Function at 0x18001ca00
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
cmp qword [0x18007baa8], 0
mov dword [rsp + 0x40], 0x72657375
mov dword [rsp + 0x44], 0x642e3233
mov dword [rsp + 0x48], 0x6c6c
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0x65726353
mov dword [rsp + 0x24], 0x6f546e65
mov dword [rsp + 0x28], 0x65696c43
mov qword [rsp + 0x2c], 0x746e
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001ca97
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001ca97
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007baa8]
test rax, rax
cmovne rcx, rax
mov qword [0x18007baa8], rcx
cmp qword [0x18007ba38], 0
mov dword [rsp + 0x20], 0x65696c43
mov dword [rsp + 0x24], 0x6f54746e
mov dword [rsp + 0x28], 0x65726353
mov qword [rsp + 0x2c], 0x6e65
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cb03
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cb03
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba38]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba38], rcx
cmp qword [0x18007ba28], 0
mov dword [rsp + 0x20], 0x4d746547
mov dword [rsp + 0x24], 0x61737365
mov dword [rsp + 0x28], 0x6f506567
mov qword [rsp + 0x2c], 0x73
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cb6f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cb6f
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba28]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba28], rcx
cmp qword [0x18007ba90], 0
mov dword [rsp + 0x20], 0x43746547
mov dword [rsp + 0x24], 0x6f737275
mov dword [rsp + 0x28], 0x666e4972
mov qword [rsp + 0x2c], 0x6f
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cbdb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cbdb
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba90]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba90], rcx
cmp qword [0x18007ba88], 0
mov dword [rsp + 0x20], 0x70696c43
mov dword [rsp + 0x24], 0x73727543
mov qword [rsp + 0x28], 0x726f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cc47
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cc47
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba88]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba88], rcx
cmp qword [0x18007ba70], 0
mov dword [rsp + 0x20], 0x6b656550
mov dword [rsp + 0x24], 0x7373654d
mov qword [rsp + 0x28], 0x41656761
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001ccb3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001ccb3
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba70]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba70], rcx
cmp qword [0x18007b9f8], 0
mov dword [rsp + 0x20], 0x6b656550
mov dword [rsp + 0x24], 0x7373654d
mov qword [rsp + 0x28], 0x57656761
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cd1f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cd1f
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9f8]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9f8], rcx
cmp qword [0x18007ba00], 0
mov dword [rsp + 0x20], 0x646e6553
mov dword [rsp + 0x24], 0x75706e49
mov qword [rsp + 0x28], 0x74
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cd8b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cd8b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba00]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba00], rcx
cmp qword [0x18007ba48], 0
mov dword [rbp - 0x60], 0x43746553
mov dword [rbp - 0x5c], 0x75747061
mov word [rbp - 0x58], 0x6572
mov byte [rbp - 0x56], 0
jne 0x18001cddf
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cddf
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba48]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba48], rcx
cmp qword [0x18007ba30], 0
mov dword [rbp], 0x656c6552
mov dword [rbp + 4], 0x43657361
mov dword [rbp + 8], 0x75747061
mov word [rbp + 0xc], 0x6572
mov byte [rbp + 0xe], 0
jne 0x18001ce3a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001ce3a
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba30]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba30], rcx
cmp qword [0x18007ba60], 0
mov dword [rsp + 0x20], 0x43746547
mov dword [rsp + 0x24], 0x75747061
mov qword [rsp + 0x28], 0x6572
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cea6
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cea6
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba60]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba60], rcx
cmp qword [0x18007ba18], 0
mov dword [rsp + 0x20], 0x776f6853
mov dword [rsp + 0x24], 0x646e6957
mov qword [rsp + 0x28], 0x776f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001cf12
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cf12
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba18]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba18], rcx
cmp qword [0x18007b9e8], 0
mov dword [rbp + 0x10], 0x46746553
mov dword [rbp + 0x14], 0x6765726f
mov dword [rbp + 0x18], 0x6e756f72
mov dword [rbp + 0x1c], 0x6e695764
mov dword [rbp + 0x20], 0x776f64
jne 0x18001cf71
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cf71
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9e8]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9e8], rcx
cmp qword [0x18007ba98], 0
mov dword [rbp - 0x30], 0x57746553
mov dword [rbp - 0x2c], 0x6f646e69
mov dword [rbp - 0x28], 0x736f5077
mov byte [rbp - 0x24], 0
jne 0x18001cfc6
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cfc6
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba98]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba98], rcx
cmp qword [0x18007ba50], 0
mov dword [rsp + 0x40], 0x33696467
mov dword [rsp + 0x44], 0x6c642e32
mov dword [rsp + 0x48], 0x6c
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0x43746547
mov dword [rsp + 0x24], 0x4270696c
mov qword [rsp + 0x28], 0x786f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001d04f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d04f
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba50]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba50], rcx
cmp qword [0x18007b9f0], 0
mov dword [rsp + 0x20], 0x656c6553
mov dword [rsp + 0x24], 0x6c437463
mov dword [rsp + 0x28], 0x61507069
mov qword [rsp + 0x2c], 0x6874
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001d0bb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d0bb
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9f0]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9f0], rcx
cmp qword [0x18007ba78], 0
mov dword [rsp + 0x40], 0x6c64746e
mov dword [rsp + 0x44], 0x6c642e6c
mov dword [rsp + 0x48], 0x6c
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0x7551775a
mov dword [rsp + 0x24], 0x56797265
mov dword [rsp + 0x28], 0x75747269
mov dword [rsp + 0x2c], 0x654d6c61
mov qword [rsp + 0x30], 0x79726f6d
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001d14b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d14b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba78]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba78], rcx
mov rdx, qword [0x18007c0c8]
mov rax, qword [0x18007c0c0]
xor ecx, ecx
sub rdx, rax
mov r9d, ecx
sar rdx, 2
test edx, edx
je 0x18001d210
mov r8, rax
cmp dword [r8], 0x36623354
je 0x18001d1a4
inc r9d
add r8, 4
cmp r9d, edx
jb 0x18001d170
test edx, edx
je 0x18001d210
nop dword [rax]
cmp dword [rax], 0x8b37daa
je 0x18001d1a4
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18001d190
jmp 0x18001d210
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x150], rbx
mov dword [rsp + 0x40], 0x6c64746e
mov dword [rsp + 0x44], 0x6c642e6c
mov dword [rsp + 0x48], 0x6c
mov byte [rsp + 0x4c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18001b560
mov rbx, rax
test rax, rax
je 0x18001d208
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [0x18007ba78]
add rdx, rbx
sub rdx, rax
mov qword [0x18007ba68], rdx
mov rbx, qword [rsp + 0x150]
cmp qword [0x18007baa0], 0
mov dword [rsp + 0x70], 0x72657375
mov dword [rsp + 0x74], 0x642e3233
mov word [rsp + 0x78], 0x6c6c
mov byte [rsp + 0x7a], 0
mov dword [rbp - 0x10], 0x6c6c6143
mov dword [rbp - 0xc], 0x7478654e
mov dword [rbp - 8], 0x6b6f6f48
mov word [rbp - 4], 0x7845
mov byte [rbp - 2], 0
jne 0x18001d287
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d287
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007baa0]
test rax, rax
cmovne rcx, rax
mov qword [0x18007baa0], rcx
cmp qword [0x18007ba40], 0
mov dword [rbp - 0x80], 0x6e72656b
mov dword [rbp - 0x7c], 0x32336c65
mov dword [rbp - 0x78], 0x6c6c642e
mov byte [rbp - 0x74], 0
mov dword [rbp - 0x40], 0x54746547
mov dword [rbp - 0x3c], 0x436b6369
mov dword [rbp - 0x38], 0x746e756f
mov byte [rbp - 0x34], 0
jne 0x18001d2f4
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d2f4
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba40]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba40], rcx
cmp qword [0x18007ba08], 0
mov dword [rbp + 0x28], 0x72657551
mov dword [rbp + 0x2c], 0x72655079
mov dword [rbp + 0x30], 0x6d726f66
mov dword [rbp + 0x34], 0x65636e61
mov dword [rbp + 0x38], 0x6e756f43
mov dword [rbp + 0x3c], 0x726574
jne 0x18001d359
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d359
lea rdx, [rbp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba08]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba08], rcx
cmp qword [0x18007ba80], 0
mov dword [rsp + 0x60], 0x6d6e6957
mov dword [rsp + 0x64], 0x6c642e6d
mov word [rsp + 0x68], 0x6c
mov dword [rbp - 0x50], 0x656d6974
mov dword [rbp - 0x4c], 0x54746547
mov dword [rbp - 0x48], 0x656d69
jne 0x18001d3c1
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d3c1
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba80]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba80], rcx
cmp qword [0x18007ba10], 0
mov dword [rbp - 0x70], 0x54746553
mov dword [rbp - 0x6c], 0x72656d69
mov byte [rbp - 0x68], 0
jne 0x18001d40f
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d40f
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba10]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba10], rcx
cmp qword [0x18007ba20], 0
mov dword [rbp - 0x20], 0x656d6974
mov dword [rbp - 0x1c], 0x45746553
mov dword [rbp - 0x18], 0x746e6576
mov byte [rbp - 0x14], 0
jne 0x18001d464
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001d464
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba20]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba20], rcx
mov eax, 1
add rsp, 0x140
pop rbp
ret