Function at 0x140007d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r15
push rbp
sub rsp, 0x2c0
mov rsi, rdx
mov rax, qword [0x140024c20]
movabs rdx, 0
xor rax, rsp
mov rbx, rcx
mov qword [rsp + 0x2b0], rax
mov eax, 0x260
mov dword [rsp + 0x2a0], edx
mov qword [rsp + rax + 0x38], rdx
mov qword [rsp + rax + 0x30], rdx
mov qword [rsp + rax + 0x28], rdx
mov qword [rsp + rax + 0x20], rdx
sub rax, 0x20
jne 0x140007d6f
lea rcx, str.ssprsecimpl
mov edx, 1
call fcn.140011da0
mov rbp, rax
mov rcx, rbp
lea rdx, str.calling_transform_encoding_username_to_code_page
call fcn.140010c10
mov rax, qword [rbx + 0x178]
xor r12d, r12d
xor edi, edi
mov ecx, 0xfde9
xor edx, edx
mov r9d, 0xffffffff
mov r13, qword [rax + 8]
mov r8, r13
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov r15d, eax
test r15d, r15d
je 0x140007e79
movsxd rcx, r15d
mov edx, 2
call qword [sym.imp.MSVCR100.dll_calloc]
mov rdi, rax
test rdi, rdi
je 0x140007e79
mov ecx, 0xfde9
xor edx, edx
mov r8, r13
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], r15d
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140007e79
xor ecx, ecx
xor eax, eax
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r13d, eax
test r13d, r13d
je 0x140007e79
movsxd rcx, r13d
mov edx, 1
call qword [sym.imp.MSVCR100.dll_calloc]
mov rbx, rax
test rbx, rbx
jne 0x140007f0d
mov qword [rsp + 0x2a8], 0
call qword [sym.imp.orauts.dll_GetLastError]
mov r12d, eax
mov ecx, 0x1100
xor edx, edx
mov r8d, r12d
mov r9d, 0x400
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r9, qword [rsp + 0x2a8]
test r9, r9
lea rax, [0x14001f414]
lea rcx, [rsp + 0x40]
cmove r9, rax
mov edx, 0x200
lea r8, [0x14001e308]
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x140007f3e
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x140007f3e
xor ecx, ecx
xor eax, eax
xor edx, edx
mov r8, rdi
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140007e79
test rdi, rdi
je 0x140007f4c
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_free]
test r12d, r12d
jne 0x14000834b
mov ecx, 1
mov edx, 6
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsi + 0x150], rax
test rax, rax
je 0x1400081aa
mov rcx, rbp
lea rdx, str.after_calling_transform_encoding_username_to_code_page._user_name_is__s_n
mov r8, rbx
mov qword [rsi + 0x18], 6
add dword [rsi + 4], 6
call fcn.140010c10
mov rdx, rbx
lea rcx, [rsp + 0x40]
call sub.orawsec12.dll_sswseIsAdministrator
mov r15d, eax
cmp r15d, 1
jne 0x140007fdb
mov rcx, rbp
lea rdx, str.__s_is_an_administrator_n
mov r8, rbx
mov dword [rsi + 0x100], 0
call fcn.140010c10
mov rax, qword [rsi + 0x150]
mov byte [rax + 4], 0
mov dword [rax], 0x65757274
jmp 0x140008151
test r15d, r15d
jne 0x140008014
mov rcx, rbp
lea rdx, str.__s_is_not_an_administrator_n
mov r8, rbx
mov dword [rsi + 0x100], 0
call fcn.140010c10
mov rax, qword [rsi + 0x150]
mov word [rax + 4], 0x65
mov dword [rax], 0x736c6166
jmp 0x140008151
mov rcx, rbp
lea rdx, str.error_while_checking_if__s_is_an_administrator__d_n
mov r8, rbx
mov r9d, r15d
call fcn.140010c10
lea rcx, str.ssprsecimpl
mov edx, 1
call fcn.140011da0
mov r13, rax
lea rdx, [rsp + 0x40]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14000806a
mov rax, rdx
add rdx, rcx
call fcn.140018880
inc rax
mov ecx, 1
movsxd r12, eax
mov edi, r12d
mov rdx, r12
mov dword [rsi + 0x100], 1
mov qword [rsi + 0x20], r12
add dword [rsi + 4], edi
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsi + 0x158], rax
test rax, rax
je 0x14000818f
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8, r12
call qword [sym.imp.MSVCR100.dll_strncpy]
lea rdx, [rsp + 0x240]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400080e3
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x14000813c
mov rdx, qword [rsi + 0x158]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140008117
mov rax, rdx
add rdx, rcx
call fcn.140018880
cmp eax, 0x7ff
jge 0x14000813c
mov rcx, r13
lea rdx, str._s:other_info:__s_n
lea r8, str.handleMiscErrors
lea r9, [rsp + 0x240]
call fcn.140010c10
mov dword [rsi + 0x104], r15d
test r13, r13
je 0x140008151
mov rcx, r13
call qword [sym.imp.MSVCR100.dll_fclose]
test rbp, rbp
je 0x14000815f
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_fclose]
test rbx, rbx
je 0x14000816d
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14001c150
add rsp, 0x2c0
pop rbp
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rcx, r13
lea rdx, str._s:failed_to_allocate__d_bytes_of_memory_for_response
lea r8, str.handleMiscErrors
mov r9d, edi
call fcn.140010c10
jmp 0x140008143
mov rcx, rbp
lea rdx, str.failed_to_allocate__d_bytes_of_memory_for_response
mov r8d, 6
call fcn.140010c10
mov byte [rsp + 0x5a], 0
mov word [rsp + 0x58], 0x7365
mov dword [rsp + 0x54], 0x74796220
mov dword [rsp + 0x50], 0x36206574
mov dword [rsp + 0x4c], 0x61636f6c
mov dword [rsp + 0x48], 0x6c61206f
mov dword [rsp + 0x44], 0x74206465
mov dword [rsp + 0x40], 0x6c696166
lea rcx, str.ssprsecimpl
mov edx, 1
call fcn.140011da0
mov rdi, rax
lea rdx, [rsp + 0x40]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14000823c
mov rax, rdx
add rdx, rcx
call fcn.140018880
inc rax
mov ecx, 1
movsxd r12, eax
mov r13d, r12d
mov rdx, r12
mov dword [rsi + 0x100], 1
mov qword [rsi + 0x20], r12
add dword [rsi + 4], r13d
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsi + 0x158], rax
test rax, rax
je 0x140008330
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8, r12
call qword [sym.imp.MSVCR100.dll_strncpy]
lea rdx, [rsp + 0x240]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400082b6
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x14000830f
mov rdx, qword [rsi + 0x158]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x1400082ea
mov rax, rdx
add rdx, rcx
call fcn.140018880
cmp eax, 0x7ff
jge 0x14000830f
mov rcx, rdi
lea rdx, str._s:other_info:__s_n
lea r8, str.handleMiscErrors
lea r9, [rsp + 0x240]
call fcn.140010c10
mov dword [rsi + 0x104], 0
test rdi, rdi
je 0x140008151
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fclose]
jmp 0x140008151
mov rcx, rdi
lea rdx, str._s:failed_to_allocate__d_bytes_of_memory_for_response
lea r8, str.handleMiscErrors
mov r9d, r13d
call fcn.140010c10
jmp 0x140008319
mov rcx, rbp
lea rdx, str.failed_while_encoding_username_to_code_page
call fcn.140010c10
lea rcx, str.ssprsecimpl
mov edx, 1
call fcn.140011da0
mov rdi, rax
lea rdx, [rsp + 0x40]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x14000839b
mov rax, rdx
add rdx, rcx
call fcn.140018880
inc rax
mov ecx, 1
movsxd r12, eax
mov r13d, r12d
mov rdx, r12
mov dword [rsi + 0x100], 1
mov qword [rsi + 0x20], r12
add dword [rsi + 4], r13d
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rsi + 0x158], rax
test rax, rax
je 0x14000848f
mov rcx, rax
lea rdx, [rsp + 0x40]
mov r8, r12
call qword [sym.imp.MSVCR100.dll_strncpy]
lea rdx, [rsp + 0x240]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140008415
mov rax, rdx
add rdx, rcx
call fcn.140018880
test rax, rax
jbe 0x14000846e
mov rdx, qword [rsi + 0x158]
mov rcx, rdx
and rdx, 0xfffffffffffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [rdx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x140008449
mov rax, rdx
add rdx, rcx
call fcn.140018880
cmp eax, 0x7ff
jge 0x14000846e
mov rcx, rdi
lea rdx, str._s:other_info:__s_n
lea r8, str.handleMiscErrors
lea r9, [rsp + 0x240]
call fcn.140010c10
mov dword [rsi + 0x104], 0
test rdi, rdi
je 0x140008151
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fclose]
jmp 0x140008151
mov rcx, rdi
lea rdx, str._s:failed_to_allocate__d_bytes_of_memory_for_response
lea r8, str.handleMiscErrors
mov r9d, r13d
call fcn.140010c10
jmp 0x140008478