Function at 0x140001b80
Capabilities:
Contain obfuscated stackstrings
Enumerate process modules

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x750
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140008030]
xor rax, rsp
mov qword [rsp + 0x740], rax
mov ebx, ecx
mov byte [rsp + 0x30], 0
mov ecx, 0x64
mov word [r11 - 0x50], cx
mov eax, 0x77
mov word [r11 - 0x4e], ax
mov eax, 0x6d
mov word [r11 - 0x4c], ax
mov eax, 0x63
mov word [r11 - 0x4a], ax
mov eax, WSAStartup
mov word [r11 - 0x48], ax
mov eax, WSAStartup
mov word [r11 - 0x46], ax
mov eax, 0x65
mov word [r11 - 0x44], ax
mov edx, 0x2e
mov word [r11 - 0x42], dx
mov word [r11 - 0x40], cx
mov eax, 0x6c
mov word [r11 - 0x3e], ax
mov word [r11 - 0x3c], ax
xor r12d, r12d
mov word [r11 - 0x3a], r12w
mov word [r11 - 0x68], cx
mov r8d, 0x32
mov word [r11 - 0x66], r8w
mov word [r11 - 0x64], cx
mov r8d, 0x31
mov word [r11 - 0x62], r8w
mov word [r11 - 0x60], dx
mov word [r11 - 0x5e], cx
mov word [r11 - 0x5c], ax
mov word [r11 - 0x5a], ax
mov word [r11 - 0x58], r12w
lea rcx, [r11 - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rsp + 0x710]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov byte [rsp + 0x6e8], 0x52
mov byte [rsp + 0x6e9], 0x65
mov byte [rsp + 0x6ea], 0x70
mov byte [rsp + 0x6eb], 0x6f
mov byte [rsp + 0x6ec], 0x72
mov byte [rsp + 0x6ed], 0x74
mov byte [rsp + 0x6ee], 0x53
mov byte [rsp + 0x6ef], 0x65
mov byte [rsp + 0x6f0], 0x63
mov byte [rsp + 0x6f1], 0x74
mov byte [rsp + 0x6f2], 0x69
mov byte [rsp + 0x6f3], 0x6f
mov byte [rsp + 0x6f4], 0x6e
mov byte [rsp + 0x6f5], r12b
lea r8, [rsp + 0x6e8]
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov r15, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x1400024f7
mov qword [rsp + 0x20], 0x2c
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbp, rax
test rax, rax
jne 0x140001d4d
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400024f7
mov rax, qword [rax]
mov qword [0x140056e00], rax
mov rax, qword [rbp + 8]
mov qword [0x140056e08], rax
mov rax, qword [rbp + 0x10]
mov qword [0x140056e10], rax
mov rax, qword [rbp + 0x18]
mov qword [0x140056e18], rax
mov rax, qword [rbp + 0x20]
mov qword [0x140056e20], rax
mov eax, dword [rbp + 0x28]
mov dword [0x140056e28], eax
call fcn.1400014c0
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call qword [0x140056ae0]
mov r15, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1400024f7
mov dword [rsp + 0x2a0], 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
mov ecx, 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x140001de9
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400024f7
lea rdx, [rsp + 0x2a0]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
jne 0x140001e14
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400024f7
mov ecx, 8
call fcn.140003e5e
test rax, rax
je 0x140001e2d
lea rcx, [rsp + 0x38]
mov qword [rax], rcx
jmp 0x140001e30
mov rax, r12
mov qword [rsp + 0x38], rax
mov rsi, r12
mov qword [rsp + 0x50], r12
mov rdi, r12
mov qword [rsp + 0x58], r12
mov rcx, r12
mov qword [rsp + 0x60], rcx
movabs r15, 0x795ceb240795ceb3
movzx ebx, byte [rsp + 0x30]
nop dword [rax]
test rsi, rsi
jne 0x140001e6a
mov r8, r12
jmp 0x140001e84
sub rcx, rsi
mov rax, r15
imul rcx
mov r8, rdx
sar r8, 9
mov rax, r8
shr rax, 0x3f
add r8, rax
mov rcx, rdi
sub rcx, rsi
mov rax, r15
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r8
jae 0x140001ed6
xor eax, eax
mov byte [rsp + 0x28], al
mov byte [rsp + 0x20], bl
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x2a0]
lea edx, [rax + 1]
mov rcx, rdi
call fcn.140003120
lea r11, [rdi + 0x438]
mov qword [rsp + 0x58], r11
jmp 0x140001fd8
mov r12, rdi
cmp rsi, rdi
jbe 0x140001eee
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x38]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r12
mov rcx, rdi
sub rcx, rsi
mov rax, r15
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rdx, rax
jne 0x140001f1d
xor edi, edi
jmp 0x140001f54
cmp rsi, rdi
jbe 0x140001f28
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
test r13, r13
je 0x140001f34
cmp r13, qword [rsp + 0x38]
je 0x140001f3a
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
sub r12, rsi
mov rax, r15
imul r12
mov rdi, rdx
sar rdi, 9
mov rax, rdi
shr rax, 0x3f
add rdi, rax
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0xa0], xmm0
lea r9, [rsp + 0x2a0]
mov r8d, 1
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x38]
call fcn.140002990
mov r12, qword [rsp + 0x50]
cmp r12, qword [rsp + 0x58]
jbe 0x140001f94
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rsi, qword [rsp + 0x38]
test rsi, rsi
jne 0x140001fa9
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor r11d, r11d
jmp 0x140001fac
mov r11, qword [rsi]
imul rdi, rdi, 0x438
lea rcx, [rdi + r12]
cmp rcx, qword [r11 + 0x20]
ja 0x140001fcf
test rsi, rsi
je 0x140001fc7
mov rax, qword [rsi]
jmp 0x140001fc9
xor eax, eax
cmp rcx, qword [rax + 0x18]
jae 0x140001fd5
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
xor r12d, r12d
lea rdx, [rsp + 0x2a0]
mov rcx, r14
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x140002000
mov rcx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
jmp 0x140001e60
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r11, qword [rsp + 0x50]
mov r13, r11
mov rbx, qword [rsp + 0x58]
cmp r11, rbx
jbe 0x14000202b
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rbx, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], r13
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
add r13, 0x30
mov rsi, qword [rsp + 0x78]
mov qword [rsp + 0x98], rsi
mov rdi, qword [rsp + 0x70]
nop dword [rax + rax]
cmp r11, rbx
jbe 0x14000206b
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
test rdi, rdi
je 0x140002077
cmp rdi, qword [rsp + 0x38]
je 0x14000207d
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
cmp rsi, rbx
je 0x1400024a9
test rdi, rdi
jne 0x140002096
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov r11, r12
jmp 0x140002099
mov r11, qword [rdi]
cmp rsi, qword [r11 + 0x20]
jb 0x1400020a5
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
lea rcx, [r13 + 0x200]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140002460
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x40
lea r8, [rsp + 0x260]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movsxd rbx, dword [rsp + 0x29c]
add rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x108
lea r8, [rsp + 0xc0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx r11d, word [rsp + 0xd4]
mov eax, dword [rsp + 0x29c]
lea r15d, [r11 + rax + 0x18]
mov r14d, r12d
cmp r12w, word [rsp + 0xc6]
jae 0x140002460
mov byte [rsp + 0x6e0], 0x2e
mov byte [rsp + 0x6e1], 0x74
mov byte [rsp + 0x6e2], 0x65
mov byte [rsp + 0x6e3], 0x78
mov byte [rsp + 0x6e4], 0x74
mov byte [rsp + 0x6e5], 0
mov ebx, r15d
add rbx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov qword [rsp + 0x20], r12
mov r9d, 0x28
lea r8, [rsp + 0x1d0]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea r11, [rsp + 0x1d0]
lea rdx, [rsp + 0x6e0]
sub rdx, r11
movzx ecx, byte [r11]
movzx eax, byte [r11 + rdx]
sub ecx, eax
jne 0x1400021c4
inc r11
test eax, eax
jne 0x1400021b0
test ecx, ecx
jne 0x140002440
mov eax, 0x64
mov word [rsp + 0x6f8], ax
mov ecx, 0x32
mov word [rsp + 0x6fa], cx
mov word [rsp + 0x6fc], ax
mov ecx, 0x31
mov word [rsp + 0x6fe], cx
mov ecx, 0x2e
mov word [rsp + 0x700], cx
mov word [rsp + 0x702], ax
mov eax, 0x6c
mov word [rsp + 0x704], ax
mov word [rsp + 0x706], ax
mov word [rsp + 0x708], r12w
mov rbx, r13
cmp word [r13], 0
je 0x140002256
nop dword [rax]
movzx ecx, word [rbx]
call qword [sym.imp.MSVCR90.dll_towlower]
mov word [rbx], ax
add rbx, 2
cmp word [rbx], 0
jne 0x140002240
mov rax, r13
lea r8, [rsp + 0x6f8]
sub r8, r13
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140002278
add rax, 2
test ecx, ecx
jne 0x140002264
test edx, edx
jne 0x140002444
mov ecx, dword [rsp + 0x1d8]
call fcn.140003d68
mov rsi, rax
mov ecx, dword [rsp + 0x1d8]
call fcn.140003d68
mov r12, rax
mov ebx, dword [rsp + 0x1d8]
mov edi, dword [rsp + 0x1dc]
add rdi, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edx, dword [rsp + 0x1d8]
mov rcx, rsi
call fcn.140001150
mov ebx, eax
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
mov rdx, r13
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov dword [rsp + 0x220], ebx
mov edx, dword [rsp + 0x1dc]
mov rdi, qword [rsp + 0x88]
add rdx, rdi
mov r9d, dword [rsp + 0x1d8]
mov r8, r12
mov rcx, qword [rsp + 0x80]
call qword [0x140056ae8]
mov edx, dword [rsp + 0x1d8]
mov rcx, r12
call fcn.140001150
mov ebx, eax
lea rcx, [rsp + 0x228]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void____ptr64]
nop
mov rdx, r13
lea rcx, [rsp + 0x228]
call qword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______ptr64___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const____ptr64____ptr64]
mov dword [rsp + 0x250], ebx
mov r8d, sendto
mov rdx, r12
mov rcx, rsi
call sub.MSVCR90.dll_memcmp
test eax, eax
jne 0x14000240f
cmp ebx, dword [rsp + 0x220]
je 0x14000240f
cmp byte [rsp + 0x30], al
jne 0x14000240f
mov byte [rsp + 0x30], 1
lea rcx, [0x140056e00]
call fcn.1400011a0
mov ecx, 0x64
mov dword [0x140056e28], ecx
mov rax, qword [0x140056e00]
mov qword [rbp], rax
mov rax, qword [0x140056e08]
mov qword [rbp + 8], rax
mov rax, qword [0x140056e10]
mov qword [rbp + 0x10], rax
mov rax, qword [0x140056e18]
mov qword [rbp + 0x18], rax
mov rax, qword [0x140056e20]
mov qword [rbp + 0x20], rax
mov eax, dword [0x140056e28]
mov dword [rbp + 0x28], eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, r12
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
nop
lea rcx, [rsp + 0x228]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x1f8]
call qword [sym.imp.MSVCP90.dll_public:_void___cdecl_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void____ptr64]
xor r12d, r12d
add r15d, 0x28
inc r14d
movzx eax, word [rsp + 0xc6]
cmp r14d, eax
jl 0x140002172
mov rsi, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x70]
test rdi, rdi
jne 0x140002475
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov r11, r12
jmp 0x140002478
mov r11, qword [rdi]
cmp rsi, qword [r11 + 0x20]
jb 0x140002484
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
add rsi, 0x438
mov qword [rsp + 0x98], rsi
add r13, 0x438
mov rbx, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
jmp 0x140002060
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400024de
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r12
mov rcx, qword [rsp + 0x38]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, qword [rsp + 0x740]
xor rcx, rsp
call fcn.140003dc0
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret