Function at 0x140001947
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
mov eax, 0xcf58
call fcn.140005760
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.1400041c7
pxor xmm0, xmm0
movaps xmmword [rbp + 0xcdc0], xmm0
movaps xmmword [rbp + 0xcdd0], xmm0
movaps xmmword [rbp + 0xcde0], xmm0
pxor xmm0, xmm0
movaps xmmword [rbp + 0xcd90], xmm0
movaps xmmword [rbp + 0xcda0], xmm0
movaps xmmword [rbp + 0xcdb0], xmm0
pxor xmm0, xmm0
movaps xmmword [rbp + 0xcd60], xmm0
movaps xmmword [rbp + 0xcd70], xmm0
movaps xmmword [rbp + 0xcd80], xmm0
mov word [rbp + 0xcd40], 0x6c
mov word [rbp + 0xcd42], 0x6c
mov word [rbp + 0xcd44], 0x64
mov word [rbp + 0xcd46], 0x2e
mov word [rbp + 0xcd48], 0x33
mov word [rbp + 0xcd4a], 0x32
mov word [rbp + 0xcd4c], 0x65
mov word [rbp + 0xcd4e], 0x73
mov word [rbp + 0xcd50], 0x55
mov word [rbp + 0xcd52], 0
mov word [rbp + 0xcd20], 0x6c
mov word [rbp + 0xcd22], 0x6c
mov word [rbp + 0xcd24], 0x64
mov word [rbp + 0xcd26], 0x2e
mov word [rbp + 0xcd28], 0x32
mov word [rbp + 0xcd2a], 0x33
mov word [rbp + 0xcd2c], 0x6c
mov word [rbp + 0xcd2e], 0x65
mov word [rbp + 0xcd30], 0x6e
mov word [rbp + 0xcd32], 0x72
mov word [rbp + 0xcd34], 0x65
mov word [rbp + 0xcd36], 0x4b
mov word [rbp + 0xcd38], 0
mov word [rbp + 0xcd00], 0x6c
mov word [rbp + 0xcd02], 0x6c
mov word [rbp + 0xcd04], 0x64
mov word [rbp + 0xcd06], 0x2e
mov word [rbp + 0xcd08], 0x6c
mov word [rbp + 0xcd0a], 0x6c
mov word [rbp + 0xcd0c], 0x64
mov word [rbp + 0xcd0e], 0x74
mov word [rbp + 0xcd10], 0x6e
mov word [rbp + 0xcd12], 0
lea rax, [rbp + 0xcd40]
mov rcx, rax
call fcn.1400018b3
lea rax, [rbp + 0xcd20]
mov rcx, rax
call fcn.1400018b3
lea rax, [rbp + 0xcd00]
mov rcx, rax
call fcn.1400018b3
movabs rax, 0x724c6f6164446c6c
mov qword [rbp + 0xccf5], rax
mov dword [rbp + 0xccfc], 0x4c6472
movabs rax, 0x74646c6c2e646c6c
mov qword [rbp + 0xcceb], rax
mov word [rbp + 0xccf3], 0x6e
movabs rax, 0x656c33322e646c6c
mov qword [rbp + 0xccde], rax
movabs rax, 0x4b65726e656c33
mov qword [rbp + 0xcce3], rax
lea rax, [rbp + 0xccf5]
mov rcx, rax
call fcn.14000182f
lea rax, [rbp + 0xcceb]
mov rcx, rax
call fcn.14000182f
lea rax, [rbp + 0xccde]
mov rcx, rax
call fcn.14000182f
lea rdx, [rbp + 0xcd40]
lea rax, [rbp + 0xce10]
mov rcx, rax
call fcn.140001766
lea rdx, [rbp + 0xcd20]
lea rax, [rbp + 0xce00]
mov rcx, rax
call fcn.140001766
lea rdx, [rbp + 0xcd00]
lea rax, [rbp + 0xcdf0]
mov rcx, rax
call fcn.140001766
mov dword [rbp + 0xcdc0], 0x30
mov qword [rbp + 0xcdc8], 0
mov dword [rbp + 0xcdd8], 0x40
lea rax, [rbp + 0xce10]
mov qword [rbp + 0xcdd0], rax
mov qword [rbp + 0xcde0], 0
mov qword [rbp + 0xcde8], 0
mov dword [rbp + 0xcd90], 0x30
mov qword [rbp + 0xcd98], 0
mov dword [rbp + 0xcda8], 0x40
lea rax, [rbp + 0xce00]
mov qword [rbp + 0xcda0], rax
mov qword [rbp + 0xcdb0], 0
mov qword [rbp + 0xcdb8], 0
mov dword [rbp + 0xcd60], 0x30
mov qword [rbp + 0xcd68], 0
mov dword [rbp + 0xcd78], 0x40
lea rax, [rbp + 0xcdf0]
mov qword [rbp + 0xcd70], rax
mov qword [rbp + 0xcd80], 0
mov qword [rbp + 0xcd88], 0
movabs rax, 0x6548616e646c6541
movabs rdx, 0x4765744d6f64756c
mov qword [rbp + 0xccc0], rax
mov qword [rbp + 0xccc8], rdx
mov byte [rbp + 0xccd0], 0
lea rax, [rbp + 0xccc0]
mov rcx, rax
call fcn.14000182f
lea rax, [rbp + 0xccde]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xccc0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xcec0], rax
movabs rax, 0x6341646472657373
mov qword [rbp + 0xccb1], rax
movabs rax, 0x47657450726f63
mov qword [rbp + 0xccb8], rax
lea rax, [rbp + 0xccb1]
mov rcx, rax
call fcn.14000182f
lea rax, [rbp + 0xccde]
mov rdx, qword [rbp + 0xcec0]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0xccb1]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0xceb8], rax
movabs rax, 0x75616c416c6c6f63
mov qword [rbp + 0xcca4], rax
movabs rbx, 0x5669727475616c
mov qword [rbp + 0xcca9], rbx
lea rax, [rbp + 0xcca4]
mov rcx, rax
call fcn.14000182f
lea rax, [rbp + 0xccde]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xcca4]
mov r8, qword [rbp + 0xceb8]
mov rdx, rax
call r8
mov qword [rbp + 0xceb0], rax
movabs rax, 0x6c50726f74656374
mov qword [rbp + 0xcc95], rax
mov qword [rbp + 0xcc9c], rbx
lea rax, [rbp + 0xcc95]
mov rcx, rax
call fcn.14000182f
lea rax, [rbp + 0xccde]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xcc95]
mov r8, qword [rbp + 0xceb8]
mov rdx, rax
call r8
mov qword [rbp + 0xcea8], rax
lea rax, [rbp + 0xcceb]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0xccf5]
mov r8, qword [rbp + 0xceb8]
mov rdx, rax
call r8
mov qword [rbp + 0xcea0], rax
mov word [rbp + 0xcc93], 0xbb49
movabs rax, 0xefbeaddeefbeadde
mov qword [rbp + 0xcc8b], rax
mov dword [rbp + 0xcc87], 0xc3e3ff41
mov rax, qword [rbp + 0xcea0]
add rax, 5
mov qword [rbp + 0xce98], rax
lea rax, [rbp + 0xcc8b]
mov rdx, qword [rbp + 0xce98]
mov qword [rax], rdx
mov rax, qword [rbp + 0xceb0]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0xce90], rax
mov rax, qword [rbp + 0xce90]
mov r8d, 5
lea rdx, [0x140013050]
mov rcx, rax
call fcn.1400016d0
mov rax, qword [rbp + 0xce90]
lea rcx, [rax + 5]
lea rax, [rbp + 0xcc93]
mov r8d, 2
mov rdx, rax
call fcn.1400016d0
mov rax, qword [rbp + 0xce90]
lea rcx, [rax + 7]
lea rax, [rbp + 0xcc8b]
mov r8d, 8
mov rdx, rax
call fcn.1400016d0
mov rax, qword [rbp + 0xce90]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0xcc87]
mov r8d, 4
mov rdx, rax
call fcn.1400016d0
mov dword [rbp + 0xcc80], 0
lea rdx, [rbp + 0xcc80]
mov rax, qword [rbp + 0xce90]
mov r10, qword [rbp + 0xcea8]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
mov rcx, rax
call r10
mov rax, qword [rbp + 0xce90]
mov qword [rbp + 0xce88], rax
mov qword [rbp + 0xcc78], 0
lea rcx, [rbp + 0xcc78]
lea rdx, [rbp + 0xce10]
mov rax, qword [rbp + 0xce88]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0xcc70], 0
lea rcx, [rbp + 0xcc70]
lea rdx, [rbp + 0xce00]
mov rax, qword [rbp + 0xce88]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0xcc68], 0
lea rcx, [rbp + 0xcc68]
lea rdx, [rbp + 0xcdf0]
mov rax, qword [rbp + 0xce88]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rax, qword [rbp + 0xcc70]
lea rdx, [rbp + 0xccb1]
mov r8, qword [rbp + 0xceb8]
mov rcx, rax
call r8
mov qword [rbp + 0xce80], rax
mov rax, qword [rbp + 0xcc70]
lea rdx, [rbp + 0xcca4]
mov r8, qword [rbp + 0xce80]
mov rcx, rax
call r8
mov qword [rbp + 0xce78], rax
mov rax, qword [rbp + 0xcc70]
lea rdx, [rbp + 0xcc95]
mov r8, qword [rbp + 0xce80]
mov rcx, rax
call r8
mov qword [rbp + 0xce70], rax
movabs rax, 0x73734d656d6f7279
movabs rdx, 0x69746550726f6365
mov qword [rbp + 0xcc50], rax
mov qword [rbp + 0xcc58], rdx
mov dword [rbp + 0xcc5f], 0x577269
lea rax, [rbp + 0xcc50]
mov rcx, rax
call fcn.14000182f
mov rax, qword [rbp + 0xcc70]
lea rdx, [rbp + 0xcc50]
mov r8, qword [rbp + 0xce80]
