Function at 0x18000a368
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a8
and qword [rdx], 0
and dword [r8], 0
lea rcx, [rbp - 0x30]
call fcn.18000368c
lea rcx, [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rbp - 0x3c]
movzx r9d, word [rbp - 0x3e]
movzx r8d, word [rbp - 0x42]
movzx edx, word [rbp - 0x46]
movzx ecx, word [rbp - 0x48]
movzx r10d, word [rbp - 0x40]
movzx r11d, byte [rbp + 0x6b]
movzx ebx, byte [rbp + 0x6a]
movzx edi, byte [rbp + 0x69]
movzx esi, byte [rbp + 0x68]
movzx r14d, byte [rbp + 0x67]
movzx r15d, byte [rbp + 0x66]
movzx r12d, byte [rbp + 0x65]
movzx r13d, byte [rbp + 0x64]
mov dword [rsp + 0x98], eax
movzx eax, word [rbp + 0x62]
mov dword [rsp + 0x90], r9d
mov r9d, dword [rbp + 0x5c]
mov dword [rsp + 0x88], r10d
mov dword [rsp + 0x80], r8d
mov dword [rsp + 0x78], edx
mov dword [rsp + 0x70], ecx
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], eax
movzx eax, word [rbp + 0x60]
lea r8, str._08x_04x_04x_02x_02x_02x_02x_02x_02x_02x_02x__04d._02d._02d__02d:_02d:_02d
lea rcx, [rbp + 0x80]
mov edx, 0x100
mov dword [rsp + 0x20], eax
call fcn.18000ca68
xor esi, esi
mov r15d, esi
cmp byte [rbp + 0x80], sil
je 0x18000a484
lea rax, [rbp + 0x80]
inc rax
inc r15d
cmp byte [rax], sil
jne 0x18000a479
cmp dword [0x180013668], esi
lea rdi, [0x180013680]
je 0x18000a4f6
lea rcx, [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [0x180013678]
mov rcx, qword [rbp + 0x1e8]
cmp rax, rcx
jg 0x18000a4e5
sub rcx, rax
movabs rax, 0xd6bf94d5e57a42bd
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 0x15180
jg 0x18000a4e5
mov eax, dword [0x180013668]
jmp 0x18000a4ed
mov eax, esi
mov dword [0x180013668], eax
test eax, eax
je 0x18000a4f6
mov r8, rdi
jmp 0x18000a519
mov dword [rbp - 0x70], 0x2e373132
mov dword [rbp - 0x6c], 0x2e323731
mov dword [rbp - 0x68], 0x2e383731
mov word [rbp - 0x64], 0x3034
mov byte [rbp - 0x62], sil
lea r8, [rbp - 0x70]
mov r14, qword [rbp + 0x1d0]
lea rax, [rbp - 0x80]
lea r12, str._pki_mscorp_crl_msitwww2.crl
mov rdx, qword [r14 + 8]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x1e8]
lea r13, [0x180010f90]
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x50]
lea rbx, [0x180010b80]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x80]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x28], rax
lea rcx, [rbp - 0x30]
mov r9d, 0x50
mov qword [rsp + 0x20], rbx
call fcn.180007c94
test eax, eax
je 0x18000a607
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x18000a5ef
mov edx, dword [rbp + 0x1e8]
lea r8, [rbp + 0x80]
mov r9d, r15d
mov rcx, rdi
call fcn.18000a244
mov rcx, qword [0x180013580]
mov r8, rdi
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x18000a5ef
mov rcx, qword [rbp + 0x1d8]
mov rax, qword [rbp - 0x78]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x1e0]
mov eax, dword [rbp - 0x80]
mov dword [rcx], eax
jmp 0x18000a74c
mov r8, qword [rbp - 0x78]
mov rcx, qword [0x180013580]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000a74c
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov dword [rbp - 0x60], esi
call fcn.1800079cc
mov rsi, qword [rbp - 0x70]
test rsi, rsi
je 0x18000a743
mov r8, qword [rsi + 0x18]
mov rdx, qword [r14 + 8]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x70], rax
lea rax, [rbp - 0x78]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x68], rax
lea rax, [rbp + 0x1e8]
mov r9d, 0x50
mov qword [rsp + 0x60], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x58], rax
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x80]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call fcn.180007c94
test eax, eax
je 0x18000a6ea
mov r14, qword [rbp - 0x50]
test r14, r14
je 0x18000a6d0
mov edx, dword [rbp + 0x1e8]
lea r8, [rbp + 0x80]
mov r9d, r15d
mov rcx, r14
call fcn.18000a244
mov rcx, qword [0x180013580]
mov r8, r14
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
jne 0x18000a6f3
lea rbx, [0x180010b80]
mov r8, qword [rbp - 0x78]
mov rcx, qword [0x180013580]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [rbp + 0x1d0]
mov rsi, qword [rsi + 0x10]
jmp 0x18000a61f
mov rcx, qword [rbp + 0x1d8]
mov rax, qword [rbp - 0x78]
mov rdx, qword [rsi + 0x18]
mov qword [rcx], rax
mov eax, dword [rbp - 0x80]
mov rcx, qword [rbp + 0x1e0]
mov dword [rcx], eax
mov al, byte [rdx]
mov dword [0x180013668], 1
mov byte [0x180013680], al
test al, al
je 0x18000a736
sub rdx, rdi
inc rdi
mov cl, byte [rdx + rdi]
mov byte [rdi], cl
test cl, cl
jne 0x18000a72a
lea rcx, [0x180013678]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rcx, [rbp - 0x70]
call fcn.18000cc74
mov eax, 1
add rsp, 0x2a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret