Function at 0x140002c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x218
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov dword [rsp + 0x80], 0
mov byte [rsp + 0x1e0], 0x4e
mov byte [rsp + 0x1e1], 0x74
mov byte [rsp + 0x1e2], 0x51
mov byte [rsp + 0x1e3], 0x75
mov byte [rsp + 0x1e4], 0x65
mov byte [rsp + 0x1e5], 0x72
mov byte [rsp + 0x1e6], 0x79
mov byte [rsp + 0x1e7], 0x49
mov byte [rsp + 0x1e8], 0x6e
mov byte [rsp + 0x1e9], 0x66
mov byte [rsp + 0x1ea], 0x6f
mov byte [rsp + 0x1eb], 0x72
mov byte [rsp + 0x1ec], 0x6d
mov byte [rsp + 0x1ed], 0x61
mov byte [rsp + 0x1ee], 0x74
mov byte [rsp + 0x1ef], 0x69
mov byte [rsp + 0x1f0], 0x6f
mov byte [rsp + 0x1f1], 0x6e
mov byte [rsp + 0x1f2], 0x50
mov byte [rsp + 0x1f3], 0x72
mov byte [rsp + 0x1f4], 0x6f
mov byte [rsp + 0x1f5], 0x63
mov byte [rsp + 0x1f6], 0x65
mov byte [rsp + 0x1f7], 0x73
mov byte [rsp + 0x1f8], 0x73
mov byte [rsp + 0x1f9], 0
mov byte [rsp + 0x60], 0x50
mov byte [rsp + 0x61], 0x72
mov byte [rsp + 0x62], 0x6f
mov byte [rsp + 0x63], 0x63
mov byte [rsp + 0x64], 0x65
mov byte [rsp + 0x65], 0x73
mov byte [rsp + 0x66], 0x73
mov byte [rsp + 0x67], 0x48
mov byte [rsp + 0x68], 0x61
mov byte [rsp + 0x69], 0x6e
mov byte [rsp + 0x6a], 0x64
mov byte [rsp + 0x6b], 0x6c
mov byte [rsp + 0x6c], 0x65
mov byte [rsp + 0x6d], 0x49
mov byte [rsp + 0x6e], 0x6e
mov byte [rsp + 0x6f], 0x66
mov byte [rsp + 0x70], 0x6f
mov byte [rsp + 0x71], 0x72
mov byte [rsp + 0x72], 0x6d
mov byte [rsp + 0x73], 0x61
mov byte [rsp + 0x74], 0x74
mov byte [rsp + 0x75], 0x69
mov byte [rsp + 0x76], 0x6f
mov byte [rsp + 0x77], 0x6e
mov byte [rsp + 0x78], 0
mov byte [rsp + 0x1d0], 0x4e
mov byte [rsp + 0x1d1], 0x74
mov byte [rsp + 0x1d2], 0x51
mov byte [rsp + 0x1d3], 0x75
mov byte [rsp + 0x1d4], 0x65
mov byte [rsp + 0x1d5], 0x72
mov byte [rsp + 0x1d6], 0x79
mov byte [rsp + 0x1d7], 0x4f
mov byte [rsp + 0x1d8], 0x62
mov byte [rsp + 0x1d9], 0x6a
mov byte [rsp + 0x1da], 0x65
mov byte [rsp + 0x1db], 0x63
mov byte [rsp + 0x1dc], 0x74
mov byte [rsp + 0x1dd], 0
mov byte [rsp + 0x48], 0x4f
mov byte [rsp + 0x49], 0x62
mov byte [rsp + 0x4a], 0x6a
mov byte [rsp + 0x4b], 0x65
mov byte [rsp + 0x4c], 0x63
mov byte [rsp + 0x4d], 0x74
mov byte [rsp + 0x4e], 0x54
mov byte [rsp + 0x4f], 0x79
mov byte [rsp + 0x50], 0x70
mov byte [rsp + 0x51], 0x65
mov byte [rsp + 0x52], 0x49
mov byte [rsp + 0x53], 0x6e
mov byte [rsp + 0x54], 0x66
mov byte [rsp + 0x55], 0x6f
mov byte [rsp + 0x56], 0x72
mov byte [rsp + 0x57], 0x6d
mov byte [rsp + 0x58], 0x61
mov byte [rsp + 0x59], 0x74
mov byte [rsp + 0x5a], 0x69
mov byte [rsp + 0x5b], 0x6f
mov byte [rsp + 0x5c], 0x6e
mov byte [rsp + 0x5d], 0
mov edx, 0x18
lea rcx, [rsp + 0x1b8]
call fcn.14000d0bc
lea rax, [rsp + 0x150]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x1e0]
mov rcx, qword [rsp + 0x90]
call fcn.140002540
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x230]
call fcn.140008754
mov dword [rsp + 0x20], 0x33
mov r9, qword [rax]
lea r8, [0x1400436e4]
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x1b8]
call fcn.140002188
nop
lea rcx, [rsp + 0x1b8]
call fcn.140004b5c
mov qword [rsp + 0x88], rax
mov edx, 0x10
lea rcx, [rsp + 0x190]
call fcn.14000d0bc
lea rcx, [rsp + 0x190]
call fcn.140002658
nop
mov edx, 0x18
lea rcx, [rsp + 0x1a0]
call fcn.14000d0bc
lea rcx, [rsp + 0x1a0]
call fcn.1400026dc
nop
mov dword [rsp + 0x44], 0
jmp 0x140002f7c
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x88]
cmp rax, qword [rcx]
jae 0x1400031bc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0xa0], rax
movsxd rcx, dword [rsp + 0x44]
imul rcx, rcx, 0x28
mov qword [rsp + 0xa8], rcx
mov rcx, qword [rsp + 0x230]
call fcn.140008754
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov ecx, dword [rsp + 0x238]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xa0]
mov r9, rcx
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xa8]
mov r8, qword [rcx + rdx + 0x10]
mov rdx, qword [rax]
lea rcx, [rsp + 0xf0]
call fcn.14001c9d8
mov qword [rsp + 0xb0], rax
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsp + 0x190]
call fcn.14000298c
lea rcx, [rsp + 0xf0]
call fcn.1400028ec
lea rax, [rsp + 0x170]
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x1d0]
mov rcx, qword [rsp + 0xb8]
call fcn.140002540
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x190]
call fcn.140008754
mov dword [rsp + 0x20], 2
mov r9, qword [rax]
mov r8, qword [sym.imp.ntdll.dll_NtQueryObject]
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x100]
call fcn.140001fc8
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
lea rcx, [rsp + 0x1a0]
call fcn.1400029d4
lea rcx, [rsp + 0x100]
call fcn.140002910
lea rcx, [rsp + 0x1a0]
call fcn.140004b5c
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0x130]
call fcn.140002590
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x228]
call fcn.1400017d0
mov byte [rsp + 0x40], al
mov al, byte [rsp + 0x40]
mov byte [rsp + 0x41], al
lea rcx, [rsp + 0x130]
call fcn.1400028c4
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x140003140
jmp 0x140002f72
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x220]
call fcn.1400025e0
mov eax, dword [rsp + 0x80]
or eax, 1
mov dword [rsp + 0x80], eax
lea rcx, [rsp + 0x1a0]
call fcn.140002910
nop
lea rcx, [rsp + 0x190]
call fcn.1400028ec
nop
lea rcx, [rsp + 0x1b8]
call fcn.140002910
nop
mov rcx, qword [rsp + 0x228]
call fcn.1400028c4
nop
mov rcx, qword [rsp + 0x230]
call fcn.1400028ec
mov rax, qword [rsp + 0x220]
jmp 0x140003227
lea rdx, str.Failed_to_hijack_object_handle
lea rcx, [rsp + 0x118]
call fcn.140002864
lea rdx, [0x140084fe8]
lea rcx, [rsp + 0x118]
call fcn.1400452d8
nop
lea rcx, [rsp + 0x1a0]
call fcn.140002910
lea rcx, [rsp + 0x190]
call fcn.1400028ec
lea rcx, [rsp + 0x1b8]
call fcn.140002910
mov rcx, qword [rsp + 0x228]
call fcn.1400028c4
mov rcx, qword [rsp + 0x230]
call fcn.1400028ec
nop
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.140043850
add rsp, 0x218
ret