Function at 0x140011375
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140011f80
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1c8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1e8]
mov rax, qword [0x14001f178]
xor rax, rbp
mov qword [rbp + 0x188], rax
lea rcx, [0x1400250a2]
call fcn.1400113c5
mov dword [rbp + 4], 0
mov qword [rbp + 0x28], 0
mov byte [rbp + 0x48], 0x7a
mov byte [rbp + 0x49], 0xdd
mov byte [rbp + 0x4a], 0xf6
mov byte [rbp + 0x4b], 0x1e
mov byte [rbp + 0x4c], 0x7d
mov byte [rbp + 0x4d], 0xd3
mov byte [rbp + 0x4e], 0xf9
mov byte [rbp + 0x4f], 0xc6
mov byte [rbp + 0x50], 9
mov byte [rbp + 0x51], 0xe3
mov byte [rbp + 0x52], 0xba
mov byte [rbp + 0x53], 0x3b
mov byte [rbp + 0x54], 0xa2
mov byte [rbp + 0x55], 0x4d
mov byte [rbp + 0x56], 0xa1
mov byte [rbp + 0x57], 0x6b
mov byte [rbp + 0x78], 0x7a
mov byte [rbp + 0x79], 0xdd
mov byte [rbp + 0x7a], 0xf6
mov byte [rbp + 0x7b], 0x1e
mov byte [rbp + 0x7c], 0x7d
mov byte [rbp + 0x7d], 0xd3
mov byte [rbp + 0x7e], 0xf9
mov byte [rbp + 0x7f], 0xd7
mov byte [rbp + 0x80], 0x17
mov byte [rbp + 0x81], 0xe0
mov byte [rbp + 0x82], 0xa1
mov byte [rbp + 0x83], 0x3d
mov byte [rbp + 0x84], 0x84
mov byte [rbp + 0x85], 0x41
mov byte [rbp + 0x86], 0xe4
mov byte [rbp + 0x87], 0x13
mov byte [rbp + 0x88], 0
mov byte [rbp + 0xa8], 0x7b
mov byte [rbp + 0xa9], 0xc6
mov byte [rbp + 0xaa], 0xed
mov byte [rbp + 0xab], 0x1e
mov byte [rbp + 0xac], 0x6d
mov byte [rbp + 0xad], 0xe2
mov byte [rbp + 0xae], 0xe7
mov byte [rbp + 0xaf], 0xe8
mov byte [rbp + 0xb0], 6
mov byte [rbp + 0xb1], 0xea
mov byte [rbp + 0xb2], 0xa6
mov byte [rbp + 0xb3], 0x2b
mov byte [rbp + 0xb4], 0xaa
mov byte [rbp + 0xb5], 0x50
mov byte [rbp + 0xb6], 0xcc
mov byte [rbp + 0xb7], 4
mov byte [rbp + 0xb8], 0x72
mov byte [rbp + 0xb9], 0x79
mov byte [rbp + 0xba], 0
mov r9d, 0x10
mov r8d, 0x10
lea rdx, section..data
lea rcx, [rbp + 0x48]
call fcn.14001128a
mov r9d, 0x10
mov r8d, 0x11
lea rdx, section..data
lea rcx, [rbp + 0x78]
call fcn.14001128a
mov r9d, 0x10
mov r8d, 0x13
lea rdx, section..data
lea rcx, [rbp + 0xa8]
call fcn.14001128a
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001f898], rax
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0x78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001f890], rax
lea rcx, str.KERNEL32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, [rbp + 0xa8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14001f888], rax
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8, qword [rbp + 0x1c8]
xor edx, edx
mov rcx, qword [rbp + 0x1b0]
call qword [0x14001f898]
mov rcx, qword [rbp + 0x1b8]
mov qword [rcx], rax
cmp qword [0x14001f898], 0
jne 0x140012207
xor eax, eax
jmp 0x140012296
mov r9d, 0x10
lea r8, section..data
mov edx, dword [rbp + 0x1c8]
mov rcx, qword [rbp + 0x1c0]
call fcn.1400113ed
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x1c8]
mov r8, qword [rbp + 0x1c0]
mov rax, qword [rbp + 0x1b8]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x1b0]
call qword [0x14001f888]
test eax, eax
jne 0x14001225c
xor eax, eax
jmp 0x140012296
lea rax, [rbp + 4]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, qword [rbp + 0x1c8]
mov rax, qword [rbp + 0x1b8]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x1b0]
call qword [0x14001f890]
test eax, eax
jne 0x140012291
xor eax, eax
jmp 0x140012296
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bec0]
call fcn.140011343
mov rax, rdi
mov rcx, qword [rbp + 0x188]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x198]
pop rdi
pop rbp
ret