Function at 0x1400111ea
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
jmp 0x1400122e0
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x9d8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x1ae
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x9f8]
mov rax, qword [0x1400250c0]
xor rax, rbp
mov qword [rbp + 0x9a0], rax
lea rcx, [0x14002b0a0]
call fcn.140011488
nop
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
mov dword [rbp + 0x40], 0x100010
mov dword [rbp + 0x44], 0
xor eax, eax
mov word [rbp + 0x48], ax
xor eax, eax
mov word [rbp + 0x4a], ax
xor eax, eax
mov word [rbp + 0x4c], ax
xor eax, eax
mov word [rbp + 0x4e], ax
xor eax, eax
mov word [rbp + 0x50], ax
xor eax, eax
mov word [rbp + 0x52], ax
mov dword [rbp + 0x54], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xe0], 0
mov qword [rbp + 0xe8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0x100], 0
mov qword [rbp + 0x108], 0
xor eax, eax
mov word [rbp + 0x110], ax
xor eax, eax
mov word [rbp + 0x112], ax
mov byte [rbp + 0x114], 0
mov byte [rbp + 0x115], 0
xor eax, eax
mov word [rbp + 0x116], ax
mov dword [rbp + 0x118], 0
xor eax, eax
mov word [rbp + 0x11c], ax
xor eax, eax
mov word [rbp + 0x11e], ax
mov dword [rbp + 0x120], 0
xor eax, eax
mov word [rbp + 0x124], ax
xor eax, eax
mov word [rbp + 0x126], ax
mov dword [rbp + 0x128], 0
mov dword [rbp + 0x12c], 0
lea rax, [rbp + 0x130]
mov rdi, rax
xor eax, eax
mov ecx, 0x80
rep stosb byte [rdi], al
lea rax, [rbp + 0x1b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
lea rax, [rbp + 0x2b0]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rbp + 0x310]
mov rdi, rax
xor eax, eax
mov ecx, 0x1a0
rep stosb byte [rdi], al
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x4c0], 0
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4d8], 0
mov byte [rbp + 0x518], 0x47
mov byte [rbp + 0x519], 0x65
mov byte [rbp + 0x51a], 0x74
mov byte [rbp + 0x51b], 0x43
mov byte [rbp + 0x51c], 0x75
mov byte [rbp + 0x51d], 0x72
mov byte [rbp + 0x51e], 0x72
mov byte [rbp + 0x51f], 0x65
mov byte [rbp + 0x520], 0x6e
mov byte [rbp + 0x521], 0x74
mov byte [rbp + 0x522], 0x54
mov byte [rbp + 0x523], 0x68
mov byte [rbp + 0x524], 0x72
mov byte [rbp + 0x525], 0x65
mov byte [rbp + 0x526], 0x61
mov byte [rbp + 0x527], 0x64
mov byte [rbp + 0x528], 0x49
mov byte [rbp + 0x529], 0x64
mov byte [rbp + 0x52a], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x518]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x548], rax
call qword [rbp + 0x548]
cmp dword [rbp + 0x9d0], eax
jne 0x1400126f9
mov byte [rbp + 0x568], 0x47
mov byte [rbp + 0x569], 0x65
mov byte [rbp + 0x56a], 0x74
mov byte [rbp + 0x56b], 0x43
mov byte [rbp + 0x56c], 0x75
mov byte [rbp + 0x56d], 0x72
mov byte [rbp + 0x56e], 0x72
mov byte [rbp + 0x56f], 0x65
mov byte [rbp + 0x570], 0x6e
mov byte [rbp + 0x571], 0x74
mov byte [rbp + 0x572], 0x54
mov byte [rbp + 0x573], 0x68
mov byte [rbp + 0x574], 0x72
mov byte [rbp + 0x575], 0x65
mov byte [rbp + 0x576], 0x61
mov byte [rbp + 0x577], 0x64
mov byte [rbp + 0x578], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x568]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x598], rax
call qword [rbp + 0x598]
mov qword [rbp + 0x4f8], rax
jmp 0x140012785
mov byte [rbp + 0x5b8], 0x4f
mov byte [rbp + 0x5b9], 0x70
mov byte [rbp + 0x5ba], 0x65
mov byte [rbp + 0x5bb], 0x6e
