Function at 0x1400015d7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
mov eax, 0x24648
call fcn.1400049b0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140003e0e
pxor xmm0, xmm0
movaps xmmword [rbp + 0x244b0], xmm0
movaps xmmword [rbp + 0x244c0], xmm0
movaps xmmword [rbp + 0x244d0], xmm0
pxor xmm0, xmm0
movaps xmmword [rbp + 0x24480], xmm0
movaps xmmword [rbp + 0x24490], xmm0
movaps xmmword [rbp + 0x244a0], xmm0
pxor xmm0, xmm0
movaps xmmword [rbp + 0x24450], xmm0
movaps xmmword [rbp + 0x24460], xmm0
movaps xmmword [rbp + 0x24470], xmm0
mov word [rbp + 0x24430], 0x6c
mov word [rbp + 0x24432], 0x6c
mov word [rbp + 0x24434], 0x64
mov word [rbp + 0x24436], 0x2e
mov word [rbp + 0x24438], 0x33
mov word [rbp + 0x2443a], 0x32
mov word [rbp + 0x2443c], 0x65
mov word [rbp + 0x2443e], 0x73
mov word [rbp + 0x24440], 0x55
mov word [rbp + 0x24442], 0
mov word [rbp + 0x24410], 0x6c
mov word [rbp + 0x24412], 0x6c
mov word [rbp + 0x24414], 0x64
mov word [rbp + 0x24416], 0x2e
mov word [rbp + 0x24418], 0x32
mov word [rbp + 0x2441a], 0x33
mov word [rbp + 0x2441c], 0x6c
mov word [rbp + 0x2441e], 0x65
mov word [rbp + 0x24420], 0x6e
mov word [rbp + 0x24422], 0x72
mov word [rbp + 0x24424], 0x65
mov word [rbp + 0x24426], 0x4b
mov word [rbp + 0x24428], 0
mov word [rbp + 0x243f0], 0x6c
mov word [rbp + 0x243f2], 0x6c
mov word [rbp + 0x243f4], 0x64
mov word [rbp + 0x243f6], 0x2e
mov word [rbp + 0x243f8], 0x6c
mov word [rbp + 0x243fa], 0x6c
mov word [rbp + 0x243fc], 0x64
mov word [rbp + 0x243fe], 0x74
mov word [rbp + 0x24400], 0x6e
mov word [rbp + 0x24402], 0
lea rax, [rbp + 0x24430]
mov rcx, rax
call fcn.140001543
lea rax, [rbp + 0x24410]
mov rcx, rax
call fcn.140001543
lea rax, [rbp + 0x243f0]
mov rcx, rax
call fcn.140001543
movabs rax, 0x724c6f6164446c6c
mov qword [rbp + 0x243e5], rax
mov dword [rbp + 0x243ec], 0x4c6472
movabs rax, 0x74646c6c2e646c6c
mov qword [rbp + 0x243db], rax
mov word [rbp + 0x243e3], 0x6e
movabs rax, 0x656c33322e646c6c
mov qword [rbp + 0x243ce], rax
movabs rax, 0x4b65726e656c33
mov qword [rbp + 0x243d3], rax
lea rax, [rbp + 0x243e5]
mov rcx, rax
call fcn.1400014bf
lea rax, [rbp + 0x243db]
mov rcx, rax
call fcn.1400014bf
lea rax, [rbp + 0x243ce]
mov rcx, rax
call fcn.1400014bf
lea rdx, [rbp + 0x24430]
lea rax, [rbp + 0x24500]
mov rcx, rax
call fcn.1400013f6
lea rdx, [rbp + 0x24410]
lea rax, [rbp + 0x244f0]
mov rcx, rax
call fcn.1400013f6
lea rdx, [rbp + 0x243f0]
lea rax, [rbp + 0x244e0]
mov rcx, rax
call fcn.1400013f6
mov dword [rbp + 0x244b0], 0x30
mov qword [rbp + 0x244b8], 0
mov dword [rbp + 0x244c8], 0x40
lea rax, [rbp + 0x24500]
mov qword [rbp + 0x244c0], rax
mov qword [rbp + 0x244d0], 0
mov qword [rbp + 0x244d8], 0
mov dword [rbp + 0x24480], 0x30
mov qword [rbp + 0x24488], 0
mov dword [rbp + 0x24498], 0x40
lea rax, [rbp + 0x244f0]
mov qword [rbp + 0x24490], rax
mov qword [rbp + 0x244a0], 0
mov qword [rbp + 0x244a8], 0
mov dword [rbp + 0x24450], 0x30
mov qword [rbp + 0x24458], 0
mov dword [rbp + 0x24468], 0x40
lea rax, [rbp + 0x244e0]
mov qword [rbp + 0x24460], rax
mov qword [rbp + 0x24470], 0
mov qword [rbp + 0x24478], 0
movabs rax, 0x6548616e646c6541
movabs rdx, 0x4765744d6f64756c
mov qword [rbp + 0x243b0], rax
mov qword [rbp + 0x243b8], rdx
mov byte [rbp + 0x243c0], 0
lea rax, [rbp + 0x243b0]
mov rcx, rax
call fcn.1400014bf
lea rax, [rbp + 0x243ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x243b0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x245b0], rax
movabs rax, 0x6341646472657373
mov qword [rbp + 0x243a1], rax
movabs rax, 0x47657450726f63
mov qword [rbp + 0x243a8], rax
lea rax, [rbp + 0x243a1]
mov rcx, rax
call fcn.1400014bf
lea rax, [rbp + 0x243ce]
mov rdx, qword [rbp + 0x245b0]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x243a1]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x245a8], rax
movabs rax, 0x75616c416c6c6f63
mov qword [rbp + 0x24394], rax
movabs rbx, 0x5669727475616c
mov qword [rbp + 0x24399], rbx
lea rax, [rbp + 0x24394]
mov rcx, rax
call fcn.1400014bf
lea rax, [rbp + 0x243ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x24394]
mov r8, qword [rbp + 0x245a8]
mov rdx, rax
call r8
mov qword [rbp + 0x245a0], rax
movabs rax, 0x6c50726f74656374
mov qword [rbp + 0x24385], rax
mov qword [rbp + 0x2438c], rbx
lea rax, [rbp + 0x24385]
mov rcx, rax
call fcn.1400014bf
lea rax, [rbp + 0x243ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x24385]
mov r8, qword [rbp + 0x245a8]
mov rdx, rax
call r8
mov qword [rbp + 0x24598], rax
lea rax, [rbp + 0x243db]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x243e5]
mov r8, qword [rbp + 0x245a8]
mov rdx, rax
call r8
mov qword [rbp + 0x24590], rax
mov word [rbp + 0x24383], 0xbb49
movabs rax, 0xefbeaddeefbeadde
mov qword [rbp + 0x2437b], rax
mov dword [rbp + 0x24377], 0xc3e3ff41
mov rax, qword [rbp + 0x24590]
add rax, 5
mov qword [rbp + 0x24588], rax
lea rax, [rbp + 0x2437b]
mov rdx, qword [rbp + 0x24588]
mov qword [rax], rdx
mov rax, qword [rbp + 0x245a0]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x24580], rax
mov rax, qword [rbp + 0x24580]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.140001360
mov rax, qword [rbp + 0x24580]
lea rcx, [rax + 5]
lea rax, [rbp + 0x24383]
mov r8d, 2
mov rdx, rax
call fcn.140001360
mov rax, qword [rbp + 0x24580]
lea rcx, [rax + 7]
lea rax, [rbp + 0x2437b]
mov r8d, 8
mov rdx, rax
call fcn.140001360
mov rax, qword [rbp + 0x24580]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x24377]
mov r8d, 4
mov rdx, rax
call fcn.140001360
mov dword [rbp + 0x24370], 0
lea rdx, [rbp + 0x24370]
mov rax, qword [rbp + 0x24580]
mov r10, qword [rbp + 0x24598]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
mov rcx, rax
call r10
mov rax, qword [rbp + 0x24580]
mov qword [rbp + 0x24578], rax
mov qword [rbp + 0x24368], 0
lea rcx, [rbp + 0x24368]
lea rdx, [rbp + 0x24500]
mov rax, qword [rbp + 0x24578]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x24360], 0
lea rcx, [rbp + 0x24360]
lea rdx, [rbp + 0x244f0]
mov rax, qword [rbp + 0x24578]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x24358], 0
lea rcx, [rbp + 0x24358]
lea rdx, [rbp + 0x244e0]
mov rax, qword [rbp + 0x24578]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rax, qword [rbp + 0x24360]
lea rdx, [rbp + 0x243a1]
mov r8, qword [rbp + 0x245a8]
mov rcx, rax
call r8
mov qword [rbp + 0x24570], rax
mov rax, qword [rbp + 0x24360]
lea rdx, [rbp + 0x24394]
mov r8, qword [rbp + 0x24570]
mov rcx, rax
call r8
mov qword [rbp + 0x24568], rax
mov rax, qword [rbp + 0x24360]
lea rdx, [rbp + 0x24385]
mov r8, qword [rbp + 0x24570]
mov rcx, rax
call r8
mov qword [rbp + 0x24560], rax
movabs rax, 0x73734d656d6f7279
movabs rdx, 0x69746550726f6365
mov qword [rbp + 0x24340], rax
mov qword [rbp + 0x24348], rdx
mov dword [rbp + 0x2434f], 0x577269
lea rax, [rbp + 0x24340]
mov rcx, rax
call fcn.1400014bf
mov rax, qword [rbp + 0x24360]
lea rdx, [rbp + 0x24340]
mov r8, qword [rbp + 0x24570]
mov rcx, rax
call r8
mov qword [rbp + 0x24558], rax
movabs rax, 0x7450726f63657373
movabs rdx, 0x657443757272656e
mov qword [rbp + 0x24320], rax
mov qword [rbp + 0x24328], rdx
mov word [rbp + 0x24330], 0x47
lea rax, [rbp + 0x24320]
mov rcx, rax
call fcn.1400014bf
mov rax, qword [rbp + 0x24360]
lea rdx, [rbp + 0x24320]
mov r8, qword [rbp + 0x24570]
mov rcx, rax
call r8
mov qword [rbp + 0x24550], rax
lea rax, [rbp + 0xe0]
lea rdx, section..data
mov ecx, 0x24240
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x2454c], 0x4848
mov eax, dword [rbp + 0x2454c]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x24540], rax
cmp qword [rbp + 0x24540], 0
jne 0x140001e0d
mov eax, 0xffffffff
jmp 0x1400020a2
mov dword [rbp + 0x245bc], 0
jmp 0x140001e7d
mov eax, dword [rbp + 0x245bc]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x24540]
add rdx, rax
mov eax, dword [rbp + 0x245bc]
cdqe
mov rax, qword [rbp + rax*8 + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x2451c], eax
cmp dword [rbp + 0x2451c], 0
je 0x140001e76
mov rax, qword [rbp + 0x24540]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x1400020a2
add dword [rbp + 0x245bc], 1
mov eax, dword [rbp + 0x245bc]
cmp eax, dword [rbp + 0x2454c]
jl 0x140001e19
mov eax, dword [rbp + 0x2454c]
shl eax, 4
mov dword [rbp + 0x2453c], eax
movabs rax, 0x3175685037455664
movabs rdx, 0x30527a6355314b37
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
mov byte [rbp + 0xd0], 0
movabs rax, 0x6c4e795939543458
movabs rdx, 0x58344f6933774f70
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
mov byte [rbp + 0xb0], 0
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.140002bfb
mov ecx, dword [rbp + 0x2453c]
mov rdx, qword [rbp + 0x24540]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.140003bee
mov eax, dword [rbp + 0x2453c]
mov qword [rbp + 0x24530], rax
mov qword [rbp + 0x24528], 0
movabs rax, 0x646172496e666f41
movabs rdx, 0x6e756d43616c656e
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov word [rbp - 0x30], 0x45
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400014bf
mov rax, qword [rbp + 0x24360]
lea rdx, [rbp - 0x40]
mov r8, qword [rbp + 0x24570]
mov rcx, rax
call r8
mov qword [rbp + 0x24520], rax
mov rax, qword [rbp + 0x24530]
mov r10, qword [rbp + 0x24568]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0x24528], rax
movabs rax, 0xde0b6b3a7640859
mov rcx, rax
call fcn.140001464
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x24530]
mov rax, qword [rbp + 0x24528]
mov r10, qword [rbp + 0x24560]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a7640801
mov rcx, rax
call fcn.140001464
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x24530]
mov rax, qword [rbp + 0x24528]
mov r10, qword [rbp + 0x24560]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a76409b1
mov rcx, rax
call fcn.140001464
mov ebx, dword [rbp + 0x2453c]
mov rax, qword [rbp + 0x24550]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0x24540]
mov rax, qword [rbp + 0x24528]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x24558]
mov r9, rbx
mov r8, rdx
mov rdx, rax
call r10
mov rax, qword [rbp + 0x24528]
mov r10, qword [rbp + 0x24520]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
mov rcx, rax
call r10
mov eax, 0
add rsp, 0x24648
pop rbx
pop rbp
ret