea rdx, str.__________LAST_WARNING___________r_nNOT_FOR_EPILEPSY
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x1400175a8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001126c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001105f]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x28], rax
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400113a2]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x48], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400112ee]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x68], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14001134d]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x88], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400110e1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xa8], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011078]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xc8], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400110c8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0xe8], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011087]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x108], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140011401]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x128], rax
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140017946
xor eax, eax
lea rsp, [rbp + 0x208]
pop rdi
pop rbp
ret