Function at 0x140080ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rbp + 0x88], rax
mov r12, rcx
mov qword [rbp - 0x68], rcx
mov dword [rsp + 0x40], 0
mov dword [rbp + 0x6d], 0x6e657272
mov word [rbp + 0x55], 0x5241
mov dword [rbp + 0x7f], 0x6c6c6174
mov word [rbp + 0x7d], 0x736e
mov dword [rbp + 0x65], 0x776f646e
mov word [rbp + 0x5e], 0x6f73
mov dword [rbp + 0x69], 0x75435c73
mov word [rbp + 0x58], 0x4d5c
mov dword [rbp + 0x50], 0x54464f53
mov dword [rbp + 0x76], 0x5c6e6f69
mov word [rbp + 0x7a], 0x6e55
mov word [rbp + 0x5b], 0x7263
mov word [rbp + 0x71], 0x5674
mov word [rbp + 0x63], 0x6957
mov byte [rbp + 0x57], 0x45
mov byte [rbp + 0x7c], 0x69
mov word [rbp + 0x74], 0x7372
mov byte [rbp + 0x5a], 0x69
mov word [rbp + 0x60], 0x7466
mov byte [rbp + 0x83], 0
mov byte [rbp + 0x62], 0x5c
mov byte [rbp + 0x5d], 0x6f
mov byte [rbp + 0x73], 0x65
mov byte [rbp + 0x54], 0x57
mov word [rbp - 0x45], 0x6974
mov word [rbp - 0x42], 0x6e
mov dword [rbp - 0x50], 0x74736e49
mov dword [rbp - 0x4c], 0x4c6c6c61
mov word [rbp - 0x47], 0x6163
mov byte [rbp - 0x48], 0x6f
mov byte [rbp - 0x43], 0x6f
mov dword [rbp - 0x58], 0x65726946
mov dword [rbp - 0x54], 0x786f66
mov word [rbp - 0x5b], 0x616c
mov dword [rbp - 0x60], 0x697a6f4d
mov byte [rbp - 0x59], 0x20
mov byte [rbp - 0x5c], 0x6c
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x140081977
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.14001b1d0
mov r15, 0xffffffffffffffff
test al, al
jne 0x14008105b
lea rcx, [rbp - 0x60]
mov rax, r15
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140081040
mov r8d, eax
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x50]
call fcn.14001b4a0
nop
mov dword [rbp - 0x78], 0x200
mov dword [rbp - 0x74], 0x100
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x140081982
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
mov dword [rsp + 0x40], 1
xor r14d, r14d
mov qword [rsp + 0x48], r14
nop dword [rax + rax]
mov qword [rbp - 0x80], 0
mov edi, dword [rbp + r14*4 - 0x78]
or edi, 0x20019
mov esi, 1
mov dword [rbp + 8], 0x6c6c642e
mov word [rbp + 4], 0x6970
mov word [rbp + 1], 0x7664
mov byte [rbp + 0xc], 0
mov word [rbp + 6], 0x3233
mov byte [rbp], 0x41
mov byte [rbp + 3], 0x61
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140081156
mov word [rbp + 0x3a], 0x7845
mov word [rbp + 0x31], 0x6765
mov byte [rbp + 0x30], 0x52
mov word [rbp + 0x34], 0x6570
mov word [rbp + 0x37], 0x654b
mov byte [rbp + 0x33], 0x4f
mov byte [rbp + 0x36], 0x6e
mov byte [rbp + 0x39], 0x79
mov word [rbp + 0x3c], 0x41
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008114d
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, 0xffffffff80000002
call rax
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.14001b940
test rax, rax
je 0x14008196c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
xor r13d, r13d
test esi, esi
jne 0x140081469
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x68], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400811c0
mov edx, 0x104
lea rcx, [rsp + 0x58]
call fcn.14001b440
mov rbx, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, r13d
mov rcx, qword [rbp - 0x80]
call fcn.140016320
mov edi, eax
inc r13d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140027150
test eax, eax
js 0x1400819a9
cmp eax, dword [rbx - 0xc]
jg 0x1400819a9
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
test edi, edi
jne 0x140081464
mov rsi, qword [rsp + 0x50]
mov eax, dword [rsi - 0x10]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
mov edx, dword [rbx - 0x10]
mov eax, edx
cmp ecx, edx
cmovle eax, ecx
xor r14d, r14d
test edx, edx
cmovns r14d, eax
cmp r14d, edx
jne 0x140081240
lea rcx, [rbx - 0x18]
call fcn.14001ade0
lea rdi, [rax + 0x18]
jmp 0x140081300
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14008125c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
je 0x14008125c
mov r15, rbx
jmp 0x140081279
call fcn.14001b940
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov r15, rbx
test rax, rax
je 0x14008199e
test r15, r15
jne 0x140081287
test r14d, r14d
jne 0x1400819a9
mov rax, qword [rcx]
mov r8d, 1
mov edx, r14d
call qword [rax]
test rax, rax
je 0x140081998
lea rdi, [rax + 0x18]
