Function at 0x140611ccd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x120
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
push rbx
push r12
mov rax, 1
test rax, rax
je 0x140611fb7
mov byte [rbp - 0x120], 0x50
mov byte [rbp - 0x11f], 0x72
mov byte [rbp - 0x11e], 0x6f
mov byte [rbp - 0x11d], 0x63
mov byte [rbp - 0x11c], 0x65
mov byte [rbp - 0x11b], 0x73
mov byte [rbp - 0x11a], 0x73
mov byte [rbp - 0x119], 0x69
mov byte [rbp - 0x118], 0x6e
mov byte [rbp - 0x117], 0x67
mov byte [rbp - 0x116], 0x20
mov byte [rbp - 0x115], 0x49
mov byte [rbp - 0x114], 0x6d
mov byte [rbp - 0x113], 0x70
mov byte [rbp - 0x112], 0x6f
mov byte [rbp - 0x111], 0x72
mov byte [rbp - 0x110], 0x74
mov byte [rbp - 0x10f], 0x20
mov byte [rbp - 0x10e], 0x44
mov byte [rbp - 0x10d], 0x69
mov byte [rbp - 0x10c], 0x72
mov byte [rbp - 0x10b], 0x65
mov byte [rbp - 0x10a], 0x63
mov byte [rbp - 0x109], 0x74
mov byte [rbp - 0x108], 0x6f
mov byte [rbp - 0x107], 0x72
mov byte [rbp - 0x106], 0x79
mov byte [rbp - 0x105], 0x3a
mov byte [rbp - 0x104], 0
mov rax, 1
mov rax, qword [rbp + 0x20]
mov eax, dword [rax + 0xc]
add rax, qword [rbp + 0x18]
mov rbx, rax
mov rax, 1
test rax, rax
je 0x140611fb7
mov rax, 1
test rax, rax
je 0x140611fb7
sub rsp, 0x20
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
add rsp, 0x20
test rax, rax
je 0x140611fb7
mov qword [rbp - 0x10], rax
mov rdx, qword [rbp + 0x20]
mov eax, dword [rdx + 0x10]
add rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov eax, dword [rdx]
test eax, eax
jne 0x140611e2d
mov eax, dword [rdx + 0x10]
add rax, qword [rbp + 0x18]
mov qword [rbp - 0x20], rax
sub r12, r12
mov rcx, r12
mov rax, qword [rbp - 0x20]
add rax, r12
mov rax, qword [rax]
test rax, rax
je 0x140611fae
mov rbx, rax
movabs rcx, 0x8000000000000000
and rax, rcx
jne 0x140611f08
mov byte [rbp - 0x120], 0x4e
mov byte [rbp - 0x11f], 0x61
mov byte [rbp - 0x11e], 0x6d
mov byte [rbp - 0x11d], 0x65
mov byte [rbp - 0x11c], 0x3a
mov byte [rbp - 0x11b], 0x20
mov byte [rbp - 0x11a], 0
lea rax, [rbp - 0x120]
mov rax, 1
test rax, rax
je 0x140611fb7
add rbx, qword [rbp + 0x18]
lea rbx, [rbx + 2]
mov rax, rbx
mov rax, 1
test rax, rax
je 0x140611fb7
mov rax, 1
test rax, rax
je 0x140611fb7
sub rsp, 0x20
mov rcx, qword [rbp - 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
add rsp, 0x20
test rax, rax
je 0x140611fb7
mov rbx, qword [rbp - 0x18]
add rbx, r12
mov qword [rbx], rax
add r12, 8
jmp 0x140611e38
mov byte [rbp - 0x120], 0x4f
mov byte [rbp - 0x11f], 0x72
mov byte [rbp - 0x11e], 0x64
mov byte [rbp - 0x11d], 0x69
mov byte [rbp - 0x11c], 0x6e
mov byte [rbp - 0x11b], 0x61
mov byte [rbp - 0x11a], 0x6c
mov byte [rbp - 0x119], 0x3a
mov byte [rbp - 0x118], 0x20
mov byte [rbp - 0x117], 0
lea rax, [rbp - 0x120]
mov rax, 1
test rax, rax
je 0x140611fb7
movabs rcx, 0x8000000000000000
xor rbx, rcx
mov rax, rbx
mov rax, 1
test rax, rax
je 0x140611cc1
sub rsp, 0x20
mov rcx, qword [rbp - 0x10]
mov rdx, rbx
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
add rsp, 0x20
test rax, rax
je 0x140611fb7
mov rbx, qword [rbp - 0x18]
add rbx, r12
mov qword [rbx], rax
add r12, 8
jmp 0x140611e38
mov rax, 1
jmp 0x140611fba
sub rax, rax
pop r12
pop rbx
leave
ret