Function at 0x1400016c3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x20b40
call fcn.140004ef0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140003f20
lea rdx, [rbp + 0x209b0]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x20980]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x20950]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov word [rbp + 0x20930], 0x6c
mov word [rbp + 0x20932], 0x6c
mov word [rbp + 0x20934], 0x64
mov word [rbp + 0x20936], 0x2e
mov word [rbp + 0x20938], 0x33
mov word [rbp + 0x2093a], 0x32
mov word [rbp + 0x2093c], 0x65
mov word [rbp + 0x2093e], 0x73
mov word [rbp + 0x20940], 0x55
mov word [rbp + 0x20942], 0
mov word [rbp + 0x20910], 0x6c
mov word [rbp + 0x20912], 0x6c
mov word [rbp + 0x20914], 0x64
mov word [rbp + 0x20916], 0x2e
mov word [rbp + 0x20918], 0x32
mov word [rbp + 0x2091a], 0x33
mov word [rbp + 0x2091c], 0x6c
mov word [rbp + 0x2091e], 0x65
mov word [rbp + 0x20920], 0x6e
mov word [rbp + 0x20922], 0x72
mov word [rbp + 0x20924], 0x65
mov word [rbp + 0x20926], 0x4b
mov word [rbp + 0x20928], 0
mov word [rbp + 0x208f0], 0x6c
mov word [rbp + 0x208f2], 0x6c
mov word [rbp + 0x208f4], 0x64
mov word [rbp + 0x208f6], 0x2e
mov word [rbp + 0x208f8], 0x6c
mov word [rbp + 0x208fa], 0x6c
mov word [rbp + 0x208fc], 0x64
mov word [rbp + 0x208fe], 0x74
mov word [rbp + 0x20900], 0x6e
mov word [rbp + 0x20902], 0
lea rax, [rbp + 0x20930]
mov rcx, rax
call fcn.140001630
lea rax, [rbp + 0x20910]
mov rcx, rax
call fcn.140001630
lea rax, [rbp + 0x208f0]
mov rcx, rax
call fcn.140001630
movabs rax, 0x724c6f6164446c6c
mov qword [rbp + 0x208e5], rax
mov dword [rbp + 0x208ec], 0x4c6472
movabs rax, 0x74646c6c2e646c6c
mov qword [rbp + 0x208db], rax
mov word [rbp + 0x208e3], 0x6e
movabs rax, 0x656c33322e646c6c
mov qword [rbp + 0x208ce], rax
movabs rax, 0x4b65726e656c33
mov qword [rbp + 0x208d3], rax
lea rax, [rbp + 0x208e5]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x208db]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x208ce]
mov rcx, rax
call fcn.1400015af
lea rdx, [rbp + 0x20930]
lea rax, [rbp + 0x20a00]
mov rcx, rax
call fcn.1400014e6
lea rdx, [rbp + 0x20910]
lea rax, [rbp + 0x209f0]
mov rcx, rax
call fcn.1400014e6
lea rdx, [rbp + 0x208f0]
lea rax, [rbp + 0x209e0]
mov rcx, rax
call fcn.1400014e6
mov dword [rbp + 0x209b0], 0x30
mov qword [rbp + 0x209b8], 0
mov dword [rbp + 0x209c8], 0x40
lea rax, [rbp + 0x20a00]
mov qword [rbp + 0x209c0], rax
mov qword [rbp + 0x209d0], 0
mov qword [rbp + 0x209d8], 0
mov dword [rbp + 0x20980], 0x30
mov qword [rbp + 0x20988], 0
mov dword [rbp + 0x20998], 0x40
lea rax, [rbp + 0x209f0]
mov qword [rbp + 0x20990], rax
mov qword [rbp + 0x209a0], 0
mov qword [rbp + 0x209a8], 0
mov dword [rbp + 0x20950], 0x30
mov qword [rbp + 0x20958], 0
mov dword [rbp + 0x20968], 0x40
lea rax, [rbp + 0x209e0]
mov qword [rbp + 0x20960], rax
mov qword [rbp + 0x20970], 0
mov qword [rbp + 0x20978], 0
movabs rax, 0x6548616e646c6541
mov qword [rbp + 0x208b0], rax
movabs rax, 0x4765744d6f64756c
mov qword [rbp + 0x208b8], rax
mov byte [rbp + 0x208c0], 0
lea rax, [rbp + 0x208b0]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x208ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x208b0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20ab0], rax
movabs rax, 0x6341646472657373
mov qword [rbp + 0x208a1], rax
movabs rax, 0x47657450726f63
mov qword [rbp + 0x208a8], rax
lea rax, [rbp + 0x208a1]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x208ce]
mov rdx, qword [rbp + 0x20ab0]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x208a1]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20aa8], rax
movabs rax, 0x75616c416c6c6f63
mov qword [rbp + 0x20894], rax
movabs rbx, 0x5669727475616c
mov qword [rbp + 0x20899], rbx
lea rax, [rbp + 0x20894]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x208ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x20894]
mov r8, qword [rbp + 0x20aa8]
mov rdx, rax
call r8
mov qword [rbp + 0x20aa0], rax
movabs rax, 0x6c50726f74656374
mov qword [rbp + 0x20885], rax
mov qword [rbp + 0x2088c], rbx
lea rax, [rbp + 0x20885]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x208ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x20885]
mov r8, qword [rbp + 0x20aa8]
mov rdx, rax
call r8
mov qword [rbp + 0x20a98], rax
lea rax, [rbp + 0x208db]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x208e5]
mov r8, qword [rbp + 0x20aa8]
mov rdx, rax
call r8
mov qword [rbp + 0x20a90], rax
mov word [rbp + 0x20883], 0xbb49
movabs rax, 0xefbeaddeefbeadde
mov qword [rbp + 0x2087b], rax
mov dword [rbp + 0x20877], 0xc3e3ff41
mov rax, qword [rbp + 0x20a90]
add rax, 5
mov qword [rbp + 0x20a88], rax
lea rax, [rbp + 0x2087b]
mov rdx, qword [rbp + 0x20a88]
mov qword [rax], rdx
mov rax, qword [rbp + 0x20aa0]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x20a80], rax
mov rax, qword [rbp + 0x20a80]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x20a80]
lea rcx, [rax + 5]
lea rax, [rbp + 0x20883]
mov r8d, 2
mov rdx, rax
call fcn.140001450
mov rax, qword [rbp + 0x20a80]
lea rcx, [rax + 7]
lea rax, [rbp + 0x2087b]
mov r8d, 8
mov rdx, rax
call fcn.140001450
mov rax, qword [rbp + 0x20a80]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x20877]
mov r8d, 4
mov rdx, rax
call fcn.140001450
mov dword [rbp + 0x20870], 0
lea rdx, [rbp + 0x20870]
mov rax, qword [rbp + 0x20a80]
mov r10, qword [rbp + 0x20a98]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
mov rcx, rax
call r10
mov rax, qword [rbp + 0x20a80]
mov qword [rbp + 0x20a78], rax
mov qword [rbp + 0x20868], 0
lea rcx, [rbp + 0x20868]
lea rdx, [rbp + 0x20a00]
mov rax, qword [rbp + 0x20a78]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x20860], 0
lea rcx, [rbp + 0x20860]
lea rdx, [rbp + 0x209f0]
mov rax, qword [rbp + 0x20a78]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x20858], 0
lea rcx, [rbp + 0x20858]
lea rdx, [rbp + 0x209e0]
mov rax, qword [rbp + 0x20a78]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rcx, qword [rbp + 0x20860]
lea rax, [rbp + 0x208a1]
mov r8, qword [rbp + 0x20aa8]
mov rdx, rax
call r8
mov qword [rbp + 0x20a70], rax
mov rcx, qword [rbp + 0x20860]
lea rax, [rbp + 0x20894]
mov r8, qword [rbp + 0x20a70]
mov rdx, rax
call r8
mov qword [rbp + 0x20a68], rax
mov rcx, qword [rbp + 0x20860]
lea rax, [rbp + 0x20885]
mov r8, qword [rbp + 0x20a70]
mov rdx, rax
call r8
mov qword [rbp + 0x20a60], rax
movabs rax, 0x73734d656d6f7279
mov qword [rbp + 0x20840], rax
movabs rax, 0x69746550726f6365
mov qword [rbp + 0x20848], rax
mov dword [rbp + 0x2084f], 0x577269
lea rax, [rbp + 0x20840]
mov rcx, rax
call fcn.1400015af
mov rcx, qword [rbp + 0x20860]
lea rax, [rbp + 0x20840]
mov r8, qword [rbp + 0x20a70]
mov rdx, rax
call r8
mov qword [rbp + 0x20a58], rax
movabs rax, 0x7450726f63657373
mov qword [rbp + 0x20820], rax
movabs rax, 0x657443757272656e
mov qword [rbp + 0x20828], rax
mov word [rbp + 0x20830], 0x47
lea rax, [rbp + 0x20820]
mov rcx, rax
call fcn.1400015af
mov rcx, qword [rbp + 0x20860]
lea rax, [rbp + 0x20820]
mov r8, qword [rbp + 0x20a70]
mov rdx, rax
call r8
mov qword [rbp + 0x20a50], rax
lea rax, [rbp + 0xe0]
lea rdx, section..data
mov ecx, 0x20740
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x20a4c], 0x40e8
mov eax, dword [rbp + 0x20a4c]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x20a40], rax
cmp qword [rbp + 0x20a40], 0
jne 0x140001ef4
mov eax, 0xffffffff
jmp 0x14000218b
mov dword [rbp + 0x20abc], 0
jmp 0x140001f64
mov eax, dword [rbp + 0x20abc]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x20a40]
add rdx, rax
mov eax, dword [rbp + 0x20abc]
cdqe
mov rax, qword [rbp + rax*8 + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x20a1c], eax
cmp dword [rbp + 0x20a1c], 0
je 0x140001f5d
mov rax, qword [rbp + 0x20a40]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x14000218b
add dword [rbp + 0x20abc], 1
mov eax, dword [rbp + 0x20abc]
cmp eax, dword [rbp + 0x20a4c]
jl 0x140001f00
mov eax, dword [rbp + 0x20a4c]
cdqe
shl eax, 4
mov dword [rbp + 0x20a3c], eax
movabs rax, 0x67504f75426a4f63
mov qword [rbp + 0xc0], rax
movabs rax, 0x6b62413878354256
mov qword [rbp + 0xc8], rax
mov byte [rbp + 0xd0], 0
movabs rax, 0x487459445747486a
mov qword [rbp + 0xa0], rax
movabs rax, 0x6b6e4f627073424c
mov qword [rbp + 0xa8], rax
mov byte [rbp + 0xb0], 0
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.140002ce4
mov ecx, dword [rbp + 0x20a3c]
mov rdx, qword [rbp + 0x20a40]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.140003cbf
mov eax, dword [rbp + 0x20a3c]
mov qword [rbp + 0x20a30], rax
mov qword [rbp + 0x20a28], 0
movabs rax, 0x646172496e666f41
mov qword [rbp - 0x40], rax
movabs rax, 0x6e756d43616c656e
mov qword [rbp - 0x38], rax
mov word [rbp - 0x30], 0x45
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400015af
mov rcx, qword [rbp + 0x20860]
lea rax, [rbp - 0x40]
mov r8, qword [rbp + 0x20a70]
mov rdx, rax
call r8
mov qword [rbp + 0x20a20], rax
mov rax, qword [rbp + 0x20a30]
mov r10, qword [rbp + 0x20a68]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0x20a28], rax
movabs rax, 0xde0b6b3a7640859
mov rcx, rax
call fcn.140001554
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x20a30]
mov rax, qword [rbp + 0x20a28]
mov r10, qword [rbp + 0x20a60]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a7640801
mov rcx, rax
call fcn.140001554
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x20a30]
mov rax, qword [rbp + 0x20a28]
mov r10, qword [rbp + 0x20a60]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a76409b1
mov rcx, rax
call fcn.140001554
mov ebx, dword [rbp + 0x20a3c]
mov rax, qword [rbp + 0x20a50]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0x20a40]
mov rax, qword [rbp + 0x20a28]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x20a58]
mov r9, rbx
mov r8, rdx
mov rdx, rax
call r10
mov rax, qword [rbp + 0x20a28]
mov r10, qword [rbp + 0x20a20]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
mov rcx, rax
call r10
mov eax, 0
add rsp, 0x20b40
pop rbx
pop rdi
pop rbp
ret