test r14d, r14d
js 0x1400819a9
cmp r14d, dword [rdi - 0xc]
jg 0x1400819a9
mov dword [rdi - 0x10], r14d
movsxd r8, r14d
mov byte [r8 + rdi], 0
test r14d, r14d
je 0x1400812f9
test rdi, rdi
je 0x1400812e9
mov rcx, rdi
test r15, r15
je 0x1400812dd
mov rdx, r15
call fcn.14001e8d0
jmp 0x1400812f9
xor edx, edx
call fcn.14001ef80
test rbx, rbx
jne 0x1400812f9
call fcn.140021dc0
mov dword [rax], 0x16
call fcn.140021c5c
mov r15, 0xffffffffffffffff
or dword [rsp + 0x40], 2
mov rdx, rsi
mov rcx, rdi
call fcn.1400284f4
test eax, eax
sete bl
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008132f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
jne 0x14008133d
mov rbx, qword [rsp + 0x58]
jmp 0x140081190
mov dword [rsp + 0x70], 1
mov dword [rsp + 0x6c], 0x104
mov rax, qword [r12]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x140081373
mov edx, 0x104
mov rcx, r12
call fcn.14001b440
mov r14, qword [r12]
mov r15, qword [rbp - 0x80]
mov esi, 1
mov word [rbp - 0x39], 0x642e
mov dword [rbp - 0x3f], 0x61776c68
mov word [rbp - 0x36], 0x6c
mov word [rbp - 0x3b], 0x6970
mov byte [rbp - 0x37], 0x6c
mov byte [rbp - 0x40], 0x53
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rbx, qword [rsp + 0x58]
test rax, rax
je 0x14008141d
mov word [rbp - 0x2d], 0x7465
mov word [rbp - 0x2a], 0x6c61
mov word [rbp - 0x27], 0x4165
mov word [rbp - 0x2f], 0x4748
mov byte [rbp - 0x25], 0
mov byte [rbp - 0x2b], 0x56
mov byte [rbp - 0x30], 0x53
mov byte [rbp - 0x28], 0x75
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140081414
lea rcx, [rsp + 0x6c]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x50]
mov rdx, rbx
mov rcx, r15
call rax
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [r12]
test rcx, rcx
jne 0x14008142a
xor eax, eax
jmp 0x14008143b
movsxd rdx, dword [rcx - 0xc]
call fcn.140027150
test eax, eax
js 0x14008198d
mov rcx, qword [r12]
cmp eax, dword [rcx - 0xc]
jg 0x14008198d
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [r12]
mov byte [rcx + rax], 0
test esi, esi
mov r15, 0xffffffffffffffff
jne 0x140081190
mov r14, qword [rsp + 0x48]
mov rax, qword [r12]
lea rdx, [rbx - 0x18]
cmp dword [rax - 0x10], 0
mov eax, r15d
jne 0x1400814a0
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008148d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
inc r14
mov qword [rsp + 0x48], r14
cmp r14, 2
jge 0x1400814b3
jmp 0x1400810a0
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400814b3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
xor r14d, r14d
mov qword [rsp + 0x48], r14
nop dword [rax + rax]
mov qword [rbp - 0x70], 0
mov edi, dword [rbp + r14*4 - 0x78]
or edi, 0x20019
mov esi, 1
mov dword [rbp + 0x18], 0x6c6c642e
mov word [rbp + 0x14], 0x6970
mov word [rbp + 0x11], 0x7664
mov byte [rbp + 0x1c], 0
mov word [rbp + 0x16], 0x3233
mov byte [rbp + 0x10], 0x41
mov byte [rbp + 0x13], 0x61
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140081576
mov word [rbp + 0x4a], 0x7845
mov word [rbp + 0x41], 0x6765
mov byte [rbp + 0x40], 0x52
mov word [rbp + 0x44], 0x6570
mov word [rbp + 0x47], 0x654b
mov byte [rbp + 0x43], 0x4f
mov byte [rbp + 0x46], 0x6e
mov byte [rbp + 0x49], 0x79
mov word [rbp + 0x4c], 0x41
lea rdx, [rbp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14008156d
lea rcx, [rbp - 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
lea rdx, [rbp + 0x50]
mov rcx, 0xffffffff80000001
call rax
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.14001b940
test rax, rax
je 0x140081961
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
xor r13d, r13d
test esi, esi
jne 0x140081889
nop dword [rax]
nop word [rax + rax]
mov dword [rsp + 0x74], 0x104
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x1400815e0
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14001b440
mov rbx, qword [rsp + 0x60]
lea r9, [rsp + 0x74]
mov r8, rbx
mov edx, r13d
mov rcx, qword [rbp - 0x70]
call fcn.140016320
mov edi, eax
inc r13d
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140027150
test eax, eax
js 0x1400819d0
cmp eax, dword [rbx - 0xc]
jg 0x1400819d0
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
test edi, edi
jne 0x140081884
mov rsi, qword [rsp + 0x50]
mov eax, dword [rsi - 0x10]
xor ecx, ecx
test eax, eax
cmovns ecx, eax
mov edx, dword [rbx - 0x10]
mov eax, edx
cmp ecx, edx
cmovle eax, ecx
xor r14d, r14d
test edx, edx
cmovns r14d, eax
cmp r14d, edx
jne 0x140081660
lea rcx, [rbx - 0x18]
call fcn.14001ade0
lea rdi, [rax + 0x18]
jmp 0x140081720
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14008167c
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
test rax, rax
je 0x14008167c
mov r15, rbx
jmp 0x140081699
call fcn.14001b940
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov rcx, rax
mov r15, rbx
test rax, rax
je 0x1400819c5
test r15, r15
jne 0x1400816a7
test r14d, r14d
jne 0x1400819d0
mov rax, qword [rcx]
mov r8d, 1
mov edx, r14d
call qword [rax]
test rax, rax
je 0x1400819bf
lea rdi, [rax + 0x18]
test r14d, r14d
js 0x1400819d0
cmp r14d, dword [rdi - 0xc]
jg 0x1400819d0
mov dword [rdi - 0x10], r14d
movsxd r8, r14d
mov byte [r8 + rdi], 0
test r14d, r14d
je 0x140081719
test rdi, rdi
je 0x140081709
mov rcx, rdi
test r15, r15
je 0x1400816fd
mov rdx, r15
call fcn.14001e8d0
jmp 0x140081719
xor edx, edx
call fcn.14001ef80
test rbx, rbx
jne 0x140081719
call fcn.140021dc0
mov dword [rax], 0x16
call fcn.140021c5c
mov r15, 0xffffffffffffffff
or dword [rsp + 0x40], 4
mov rdx, rsi
mov rcx, rdi
call fcn.1400284f4
test eax, eax
sete bl
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14008174f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
test bl, bl
jne 0x14008175d
mov rbx, qword [rsp + 0x60]
jmp 0x1400815b0
mov dword [rsp + 0x7c], 1
mov dword [rsp + 0x78], 0x104
mov rax, qword [r12]
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x140081793
mov edx, 0x104
mov rcx, r12
call fcn.14001b440
mov r14, qword [r12]
mov r15, qword [rbp - 0x70]
mov esi, 1
mov word [rbp - 0x19], 0x642e
mov dword [rbp - 0x1f], 0x61776c68
mov word [rbp - 0x16], 0x6c
mov word [rbp - 0x1b], 0x6970
mov byte [rbp - 0x17], 0x6c
mov byte [rbp - 0x20], 0x53
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
mov rbx, qword [rsp + 0x60]
test rax, rax
je 0x14008183d
mov word [rbp - 0xd], 0x7465
mov word [rbp - 0xa], 0x6c61
mov word [rbp - 7], 0x4165
mov word [rbp - 0xf], 0x4748
mov byte [rbp - 5], 0
mov byte [rbp - 0xb], 0x56
mov byte [rbp - 0x10], 0x53
mov byte [rbp - 8], 0x75
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140081834
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x7c]
lea r8, [rbp - 0x50]
mov rdx, rbx
mov rcx, r15
call rax
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [r12]
test rcx, rcx
jne 0x14008184a
xor eax, eax
jmp 0x14008185b
movsxd rdx, dword [rcx - 0xc]
call fcn.140027150
test eax, eax
js 0x1400819b4
mov rcx, qword [r12]
cmp eax, dword [rcx - 0xc]
jg 0x1400819b4
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [r12]
mov byte [rcx + rax], 0
test esi, esi
mov r15, 0xffffffffffffffff
jne 0x1400815b0
mov r14, qword [rsp + 0x48]
mov rax, qword [r12]
lea rdx, [rbx - 0x18]
cmp dword [rax - 0x10], 0
mov eax, r15d
jne 0x1400818c0
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400818ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
inc r14
mov qword [rsp + 0x48], r14
cmp r14, 2
jge 0x1400818d3
jmp 0x1400814c0
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400818d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rax, qword [r12]
cmp dword [rax - 0x10], 0
je 0x14008190f
mov word [rbp + 0x20], 0x665c
mov word [rbp + 0x23], 0x6572
mov word [rbp + 0x26], 0x786f
mov dword [rbp + 0x29], 0x657865
mov byte [rbp + 0x28], 0x2e
mov byte [rbp + 0x25], 0x66
mov byte [rbp + 0x22], 0x69
lea rdx, [rbp + 0x20]
mov rcx, r12
call fcn.14001ad20
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x14008192e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r12
mov rcx, qword [rbp + 0x88]
xor rcx, rsp
call fcn.14001c9b0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80004005
call fcn.14001b6d0
int3
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80070057
call fcn.14001b6d0
int3
call fcn.14001b3e0
int3
mov ecx, 0x80004005
call fcn.14001b6d0
int3
mov ecx, 0x80070057
call fcn.14001b6d0
nop
mov ecx, 0x80070057
call fcn.14001b6d0
int3
call fcn.14001b3e0
int3
mov ecx, 0x80004005
call fcn.14001b6d0
int3
mov ecx, 0x80070057
call fcn.14001b6d0
int3