Function at 0x140002910
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
movabs rax, 0x7163417470797243
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
push rdi
movabs rdi, 0x3233697061766441
push rsi
push rbx
sub rsp, 0x138
mov rsi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x11b], rax
lea rcx, [rsp + 0x61]
movabs rax, 0x746e6f4365726975
mov qword [rsp + 0x190], r8
mov qword [rsp + 0x198], r9
mov dword [rsp + 0x188], edx
mov qword [rsp + 0x123], rax
mov dword [rsp + 0x12b], 0x57747865
mov byte [rsp + 0x12f], 0
mov qword [rsp + 0x61], rdi
mov dword [rsp + 0x69], 0x6c6c642e
mov byte [rsp + 0x6d], 0
call rsi
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x11b]
mov rcx, rax
call rbx
lea rcx, [rsp + 0x6e]
mov qword [rsp + 0x6e], rdi
mov qword [rsp + 0x38], rax
movabs rax, 0x6572437470797243
mov qword [rsp + 0xe6], rax
movabs rax, 0x68736148657461
mov qword [rsp + 0xee], rax
mov dword [rsp + 0x76], 0x6c6c642e
mov byte [rsp + 0x7a], 0
call rsi
lea rdx, [rsp + 0xe6]
mov rcx, rax
call rbx
lea rcx, [rsp + 0x7b]
mov qword [rsp + 0x7b], rdi
mov qword [rsp + 0x30], rax
movabs rax, 0x7361487470797243
mov qword [rsp + 0xc9], rax
mov dword [rsp + 0xd1], 0x74614468
mov word [rsp + 0xd5], 0x61
mov dword [rsp + 0x83], 0x6c6c642e
mov byte [rsp + 0x87], 0
call rsi
lea rdx, [rsp + 0xc9]
mov rcx, rax
call rbx
lea rcx, [rsp + 0x88]
mov dword [rsp + 0xdf], 0x4b657669
mov r14, rax
mov byte [rsp + 0xe5], 0
movabs rax, 0x7265447470797243
mov qword [rsp + 0xd7], rax
mov word [rsp + 0xe3], 0x7965
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x90], 0x6c6c642e
mov byte [rsp + 0x94], 0
call rsi
lea rdx, [rsp + 0xd7]
mov rcx, rax
call rbx
lea rcx, [rsp + 0xa2]
mov dword [rsp + 0x9d], 0x74707972
mov r13, rax
movabs rax, 0x6365447470797243
mov byte [rsp + 0xa1], 0
mov qword [rsp + 0x95], rax
mov qword [rsp + 0xa2], rdi
mov dword [rsp + 0xaa], 0x6c6c642e
mov byte [rsp + 0xae], 0
call rsi
lea rdx, [rsp + 0x95]
mov rcx, rax
call rbx
lea rcx, [rsp + 0xaf]
mov dword [rsp + 0x117], 0x747865
mov rbp, rax
mov qword [rsp + 0xaf], rdi
movabs rax, 0x6c65527470797243
mov qword [rsp + 0x107], rax
movabs rax, 0x746e6f4365736165
mov qword [rsp + 0x10f], rax
mov dword [rsp + 0xb7], 0x6c6c642e
mov byte [rsp + 0xbb], 0
call rsi
lea rdx, [rsp + 0x107]
mov rcx, rax
call rbx
lea rcx, [rsp + 0xbc]
mov byte [rsp + 0x106], 0
mov r15, rax
mov qword [rsp + 0xbc], rdi
movabs rax, 0x7365447470797243
mov qword [rsp + 0xf6], rax
movabs rax, 0x68736148796f7274
mov qword [rsp + 0xfe], rax
mov dword [rsp + 0xc4], 0x6c6c642e
mov byte [rsp + 0xc8], 0
call rsi
lea rdx, [rsp + 0xf6]
mov rcx, rax
call rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
mov r11, qword [rsp + 0x38]
mov rbx, rax
lea rcx, [rsp + 0x48]
mov r9d, 0x18
call r11
mov r10, qword [rsp + 0x30]
test eax, eax
jne 0x140002c10
or eax, 0xffffffff
jmp 0x140002cba
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call r10
test eax, eax
je 0x140002c08
xor r9d, r9d
mov r8d, dword [rsp + 0x198]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x190]
call r14
test eax, eax
je 0x140002c08
lea rax, [rsp + 0x58]
xor r9d, r9d
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
call r13
test eax, eax
je 0x140002c08
lea rax, [rsp + 0x188]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], r12
call rbp
test eax, eax
je 0x140002c08
xor edx, edx
mov rcx, qword [rsp + 0x48]
call r15
mov rcx, qword [rsp + 0x50]
call rbx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret