Function at 0x7ff6fba64708
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor esi, esi
mov edx, 0x57f23a
mov r8d, edx
mov ecx, esi
lea edi, [rsi + 1]
imul r8d, r8d
add r8d, ecx
cmove r8d, ecx
add ecx, edi
cmp ecx, edx
jb 0x7ff6fba64736
mov eax, 0x6c16c16d
lea r14, [0x7ff6fba91ff0]
mul r8d
mov eax, r8d
mov r10d, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x5a
sub r8d, eax
or rcx, 0xffffffffffffffff
mov rax, rcx
inc rax
cmp byte [r14 + rax], sil
jne 0x7ff6fba64772
test rax, rax
je 0x7ff6fba647a0
mov rdx, r14
xor byte [rdx], r8b
add r10d, edi
add rdx, rdi
mov r9, rcx
inc r9
cmp byte [r14 + r9], sil
jne 0x7ff6fba6478f
movsxd rax, r10d
cmp rax, r9
jb 0x7ff6fba64783
inc rcx
cmp byte [r14 + rcx], sil
jne 0x7ff6fba647a0
lea r11, [0x7ff6fba82a00]
mov ebx, 0x44
lea r10, [0x7ff6fba7e5c0]
mov r9d, esi
cmp dword [r10], esi
jbe 0x7ff6fba647e1
mov r8, r11
movsxd rax, r9d
xor edx, edx
div rcx
add r9d, edi
mov al, byte [rdx + r14]
xor byte [r8], al
add r8, rdi
cmp r9d, dword [r10]
jb 0x7ff6fba647c7
add r10, 4
add r11, 0x32
sub rbx, rdi
jne 0x7ff6fba647bc
mov r8d, esi
lea r9, [0x7ff6fba89598]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x2e
jb 0x7ff6fba647f8
mov r8d, esi
lea r9, [0x7ff6fba897f0]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x5f0
jb 0x7ff6fba6481d
mov r8d, esi
lea r9, [0x7ff6fba89780]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
movsx eax, byte [rdx + r14]
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x2f
jb 0x7ff6fba64845
mov r8d, esi
lea r9, [0x7ff6fba89428]
mov r10d, 0x18
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
movsx eax, byte [rdx + r14]
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, r10d
jb 0x7ff6fba64873
mov r8d, esi
lea r9, [0x7ff6fba895c8]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x2e
jb 0x7ff6fba6489a
mov r8d, esi
lea r9, [0x7ff6fba89580]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x15
jb 0x7ff6fba648bf
mov r8d, esi
lea r9, [0x7ff6fba89758]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x26
jb 0x7ff6fba648e4
mov r8d, esi
lea r9, [0x7ff6fba897e0]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 8
jb 0x7ff6fba64909
mov r8d, esi
lea r9, [0x7ff6fba896b0]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x48
jb 0x7ff6fba6492e
mov r8d, esi
lea r9, [0x7ff6fba89198]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0xa
jb 0x7ff6fba64953
mov r8d, esi
lea r9, [0x7ff6fba895f8]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0xf
jb 0x7ff6fba64978
mov r8d, esi
lea r9, [0x7ff6fba89698]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x11
jb 0x7ff6fba6499d
mov r8d, esi
lea r9, [0x7ff6fba82948]
movsxd rax, r8d
xor edx, edx
div rcx
add r8d, edi
mov al, byte [rdx + r14]
xor byte [r9], al
add r9, rdi
cmp r8d, 0x3a
jb 0x7ff6fba649c2
mov r9, rsi
lea r8, [0x7ff6fba89610]
mov r11d, 0x41
xor edx, edx
mov rax, r9
div rcx
add r9, rdi
movsx eax, byte [rdx + r14]
xor word [r8], ax
lea r8, [r8 + 2]
sub r11, rdi
jne 0x7ff6fba649ed
mov r9, rsi
lea r8, [0x7ff6fba82990]
mov r11d, 0x35
xor edx, edx
mov rax, r9
div rcx
add r9, rdi
movsx eax, byte [rdx + r14]
xor word [r8], ax
lea r8, [r8 + 2]
sub r11, rdi
jne 0x7ff6fba64a1a
mov r9, rsi
lea r8, [0x7ff6fba83cf8]
mov r11d, 0x19
xor edx, edx
mov rax, r9
div rcx
add r9, rdi
movsx eax, byte [rdx + r14]
xor word [r8], ax
lea r8, [r8 + 2]
sub r11, rdi
jne 0x7ff6fba64a47
mov r9, rsi
lea r8, [0x7ff6fba89720]
xor edx, edx
mov rax, r9
div rcx
add r9, rdi
movsx eax, byte [rdx + r14]
xor word [r8], ax
lea r8, [r8 + 2]
sub r10, rdi
jne 0x7ff6fba64a6e
mov r9, rsi
lea r8, [0x7ff6fba82930]
mov r10d, 0xb
xor edx, edx
mov rax, r9
div rcx
add r9, rdi
movsx eax, byte [rdx + r14]
xor word [r8], ax
add r8, 2
sub r10, rdi
jne 0x7ff6fba64a9b
mov qword [rbp - 0x20], rsi
mov ecx, esi
mov bl, byte [rbp - 0x19]
mov r11b, sil
mov dil, byte [rbp - 0x1a]
mov eax, 1
mov r14b, byte [rbp - 0x1c]
mov r15b, byte [rbp - 0x1d]
mov r12b, byte [rbp - 0x1e]
mov r13b, byte [rbp - 0x1f]
mov dword [rbp - 0x18], esi
mov r8b, byte [rbp - 0x15]
mov r9b, byte [rbp - 0x16]
mov r10b, byte [rbp - 0x17]
mov byte [rbp - 0x14], sil
mov sil, byte [rbp - 0x1b]
cmp ecx, 0x6b
