Function at 0x18001c340
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
cmp qword [0x18007ba98], 0
mov dword [rsp + 0x40], 0x72657375
mov dword [rsp + 0x44], 0x642e3233
mov dword [rsp + 0x48], 0x6c6c
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0x65726353
mov dword [rsp + 0x24], 0x6f546e65
mov dword [rsp + 0x28], 0x65696c43
mov qword [rsp + 0x2c], 0x746e
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c3d7
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c3d7
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba98]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba98], rcx
cmp qword [0x18007ba30], 0
mov dword [rsp + 0x20], 0x65696c43
mov dword [rsp + 0x24], 0x6f54746e
mov dword [rsp + 0x28], 0x65726353
mov qword [rsp + 0x2c], 0x6e65
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c443
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c443
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba30]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba30], rcx
cmp qword [0x18007ba20], 0
mov dword [rsp + 0x20], 0x4d746547
mov dword [rsp + 0x24], 0x61737365
mov dword [rsp + 0x28], 0x6f506567
mov qword [rsp + 0x2c], 0x73
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c4af
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c4af
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba20]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba20], rcx
cmp qword [0x18007ba80], 0
mov dword [rsp + 0x20], 0x43746547
mov dword [rsp + 0x24], 0x6f737275
mov dword [rsp + 0x28], 0x666e4972
mov qword [rsp + 0x2c], 0x6f
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c51b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c51b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba80]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba80], rcx
cmp qword [0x18007ba78], 0
mov dword [rsp + 0x20], 0x70696c43
mov dword [rsp + 0x24], 0x73727543
mov qword [rsp + 0x28], 0x726f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c587
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c587
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba78]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba78], rcx
cmp qword [0x18007ba60], 0
mov dword [rsp + 0x20], 0x6b656550
mov dword [rsp + 0x24], 0x7373654d
mov qword [rsp + 0x28], 0x41656761
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c5f3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c5f3
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba60]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba60], rcx
cmp qword [0x18007b9f0], 0
mov dword [rsp + 0x20], 0x6b656550
mov dword [rsp + 0x24], 0x7373654d
mov qword [rsp + 0x28], 0x57656761
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c65f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c65f
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9f0]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9f0], rcx
cmp qword [0x18007b9f8], 0
mov dword [rsp + 0x20], 0x646e6553
mov dword [rsp + 0x24], 0x75706e49
mov qword [rsp + 0x28], 0x74
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c6cb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c6cb
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9f8]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9f8], rcx
cmp qword [0x18007ba40], 0
mov dword [rbp - 0x60], 0x43746553
mov dword [rbp - 0x5c], 0x75747061
mov word [rbp - 0x58], 0x6572
mov byte [rbp - 0x56], 0
jne 0x18001c71f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c71f
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba40]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba40], rcx
cmp qword [0x18007ba28], 0
mov dword [rbp], 0x656c6552
mov dword [rbp + 4], 0x43657361
mov dword [rbp + 8], 0x75747061
mov word [rbp + 0xc], 0x6572
mov byte [rbp + 0xe], 0
jne 0x18001c77a
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c77a
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba28]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba28], rcx
cmp qword [0x18007ba50], 0
mov dword [rsp + 0x20], 0x43746547
mov dword [rsp + 0x24], 0x75747061
mov qword [rsp + 0x28], 0x6572
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c7e6
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c7e6
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba50]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba50], rcx
cmp qword [0x18007ba10], 0
mov dword [rsp + 0x20], 0x776f6853
mov dword [rsp + 0x24], 0x646e6957
mov qword [rsp + 0x28], 0x776f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c852
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c852
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba10]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba10], rcx
cmp qword [0x18007b9e0], 0
mov dword [rbp + 0x10], 0x46746553
mov dword [rbp + 0x14], 0x6765726f
mov dword [rbp + 0x18], 0x6e756f72
mov dword [rbp + 0x1c], 0x6e695764
mov dword [rbp + 0x20], 0x776f64
jne 0x18001c8b1
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c8b1
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9e0]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9e0], rcx
cmp qword [0x18007ba88], 0
mov dword [rbp - 0x30], 0x57746553
mov dword [rbp - 0x2c], 0x6f646e69
mov dword [rbp - 0x28], 0x736f5077
mov byte [rbp - 0x24], 0
jne 0x18001c906
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c906
lea rdx, [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba88]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba88], rcx
cmp qword [0x18007ba48], 0
mov dword [rsp + 0x40], 0x33696467
mov dword [rsp + 0x44], 0x6c642e32
mov dword [rsp + 0x48], 0x6c
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0x43746547
mov dword [rsp + 0x24], 0x4270696c
mov qword [rsp + 0x28], 0x786f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c98f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c98f
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba48]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba48], rcx
cmp qword [0x18007b9e8], 0
mov dword [rsp + 0x20], 0x656c6553
mov dword [rsp + 0x24], 0x6c437463
mov dword [rsp + 0x28], 0x61507069
mov qword [rsp + 0x2c], 0x6874
mov qword [rsp + 0x34], 0
mov byte [rsp + 0x3c], 0
jne 0x18001c9fb
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001c9fb
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007b9e8]
test rax, rax
cmovne rcx, rax
mov qword [0x18007b9e8], rcx
cmp qword [0x18007ba68], 0
mov dword [rsp + 0x40], 0x6c64746e
mov dword [rsp + 0x44], 0x6c642e6c
mov dword [rsp + 0x48], 0x6c
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x20], 0x7551775a
mov dword [rsp + 0x24], 0x56797265
mov dword [rsp + 0x28], 0x75747269
mov dword [rsp + 0x2c], 0x654d6c61
mov qword [rsp + 0x30], 0x79726f6d
mov dword [rsp + 0x38], 0
mov byte [rsp + 0x3c], 0
jne 0x18001ca8b
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001ca8b
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba68]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba68], rcx
mov rdx, qword [0x18007c0b8]
mov rax, qword [0x18007c0b0]
xor ecx, ecx
sub rdx, rax
mov r9d, ecx
sar rdx, 2
test edx, edx
je 0x18001cb50
mov r8, rax
cmp dword [r8], 0x36623354
je 0x18001cae4
inc r9d
add r8, 4
cmp r9d, edx
jb 0x18001cab0
test edx, edx
je 0x18001cb50
nop dword [rax]
cmp dword [rax], 0x8b37daa
je 0x18001cae4
inc ecx
add rax, 4
cmp ecx, edx
jb 0x18001cad0
jmp 0x18001cb50
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x150], rbx
mov dword [rsp + 0x40], 0x6c64746e
mov dword [rsp + 0x44], 0x6c642e6c
mov dword [rsp + 0x48], 0x6c
mov byte [rsp + 0x4c], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.18001aea0
mov rbx, rax
test rax, rax
je 0x18001cb48
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, qword [0x18007ba68]
add rdx, rbx
sub rdx, rax
mov qword [0x18007ba58], rdx
mov rbx, qword [rsp + 0x150]
cmp qword [0x18007ba90], 0
mov dword [rsp + 0x70], 0x72657375
mov dword [rsp + 0x74], 0x642e3233
mov word [rsp + 0x78], 0x6c6c
mov byte [rsp + 0x7a], 0
mov dword [rbp - 0x10], 0x6c6c6143
mov dword [rbp - 0xc], 0x7478654e
mov dword [rbp - 8], 0x6b6f6f48
mov word [rbp - 4], 0x7845
mov byte [rbp - 2], 0
jne 0x18001cbc7
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cbc7
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba90]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba90], rcx
cmp qword [0x18007ba38], 0
mov dword [rbp - 0x80], 0x6e72656b
mov dword [rbp - 0x7c], 0x32336c65
mov dword [rbp - 0x78], 0x6c6c642e
mov byte [rbp - 0x74], 0
mov dword [rbp - 0x40], 0x54746547
mov dword [rbp - 0x3c], 0x436b6369
mov dword [rbp - 0x38], 0x746e756f
mov byte [rbp - 0x34], 0
jne 0x18001cc34
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cc34
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba38]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba38], rcx
cmp qword [0x18007ba00], 0
mov dword [rbp + 0x28], 0x72657551
mov dword [rbp + 0x2c], 0x72655079
mov dword [rbp + 0x30], 0x6d726f66
mov dword [rbp + 0x34], 0x65636e61
mov dword [rbp + 0x38], 0x6e756f43
mov dword [rbp + 0x3c], 0x726574
jne 0x18001cc99
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cc99
lea rdx, [rbp + 0x28]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba00]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba00], rcx
cmp qword [0x18007ba70], 0
mov dword [rsp + 0x60], 0x6d6e6957
mov dword [rsp + 0x64], 0x6c642e6d
mov word [rsp + 0x68], 0x6c
mov dword [rbp - 0x50], 0x656d6974
mov dword [rbp - 0x4c], 0x54746547
mov dword [rbp - 0x48], 0x656d69
jne 0x18001cd01
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cd01
lea rdx, [rbp - 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba70]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba70], rcx
cmp qword [0x18007ba08], 0
mov dword [rbp - 0x70], 0x54746553
mov dword [rbp - 0x6c], 0x72656d69
mov byte [rbp - 0x68], 0
jne 0x18001cd4f
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cd4f
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba08]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba08], rcx
cmp qword [0x18007ba18], 0
mov dword [rbp - 0x20], 0x656d6974
mov dword [rbp - 0x1c], 0x45746553
mov dword [rbp - 0x18], 0x746e6576
mov byte [rbp - 0x14], 0
jne 0x18001cda4
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x18001cda4
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18007ba18]
test rax, rax
cmovne rcx, rax
mov qword [0x18007ba18], rcx
mov eax, 1
add rsp, 0x140
pop rbp
ret