Function at 0x140011360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x78], rcx
mov qword [rsp + 0x38], rdx
xor r13d, r13d
mov qword [rbp - 0x2c], r13
mov dword [rbp - 0x38], 0x696e6957
mov dword [rbp - 0x34], 0x2e74656e
mov dword [rbp - 0x30], 0x6c6c64
mov dword [rbp - 0x42], r13d
mov word [rbp - 0x3e], r13w
mov dword [rbp - 0x50], 0x65746e49
mov dword [rbp - 0x4c], 0x74656e72
mov dword [rbp - 0x48], 0x6e65704f
mov word [rbp - 0x44], 0x41
mov word [rbp - 0xf], r13w
mov byte [rbp - 0xd], r13b
movdqa xmm0, xmmword [0x140039090]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], r13b
mov word [rbp + 9], r13w
mov byte [rbp + 0xb], r13b
movdqa xmm0, xmmword [0x140039120]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp + 8], r13b
lea rcx, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400400b0], rax
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140040098], rax
lea rdx, [rbp - 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400400a0], rax
lea ecx, [r13 + 0x14]
call fcn.140012abc
mov r14, rax
mov qword [rax + 0xc], r13
mov dword [rax], 0x697a6f4d
mov dword [rax + 4], 0x2f616c6c
mov dword [rax + 8], 0x302e35
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [0x1400400b0]
mov r12, rax
test rax, rax
jne 0x14001150d
mov rcx, r14
call fcn.140012570
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r13
mov r8d, 2
lea rdx, [0x140038ffc]
mov rcx, rsi
call fcn.1400019f0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140011504
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x1400114ff
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011c18
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], r13
jmp 0x14001171f
mov ecx, 0x64
call fcn.140012abc
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x2f], xmm0
movups xmmword [rbx + 0x3f], xmm0
movups xmmword [rbx + 0x4f], xmm0
mov dword [rbx + 0x5f], eax
mov byte [rbx + 0x63], al
mov dword [rbx], 0x70747468
mov dword [rbx + 4], 0x2f2f3a73
mov dword [rbx + 8], 0x2e697061
mov dword [rbx + 0xc], 0x6f6c7069
mov dword [rbx + 0x10], 0x69746163
mov dword [rbx + 0x14], 0x6e2e6e6f
mov dword [rbx + 0x18], 0x3f2f7465
mov dword [rbx + 0x1c], 0x3d646d63
mov dword [rbx + 0x20], 0x632d7069
mov dword [rbx + 0x24], 0x746e756f
mov dword [rbx + 0x28], 0x69267972
mov word [rbx + 0x2c], 0x3d70
mov byte [rbx + 0x2e], al
mov r8, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140011593
mov r8, qword [rdi]
lea rcx, [rbx - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], al
jne 0x140011597
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400115b0
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x800000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [0x140040098]
mov r15, rax
test rax, rax
jne 0x1400115f7
mov rcx, r14
call fcn.140012570
mov rcx, rbx
jmp 0x1400114a1
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp + 0xe0]
call fcn.14002a9f0
lea r9, [rbp - 0x80]
mov r8d, 0xc4
lea rdx, [rbp + 0xe0]
mov rcx, r15
call qword [0x1400400a0]
test eax, eax
je 0x1400115e7
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0xe0]
mov r15, 0xffffffffffffffff
mov rax, r15
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140011650
cmp rax, 1
jae 0x140011933
mov ecx, 0x1e
call fcn.140012abc
mov r14, rax
mov qword [rax + 0xc], r13
mov qword [rax + 0x14], r13
mov word [rax + 0x1c], r13w
mov dword [rax], 0x697a6f4d
mov dword [rax + 4], 0x2f616c6c
mov dword [rax + 8], 0x302e35
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [0x1400400b0]
mov r13, rax
test rax, rax
jne 0x140011757
mov rcx, r14
call fcn.140012570
mov r8d, 2
lea rdx, [0x140038ffc]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor ebx, ebx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
mov rcx, rsi
call fcn.1400019f0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14001171b
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140011716
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011c1e
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], rbx
mov rax, rsi
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140012550
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc8
call fcn.140012abc
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x12], xmm0
movups xmmword [rbx + 0x22], xmm0
movups xmmword [rbx + 0x32], xmm0
movups xmmword [rbx + 0x42], xmm0
movups xmmword [rbx + 0x52], xmm0
mov word [rbx + 0x62], ax
mov dword [rbx], 0x70747468
mov dword [rbx + 4], 0x2f2f3a73
mov dword [rbx + 8], 0x70617069
mov dword [rbx + 0xc], 0x6f632e69
mov word [rbx + 0x10], 0x2f
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400117af
