Function at 0x140001ba0
Capabilities:
Create thread
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0x1460
call fcn.140002e00
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1450], rax
xor r13d, r13d
mov qword [0x1400056f8], rcx
lea rax, [0x1400018a0]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x60]
lea rax, str.WindowClass
mov qword [rsp + 0x70], r13
xorps xmm0, xmm0
mov qword [rsp + 0xa0], rax
movdqa xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0x60], 0x50
mov dword [rsp + 0x64], 3
mov qword [rsp + 0x90], 6
call qword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x140001c87
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Cannot_register_class__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rsp + 0x1450]
xor rcx, rsp
call fcn.140001fc0
mov rbp, qword [rsp + 0x14a8]
add rsp, 0x1460
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x1498], rbx
xor ecx, ecx
mov qword [rsp + 0x14a0], r14
call qword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [0x140005078]
mov ecx, 1
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r8d, dword [0x140005074]
xor r9d, r9d
mov rcx, qword [0x1400056f8]
sub eax, r8d
mov qword [rsp + 0x58], r13
cdq
mov qword [rsp + 0x50], rcx
sub eax, edx
mov ecx, dword [0x140005078]
mov rdx, qword [rsp + 0xa0]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r8d
lea r8, str.AMOGUS_VIRUS
mov dword [rsp + 0x30], ecx
mov ecx, 0x200000
sar eax, 1
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov r14, rax
test rax, rax
jne 0x140001d46
mov r14, qword [rsp + 0x14a0]
lea r8, str.Error
mov rbx, qword [rsp + 0x1498]
lea rdx, str.Cannot_create_window__
mov r9d, 0x10
jmp 0x140001c57
xor r8d, r8d
mov edx, 0xfffffff0
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, r14
call qword [sym.imp.USER32.dll_UpdateWindow]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140001e1e
lea r9, [0x1400056b0]
mov dword [rsp + 0xb0], 3
lea r8, [rsp + 0xb0]
xor ecx, ecx
lea rdx, [0x140003418]
call qword [sym.imp.d2d1.dll_Ordinal_1]
call fcn.140001250
call fcn.1400013b0
call fcn.1400014a0
mov ebx, eax
call fcn.140001030
mov rcx, qword [0x140005698]
lea rdx, [rsp + 0xb0]
mov r8, qword [rcx]
call qword [r8 + 0x28]
lea rdx, [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [0x140005078], ecx
mov rcx, qword [0x140005698]
mov r8, qword [rcx]
call qword [r8 + 0x28]
mov edx, dword [0x140005078]
mov rcx, r14
mov r8d, dword [rax + 4]
mov dword [0x140005074], r8d
call fcn.1400017d0
test ebx, ebx
js 0x140001e1e
mov rcx, r14
call fcn.1400015d0
mov rcx, r14
call fcn.1400016f0
lea rax, [rsp + 0xb8]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, section..text
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, 1
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
inc rdx
cmp rdx, 0x270
jb 0x140001e50
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
lea r12d, [rax - 0x12c]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea r15d, [rax - 0x12c]
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
xor edx, edx
div r12d
mov ebp, edx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
xor edx, edx
div r15d
mov esi, edx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edi, eax
and dil, 1
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ebx, eax
and bl, 1
nop dword [rax]
mov dword [rsp + 0x30], r13d
mov r9d, esi
mov dword [rsp + 0x28], 0x190
mov r8d, ebp
xor edx, edx
mov dword [rsp + 0x20], 0x12c
mov rcx, r14
call qword [sym.imp.USER32.dll_SetWindowPos]
test dil, dil
mov ecx, 0xfffffff6
mov eax, 0xa
cmove eax, ecx
add ebp, eax
mov eax, 0xa
test bl, bl
cmove eax, ecx
add eax, esi
mov esi, eax
test ebp, ebp
jns 0x140001f0f
mov dil, 1
jmp 0x140001f1a
cmp ebp, r12d
movzx edi, dil
cmovg edi, r13d
test eax, eax
jns 0x140001f22
mov bl, 1
jmp 0x140001f2c
cmp eax, r15d
movzx ebx, bl
cmovg ebx, r13d
mov rcx, qword [0x140005700]
test rcx, rcx
je 0x140001f91
cmp qword [0x1400056a8], r13
je 0x140001f91
mov rax, qword [rcx]
call qword [rax + 0x180]
mov rcx, qword [0x140005700]
lea rdx, [rsp + 0xb0]
mov rax, qword [rcx]
call qword [rax + 0x1a8]
call fcn.140001170
mov rcx, qword [0x140005700]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x188]
mov rcx, qword [0x1400056a8]
xor r8d, r8d
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001ec0