Function at 0x4017bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rbx
mov eax, 0x20530
call fcn.004041c0
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.00402df0
lea rdx, [rbp + 0x203b0]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x20380]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x20350]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov word [rbp + 0x20330], 0x6c
mov word [rbp + 0x20332], 0x6c
mov word [rbp + 0x20334], 0x64
mov word [rbp + 0x20336], 0x2e
mov word [rbp + 0x20338], 0x33
mov word [rbp + 0x2033a], 0x32
mov word [rbp + 0x2033c], 0x65
mov word [rbp + 0x2033e], 0x73
mov word [rbp + 0x20340], 0x55
mov word [rbp + 0x20342], 0
mov word [rbp + 0x20310], 0x6c
mov word [rbp + 0x20312], 0x6c
mov word [rbp + 0x20314], 0x64
mov word [rbp + 0x20316], 0x2e
mov word [rbp + 0x20318], 0x32
mov word [rbp + 0x2031a], 0x33
mov word [rbp + 0x2031c], 0x6c
mov word [rbp + 0x2031e], 0x65
mov word [rbp + 0x20320], 0x6e
mov word [rbp + 0x20322], 0x72
mov word [rbp + 0x20324], 0x65
mov word [rbp + 0x20326], 0x4b
mov word [rbp + 0x20328], 0
mov word [rbp + 0x202f0], 0x6c
mov word [rbp + 0x202f2], 0x6c
mov word [rbp + 0x202f4], 0x64
mov word [rbp + 0x202f6], 0x2e
mov word [rbp + 0x202f8], 0x6c
mov word [rbp + 0x202fa], 0x6c
mov word [rbp + 0x202fc], 0x64
mov word [rbp + 0x202fe], 0x74
mov word [rbp + 0x20300], 0x6e
mov word [rbp + 0x20302], 0
lea rax, [rbp + 0x20330]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x20310]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x202f0]
mov rcx, rax
call fcn.0040172d
mov byte [rbp + 0x202e5], 0x6c
mov byte [rbp + 0x202e6], 0x6c
mov byte [rbp + 0x202e7], 0x44
mov byte [rbp + 0x202e8], 0x64
mov byte [rbp + 0x202e9], 0x61
mov byte [rbp + 0x202ea], 0x6f
mov byte [rbp + 0x202eb], 0x4c
mov byte [rbp + 0x202ec], 0x72
mov byte [rbp + 0x202ed], 0x64
mov byte [rbp + 0x202ee], 0x4c
mov byte [rbp + 0x202ef], 0
mov byte [rbp + 0x202db], 0x6c
mov byte [rbp + 0x202dc], 0x6c
mov byte [rbp + 0x202dd], 0x64
mov byte [rbp + 0x202de], 0x2e
mov byte [rbp + 0x202df], 0x6c
mov byte [rbp + 0x202e0], 0x6c
mov byte [rbp + 0x202e1], 0x64
mov byte [rbp + 0x202e2], 0x74
mov byte [rbp + 0x202e3], 0x6e
mov byte [rbp + 0x202e4], 0
mov byte [rbp + 0x202ce], 0x6c
mov byte [rbp + 0x202cf], 0x6c
mov byte [rbp + 0x202d0], 0x64
mov byte [rbp + 0x202d1], 0x2e
mov byte [rbp + 0x202d2], 0x32
mov byte [rbp + 0x202d3], 0x33
mov byte [rbp + 0x202d4], 0x6c
mov byte [rbp + 0x202d5], 0x65
mov byte [rbp + 0x202d6], 0x6e
mov byte [rbp + 0x202d7], 0x72
mov byte [rbp + 0x202d8], 0x65
mov byte [rbp + 0x202d9], 0x4b
mov byte [rbp + 0x202da], 0
lea rax, [rbp + 0x202e5]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x202db]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x202ce]
mov rcx, rax
call fcn.004016b0
lea rdx, [rbp + 0x20330]
lea rax, [rbp + 0x20400]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x20310]
lea rax, [rbp + 0x203f0]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x202f0]
lea rax, [rbp + 0x203e0]
mov rcx, rax
call fcn.004015e6
mov dword [rbp + 0x203b0], 0x30
mov qword [rbp + 0x203b8], 0
mov dword [rbp + 0x203c8], 0x40
lea rax, [rbp + 0x20400]
mov qword [rbp + 0x203c0], rax
mov qword [rbp + 0x203d0], 0
mov qword [rbp + 0x203d8], 0