mov rcx, rax
call r8
mov qword [rbp + 0xce68], rax
movabs rax, 0x7450726f63657373
movabs rdx, 0x657443757272656e
mov qword [rbp + 0xcc30], rax
mov qword [rbp + 0xcc38], rdx
mov word [rbp + 0xcc40], 0x47
lea rax, [rbp + 0xcc30]
mov rcx, rax
call fcn.14000182f
mov rax, qword [rbp + 0xcc70]
lea rdx, [rbp + 0xcc30]
mov r8, qword [rbp + 0xce80]
mov rcx, rax
call r8
mov qword [rbp + 0xce60], rax
lea rax, [rbp + 0xe0]
lea rdx, str.a98bf54c_fc44_76b3_3664_ce51fe7d7d89
mov ecx, 0xcb48
mov r8, rcx
mov rcx, rax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov dword [rbp + 0xce5c], 0x1969
mov eax, dword [rbp + 0xce5c]
cdqe
shl rax, 4
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov qword [rbp + 0xce50], rax
cmp qword [rbp + 0xce50], 0
jne 0x14000217d
mov eax, 0xffffffff
jmp 0x140002414
mov dword [rbp + 0xcecc], 0
jmp 0x1400021ed
mov eax, dword [rbp + 0xcecc]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0xce50]
add rdx, rax
mov eax, dword [rbp + 0xcecc]
cdqe
mov rax, qword [rbp + rax*8 + 0xe0]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0xce2c], eax
cmp dword [rbp + 0xce2c], 0
je 0x1400021e6
mov rax, qword [rbp + 0xce50]
mov rcx, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, 0xffffffff
jmp 0x140002414
add dword [rbp + 0xcecc], 1
mov eax, dword [rbp + 0xcecc]
cmp eax, dword [rbp + 0xce5c]
jl 0x140002189
mov eax, dword [rbp + 0xce5c]
cdqe
shl eax, 4
mov dword [rbp + 0xce4c], eax
movabs rax, 0x415147484c464a71
movabs rdx, 0x6c346453674f6c54
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xc8], rdx
mov byte [rbp + 0xd0], 0
movabs rax, 0x6571734631476b49
movabs rdx, 0x5237447768504335
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
mov byte [rbp + 0xb0], 0
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.140002f6b
mov ecx, dword [rbp + 0xce4c]
mov rdx, qword [rbp + 0xce50]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.140003f5e
mov eax, dword [rbp + 0xce4c]
mov qword [rbp + 0xce40], rax
mov qword [rbp + 0xce38], 0
movabs rax, 0x646172496e666f41
movabs rdx, 0x6e756d43616c656e
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov word [rbp - 0x30], 0x45
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14000182f
mov rax, qword [rbp + 0xcc70]
lea rdx, [rbp - 0x40]
mov r8, qword [rbp + 0xce80]
mov rcx, rax
call r8
mov qword [rbp + 0xce30], rax
mov rax, qword [rbp + 0xce40]
mov r10, qword [rbp + 0xce78]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0xce38], rax
movabs rax, 0xde0b6b3a7640859
mov rcx, rax
call fcn.1400017d4
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0xce40]
mov rax, qword [rbp + 0xce38]
mov r10, qword [rbp + 0xce70]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a7640801
mov rcx, rax
call fcn.1400017d4
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0xce40]
mov rax, qword [rbp + 0xce38]
mov r10, qword [rbp + 0xce70]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a76409b1
mov rcx, rax
call fcn.1400017d4
mov ebx, dword [rbp + 0xce4c]
mov rax, qword [rbp + 0xce60]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0xce50]
mov rax, qword [rbp + 0xce38]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0xce68]
mov r9, rbx
mov r8, rdx
mov rdx, rax
call r10
mov rax, qword [rbp + 0xce38]
mov r10, qword [rbp + 0xce30]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
mov rcx, rax
call r10
mov eax, 0
add rsp, 0xcf58
pop rbx
pop rbp
ret