Function at 0x4017bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x7b1a0
call fcn.00405680
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.004042b0
lea rdx, [rbp + 0x7b020]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x7aff0]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x7afc0]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov word [rbp + 0x7afa0], 0x6c
mov word [rbp + 0x7afa2], 0x6c
mov word [rbp + 0x7afa4], 0x64
mov word [rbp + 0x7afa6], 0x2e
mov word [rbp + 0x7afa8], 0x33
mov word [rbp + 0x7afaa], 0x32
mov word [rbp + 0x7afac], 0x65
mov word [rbp + 0x7afae], 0x73
mov word [rbp + 0x7afb0], 0x55
mov word [rbp + 0x7afb2], 0
mov word [rbp + 0x7af80], 0x6c
mov word [rbp + 0x7af82], 0x6c
mov word [rbp + 0x7af84], 0x64
mov word [rbp + 0x7af86], 0x2e
mov word [rbp + 0x7af88], 0x32
mov word [rbp + 0x7af8a], 0x33
mov word [rbp + 0x7af8c], 0x6c
mov word [rbp + 0x7af8e], 0x65
mov word [rbp + 0x7af90], 0x6e
mov word [rbp + 0x7af92], 0x72
mov word [rbp + 0x7af94], 0x65
mov word [rbp + 0x7af96], 0x4b
mov word [rbp + 0x7af98], 0
mov word [rbp + 0x7af60], 0x6c
mov word [rbp + 0x7af62], 0x6c
mov word [rbp + 0x7af64], 0x64
mov word [rbp + 0x7af66], 0x2e
mov word [rbp + 0x7af68], 0x6c
mov word [rbp + 0x7af6a], 0x6c
mov word [rbp + 0x7af6c], 0x64
mov word [rbp + 0x7af6e], 0x74
mov word [rbp + 0x7af70], 0x6e
mov word [rbp + 0x7af72], 0
lea rax, [rbp + 0x7afa0]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x7af80]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x7af60]
mov rcx, rax
call fcn.0040172d
mov byte [rbp + 0x7af55], 0x6c
mov byte [rbp + 0x7af56], 0x6c
mov byte [rbp + 0x7af57], 0x44
mov byte [rbp + 0x7af58], 0x64
mov byte [rbp + 0x7af59], 0x61
mov byte [rbp + 0x7af5a], 0x6f
mov byte [rbp + 0x7af5b], 0x4c
mov byte [rbp + 0x7af5c], 0x72
mov byte [rbp + 0x7af5d], 0x64
mov byte [rbp + 0x7af5e], 0x4c
mov byte [rbp + 0x7af5f], 0
mov byte [rbp + 0x7af4b], 0x6c
mov byte [rbp + 0x7af4c], 0x6c
mov byte [rbp + 0x7af4d], 0x64
mov byte [rbp + 0x7af4e], 0x2e
mov byte [rbp + 0x7af4f], 0x6c
mov byte [rbp + 0x7af50], 0x6c
mov byte [rbp + 0x7af51], 0x64
mov byte [rbp + 0x7af52], 0x74
mov byte [rbp + 0x7af53], 0x6e
mov byte [rbp + 0x7af54], 0
mov byte [rbp + 0x7af3e], 0x6c
mov byte [rbp + 0x7af3f], 0x6c
mov byte [rbp + 0x7af40], 0x64
mov byte [rbp + 0x7af41], 0x2e
mov byte [rbp + 0x7af42], 0x32
mov byte [rbp + 0x7af43], 0x33
mov byte [rbp + 0x7af44], 0x6c
mov byte [rbp + 0x7af45], 0x65
mov byte [rbp + 0x7af46], 0x6e
mov byte [rbp + 0x7af47], 0x72
mov byte [rbp + 0x7af48], 0x65
mov byte [rbp + 0x7af49], 0x4b
mov byte [rbp + 0x7af4a], 0
lea rax, [rbp + 0x7af55]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x7af4b]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x7af3e]
mov rcx, rax
call fcn.004016b0
lea rdx, [rbp + 0x7afa0]
lea rax, [rbp + 0x7b070]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x7af80]
lea rax, [rbp + 0x7b060]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x7af60]
lea rax, [rbp + 0x7b050]
mov rcx, rax
call fcn.004015e6
mov dword [rbp + 0x7b020], 0x30
mov qword [rbp + 0x7b028], 0
mov dword [rbp + 0x7b038], 0x40
lea rax, [rbp + 0x7b070]
mov qword [rbp + 0x7b030], rax
mov qword [rbp + 0x7b040], 0
mov qword [rbp + 0x7b048], 0
mov dword [rbp + 0x7aff0], 0x30
mov qword [rbp + 0x7aff8], 0
mov dword [rbp + 0x7b008], 0x40
lea rax, [rbp + 0x7b060]
mov qword [rbp + 0x7b000], rax
mov qword [rbp + 0x7b010], 0
mov qword [rbp + 0x7b018], 0
mov dword [rbp + 0x7afc0], 0x30
mov qword [rbp + 0x7afc8], 0
mov dword [rbp + 0x7afd8], 0x40
lea rax, [rbp + 0x7b050]
mov qword [rbp + 0x7afd0], rax
mov qword [rbp + 0x7afe0], 0
mov qword [rbp + 0x7afe8], 0
mov byte [rbp + 0x7af20], 0x41
mov byte [rbp + 0x7af21], 0x65
mov byte [rbp + 0x7af22], 0x6c
mov byte [rbp + 0x7af23], 0x64
mov byte [rbp + 0x7af24], 0x6e
mov byte [rbp + 0x7af25], 0x61
mov byte [rbp + 0x7af26], 0x48
mov byte [rbp + 0x7af27], 0x65
mov byte [rbp + 0x7af28], 0x6c
mov byte [rbp + 0x7af29], 0x75
mov byte [rbp + 0x7af2a], 0x64
mov byte [rbp + 0x7af2b], 0x6f
mov byte [rbp + 0x7af2c], 0x4d
mov byte [rbp + 0x7af2d], 0x74
mov byte [rbp + 0x7af2e], 0x65
mov byte [rbp + 0x7af2f], 0x47
mov byte [rbp + 0x7af30], 0
lea rax, [rbp + 0x7af20]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x7af3e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x7af20]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x7b110], rax
mov byte [rbp + 0x7af11], 0x73
mov byte [rbp + 0x7af12], 0x73
mov byte [rbp + 0x7af13], 0x65
mov byte [rbp + 0x7af14], 0x72
mov byte [rbp + 0x7af15], 0x64
mov byte [rbp + 0x7af16], 0x64
mov byte [rbp + 0x7af17], 0x41
mov byte [rbp + 0x7af18], 0x63
mov byte [rbp + 0x7af19], 0x6f
mov byte [rbp + 0x7af1a], 0x72
mov byte [rbp + 0x7af1b], 0x50
mov byte [rbp + 0x7af1c], 0x74
mov byte [rbp + 0x7af1d], 0x65
mov byte [rbp + 0x7af1e], 0x47
mov byte [rbp + 0x7af1f], 0
lea rax, [rbp + 0x7af11]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x7af3e]
mov rdx, qword [rbp + 0x7b110]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x7af11]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x7b108], rax
mov byte [rbp + 0x7af04], 0x63
mov byte [rbp + 0x7af05], 0x6f
mov byte [rbp + 0x7af06], 0x6c
mov byte [rbp + 0x7af07], 0x6c
mov byte [rbp + 0x7af08], 0x41
mov byte [rbp + 0x7af09], 0x6c
mov byte [rbp + 0x7af0a], 0x61
mov byte [rbp + 0x7af0b], 0x75
mov byte [rbp + 0x7af0c], 0x74
mov byte [rbp + 0x7af0d], 0x72
mov byte [rbp + 0x7af0e], 0x69
mov byte [rbp + 0x7af0f], 0x56
mov byte [rbp + 0x7af10], 0
lea rax, [rbp + 0x7af04]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x7af3e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x7af04]
mov r8, qword [rbp + 0x7b108]
mov rdx, rax
call r8
mov qword [rbp + 0x7b100], rax
mov byte [rbp + 0x7aef5], 0x74
mov byte [rbp + 0x7aef6], 0x63
mov byte [rbp + 0x7aef7], 0x65
mov byte [rbp + 0x7aef8], 0x74
mov byte [rbp + 0x7aef9], 0x6f
mov byte [rbp + 0x7aefa], 0x72
mov byte [rbp + 0x7aefb], 0x50
mov byte [rbp + 0x7aefc], 0x6c
mov byte [rbp + 0x7aefd], 0x61
mov byte [rbp + 0x7aefe], 0x75
mov byte [rbp + 0x7aeff], 0x74
mov byte [rbp + 0x7af00], 0x72
mov byte [rbp + 0x7af01], 0x69
mov byte [rbp + 0x7af02], 0x56
mov byte [rbp + 0x7af03], 0
lea rax, [rbp + 0x7aef5]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x7af3e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x7aef5]
mov r8, qword [rbp + 0x7b108]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0f8], rax
lea rax, [rbp + 0x7af4b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x7af55]
mov r8, qword [rbp + 0x7b108]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0f0], rax
mov byte [rbp + 0x7aef3], 0x49
mov byte [rbp + 0x7aef4], 0xbb
mov byte [rbp + 0x7aeeb], 0xde
mov byte [rbp + 0x7aeec], 0xad
mov byte [rbp + 0x7aeed], 0xbe
mov byte [rbp + 0x7aeee], 0xef
mov byte [rbp + 0x7aeef], 0xde
mov byte [rbp + 0x7aef0], 0xad
mov byte [rbp + 0x7aef1], 0xbe
mov byte [rbp + 0x7aef2], 0xef
mov byte [rbp + 0x7aee7], 0x41
mov byte [rbp + 0x7aee8], 0xff
mov byte [rbp + 0x7aee9], 0xe3
mov byte [rbp + 0x7aeea], 0xc3
mov rax, qword [rbp + 0x7b0f0]
add rax, 5
mov qword [rbp + 0x7b0e8], rax
lea rax, [rbp + 0x7aeeb]
mov rdx, qword [rbp + 0x7b0e8]
mov qword [rax], rdx
mov rax, qword [rbp + 0x7b100]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x7b0e0], rax
mov rax, qword [rbp + 0x7b0e0]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.00401550
mov rax, qword [rbp + 0x7b0e0]
lea rcx, [rax + 5]
lea rax, [rbp + 0x7aef3]
mov r8d, 2
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x7b0e0]
lea rcx, [rax + 7]
lea rax, [rbp + 0x7aeeb]
mov r8d, 8
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x7b0e0]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x7aee7]
mov r8d, 4
mov rdx, rax
call fcn.00401550
mov dword [rbp + 0x7aee0], 0
lea rdx, [rbp + 0x7aee0]
mov rcx, qword [rbp + 0x7b0e0]
mov rax, qword [rbp + 0x7b0f8]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
call rax
mov rax, qword [rbp + 0x7b0e0]
mov qword [rbp + 0x7b0d8], rax
mov qword [rbp + 0x7aed8], 0
lea rcx, [rbp + 0x7aed8]
lea rdx, [rbp + 0x7b070]
mov rax, qword [rbp + 0x7b0d8]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x7aed0], 0
lea rcx, [rbp + 0x7aed0]
lea rdx, [rbp + 0x7b060]
mov rax, qword [rbp + 0x7b0d8]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x7aec8], 0
lea rcx, [rbp + 0x7aec8]
lea rdx, [rbp + 0x7b050]
mov rax, qword [rbp + 0x7b0d8]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rcx, qword [rbp + 0x7aed0]
lea rax, [rbp + 0x7af11]
mov r8, qword [rbp + 0x7b108]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0d0], rax
mov rcx, qword [rbp + 0x7aed0]
lea rax, [rbp + 0x7af04]
mov r8, qword [rbp + 0x7b0d0]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0c8], rax
mov rcx, qword [rbp + 0x7aed0]
lea rax, [rbp + 0x7aef5]
mov r8, qword [rbp + 0x7b0d0]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0c0], rax
mov byte [rbp + 0x7aeb0], 0x79
mov byte [rbp + 0x7aeb1], 0x72
mov byte [rbp + 0x7aeb2], 0x6f
mov byte [rbp + 0x7aeb3], 0x6d
mov byte [rbp + 0x7aeb4], 0x65
mov byte [rbp + 0x7aeb5], 0x4d
mov byte [rbp + 0x7aeb6], 0x73
mov byte [rbp + 0x7aeb7], 0x73
mov byte [rbp + 0x7aeb8], 0x65
mov byte [rbp + 0x7aeb9], 0x63
mov byte [rbp + 0x7aeba], 0x6f
mov byte [rbp + 0x7aebb], 0x72
mov byte [rbp + 0x7aebc], 0x50
mov byte [rbp + 0x7aebd], 0x65
mov byte [rbp + 0x7aebe], 0x74
mov byte [rbp + 0x7aebf], 0x69
mov byte [rbp + 0x7aec0], 0x72
mov byte [rbp + 0x7aec1], 0x57
mov byte [rbp + 0x7aec2], 0
lea rax, [rbp + 0x7aeb0]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x7aed0]
lea rax, [rbp + 0x7aeb0]
mov r8, qword [rbp + 0x7b0d0]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0b8], rax
mov byte [rbp + 0x7ae90], 0x73
mov byte [rbp + 0x7ae91], 0x73
mov byte [rbp + 0x7ae92], 0x65
mov byte [rbp + 0x7ae93], 0x63
mov byte [rbp + 0x7ae94], 0x6f
mov byte [rbp + 0x7ae95], 0x72
mov byte [rbp + 0x7ae96], 0x50
mov byte [rbp + 0x7ae97], 0x74
mov byte [rbp + 0x7ae98], 0x6e
mov byte [rbp + 0x7ae99], 0x65
mov byte [rbp + 0x7ae9a], 0x72
mov byte [rbp + 0x7ae9b], 0x72
mov byte [rbp + 0x7ae9c], 0x75
mov byte [rbp + 0x7ae9d], 0x43
mov byte [rbp + 0x7ae9e], 0x74
mov byte [rbp + 0x7ae9f], 0x65
mov byte [rbp + 0x7aea0], 0x47
mov byte [rbp + 0x7aea1], 0
lea rax, [rbp + 0x7ae90]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x7aed0]
lea rax, [rbp + 0x7ae90]
mov r8, qword [rbp + 0x7b0d0]
mov rdx, rax
call r8
mov qword [rbp + 0x7b0b0], rax
lea rax, [rbp + 0xe0]
lea rdx, str.b947778e_1810_8b95_b12e_3a9beff709d0
mov ecx, 0x7ada8
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x7b0ac], 0xf5b5
mov eax, dword [rbp + 0x7b0ac]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x7b0a0], rax
cmp qword [rbp + 0x7b0a0], 0
jne 0x402289
mov eax, 0xffffffff
jmp 0x40252c
mov dword [rbp + 0x7b11c], 0
jmp 0x4022f9
mov eax, dword [rbp + 0x7b11c]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x7b0a0]
add rdx, rax
mov eax, dword [rbp + 0x7b11c]
cdqe
mov rax, qword [rbp + rax*8 + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x7b09c], eax
cmp dword [rbp + 0x7b09c], 0
je 0x4022f2
mov rax, qword [rbp + 0x7b0a0]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x40252c
add dword [rbp + 0x7b11c], 1
mov eax, dword [rbp + 0x7b11c]
cmp eax, dword [rbp + 0x7b0ac]
jl 0x402295
mov eax, dword [rbp + 0x7b0ac]
cdqe
shl eax, 4
mov dword [rbp + 0x7b098], eax
movabs rax, 0x634930796b717141
mov qword [rbp + 0xc0], rax
movabs rax, 0x3753453561564955
mov qword [rbp + 0xc8], rax
mov byte [rbp + 0xd0], 0
movabs rax, 0x5332756b554c5148
mov qword [rbp + 0xa0], rax
movabs rax, 0x665644614a67694b
mov qword [rbp + 0xa8], rax
mov byte [rbp + 0xb0], 0
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.0040308e
mov ecx, dword [rbp + 0x7b098]
mov rdx, qword [rbp + 0x7b0a0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.0040404d
mov eax, dword [rbp + 0x7b098]
mov qword [rbp + 0x7b090], rax
mov qword [rbp + 0x7b088], 0
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x66
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x3c], 0x49
mov byte [rbp - 0x3b], 0x72
mov byte [rbp - 0x3a], 0x61
mov byte [rbp - 0x39], 0x64
mov byte [rbp - 0x38], 0x6e
mov byte [rbp - 0x37], 0x65
mov byte [rbp - 0x36], 0x6c
mov byte [rbp - 0x35], 0x61
mov byte [rbp - 0x34], 0x43
mov byte [rbp - 0x33], 0x6d
mov byte [rbp - 0x32], 0x75
mov byte [rbp - 0x31], 0x6e
mov byte [rbp - 0x30], 0x45
mov byte [rbp - 0x2f], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x7aed0]
lea rax, [rbp - 0x40]
mov r8, qword [rbp + 0x7b0d0]
mov rdx, rax
call r8
mov qword [rbp + 0x7b080], rax
mov rdx, qword [rbp + 0x7b090]
mov rax, qword [rbp + 0x7b0c8]
mov r9d, 4
mov r8d, 0x3000
mov ecx, 0
call rax
mov qword [rbp + 0x7b088], rax
movabs rcx, 0xde0b6b3a7640859
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x7b090]
mov rcx, qword [rbp + 0x7b088]
mov rax, qword [rbp + 0x7b0c0]
mov r9, r8
mov r8d, 0x20
call rax
movabs rcx, 0xde0b6b3a7640801
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x7b090]
mov rcx, qword [rbp + 0x7b088]
mov rax, qword [rbp + 0x7b0c0]
mov r9, r8
mov r8d, 0x40
call rax
movabs rcx, 0xde0b6b3a76409b1
call fcn.00401654
mov ebx, dword [rbp + 0x7b098]
mov rax, qword [rbp + 0x7b0b0]
call rax
mov r10, rax
mov rcx, qword [rbp + 0x7b0a0]
mov rdx, qword [rbp + 0x7b088]
mov qword [rsp + 0x20], 0
mov rax, qword [rbp + 0x7b0b8]
mov r9, rbx
mov r8, rcx
mov rcx, r10
call rax
mov rcx, qword [rbp + 0x7b088]
mov rax, qword [rbp + 0x7b080]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
call rax
mov eax, 0
add rsp, 0x7b1a0
pop rbx
pop rdi
pop rbp
ret