mov dword [rbp + 0x20380], 0x30
mov qword [rbp + 0x20388], 0
mov dword [rbp + 0x20398], 0x40
lea rax, [rbp + 0x203f0]
mov qword [rbp + 0x20390], rax
mov qword [rbp + 0x203a0], 0
mov qword [rbp + 0x203a8], 0
mov dword [rbp + 0x20350], 0x30
mov qword [rbp + 0x20358], 0
mov dword [rbp + 0x20368], 0x40
lea rax, [rbp + 0x203e0]
mov qword [rbp + 0x20360], rax
mov qword [rbp + 0x20370], 0
mov qword [rbp + 0x20378], 0
mov byte [rbp + 0x202b0], 0x41
mov byte [rbp + 0x202b1], 0x65
mov byte [rbp + 0x202b2], 0x6c
mov byte [rbp + 0x202b3], 0x64
mov byte [rbp + 0x202b4], 0x6e
mov byte [rbp + 0x202b5], 0x61
mov byte [rbp + 0x202b6], 0x48
mov byte [rbp + 0x202b7], 0x65
mov byte [rbp + 0x202b8], 0x6c
mov byte [rbp + 0x202b9], 0x75
mov byte [rbp + 0x202ba], 0x64
mov byte [rbp + 0x202bb], 0x6f
mov byte [rbp + 0x202bc], 0x4d
mov byte [rbp + 0x202bd], 0x74
mov byte [rbp + 0x202be], 0x65
mov byte [rbp + 0x202bf], 0x47
mov byte [rbp + 0x202c0], 0
lea rax, [rbp + 0x202b0]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x202ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x202b0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x204a0], rax
mov byte [rbp + 0x202a1], 0x73
mov byte [rbp + 0x202a2], 0x73
mov byte [rbp + 0x202a3], 0x65
mov byte [rbp + 0x202a4], 0x72
mov byte [rbp + 0x202a5], 0x64
mov byte [rbp + 0x202a6], 0x64
mov byte [rbp + 0x202a7], 0x41
mov byte [rbp + 0x202a8], 0x63
mov byte [rbp + 0x202a9], 0x6f
mov byte [rbp + 0x202aa], 0x72
mov byte [rbp + 0x202ab], 0x50
mov byte [rbp + 0x202ac], 0x74
mov byte [rbp + 0x202ad], 0x65
mov byte [rbp + 0x202ae], 0x47
mov byte [rbp + 0x202af], 0
lea rax, [rbp + 0x202a1]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x202ce]
mov rdx, qword [rbp + 0x204a0]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x202a1]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x20498], rax
mov byte [rbp + 0x20294], 0x63
mov byte [rbp + 0x20295], 0x6f
mov byte [rbp + 0x20296], 0x6c
mov byte [rbp + 0x20297], 0x6c
mov byte [rbp + 0x20298], 0x41
mov byte [rbp + 0x20299], 0x6c
mov byte [rbp + 0x2029a], 0x61
mov byte [rbp + 0x2029b], 0x75
mov byte [rbp + 0x2029c], 0x74
mov byte [rbp + 0x2029d], 0x72
mov byte [rbp + 0x2029e], 0x69
mov byte [rbp + 0x2029f], 0x56
mov byte [rbp + 0x202a0], 0
lea rax, [rbp + 0x20294]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x202ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x20294]
mov r8, qword [rbp + 0x20498]
mov rdx, rax
call r8
mov qword [rbp + 0x20490], rax
mov byte [rbp + 0x20285], 0x74
mov byte [rbp + 0x20286], 0x63
mov byte [rbp + 0x20287], 0x65
mov byte [rbp + 0x20288], 0x74
mov byte [rbp + 0x20289], 0x6f
mov byte [rbp + 0x2028a], 0x72
mov byte [rbp + 0x2028b], 0x50
mov byte [rbp + 0x2028c], 0x6c
mov byte [rbp + 0x2028d], 0x61
mov byte [rbp + 0x2028e], 0x75
mov byte [rbp + 0x2028f], 0x74
mov byte [rbp + 0x20290], 0x72
mov byte [rbp + 0x20291], 0x69
mov byte [rbp + 0x20292], 0x56
mov byte [rbp + 0x20293], 0
lea rax, [rbp + 0x20285]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x202ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x20285]
mov r8, qword [rbp + 0x20498]
mov rdx, rax
call r8
mov qword [rbp + 0x20488], rax
lea rax, [rbp + 0x202db]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x202e5]
mov r8, qword [rbp + 0x20498]
mov rdx, rax
call r8
mov qword [rbp + 0x20480], rax
mov byte [rbp + 0x20283], 0x49
mov byte [rbp + 0x20284], 0xbb
mov byte [rbp + 0x2027b], 0xde
mov byte [rbp + 0x2027c], 0xad
mov byte [rbp + 0x2027d], 0xbe
mov byte [rbp + 0x2027e], 0xef
mov byte [rbp + 0x2027f], 0xde
mov byte [rbp + 0x20280], 0xad
mov byte [rbp + 0x20281], 0xbe
mov byte [rbp + 0x20282], 0xef
mov byte [rbp + 0x20277], 0x41
mov byte [rbp + 0x20278], 0xff
mov byte [rbp + 0x20279], 0xe3
mov byte [rbp + 0x2027a], 0xc3
mov rax, qword [rbp + 0x20480]
add rax, 5
mov qword [rbp + 0x20478], rax
lea rax, [rbp + 0x2027b]
mov rdx, qword [rbp + 0x20478]
mov qword [rax], rdx
mov rax, qword [rbp + 0x20490]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x20470], rax
mov rax, qword [rbp + 0x20470]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.00401550
mov rax, qword [rbp + 0x20470]
lea rcx, [rax + 5]
lea rax, [rbp + 0x20283]
mov r8d, 2
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x20470]
lea rcx, [rax + 7]
lea rax, [rbp + 0x2027b]
mov r8d, 8
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x20470]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x20277]
mov r8d, 4
mov rdx, rax
call fcn.00401550
mov dword [rbp + 0x20270], 0
lea rdx, [rbp + 0x20270]
mov rcx, qword [rbp + 0x20470]
mov rax, qword [rbp + 0x20488]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
call rax
mov rax, qword [rbp + 0x20470]
mov qword [rbp + 0x20468], rax
mov qword [rbp + 0x20268], 0
lea rcx, [rbp + 0x20268]
lea rdx, [rbp + 0x20400]
mov rax, qword [rbp + 0x20468]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x20260], 0
lea rcx, [rbp + 0x20260]
lea rdx, [rbp + 0x203f0]
mov rax, qword [rbp + 0x20468]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x20258], 0
lea rcx, [rbp + 0x20258]
lea rdx, [rbp + 0x203e0]
mov rax, qword [rbp + 0x20468]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rcx, qword [rbp + 0x20260]
lea rax, [rbp + 0x202a1]
mov r8, qword [rbp + 0x20498]
mov rdx, rax
call r8
mov qword [rbp + 0x20460], rax
mov rcx, qword [rbp + 0x20260]
lea rax, [rbp + 0x20294]
mov r8, qword [rbp + 0x20460]
mov rdx, rax
call r8
mov qword [rbp + 0x20458], rax
mov rcx, qword [rbp + 0x20260]
lea rax, [rbp + 0x20285]
mov r8, qword [rbp + 0x20460]
mov rdx, rax
call r8
mov qword [rbp + 0x20450], rax
mov byte [rbp + 0x20240], 0x79
mov byte [rbp + 0x20241], 0x72
mov byte [rbp + 0x20242], 0x6f
mov byte [rbp + 0x20243], 0x6d
mov byte [rbp + 0x20244], 0x65
mov byte [rbp + 0x20245], 0x4d
mov byte [rbp + 0x20246], 0x73
mov byte [rbp + 0x20247], 0x73
mov byte [rbp + 0x20248], 0x65
mov byte [rbp + 0x20249], 0x63
mov byte [rbp + 0x2024a], 0x6f
mov byte [rbp + 0x2024b], 0x72
mov byte [rbp + 0x2024c], 0x50
mov byte [rbp + 0x2024d], 0x65
mov byte [rbp + 0x2024e], 0x74
mov byte [rbp + 0x2024f], 0x69
mov byte [rbp + 0x20250], 0x72
mov byte [rbp + 0x20251], 0x57
mov byte [rbp + 0x20252], 0
lea rax, [rbp + 0x20240]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x20260]
lea rax, [rbp + 0x20240]
mov r8, qword [rbp + 0x20460]
mov rdx, rax
call r8
mov qword [rbp + 0x20448], rax
mov byte [rbp + 0x20220], 0x73
mov byte [rbp + 0x20221], 0x73
mov byte [rbp + 0x20222], 0x65
mov byte [rbp + 0x20223], 0x63
mov byte [rbp + 0x20224], 0x6f
mov byte [rbp + 0x20225], 0x72
mov byte [rbp + 0x20226], 0x50
mov byte [rbp + 0x20227], 0x74
mov byte [rbp + 0x20228], 0x6e
mov byte [rbp + 0x20229], 0x65
mov byte [rbp + 0x2022a], 0x72
mov byte [rbp + 0x2022b], 0x72
mov byte [rbp + 0x2022c], 0x75
mov byte [rbp + 0x2022d], 0x43
mov byte [rbp + 0x2022e], 0x74
mov byte [rbp + 0x2022f], 0x65
mov byte [rbp + 0x20230], 0x47
mov byte [rbp + 0x20231], 0
lea rax, [rbp + 0x20220]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x20260]
lea rax, [rbp + 0x20220]
mov r8, qword [rbp + 0x20460]
mov rdx, rax
call r8
mov qword [rbp + 0x20440], rax
lea rax, [rbp - 0x20]
lea rdx, str.040422e8_4a00_279c_2582_e3e003fbffb7
mov ecx, 0x20238
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x2043c], 0x4047
mov eax, dword [rbp + 0x2043c]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x20430], rax
cmp qword [rbp + 0x20430], 0
jne 0x402286
mov eax, 0xffffffff
jmp 0x40249b
mov dword [rbp + 0x204ac], 0
jmp 0x4022f3
mov eax, dword [rbp + 0x204ac]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x20430]
add rdx, rax
mov eax, dword [rbp + 0x204ac]
cdqe
mov rax, qword [rbp + rax*8 - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x2042c], eax
cmp dword [rbp + 0x2042c], 0
je 0x4022ec
mov rax, qword [rbp + 0x20430]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x40249b
add dword [rbp + 0x204ac], 1
mov eax, dword [rbp + 0x204ac]
cmp eax, dword [rbp + 0x2043c]
jl 0x402292
mov eax, dword [rbp + 0x2043c]
cdqe
shl eax, 4
mov dword [rbp + 0x20428], eax
mov eax, dword [rbp + 0x20428]
mov qword [rbp + 0x20420], rax
mov qword [rbp + 0x20418], 0
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x66
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x3c], 0x49
mov byte [rbp - 0x3b], 0x72
mov byte [rbp - 0x3a], 0x61
mov byte [rbp - 0x39], 0x64
mov byte [rbp - 0x38], 0x6e
mov byte [rbp - 0x37], 0x65
mov byte [rbp - 0x36], 0x6c
mov byte [rbp - 0x35], 0x61
mov byte [rbp - 0x34], 0x43
mov byte [rbp - 0x33], 0x6d
mov byte [rbp - 0x32], 0x75
mov byte [rbp - 0x31], 0x6e
mov byte [rbp - 0x30], 0x45
mov byte [rbp - 0x2f], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x20260]
lea rax, [rbp - 0x40]
mov r8, qword [rbp + 0x20460]
mov rdx, rax
call r8
mov qword [rbp + 0x20410], rax
mov rdx, qword [rbp + 0x20420]
mov rax, qword [rbp + 0x20458]
mov r9d, 4
mov r8d, 0x3000
mov ecx, 0
call rax
mov qword [rbp + 0x20418], rax
movabs rcx, 0xde0b6b3a7640859
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x20420]
mov rcx, qword [rbp + 0x20418]
mov rax, qword [rbp + 0x20450]
mov r9, r8
mov r8d, 0x20
call rax
movabs rcx, 0xde0b6b3a7640801
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x20420]
mov rcx, qword [rbp + 0x20418]
mov rax, qword [rbp + 0x20450]
mov r9, r8
mov r8d, 0x40
call rax
movabs rcx, 0xde0b6b3a76409b1
call fcn.00401654
mov ebx, dword [rbp + 0x20428]
mov rax, qword [rbp + 0x20440]
call rax
mov r10, rax
mov rcx, qword [rbp + 0x20430]
mov rdx, qword [rbp + 0x20418]
mov qword [rsp + 0x20], 0
mov rax, qword [rbp + 0x20448]
mov r9, rbx
mov r8, rcx
mov rcx, r10
call rax
mov rcx, qword [rbp + 0x20418]
mov rax, qword [rbp + 0x20410]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
call rax
mov eax, 0
add rsp, 0x20530
pop rbx
pop rdi
pop rbp
ret