Function at 0x1400115a0
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
jmp 0x14001a5c0
push rbp
push rsi
push rdi
sub rsp, 0x7a0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x148
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002b040]
xor rax, rbp
mov qword [rbp + 0x758], rax
lea rcx, [0x1400320f6]
call fcn.140011843
nop
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
lea rax, [rbp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x32
rep stosb byte [rdi], al
lea rcx, str.enter_password:
call qword [sym.imp.ucrtbased.dll_puts]
nop
mov r8d, 0x32
lea rdx, [rbp + 0x48]
lea rcx, [0x140025f44]
call fcn.1400114d3
nop
lea rax, [rbp + 0x98]
lea rcx, str.hint:_sha256_hashing
mov rdi, rax
mov rsi, rcx
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov r8d, 0x15
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0xc8]
call fcn.1400113ed
nop
lea r8, [rbp + 8]
mov edx, 0x32
lea rcx, [rbp + 0x48]
call fcn.14001113b
nop
lea rax, [rbp + 0xf8]
lea rcx, [0x140026418]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x21
rep movsb byte [rdi], byte [rsi]
mov byte [rbp + 0x134], 1
mov qword [rbp + 0x158], 0
jmp 0x14001a6cc
mov rax, qword [rbp + 0x158]
inc rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x158], 0x20
jae 0x14001a700
mov rax, qword [rbp + 0x158]
movzx eax, byte [rbp + rax + 0xf8]
mov rcx, qword [rbp + 0x158]
movzx ecx, byte [rbp + rcx + 8]
cmp eax, ecx
je 0x14001a6fe
mov byte [rbp + 0x134], 0
jmp 0x14001a700
jmp 0x14001a6bb
movzx eax, byte [rbp + 0x134]
test eax, eax
je 0x14001a964
lea rax, [rbp + 0x178]
lea rcx, str.aniharabublil___
mov rdi, rax
mov rsi, rcx
mov ecx, 0x11
rep movsb byte [rdi], byte [rsi]
mov byte [rbp + 0x1a8], pe_nt_image_headers64
mov byte [rbp + 0x1a9], 0x7a
mov byte [rbp + 0x1aa], 0x7a
mov byte [rbp + 0x1ab], 0x3a
mov byte [rbp + 0x1ac], 0x21
mov byte [rbp + 0x1ad], 0x33
mov byte [rbp + 0x1ae], 0x4a
mov byte [rbp + 0x1af], 0x79
mov byte [rbp + 0x1b0], 0x6c
mov byte [rbp + 0x1b1], 0x4c
mov byte [rbp + 0x1b2], 0x3c
mov byte [rbp + 0x1b3], 0x72
mov byte [rbp + 0x1b4], 0x34
mov byte [rbp + 0x1b5], 0xc0
mov byte [rbp + 0x1b6], 0x33
mov byte [rbp + 0x1b7], 0xb5
mov edx, 0x110
lea rcx, [rbp + 0x1e0]
call fcn.1400115af
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x24
lea rdx, str.executable1.exe
lea rcx, [rbp + 0x1e0]
call fcn.1400117a3
nop
lea rdx, [rbp + 0x738]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rcx, rax
call fcn.14001187a
mov dword [rbp + 0x304], eax
movsxd rax, dword [rbp + 0x304]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x328], rax
movsxd rax, dword [rbp + 0x304]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0x348], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
nop
movsxd rax, dword [rbp + 0x304]
mov r8, rax
mov rdx, qword [rbp + 0x328]
lea rcx, [rbp + 0x1e0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
nop
lea rcx, [rbp + 0x1e0]
call fcn.140011497
nop
lea rax, [rbp + 0x368]
lea rcx, str.hint:_aes256
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd
rep movsb byte [rdi], byte [rsi]
mov r8d, 0xd
lea rdx, [rbp + 0x368]
lea rcx, [rbp + 0x398]
call fcn.1400113ed
nop
mov byte [rsp + 0x30], 1
mov eax, dword [rbp + 0x304]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x348]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x304]
mov r8, qword [rbp + 0x328]
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x178]
call fcn.140011627
nop
mov edx, 0x108
lea rcx, [rbp + 0x3d0]
call fcn.140011325
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 0x20
lea rdx, str.i_would_try_the_other_way.png
lea rcx, [rbp + 0x3d0]
call fcn.14001130c
nop
movsxd rax, dword [rbp + 0x304]
mov r8, rax
mov rdx, qword [rbp + 0x348]
lea rcx, [rbp + 0x3d0]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
nop
mov rcx, qword [rbp + 0x328]
call qword [sym.imp.ucrtbased.dll_free]
nop
mov rcx, qword [rbp + 0x348]
call qword [sym.imp.ucrtbased.dll_free]
nop
lea rcx, [rbp + 0x3d0]
call fcn.1400111fe
nop
lea rcx, [rbp + 0x1e0]
call fcn.14001114a
nop
jmp 0x14001a972
lea rcx, str.start_chrome_https:__www.youtube.com_watch_vec3H7FYrYbo
call qword [sym.imp.ucrtbased.dll_system]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x40]
lea rdx, [0x140025500]
call fcn.1400116e5
mov eax, edi
mov rcx, qword [rbp + 0x758]
xor rcx, rbp
call fcn.1400113e8
lea rsp, [rbp + 0x760]
pop rdi
pop rsi
pop rbp
ret