Function at 0x140011271
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
jmp 0x140011850
push rbp
push rdi
mov eax, 0x12e8
call fcn.1400110b4
sub rsp, rax
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x35a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1298], rax
lea rcx, [0x1400250f4]
call fcn.14001137f
mov byte [rbp + 4], 0x11
mov byte [rbp + 0x24], 0x12
mov dword [rbp + 0x44], 0x6987
mov eax, 0x6b
mov word [rbp + 0x68], ax
mov eax, 0x65
mov word [rbp + 0x6a], ax
mov eax, 0x72
mov word [rbp + 0x6c], ax
mov eax, 0x6e
mov word [rbp + 0x6e], ax
mov eax, 0x65
mov word [rbp + 0x70], ax
mov eax, 0x6c
mov word [rbp + 0x72], ax
mov eax, 0x33
mov word [rbp + 0x74], ax
mov eax, 0x32
mov word [rbp + 0x76], ax
mov eax, 0x2e
mov word [rbp + 0x78], ax
mov eax, 0x64
mov word [rbp + 0x7a], ax
mov eax, 0x6c
mov word [rbp + 0x7c], ax
mov eax, 0x6c
mov word [rbp + 0x7e], ax
xor eax, eax
mov word [rbp + 0x80], ax
mov byte [rbp + 0xa8], 0x4c
mov byte [rbp + 0xa9], 0x6f
mov byte [rbp + 0xaa], 0x61
mov byte [rbp + 0xab], 0x64
mov byte [rbp + 0xac], 0x4c
mov byte [rbp + 0xad], 0x69
mov byte [rbp + 0xae], 0x62
mov byte [rbp + 0xaf], 0x72
mov byte [rbp + 0xb0], 0x61
mov byte [rbp + 0xb1], 0x72
mov byte [rbp + 0xb2], 0x79
mov byte [rbp + 0xb3], 0x41
mov byte [rbp + 0xb4], 0
mov byte [rbp + 0xd8], 0x47
mov byte [rbp + 0xd9], 0x65
mov byte [rbp + 0xda], 0x74
mov byte [rbp + 0xdb], 0x50
mov byte [rbp + 0xdc], 0x72
mov byte [rbp + 0xdd], 0x6f
mov byte [rbp + 0xde], 0x63
mov byte [rbp + 0xdf], 0x41
mov byte [rbp + 0xe0], 0x64
mov byte [rbp + 0xe1], 0x64
mov byte [rbp + 0xe2], 0x72
mov byte [rbp + 0xe3], 0x65
mov byte [rbp + 0xe4], 0x73
mov byte [rbp + 0xe5], 0x73
mov byte [rbp + 0xe6], 0
mov byte [rbp + 0x108], 0x56
mov byte [rbp + 0x109], 0x69
mov byte [rbp + 0x10a], 0x72
mov byte [rbp + 0x10b], 0x74
mov byte [rbp + 0x10c], 0x75
mov byte [rbp + 0x10d], 0x61
mov byte [rbp + 0x10e], 0x6c
mov byte [rbp + 0x10f], 0x41
mov byte [rbp + 0x110], 0x6c
mov byte [rbp + 0x111], 0x6c
mov byte [rbp + 0x112], 0x6f
mov byte [rbp + 0x113], 0x63
mov byte [rbp + 0x114], 0x45
mov byte [rbp + 0x115], 0x78
mov byte [rbp + 0x116], 0
mov byte [rbp + 0x138], 0x4f
mov byte [rbp + 0x139], 0x70
mov byte [rbp + 0x13a], 0x65
mov byte [rbp + 0x13b], 0x6e
mov byte [rbp + 0x13c], 0x50
mov byte [rbp + 0x13d], 0x72
mov byte [rbp + 0x13e], 0x6f
mov byte [rbp + 0x13f], 0x63
mov byte [rbp + 0x140], 0x65
mov byte [rbp + 0x141], 0x73
mov byte [rbp + 0x142], 0x73
mov byte [rbp + 0x143], 0
mov byte [rbp + 0x168], 0x77
mov byte [rbp + 0x169], 0x73
mov byte [rbp + 0x16a], 0x32
mov byte [rbp + 0x16b], 0x5f
mov byte [rbp + 0x16c], 0x33
mov byte [rbp + 0x16d], 0x32
mov byte [rbp + 0x16e], 0x2e
mov byte [rbp + 0x16f], 0x64
mov byte [rbp + 0x170], 0x6c
mov byte [rbp + 0x171], 0x6c
mov byte [rbp + 0x172], 0
mov byte [rbp + 0x198], 0x57
mov byte [rbp + 0x199], 0x53
mov byte [rbp + 0x19a], 0x41
mov byte [rbp + 0x19b], 0x53
mov byte [rbp + 0x19c], 0x74
mov byte [rbp + 0x19d], 0x61
mov byte [rbp + 0x19e], 0x72
mov byte [rbp + 0x19f], 0x74
mov byte [rbp + 0x1a0], 0x75
mov byte [rbp + 0x1a1], 0x70
mov byte [rbp + 0x1a2], 0
mov byte [rbp + 0x1c8], 0x57
mov byte [rbp + 0x1c9], 0x53
mov byte [rbp + 0x1ca], 0x41
mov byte [rbp + 0x1cb], 0x43
mov byte [rbp + 0x1cc], 0x6c
mov byte [rbp + 0x1cd], 0x65
mov byte [rbp + 0x1ce], 0x61
mov byte [rbp + 0x1cf], 0x6e
mov byte [rbp + 0x1d0], 0x75
mov byte [rbp + 0x1d1], 0x70
mov byte [rbp + 0x1d2], 0
mov byte [rbp + 0x1f4], 0x73
mov byte [rbp + 0x1f5], 0x6f
mov byte [rbp + 0x1f6], 0x63
mov byte [rbp + 0x1f7], 0x6b
mov byte [rbp + 0x1f8], 0x65
mov byte [rbp + 0x1f9], 0x74
mov byte [rbp + 0x1fa], 0
mov byte [rbp + 0x214], 0x68
mov byte [rbp + 0x215], 0x74
mov byte [rbp + 0x216], 0x6f
mov byte [rbp + 0x217], 0x6e
mov byte [rbp + 0x218], 0x73
mov byte [rbp + 0x219], 0
mov byte [rbp + 0x238], 0x69
mov byte [rbp + 0x239], 0x6e
mov byte [rbp + 0x23a], 0x65
mov byte [rbp + 0x23b], 0x74
mov byte [rbp + 0x23c], 0x5f
mov byte [rbp + 0x23d], 0x61
mov byte [rbp + 0x23e], 0x64
mov byte [rbp + 0x23f], 0x64
mov byte [rbp + 0x240], 0x72
mov byte [rbp + 0x241], 0
mov byte [rbp + 0x268], 0x63
mov byte [rbp + 0x269], 0x6f
mov byte [rbp + 0x26a], 0x6e
mov byte [rbp + 0x26b], 0x6e
mov byte [rbp + 0x26c], 0x65
mov byte [rbp + 0x26d], 0x63
mov byte [rbp + 0x26e], 0x74
mov byte [rbp + 0x26f], 0
mov byte [rbp + 0x288], 0x63
mov byte [rbp + 0x289], 0x6c
mov byte [rbp + 0x28a], 0x6f
mov byte [rbp + 0x28b], 0x73
mov byte [rbp + 0x28c], 0x65
mov byte [rbp + 0x28d], 0x73
mov byte [rbp + 0x28e], 0x6f
mov byte [rbp + 0x28f], 0x63
mov byte [rbp + 0x290], 0x6b
mov byte [rbp + 0x291], 0x65
mov byte [rbp + 0x292], 0x74
mov byte [rbp + 0x293], 0
mov byte [rbp + 0x2b4], 0x73
mov byte [rbp + 0x2b5], 0x65
mov byte [rbp + 0x2b6], 0x6e
mov byte [rbp + 0x2b7], 0x64
mov byte [rbp + 0x2b8], 0
mov byte [rbp + 0x2d4], 0x72
mov byte [rbp + 0x2d5], 0x65
mov byte [rbp + 0x2d6], 0x63
mov byte [rbp + 0x2d7], 0x76
mov byte [rbp + 0x2d8], 0
mov byte [rbp + 0x2f8], 0x31
mov byte [rbp + 0x2f9], 0x32
mov byte [rbp + 0x2fa], 0x37
mov byte [rbp + 0x2fb], 0x2e
mov byte [rbp + 0x2fc], 0x30
mov byte [rbp + 0x2fd], 0x2e
mov byte [rbp + 0x2fe], 0x30
mov byte [rbp + 0x2ff], 0x2e
mov byte [rbp + 0x300], 0x31
mov byte [rbp + 0x301], 0
mov byte [rbp + 0x328], 0x57
mov byte [rbp + 0x329], 0x72
mov byte [rbp + 0x32a], 0x69
mov byte [rbp + 0x32b], 0x74
mov byte [rbp + 0x32c], 0x65
mov byte [rbp + 0x32d], 0x50
mov byte [rbp + 0x32e], 0x72
mov byte [rbp + 0x32f], 0x6f
mov byte [rbp + 0x330], 0x63
mov byte [rbp + 0x331], 0x65
mov byte [rbp + 0x332], 0x73
mov byte [rbp + 0x333], 0x73
mov byte [rbp + 0x334], 0x4d
mov byte [rbp + 0x335], 0x65
mov byte [rbp + 0x336], 0x6d
mov byte [rbp + 0x337], 0x6f
mov byte [rbp + 0x338], 0x72
mov byte [rbp + 0x339], 0x79
mov byte [rbp + 0x33a], 0
mov byte [rbp + 0x354], 0x12
mov byte [rbp + 0x355], 2
mov byte [rbp + 0x356], 0x14
mov byte [rbp + 0x357], 0
lea rcx, [rbp + 0x68]
call fcn.140011352
mov qword [rbp + 0x378], rax
cmp qword [rbp + 0x378], 0
jne 0x140011dfd
mov eax, 1
jmp 0x1400124ad
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x378]
call fcn.14001110e
mov qword [rbp + 0x398], rax
cmp qword [rbp + 0x398], 0
jne 0x140011e2b
mov eax, 2
jmp 0x1400124ad
lea rdx, [rbp + 0xd8]
mov rcx, qword [rbp + 0x378]
call fcn.14001110e
mov qword [rbp + 0x3b8], rax
cmp qword [rbp + 0x3b8], 0
jne 0x140011e59
mov eax, 3
jmp 0x1400124ad
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x3d8], rax
mov rax, qword [rbp + 0x3b8]
mov qword [rbp + 0x3f8], rax
lea rcx, [rbp + 0x168]
call qword [rbp + 0x3d8]
mov qword [rbp + 0x418], rax
lea rdx, [rbp + 0x198]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x438], rax
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0x458], rax
lea rdx, [rbp + 0x480]
mov cx, 0x202
call qword [rbp + 0x458]
test eax, eax
je 0x140011ed0
mov eax, 1
jmp 0x1400124ad
lea rdx, [rbp + 0x1f4]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x688], rax
mov rax, qword [rbp + 0x688]
mov qword [rbp + 0x6a8], rax
xor r8d, r8d
mov edx, 1
mov ecx, 2
call qword [rbp + 0x6a8]
mov qword [rbp + 0x638], rax
cmp qword [rbp + 0x638], 0xffffffffffffffff
jne 0x140011f26
mov eax, 1
jmp 0x1400124ad
lea rdx, [rbp + 0x214]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x6c8], rax
mov rax, qword [rbp + 0x6c8]
mov qword [rbp + 0x6e8], rax
lea rdx, [rbp + 0x238]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x708], rax
mov rax, qword [rbp + 0x708]
mov qword [rbp + 0x728], rax
lea rcx, [rbp + 0x2f8]
call qword [rbp + 0x728]
mov dword [rbp + 0x65c], eax
mov eax, 2
mov word [rbp + 0x658], ax
movzx ecx, word [rbp + 0x44]
call qword [rbp + 0x6e8]
mov word [rbp + 0x65a], ax
lea rdx, [rbp + 0x268]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x748], rax
mov rax, qword [rbp + 0x748]
mov qword [rbp + 0x768], rax
mov r8d, 0x10
lea rdx, [rbp + 0x658]
mov rcx, qword [rbp + 0x638]
call qword [rbp + 0x768]
test eax, eax
jge 0x140011ff6
mov eax, 1
jmp 0x1400124ad
lea rdx, [rbp + 0x2b4]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x788], rax
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x7a8], rax
lea rdx, [rbp + 0x288]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x7c8], rax
mov rax, qword [rbp + 0x7c8]
mov qword [rbp + 0x7e8], rax
lea rdx, [rbp + 0x1c8]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x808], rax
mov rax, qword [rbp + 0x808]
mov qword [rbp + 0x828], rax
lea rcx, [rbp + 0x354]
call fcn.14001117c
xor r9d, r9d
mov r8d, eax
lea rdx, [rbp + 0x354]
mov rcx, qword [rbp + 0x638]
call qword [rbp + 0x7a8]
mov dword [rbp + 0x844], eax
cmp dword [rbp + 0x844], 0xffffffff
jne 0x1400120c0
mov rcx, qword [rbp + 0x638]
call qword [rbp + 0x7e8]
call qword [rbp + 0x828]
mov eax, 1
jmp 0x1400124ad
lea rdx, [rbp + 0x2d4]
mov rcx, qword [rbp + 0x418]
call fcn.14001110e
mov qword [rbp + 0x868], rax
mov rax, qword [rbp + 0x868]
mov qword [rbp + 0x888], rax
mov dword [rbp + 0x8a4], 0x200
mov ecx, 0x10
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0xae8], rax
mov dword [rbp + 0xb04], 0
mov qword [rbp + 0xb28], 0
mov dword [rbp + 0xb44], 0
mov byte [rbp + 0xb64], 0
mov byte [rbp + 0xb84], 0
mov dword [rbp + 0xba4], 0
xor r9d, r9d
mov r8d, dword [rbp + 0x8a4]
lea rdx, [rbp + 0x8d0]
mov rcx, qword [rbp + 0x638]
call qword [rbp + 0x888]
mov dword [rbp + 0xbc4], eax
cmp dword [rbp + 0xbc4], 0
jle 0x1400122c2
cmp qword [rbp + 0xae8], 0
je 0x1400122c2
mov dword [rbp + 0xbe4], 0
jmp 0x140012194
mov eax, dword [rbp + 0xbe4]
inc eax
mov dword [rbp + 0xbe4], eax
mov eax, dword [rbp + 0xbc4]
cmp dword [rbp + 0xbe4], eax
jge 0x1400122c2
movzx eax, byte [rbp + 0xb84]
test eax, eax
jne 0x140012285
movsxd rax, dword [rbp + 0xbe4]
movsx eax, byte [rbp + rax + 0x8d0]
movsx ecx, byte [rbp + 0x24]
cmp eax, ecx
jne 0x14001222a
mov byte [rbp + 0xb84], 1
mov rcx, qword [rbp + 0xae8]
call qword [sym.imp.ucrtbased.dll_atoi]
mov dword [rbp + 0xba4], eax
mov eax, dword [rbp + 0xba4]
add eax, 1
mov eax, eax
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 0xb28], rax
cmp qword [rbp + 0xb28], 0
je 0x140012228
movsxd rax, dword [rbp + 0xba4]
mov rcx, qword [rbp + 0xb28]
mov byte [rcx + rax], 0
jmp 0x140012283
movzx eax, byte [rbp + 0xb64]
test eax, eax
je 0x140012265
movsxd rax, dword [rbp + 0xbe4]
movsxd rcx, dword [rbp + 0xb04]
mov rdx, qword [rbp + 0xae8]
movzx eax, byte [rbp + rax + 0x8d0]
mov byte [rdx + rcx], al
mov eax, dword [rbp + 0xb04]
inc eax
mov dword [rbp + 0xb04], eax
jmp 0x140012283
movsxd rax, dword [rbp + 0xbe4]
movsx eax, byte [rbp + rax + 0x8d0]
movsx ecx, byte [rbp + 4]
cmp eax, ecx
jne 0x140012283
mov byte [rbp + 0xb64], 1
jmp 0x1400122bd
cmp qword [rbp + 0xb28], 0
je 0x1400122bd
movsxd rax, dword [rbp + 0xbe4]
movsxd rcx, dword [rbp + 0xb44]
mov rdx, qword [rbp + 0xb28]
movzx eax, byte [rbp + rax + 0x8d0]
mov byte [rdx + rcx], al
mov eax, dword [rbp + 0xb44]
inc eax
mov dword [rbp + 0xb44], eax
jmp 0x140012186
cmp dword [rbp + 0xbc4], 0
jg 0x14001213b
mov rcx, qword [rbp + 0x638]
call qword [rbp + 0x7e8]
call qword [rbp + 0x828]
cmp dword [rbp + 0xba4], 0
jle 0x1400124ab
mov eax, dword [rbp + 0xb44]
cmp dword [rbp + 0xba4], eax
jne 0x1400124ab
mov dword [rbp + 0xc04], 0x7a64
lea rdx, [rbp + 0x138]
mov rcx, qword [rbp + 0x378]
call fcn.14001110e
mov qword [rbp + 0xc28], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc48], rax
lea rdx, [rbp + 0x108]
mov rcx, qword [rbp + 0x378]
call fcn.14001110e
mov qword [rbp + 0xc68], rax
mov rax, qword [rbp + 0xc28]
mov qword [rbp + 0xc88], rax
mov r8d, dword [rbp + 0xc04]
xor edx, edx
mov ecx, 0x1fffff
call qword [rbp + 0xc48]
mov qword [rbp + 0xca8], rax
cmp qword [rbp + 0xca8], 0
jne 0x14001238a
mov eax, 1
jmp 0x1400124ad
movsxd rax, dword [rbp + 0xba4]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, rax
xor edx, edx
mov rcx, qword [rbp + 0xca8]
call qword [rbp + 0xc88]
mov qword [rbp + 0xcc8], rax
cmp qword [rbp + 0xcc8], 0
jne 0x1400123cc
mov eax, 1
jmp 0x1400124ad
lea rdx, [rbp + 0x328]
mov rcx, qword [rbp + 0x378]
call fcn.14001110e
mov qword [rbp + 0xce8], rax
mov rax, qword [rbp + 0xce8]
mov qword [rbp + 0xd08], rax
movsxd rax, dword [rbp + 0xba4]
mov qword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0xb28]
mov rdx, qword [rbp + 0xcc8]
mov rcx, qword [rbp + 0xca8]
call qword [rbp + 0xd08]
test rax, rax
jne 0x14001242e
mov eax, 1
jmp 0x1400124ad
mov qword [rbp + 0xd28], 0
mov dword [rbp + 0xd44], 0
lea rax, [rbp + 0xd44]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xcc8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xca8]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0xd28], rax
cmp qword [rbp + 0xd28], 0
jne 0x140012491
mov eax, 1
jmp 0x1400124ad
mov rcx, qword [rbp + 0xd28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xca8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001cda8]
call fcn.140011311
mov rax, rdi
mov rcx, qword [rbp + 0x1298]
xor rcx, rbp
call fcn.1400111b8
lea rsp, [rbp + 0x12a8]
pop rdi
pop rbp
ret