Function at 0x140002eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x288
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9, [0x14006dd18]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x14006dd28]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x50]
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm11, xmmword [rbp + 0x80]
movsd xmm10, qword [rbp + 0x90]
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm9, xmmword [rbp + 0x68]
movsd xmm8, qword [rbp + 0x78]
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm7, xmmword [rbp + 0x50]
movsd xmm6, qword [rbp + 0x60]
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movaps xmmword [rbp + 0x100], xmm11
movsd qword [rbp + 0x110], xmm10
movaps xmmword [rbp - 0x40], xmm9
movsd qword [rbp - 0x30], xmm8
movaps xmmword [rbp - 0x20], xmm7
movsd qword [rbp - 0x10], xmm6
movups xmm0, xmmword [rbp + 0x38]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rbp + 0x48]
movsd qword [rbp + 0x10], xmm1
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x20]
lea rdx, [rbp]
mov rcx, qword [rbp + 0x1d0]
call rbx
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x38]
lea ecx, [rdi + 0x19]
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x140003086
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x140088820]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140003514
jmp 0x140003089
mov rbx, r15
mov qword [rbp + 0xc8], rbx
test rbx, rbx
je 0x14000351f
lea r8, [rbp - 0x68]
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x1d0]
call rsi
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400030e6
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400030c7
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400030d9
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rcx]
lea r8, [rbp + 0x1c8]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1d8]
call qword [rax + 0x38]
mov dword [rsp + 0x50], 0x696d6461
mov dword [rsp + 0x54], 0x7473696e
mov dword [rsp + 0x58], 0x6f746172
mov word [rsp + 0x5c], 0x72
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x50]
mov ecx, 0x18
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x140003170
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x50]
call fcn.14000bdd0
mov qword [rbx], rax
jmp 0x140003173
mov rbx, r15
mov qword [rbp + 0xd0], rbx
test rbx, rbx
je 0x14000351f
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x1d8]
call rsi
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400031cc
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400031ad
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400031bf
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
mov edx, 3
call qword [rax + 0x70]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x90]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
call qword [rax + 0x58]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0xb0]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp + 0xd8]
call qword [rax + 0x138]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0xe0]
mov edx, 9
call qword [rax + 0x50]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + 0x88]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
xor edx, edx
call qword [rax + 0x60]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, str.MbLk
call qword [rax]
movdqa xmm0, xmmword [0x140088d60]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x65614474
mov dword [rsp + 0x74], 0x2e6e6f6d
mov dword [rsp + 0x78], 0x657865
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x58]
mov ecx, 0x18
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x1400032f5
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x60]
call fcn.14000bdd0
mov qword [rbx], rax
jmp 0x1400032f8
mov rbx, r15
mov qword [rbp + 0xe8], rbx
test rbx, rbx
je 0x14000351f
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x70]
call rsi
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000334e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000332f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140003341
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x88]
mov eax, 8
mov word [rbp + 0x20], ax
lea rcx, [0x14008871c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x14000352a
movups xmm6, xmmword [rbp + 0x20]
movsd xmm7, qword [rbp + 0x30]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm8, xmmword [rbp + 0xb0]
movsd xmm9, qword [rbp + 0xc0]
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm10, xmmword [rbp + 0x98]
movsd xmm11, qword [rbp + 0xa8]
mov r14, qword [rbp + 0x1c8]
mov ecx, 0x18
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x140003402
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.ClientDaemon
call fcn.14000bdd0
mov qword [rbx], rax
jmp 0x140003405
mov rbx, r15
mov qword [rbp + 0xf0], rbx
test rbx, rbx
je 0x140003509
movaps xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
movaps xmmword [rbp - 0x20], xmm8
movsd qword [rbp - 0x10], xmm9
movaps xmmword [rbp - 0x40], xmm10
movsd qword [rbp - 0x30], xmm11
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, r14
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x68]
call rsi
nop
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x1400034b1
mov rcx, qword [rbx]
test rcx, rcx
je 0x140003491
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400034a3
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
nop
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r11, [rsp + 0x288]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14000bcd0
nop
mov ecx, 0x8007000e
call fcn.14000bcd0
nop
mov ecx, 0x8007000e
call fcn.14000bcd0
int3
mov ecx, 0x8007000e
call fcn.14000bcd0
int3