jne 0x7ff6fba64b0a
cmp byte [rbp - 0x20], cl
je 0x7ff6fba64c6f
mov byte [rbp - 0x20], cl
jmp 0x7ff6fba64bef
cmp ecx, 0x65
jne 0x7ff6fba64b35
cmp r13b, cl
je 0x7ff6fba64b1f
mov r13b, cl
mov byte [rbp - 0x1f], cl
jmp 0x7ff6fba64bef
cmp r14b, 0x65
je 0x7ff6fba64c6f
mov r14b, 0x65
mov byte [rbp - 0x1c], r14b
jmp 0x7ff6fba64bef
cmp ecx, 0x72
jne 0x7ff6fba64b4e
cmp r12b, cl
je 0x7ff6fba64c6f
mov r12b, cl
mov byte [rbp - 0x1e], cl
jmp 0x7ff6fba64bef
cmp ecx, 0x6e
jne 0x7ff6fba64b67
cmp r15b, cl
je 0x7ff6fba64c6f
mov r15b, cl
mov byte [rbp - 0x1d], cl
jmp 0x7ff6fba64bef
cmp ecx, 0x6c
jne 0x7ff6fba64b9b
cmp sil, cl
je 0x7ff6fba64b79
mov sil, cl
mov byte [rbp - 0x1b], cl
jmp 0x7ff6fba64bef
cmp r9b, 0x6c
je 0x7ff6fba64b88
mov r9b, 0x6c
mov byte [rbp - 0x16], r9b
jmp 0x7ff6fba64bef
cmp r8b, 0x6c
je 0x7ff6fba64c6f
mov r8b, 0x6c
mov byte [rbp - 0x15], r8b
jmp 0x7ff6fba64bef
cmp ecx, 0x33
jne 0x7ff6fba64bb1
cmp dil, cl
je 0x7ff6fba64c6f
mov dil, cl
mov byte [rbp - 0x1a], cl
jmp 0x7ff6fba64bef
cmp ecx, 0x32
jne 0x7ff6fba64bc5
cmp bl, cl
je 0x7ff6fba64c6f
mov bl, cl
mov byte [rbp - 0x19], cl
jmp 0x7ff6fba64bef
cmp ecx, 0x2e
jne 0x7ff6fba64bdb
cmp r11b, cl
je 0x7ff6fba64c6f
mov r11b, cl
mov byte [rbp - 0x18], cl
jmp 0x7ff6fba64bef
cmp ecx, 0x64
jne 0x7ff6fba64c46
cmp r10b, cl
je 0x7ff6fba64c6f
mov r10b, cl
mov byte [rbp - 0x17], cl
xor edx, edx
add ecx, 0x57f23a
je 0x7ff6fba64c0f
mov r13d, ecx
imul ecx, ecx
add ecx, edx
cmove ecx, edx
inc edx
cmp edx, r13d
jb 0x7ff6fba64bfc
mov r13b, byte [rbp - 0x1f]
mov eax, 0x6c16c16d
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x5a
sub ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xfa
sub ecx, eax
mov eax, 1
jmp 0x7ff6fba64c6f
cmp ecx, 0xfe
jl 0x7ff6fba64c6f
xor eax, eax
xor ecx, ecx
lea edx, [rax + 1]
cmp byte [rbp + rcx - 0x20], 0
cmove eax, edx
add rcx, rdx
cmp rcx, 0xc
jl 0x7ff6fba64c55
cmp eax, edx
jne 0x7ff6fba64c7d
xor ecx, ecx
mov rax, rdx
add ecx, eax
cmp ecx, 0xff
jl 0x7ff6fba64af4
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov qword [0x7ff6fbd313a8], rax
lea rdx, [0x7ff6fba82a00]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x7ff6fba83202]
mov qword [0x7ff6fbd313c0], rax
call rax
lea rcx, [0x7ff6fba832ca]
mov qword [0x7ff6fba93430], rax
call qword [0x7ff6fbd313c0]
lea rcx, [0x7ff6fba8361c]
mov qword [0x7ff6fba943f0], rax
call qword [0x7ff6fbd313c0]
lea rcx, [0x7ff6fba836b2]
mov qword [0x7ff6fba946c0], rax
call qword [0x7ff6fbd313c0]
lea rcx, str.Iphlpapi.dll
mov qword [0x7ff6fbd313b8], rax
call qword [0x7ff6fbd313c0]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba7e4c8]
mov qword [0x7ff6fba93428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82a32]
mov qword [0x7ff6fba93398], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba833c4]
mov qword [0x7ff6fba94428], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82ee2]
mov qword [0x7ff6fba946e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba831d0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82d84]
mov qword [0x7ff6fba93448], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba8316c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82a96]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82b90]
mov qword [0x7ff6fbd33ae0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba8348c]
mov qword [0x7ff6fba933a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba830a4]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82afa]
mov qword [0x7ff6fbd313a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82d20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba93428]
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x49746547
mov dword [rbp - 0xc], 0x74654e70
mov dword [rbp - 8], 0x6c626154
mov word [rbp - 4], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82f78]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82e4c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, str.GetSystemDefaultLangID
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba834be]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82f14]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba83554]
mov qword [0x7ff6fba94438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82bc2]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba835ea]
mov qword [0x7ff6fba94420], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba83586]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82d52]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba8313a]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba83040]
mov qword [0x7ff6fba933b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba83428]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba83360]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba83072]
mov qword [0x7ff6fba933a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba830d6]
mov qword [0x7ff6fbd33af8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313b8]
lea rdx, [0x7ff6fba836e4]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82f46]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82de8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba8300e]
mov qword [0x7ff6fba94430], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba7e4f0]
mov qword [0x7ff6fba93440], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82ac8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313b8]
lea rdx, [0x7ff6fba83716]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82cee]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82e1a]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82b5e]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, str.GetFileSizeEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82c8a]
mov qword [0x7ff6fba943f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba83108]
mov qword [0x7ff6fbd34078], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba93430]
lea rdx, [0x7ff6fba83266]
mov qword [0x7ff6fbd33af0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba83522]
mov qword [0x7ff6fba946c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba93430]
lea rdx, [0x7ff6fba83298]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82bf4]
mov qword [0x7ff6fba94408], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82e7e]
mov qword [0x7ff6fba94400], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba834f0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82b2c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba8319e]
mov qword [0x7ff6fba933b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82faa]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82a64]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba8345a]
mov qword [0x7ff6fba946e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, str.MoveFileExW
mov qword [0x7ff6fba93390], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba93430]
lea rdx, [0x7ff6fba83234]
mov qword [0x7ff6fba946f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba946c0]
lea rdx, [0x7ff6fba8364e]
mov qword [0x7ff6fbd313b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba8332e]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba833f6]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba7e528]
mov qword [0x7ff6fba946d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82eb0]
mov qword [0x7ff6fba946f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82db6]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82cbc]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x7ff6fba82c26]
mov rcx, qword [0x7ff6fbd313a8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba7e540]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba83392]
mov qword [0x7ff6fbd313c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba946c0]
lea rdx, [0x7ff6fba83680]
mov qword [0x7ff6fbd34080], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82c58]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fbd313a8]
lea rdx, [0x7ff6fba82fdc]
mov qword [0x7ff6fba94410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba832fc]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x7ff6fba943f0]
lea rdx, [0x7ff6fba835b8]
mov qword [0x7ff6fba93438], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r11, [rsp + 0x40]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret