Function at 0x140001c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x1400054f0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x657865
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001ce9
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ce4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ce4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x1400054e0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x657865
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001d5e
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d59
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x1400055e0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x6578652e
mov byte [rbp - 0x3c], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001dd6
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001dd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001dd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x140005630]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x652e7765
mov word [rbp - 0x3c], 0x6578
mov byte [rbp - 0x3a], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001e54
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x140005620]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x6578
mov byte [rbp - 0x3e], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001ecb
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ec6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ec6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x6f727038
mov dword [rbp - 0x4c], 0x6e6f6d63
mov dword [rbp - 0x48], 0x6578652e
mov byte [rbp - 0x44], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001f44
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x61646917
mov dword [rbp - 0x4c], 0x78652e71
mov word [rbp - 0x48], 0x65
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140001fb9
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x61646962
mov dword [rbp - 0x4c], 0x2e343671
mov dword [rbp - 0x48], 0x657865
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000202f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000202a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000202a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x72695758
mov dword [rbp - 0x4c], 0x61687365
mov dword [rbp - 0x48], 0x652e6b72
mov word [rbp - 0x44], 0x6578
mov byte [rbp - 0x42], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400020ae
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400020a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400020a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x64694652
mov dword [rbp - 0x4c], 0x72656c64
mov dword [rbp - 0x48], 0x6578652e
mov byte [rbp - 0x44], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002127
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002122
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002122
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x6e655871
mov dword [rbp - 0x4c], 0x3436736f
mov dword [rbp - 0x48], 0x6578652e
mov byte [rbp - 0x44], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400021a0
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000219b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000219b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x140005690]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x65
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002214
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000220f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000220f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x1400055b0]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [str.indows_Service__]
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x62203233
mov dword [rbp - 0x2c], 0x2e297469
mov dword [rbp - 0x28], 0x657865
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400022a4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000229f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000229f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x44734b4f
mov dword [rbp - 0x4c], 0x65706d75
mov dword [rbp - 0x48], 0x78652e72
mov word [rbp - 0x44], 0x65
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002320
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000231b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000231b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x34367801
mov dword [rbp - 0x4c], 0x2e676264
mov dword [rbp - 0x48], 0x657865
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002396
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002391
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
mov dword [rbp - 0x50], 0x3233783e
mov dword [rbp - 0x4c], 0x2e676264
mov dword [rbp - 0x48], 0x657865
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000240c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002407
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002407
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x140005600]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x6578652e
mov byte [rbp - 0x3c], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002484
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000247f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000247f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x1400055f0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x6578652e
mov byte [rbp - 0x3c], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400024fc
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400024f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400024f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
jne 0x140002574
movdqa xmm0, xmmword [0x140005610]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x6578
mov byte [rbp - 0x3e], bl
lea rdx, [rbp - 0x4f]
lea rcx, [rbp - 0x20]
call fcn.140003770
nop
lea rcx, [rbp - 0x20]
call fcn.140001300
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000256f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000256a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000256a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003d04
test rbx, rbx
je 0x140002579
call fcn.140001940
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret