Function at 0x140002900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x240
mov byte [rsp + 0x80], 0xfb
mov byte [rsp + 0x81], 0x5b
mov byte [rsp + 0x82], 0x16
mov byte [rsp + 0x83], 0x5f
mov byte [rsp + 0x84], 0x48
mov byte [rsp + 0x85], 0x5f
mov byte [rsp + 0x86], 0
mov dword [rsp + 0x1c8], 0
jmp 0x140002962
mov eax, dword [rsp + 0x1c8]
inc eax
mov dword [rsp + 0x1c8], eax
movsxd rax, dword [rsp + 0x1c8]
cmp rax, 7
jae 0x140002ad5
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
xor eax, 0x7c
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
sub eax, 0x7c
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
xor eax, 0x20
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
sub eax, 0x20
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
xor eax, 0xfe
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
sub eax, 0xfe
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
xor eax, 0x34
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
sub eax, 0x34
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
xor eax, 0x8f
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
movsxd rax, dword [rsp + 0x1c8]
movzx eax, byte [rsp + rax + 0x80]
sub eax, 0x8f
movsxd rcx, dword [rsp + 0x1c8]
mov byte [rsp + rcx + 0x80], al
jmp 0x140002952
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x40]
call fcn.140007d00
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x1c0], 0
mov byte [rsp + 0x68], 0xdb
mov byte [rsp + 0x69], 0x75
mov byte [rsp + 0x6a], 0x42
mov byte [rsp + 0x6b], 0x4e
mov byte [rsp + 0x6c], 0x75
mov byte [rsp + 0x6d], 0x7c
mov byte [rsp + 0x6e], 0x83
mov byte [rsp + 0x6f], 0x82
mov byte [rsp + 0x70], 0x8e
mov byte [rsp + 0x71], 0x74
mov byte [rsp + 0x72], 0x7c
mov byte [rsp + 0x73], 0x7c
mov byte [rsp + 0x74], 0
mov dword [rsp + 0x1cc], 0
jmp 0x140002b71
mov eax, dword [rsp + 0x1cc]
inc eax
mov dword [rsp + 0x1cc], eax
movsxd rax, dword [rsp + 0x1cc]
cmp rax, 0xd
jae 0x140002c38
movsxd rax, dword [rsp + 0x1cc]
movzx eax, byte [rsp + rax + 0x68]
xor eax, 0xee
movsxd rcx, dword [rsp + 0x1cc]
mov byte [rsp + rcx + 0x68], al
movsxd rax, dword [rsp + 0x1cc]
movzx eax, byte [rsp + rax + 0x68]
sub eax, 0xee
movsxd rcx, dword [rsp + 0x1cc]
mov byte [rsp + rcx + 0x68], al
movsxd rax, dword [rsp + 0x1cc]
movzx eax, byte [rsp + rax + 0x68]
xor eax, 0xd4
movsxd rcx, dword [rsp + 0x1cc]
mov byte [rsp + rcx + 0x68], al
movsxd rax, dword [rsp + 0x1cc]
movzx eax, byte [rsp + rax + 0x68]
sub eax, 0xd4
movsxd rcx, dword [rsp + 0x1cc]
mov byte [rsp + rcx + 0x68], al
movsxd rax, dword [rsp + 0x1cc]
movzx eax, byte [rsp + rax + 0x68]
xor eax, 0x7a
movsxd rcx, dword [rsp + 0x1cc]
mov byte [rsp + rcx + 0x68], al
movsxd rax, dword [rsp + 0x1cc]
movzx eax, byte [rsp + rax + 0x68]
sub eax, 0x7a
movsxd rcx, dword [rsp + 0x1cc]
mov byte [rsp + rcx + 0x68], al
jmp 0x140002b61
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x78], 0
jne 0x140002c5a
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x60], 0
jne 0x140002e62
mov byte [rsp + 0x1d8], 0xad
mov byte [rsp + 0x1d9], 0x22
mov byte [rsp + 0x1da], 0x4f