mov rcx, qword [rdi]
lea rdx, [rbx - 1]
lea rdx, [rdx + 1]
cmp byte [rdx], al
jne 0x1400117b3
xor r8d, r8d
nop
movzx eax, byte [rcx + r8]
mov byte [rdx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x1400117c0
mov ecx, 0x1e
call fcn.140012abc
mov rcx, rax
xor r12d, r12d
mov qword [rax + 0xf], r12
mov dword [rax + 0x17], r12d
mov word [rax + 0x1b], r12w
mov byte [rax + 0x1d], r12b
mov dword [rax], 0x756f632f
mov dword [rax + 4], 0x7972746e
mov dword [rax + 8], 0x6d616e5f
mov word [rax + 0xc], 0x2f65
mov byte [rax + 0xe], r12b
lea rdx, [rbx - 1]
lea rdx, [rdx + 1]
cmp byte [rdx], r12b
jne 0x140011814
xor r8d, r8d
movzx eax, byte [rcx + r8]
mov byte [rdx + r8], al
lea r8, [r8 + 1]
test al, al
jne 0x140011820
call fcn.140012570
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x800000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r13
call qword [0x140040098]
mov r12, rax
test rax, rax
jne 0x14001186d
mov rcx, r14
call fcn.140012570
mov rcx, rbx
jmp 0x1400116b6
xor edx, edx
mov r8d, 0xc4
lea rcx, [rbp + 0x10]
call fcn.14002a9f0
lea r9, [rbp - 0x78]
mov r8d, 0xc4
lea rdx, [rbp + 0x10]
mov rcx, r12
call qword [0x1400400a0]
test eax, eax
jne 0x1400118a9
mov rcx, r14
call fcn.140012570
mov rcx, rbx
jmp 0x1400116b6
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r13
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call fcn.140012570
mov rcx, rbx
call fcn.140012570
lea rax, [rbp + 0x10]
nop
inc r15
cmp byte [rax + r15], 0
jne 0x1400118d0
cmp r15, 1
jae 0x140011927
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14001191a
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140011915
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011c18
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], 0
jmp 0x140011722
mov r8, r15
lea rdx, [rbp + 0x10]
jmp 0x1400116c8
lea rdx, [0x140039000]
lea rcx, [rbp + 0xe0]
call fcn.14001c240
lea rdx, [0x140039000]
xor ecx, ecx
call fcn.14001c240
lea rdx, [0x140039000]
xor ecx, ecx
call fcn.14001c240
lea rdx, [0x140039000]
xor ecx, ecx
call fcn.14001c240
lea rdx, [rax - 1]
lea rdx, [rdx + 1]
cmp byte [rdx], 0
jne 0x140011974
movzx ecx, word [0x140039004]
mov word [rdx], cx
lea rdx, [0x140039004]
mov rcx, rax
call fcn.14001c240
lea rdx, [0x140039004]
xor ecx, ecx
call fcn.14001c240
mov r12, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
xor r8d, r8d
lea rdx, [0x140038ca0]
lea rcx, [rsp + 0x40]
call fcn.1400019f0
nop
mov r14, r15
inc r14
cmp byte [r12 + r14], 0
jne 0x1400119d1
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140011a20
lea rax, [r14 + rcx]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.14002adb0
mov byte [r14 + rbx], 0
jmp 0x140011a35
mov qword [rsp + 0x20], r14
mov r9, r12
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140009540
mov eax, 1
mov rbx, qword [rsp + 0x50]
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
sub rbx, rax
lea r8, [rbx + 1]
lea rdx, [rcx + rax]
call fcn.14002adb0
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.1400092a0
nop
lea r14, [rsp + 0x60]
mov r13, qword [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova r14, r13
mov r12, qword [rsp + 0x70]
cmp r12, 1
jb 0x140011ae8
lea rbx, [r14 + r12]
mov r8, rbx
sub r8, r14
mov edx, 0x22
mov rcx, r14
call fcn.14002b510
test rax, rax
je 0x140011ae8
cmp byte [rax], 0x22
jne 0x140011ac0
xor ecx, ecx
jmp 0x140011ac5
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140011c04
inc rax
mov r8, rbx
sub r8, rax
mov edx, 0x22
mov rcx, rax
call fcn.14002b510
test rax, rax
jne 0x140011ab7
mov rax, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
cmp r12, rax
cmovb rax, r12
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, r13
mov r8, rax
lea rcx, [rbp - 0x70]
call fcn.1400019f0
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rsi + 0x10], xmm1
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x140011b6a
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011b65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011c24
call fcn.140012570
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140011bb6
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011bb1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011c0c
call fcn.140012570
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14001171b
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140011716
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140011c12
jmp 0x140011713
sub rax, r14
jmp 0x140011aeb
call fcn.140019138
nop
call fcn.140019138
int3
call fcn.140019138
int3
call fcn.140019138
nop
call fcn.140019138
int3