mov byte [rbp + 0x5bc], 0x54
mov byte [rbp + 0x5bd], 0x68
mov byte [rbp + 0x5be], 0x72
mov byte [rbp + 0x5bf], 0x65
mov byte [rbp + 0x5c0], 0x61
mov byte [rbp + 0x5c1], 0x64
mov byte [rbp + 0x5c2], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x5b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x5e8], rax
mov r8d, dword [rbp + 0x9d0]
xor edx, edx
mov ecx, 0x1fffff
call qword [rbp + 0x5e8]
mov qword [rbp + 0x4f8], rax
mov byte [rbp + 0x608], 0x47
mov byte [rbp + 0x609], 0x65
mov byte [rbp + 0x60a], 0x74
mov byte [rbp + 0x60b], 0x54
mov byte [rbp + 0x60c], 0x68
mov byte [rbp + 0x60d], 0x72
mov byte [rbp + 0x60e], 0x65
mov byte [rbp + 0x60f], 0x61
mov byte [rbp + 0x610], 0x64
mov byte [rbp + 0x611], 0x43
mov byte [rbp + 0x612], 0x6f
mov byte [rbp + 0x613], 0x6e
mov byte [rbp + 0x614], 0x74
mov byte [rbp + 0x615], 0x65
mov byte [rbp + 0x616], 0x78
mov byte [rbp + 0x617], 0x74
mov byte [rbp + 0x618], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x608]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x638], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x4f8]
call qword [rbp + 0x638]
nop
cmp dword [rbp + 0x9e8], 0
je 0x140012902
mov eax, dword [rbp + 0x9e0]
mov rcx, qword [rbp + 0x9d8]
mov qword [rbp + rax*8 + 0x58], rcx
mov eax, dword [rbp + 0x9e0]
lea eax, [rax*4 + 0x10]
mov ecx, 3
mov qword [rbp + 0x998], rcx
movzx ecx, al
mov rax, qword [rbp + 0x998]
shl rax, cl
not rax
mov rcx, qword [rbp + 0x80]
and rcx, rax
mov rax, rcx
mov qword [rbp + 0x80], rax
mov eax, dword [rbp + 0x9e0]
lea eax, [rax*4 + 0x12]
mov ecx, 3
mov qword [rbp + 0x998], rcx
movzx ecx, al
mov rax, qword [rbp + 0x998]
shl rax, cl
not rax
mov rcx, qword [rbp + 0x80]
and rcx, rax
mov rax, rcx
mov qword [rbp + 0x80], rax
mov eax, dword [rbp + 0x9e0]
shl eax, 1
mov ecx, 1
mov qword [rbp + 0x998], rcx
movzx ecx, al
mov rax, qword [rbp + 0x998]
shl rax, cl
mov rcx, qword [rbp + 0x80]
or rcx, rax
mov rax, rcx
mov qword [rbp + 0x80], rax
jmp 0x14001295d
mov eax, dword [rbp + 0x9e0]
mov rcx, qword [rbp + 0x9d8]
cmp qword [rbp + rax*8 + 0x58], rcx
jne 0x14001295d
mov eax, dword [rbp + 0x9e0]
shl eax, 1
mov ecx, 1
mov qword [rbp + 0x998], rcx
movzx ecx, al
mov rax, qword [rbp + 0x998]
shl rax, cl
not rax
mov rcx, qword [rbp + 0x80]
and rcx, rax
mov rax, rcx
mov qword [rbp + 0x80], rax
mov eax, dword [rbp + 0x9e0]
mov qword [rbp + rax*8 + 0x58], 0
mov byte [rbp + 0x658], 0x53
mov byte [rbp + 0x659], 0x65
mov byte [rbp + 0x65a], 0x74
mov byte [rbp + 0x65b], 0x54
mov byte [rbp + 0x65c], 0x68
mov byte [rbp + 0x65d], 0x72
mov byte [rbp + 0x65e], 0x65
mov byte [rbp + 0x65f], 0x61
mov byte [rbp + 0x660], 0x64
mov byte [rbp + 0x661], 0x43
mov byte [rbp + 0x662], 0x6f
mov byte [rbp + 0x663], 0x6e
mov byte [rbp + 0x664], 0x74
mov byte [rbp + 0x665], 0x65
mov byte [rbp + 0x666], 0x78
mov byte [rbp + 0x667], 0x74
mov byte [rbp + 0x668], 0
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x658]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x688], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x4f8]
call qword [rbp + 0x688]
nop
cmp qword [rbp + 0x4f8], 0xffffffffffffffff
je 0x140012a22
mov rcx, qword [rbp + 0x4f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140020080]
call fcn.140011401
mov rcx, qword [rbp + 0x9a0]
xor rcx, rbp
call fcn.14001123f
lea rsp, [rbp + 0x9b8]
pop rdi
pop rbp
ret