mov byte [rsp + 0x1db], 0x73
mov byte [rsp + 0x1dc], 0x3c
mov byte [rsp + 0x1dd], 0x4f
mov byte [rsp + 0x1de], 0x9c
mov byte [rsp + 0x1df], 0x91
mov byte [rsp + 0x1e0], 0x91
mov byte [rsp + 0x1e1], 0x34
mov byte [rsp + 0x1e2], 0x48
mov byte [rsp + 0x1e3], 0x4f
mov byte [rsp + 0x1e4], 0x34
mov byte [rsp + 0x1e5], 0x90
mov byte [rsp + 0x1e6], 0x7d
mov byte [rsp + 0x1e7], 0x62
mov byte [rsp + 0x1e8], 0x9d
mov byte [rsp + 0x1e9], 0x36
mov byte [rsp + 0x1ea], 0x73
mov byte [rsp + 0x1eb], 0x90
mov byte [rsp + 0x1ec], 0x3d
mov byte [rsp + 0x1ed], 0x48
mov byte [rsp + 0x1ee], 0x91
mov byte [rsp + 0x1ef], 0x3c
mov byte [rsp + 0x1f0], 0
mov dword [rsp + 0x1f8], 0
jmp 0x140002d4b
mov eax, dword [rsp + 0x1f8]
inc eax
mov dword [rsp + 0x1f8], eax
movsxd rax, dword [rsp + 0x1f8]
cmp rax, 0x19
jae 0x140002e3a
movsxd rax, dword [rsp + 0x1f8]
movzx eax, byte [rsp + rax + 0x1d8]
xor eax, 0xec
movsxd rcx, dword [rsp + 0x1f8]
mov byte [rsp + rcx + 0x1d8], al
movsxd rax, dword [rsp + 0x1f8]
movzx eax, byte [rsp + rax + 0x1d8]
sub eax, 0xec
movsxd rcx, dword [rsp + 0x1f8]
mov byte [rsp + rcx + 0x1d8], al
movsxd rax, dword [rsp + 0x1f8]
movzx eax, byte [rsp + rax + 0x1d8]
xor eax, 0xae
movsxd rcx, dword [rsp + 0x1f8]
mov byte [rsp + rcx + 0x1d8], al
movsxd rax, dword [rsp + 0x1f8]
movzx eax, byte [rsp + rax + 0x1d8]
sub eax, 0xae
movsxd rcx, dword [rsp + 0x1f8]
mov byte [rsp + rcx + 0x1d8], al
movsxd rax, dword [rsp + 0x1f8]
movzx eax, byte [rsp + rax + 0x1d8]
xor eax, 0x97
movsxd rcx, dword [rsp + 0x1f8]
mov byte [rsp + rcx + 0x1d8], al
movsxd rax, dword [rsp + 0x1f8]
movzx eax, byte [rsp + rax + 0x1d8]
sub eax, 0x97
movsxd rcx, dword [rsp + 0x1f8]
mov byte [rsp + rcx + 0x1d8], al
jmp 0x140002d3b
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x1d0], rax
mov rdx, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x20], 0
jne 0x140003016
mov byte [rsp + 0x200], 0x50
mov byte [rsp + 0x201], 0xc2
mov byte [rsp + 0x202], 0xb1
mov byte [rsp + 0x203], 0xb5
mov byte [rsp + 0x204], 0xc7
mov byte [rsp + 0x205], 0xc5
mov byte [rsp + 0x206], 0xc5
mov byte [rsp + 0x207], 5
mov byte [rsp + 0x208], 2
mov byte [rsp + 0x209], 0x66
mov byte [rsp + 0x20a], 0xab
mov byte [rsp + 0x20b], 0xc2
mov byte [rsp + 0x20c], 0xc5
mov byte [rsp + 0x20d], 0xc4
mov byte [rsp + 0x20e], 0
mov dword [rsp + 0x218], 0
jmp 0x140002f03
mov eax, dword [rsp + 0x218]
inc eax
mov dword [rsp + 0x218], eax
movsxd rax, dword [rsp + 0x218]
cmp rax, 0xf
jae 0x140002fee
movsxd rax, dword [rsp + 0x218]
movzx eax, byte [rsp + rax + 0x200]
xor eax, 0x86
movsxd rcx, dword [rsp + 0x218]
mov byte [rsp + rcx + 0x200], al
movsxd rax, dword [rsp + 0x218]
movzx eax, byte [rsp + rax + 0x200]
sub eax, 0x86
movsxd rcx, dword [rsp + 0x218]
mov byte [rsp + rcx + 0x200], al
movsxd rax, dword [rsp + 0x218]
movzx eax, byte [rsp + rax + 0x200]
xor eax, 0x54
movsxd rcx, dword [rsp + 0x218]
mov byte [rsp + rcx + 0x200], al
movsxd rax, dword [rsp + 0x218]
movzx eax, byte [rsp + rax + 0x200]
sub eax, 0x54
movsxd rcx, dword [rsp + 0x218]
mov byte [rsp + rcx + 0x200], al
movsxd rax, dword [rsp + 0x218]
movzx eax, byte [rsp + rax + 0x200]
xor eax, 0xbb
movsxd rcx, dword [rsp + 0x218]
mov byte [rsp + rcx + 0x200], al
movsxd rax, dword [rsp + 0x218]
movzx eax, byte [rsp + rax + 0x200]
sub eax, 0xbb
movsxd rcx, dword [rsp + 0x218]
mov byte [rsp + rcx + 0x200], al
jmp 0x140002ef3
lea rax, [rsp + 0x200]
mov qword [rsp + 0x210], rax
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x1c0], 0
jne 0x1400031c8
mov byte [rsp + 0x228], 0x30
mov byte [rsp + 0x229], 0xd6
mov byte [rsp + 0x22a], 0xc3
mov byte [rsp + 0x22b], 0x67
mov byte [rsp + 0x22c], 0xa5
mov byte [rsp + 0x22d], 0xd7
mov byte [rsp + 0x22e], 0xd7
mov byte [rsp + 0x22f], 0x97
mov byte [rsp + 0x230], 0x96
mov byte [rsp + 0x231], 0x22
mov byte [rsp + 0x232], 0xa5
mov byte [rsp + 0x233], 0x88
mov byte [rsp + 0x234], 0xd4
mov byte [rsp + 0x235], 0
mov dword [rsp + 0x238], 0
jmp 0x1400030b2
mov eax, dword [rsp + 0x238]
inc eax
mov dword [rsp + 0x238], eax
movsxd rax, dword [rsp + 0x238]
cmp rax, 0xe
jae 0x14000319d
movsxd rax, dword [rsp + 0x238]
movzx eax, byte [rsp + rax + 0x228]
xor eax, 0x92
movsxd rcx, dword [rsp + 0x238]
mov byte [rsp + rcx + 0x228], al
movsxd rax, dword [rsp + 0x238]
movzx eax, byte [rsp + rax + 0x228]
sub eax, 0x92
movsxd rcx, dword [rsp + 0x238]
mov byte [rsp + rcx + 0x228], al
movsxd rax, dword [rsp + 0x238]
movzx eax, byte [rsp + rax + 0x228]
xor eax, 0x54
movsxd rcx, dword [rsp + 0x238]
mov byte [rsp + rcx + 0x228], al
movsxd rax, dword [rsp + 0x238]
movzx eax, byte [rsp + rax + 0x228]
sub eax, 0x54
movsxd rcx, dword [rsp + 0x238]
mov byte [rsp + rcx + 0x228], al
movsxd rax, dword [rsp + 0x238]
movzx eax, byte [rsp + rax + 0x228]
xor eax, 0xdc
movsxd rcx, dword [rsp + 0x238]
mov byte [rsp + rcx + 0x228], al
movsxd rax, dword [rsp + 0x238]
movzx eax, byte [rsp + rax + 0x228]
sub eax, 0xdc
movsxd rcx, dword [rsp + 0x238]
mov byte [rsp + rcx + 0x228], al
jmp 0x1400030a2
lea rax, [rsp + 0x228]
mov qword [rsp + 0x220], rax
mov rdx, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x1c0], rax
xor edx, edx
mov ecx, 2
call qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x140003209
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x250]
call fcn.140007d40
lea rcx, [rsp + 0x40]
call fcn.140007dd0
mov rax, qword [rsp + 0x250]
jmp 0x1400032cc
mov dword [rsp + 0x90], 0x130
lea rax, [rsp + 0x94]
mov rdi, rax
xor eax, eax
mov ecx, 0x12c
rep stosb byte [rdi], al
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
mov dword [rsp + 0x23c], eax
jmp 0x14000325d
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x1c0]
mov dword [rsp + 0x23c], eax
cmp dword [rsp + 0x23c], 0
je 0x14000329d
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0xbc]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140003290
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.14000af30
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140003242
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x250]
call fcn.140007d40
lea rcx, [rsp + 0x40]
call fcn.140007dd0
mov rax, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret