Function at 0x1400016c7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
mov eax, 0x1b548
call fcn.140003a30
sub rsp, rax
lea rbp, [rsp + 0x80]
call fcn.140002a50
pxor xmm0, xmm0
movups xmmword [rbp + 0x1b3b0], xmm0
movups xmmword [rbp + 0x1b3c0], xmm0
movups xmmword [rbp + 0x1b3d0], xmm0
pxor xmm0, xmm0
movups xmmword [rbp + 0x1b380], xmm0
movups xmmword [rbp + 0x1b390], xmm0
movups xmmword [rbp + 0x1b3a0], xmm0
pxor xmm0, xmm0
movups xmmword [rbp + 0x1b350], xmm0
movups xmmword [rbp + 0x1b360], xmm0
movups xmmword [rbp + 0x1b370], xmm0
mov word [rbp + 0x1b330], 0x6c
mov word [rbp + 0x1b332], 0x6c
mov word [rbp + 0x1b334], 0x64
mov word [rbp + 0x1b336], 0x2e
mov word [rbp + 0x1b338], 0x33
mov word [rbp + 0x1b33a], 0x32
mov word [rbp + 0x1b33c], 0x65
mov word [rbp + 0x1b33e], 0x73
mov word [rbp + 0x1b340], 0x55
mov word [rbp + 0x1b342], 0
mov word [rbp + 0x1b310], 0x6c
mov word [rbp + 0x1b312], 0x6c
mov word [rbp + 0x1b314], 0x64
mov word [rbp + 0x1b316], 0x2e
mov word [rbp + 0x1b318], 0x32
mov word [rbp + 0x1b31a], 0x33
mov word [rbp + 0x1b31c], 0x6c
mov word [rbp + 0x1b31e], 0x65
mov word [rbp + 0x1b320], 0x6e
mov word [rbp + 0x1b322], 0x72
mov word [rbp + 0x1b324], 0x65
mov word [rbp + 0x1b326], 0x4b
mov word [rbp + 0x1b328], 0
mov word [rbp + 0x1b2f0], 0x6c
mov word [rbp + 0x1b2f2], 0x6c
mov word [rbp + 0x1b2f4], 0x64
mov word [rbp + 0x1b2f6], 0x2e
mov word [rbp + 0x1b2f8], 0x6c
mov word [rbp + 0x1b2fa], 0x6c
mov word [rbp + 0x1b2fc], 0x64
mov word [rbp + 0x1b2fe], 0x74
mov word [rbp + 0x1b300], 0x6e
mov word [rbp + 0x1b302], 0
lea rax, [rbp + 0x1b330]
mov rcx, rax
call fcn.140001633
lea rax, [rbp + 0x1b310]
mov rcx, rax
call fcn.140001633
lea rax, [rbp + 0x1b2f0]
mov rcx, rax
call fcn.140001633
movabs rax, 0x724c6f6164446c6c
mov qword [rbp + 0x1b2e5], rax
mov dword [rbp + 0x1b2ec], 0x4c6472
movabs rax, 0x74646c6c2e646c6c
mov qword [rbp + 0x1b2db], rax
mov word [rbp + 0x1b2e3], 0x6e
movabs rax, 0x656c33322e646c6c
mov qword [rbp + 0x1b2ce], rax
movabs rax, 0x4b65726e656c33
mov qword [rbp + 0x1b2d3], rax
lea rax, [rbp + 0x1b2e5]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x1b2db]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x1b2ce]
mov rcx, rax
call fcn.1400015af
lea rdx, [rbp + 0x1b330]
lea rax, [rbp + 0x1b400]
mov rcx, rax
call fcn.1400014e6
lea rdx, [rbp + 0x1b310]
lea rax, [rbp + 0x1b3f0]
mov rcx, rax
call fcn.1400014e6
lea rdx, [rbp + 0x1b2f0]
lea rax, [rbp + 0x1b3e0]
mov rcx, rax
call fcn.1400014e6
mov dword [rbp + 0x1b3b0], 0x30
mov qword [rbp + 0x1b3b8], 0
mov dword [rbp + 0x1b3c8], 0x40
lea rax, [rbp + 0x1b400]
mov qword [rbp + 0x1b3c0], rax
mov qword [rbp + 0x1b3d0], 0
mov qword [rbp + 0x1b3d8], 0
mov dword [rbp + 0x1b380], 0x30
mov qword [rbp + 0x1b388], 0
mov dword [rbp + 0x1b398], 0x40
lea rax, [rbp + 0x1b3f0]
mov qword [rbp + 0x1b390], rax
mov qword [rbp + 0x1b3a0], 0
mov qword [rbp + 0x1b3a8], 0
mov dword [rbp + 0x1b350], 0x30
mov qword [rbp + 0x1b358], 0
mov dword [rbp + 0x1b368], 0x40
lea rax, [rbp + 0x1b3e0]
mov qword [rbp + 0x1b360], rax
mov qword [rbp + 0x1b370], 0
mov qword [rbp + 0x1b378], 0
movabs rax, 0x6548616e646c6541
movabs rdx, 0x4765744d6f64756c
mov qword [rbp + 0x1b2b0], rax
mov qword [rbp + 0x1b2b8], rdx
mov byte [rbp + 0x1b2c0], 0
lea rax, [rbp + 0x1b2b0]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x1b2ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1b2b0]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1b4b0], rax
movabs rax, 0x6341646472657373
mov qword [rbp + 0x1b2a1], rax
movabs rax, 0x47657450726f63
mov qword [rbp + 0x1b2a8], rax
lea rax, [rbp + 0x1b2a1]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x1b2ce]
mov rdx, qword [rbp + 0x1b4b0]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x1b2a1]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x1b4a8], rax
movabs rax, 0x75616c416c6c6f63
mov qword [rbp + 0x1b294], rax
movabs rbx, 0x5669727475616c
mov qword [rbp + 0x1b299], rbx
lea rax, [rbp + 0x1b294]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x1b2ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1b294]
mov r8, qword [rbp + 0x1b4a8]
mov rdx, rax
call r8
mov qword [rbp + 0x1b4a0], rax
movabs rax, 0x6c50726f74656374
mov qword [rbp + 0x1b285], rax
mov qword [rbp + 0x1b28c], rbx
lea rax, [rbp + 0x1b285]
mov rcx, rax
call fcn.1400015af
lea rax, [rbp + 0x1b2ce]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1b285]
mov r8, qword [rbp + 0x1b4a8]
mov rdx, rax
call r8
mov qword [rbp + 0x1b498], rax
lea rax, [rbp + 0x1b2db]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x1b2e5]
mov r8, qword [rbp + 0x1b4a8]
mov rdx, rax
call r8
mov qword [rbp + 0x1b490], rax
mov word [rbp + 0x1b283], 0xbb49
movabs rax, 0xefbeaddeefbeadde
mov qword [rbp + 0x1b27b], rax
mov dword [rbp + 0x1b277], 0xc3e3ff41
mov rax, qword [rbp + 0x1b490]
add rax, 5
mov qword [rbp + 0x1b488], rax
lea rax, [rbp + 0x1b27b]
mov rdx, qword [rbp + 0x1b488]
mov qword [rax], rdx
mov rax, qword [rbp + 0x1b4a0]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x1b480], rax
mov rax, qword [rbp + 0x1b480]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.140001450
mov rax, qword [rbp + 0x1b480]
lea rcx, [rax + 5]
lea rax, [rbp + 0x1b283]
mov r8d, 2
mov rdx, rax
call fcn.140001450
mov rax, qword [rbp + 0x1b480]
lea rcx, [rax + 7]
lea rax, [rbp + 0x1b27b]
mov r8d, 8
mov rdx, rax
call fcn.140001450
mov rax, qword [rbp + 0x1b480]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x1b277]
mov r8d, 4
mov rdx, rax
call fcn.140001450
mov dword [rbp + 0x1b270], 0
lea rdx, [rbp + 0x1b270]
mov rax, qword [rbp + 0x1b480]
mov r10, qword [rbp + 0x1b498]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
mov rcx, rax
call r10
mov rax, qword [rbp + 0x1b480]
mov qword [rbp + 0x1b478], rax
mov qword [rbp + 0x1b268], 0
lea rcx, [rbp + 0x1b268]
lea rdx, [rbp + 0x1b400]
mov rax, qword [rbp + 0x1b478]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x1b260], 0
lea rcx, [rbp + 0x1b260]
lea rdx, [rbp + 0x1b3f0]
mov rax, qword [rbp + 0x1b478]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x1b258], 0
lea rcx, [rbp + 0x1b258]
lea rdx, [rbp + 0x1b3e0]
mov rax, qword [rbp + 0x1b478]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rax, qword [rbp + 0x1b260]
lea rdx, [rbp + 0x1b2a1]
mov r8, qword [rbp + 0x1b4a8]
mov rcx, rax
call r8
mov qword [rbp + 0x1b470], rax
mov rax, qword [rbp + 0x1b260]
lea rdx, [rbp + 0x1b294]
mov r8, qword [rbp + 0x1b470]
mov rcx, rax
call r8
mov qword [rbp + 0x1b468], rax
mov rax, qword [rbp + 0x1b260]
lea rdx, [rbp + 0x1b285]
mov r8, qword [rbp + 0x1b470]
mov rcx, rax
call r8
mov qword [rbp + 0x1b460], rax
movabs rax, 0x73734d656d6f7279
movabs rdx, 0x69746550726f6365
mov qword [rbp + 0x1b240], rax
mov qword [rbp + 0x1b248], rdx
mov dword [rbp + 0x1b24f], 0x577269
lea rax, [rbp + 0x1b240]
mov rcx, rax
call fcn.1400015af
mov rax, qword [rbp + 0x1b260]
lea rdx, [rbp + 0x1b240]
mov r8, qword [rbp + 0x1b470]
mov rcx, rax
call r8
mov qword [rbp + 0x1b458], rax
movabs rax, 0x7450726f63657373
movabs rdx, 0x657443757272656e
mov qword [rbp + 0x1b220], rax
mov qword [rbp + 0x1b228], rdx
mov word [rbp + 0x1b230], 0x47
lea rax, [rbp + 0x1b220]
mov rcx, rax
call fcn.1400015af
mov rax, qword [rbp + 0x1b260]
lea rdx, [rbp + 0x1b220]
mov r8, qword [rbp + 0x1b470]
mov rcx, rax
call r8
mov qword [rbp + 0x1b450], rax
lea rax, [rbp - 0x20]
lea rdx, section..data
mov ecx, 0x1b240
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x1b44c], 0x3648
mov eax, dword [rbp + 0x1b44c]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x1b440], rax
cmp qword [rbp + 0x1b440], 0
jne 0x140001efa
mov eax, 0xffffffff
jmp 0x140002101
mov dword [rbp + 0x1b4bc], 0
jmp 0x140001f67
mov eax, dword [rbp + 0x1b4bc]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x1b440]
add rdx, rax
mov eax, dword [rbp + 0x1b4bc]
cdqe
mov rax, qword [rbp + rax*8 - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x1b41c], eax
cmp dword [rbp + 0x1b41c], 0
je 0x140001f60
mov rax, qword [rbp + 0x1b440]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x140002101
add dword [rbp + 0x1b4bc], 1
mov eax, dword [rbp + 0x1b4bc]
cmp eax, dword [rbp + 0x1b44c]
jl 0x140001f06
mov eax, dword [rbp + 0x1b44c]
shl eax, 4
mov dword [rbp + 0x1b43c], eax
mov eax, dword [rbp + 0x1b43c]
mov qword [rbp + 0x1b430], rax
mov qword [rbp + 0x1b428], 0
movabs rax, 0x646172496e666f41
movabs rdx, 0x6e756d43616c656e
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov word [rbp - 0x30], 0x45
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.1400015af
mov rax, qword [rbp + 0x1b260]
lea rdx, [rbp - 0x40]
mov r8, qword [rbp + 0x1b470]
mov rcx, rax
call r8
mov qword [rbp + 0x1b420], rax
mov rax, qword [rbp + 0x1b430]
mov r10, qword [rbp + 0x1b468]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0x1b428], rax
movabs rax, 0xde0b6b3a7640859
mov rcx, rax
call fcn.140001554
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x1b430]
mov rax, qword [rbp + 0x1b428]
mov r10, qword [rbp + 0x1b460]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a7640801
mov rcx, rax
call fcn.140001554
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x1b430]
mov rax, qword [rbp + 0x1b428]
mov r10, qword [rbp + 0x1b460]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
call r10
movabs rax, 0xde0b6b3a76409b1
mov rcx, rax
call fcn.140001554
mov ebx, dword [rbp + 0x1b43c]
mov rax, qword [rbp + 0x1b450]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0x1b440]
mov rax, qword [rbp + 0x1b428]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x1b458]
mov r9, rbx
mov r8, rdx
mov rdx, rax
call r10
mov rax, qword [rbp + 0x1b428]
mov r10, qword [rbp + 0x1b420]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
mov rcx, rax
call r10
mov eax, 0
add rsp, 0x1b548
pop rbx
pop rbp
ret