Function at 0x69d45a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
xor r8d, r8d
movabs rax, 0x3233697061737457
mov rbx, rcx
lea rbp, [rsp + 0x70]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x50], 0
lea rdi, [rsp + 0x90]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], 0x6c6c642e
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x58], 0x16
call fcn.69deb030
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
movabs rcx, 0x636f725065746172
mov r15, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x70], rdx
movabs rdx, 0x656d756e45535457
mov qword [rax], rdx
mov edx, 0x4173
mov qword [rax + 8], rcx
mov dword [rax + 0x10], 0x65737365
mov word [rax + 0x14], dx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x68], rax
mov byte [rdx + rax], 0
mov rcx, qword [rsp + 0x80]
call r15
mov rcx, rax
test rax, rax
je 0x69d45cd8
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
call rax
test rax, rax
je 0x69d45d0d
lea rdx, [rsp + 0x4c]
lea r9, [rsp + 0x50]
mov r8d, 1
xor ecx, ecx
mov qword [rsp + 0x20], rdx
xor edx, edx
call rax
mov rcx, qword [rsp + 0x60]
mov esi, eax
cmp rcx, rbp
je 0x69d45b90
call fcn.69dfe2a0
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
je 0x69d45ba2
call fcn.69dfe2a0
test esi, esi
je 0x69d45cd0
mov r12d, dword [rsp + 0x4c]
mov r13, qword [rsp + 0x50]
test r12d, r12d
je 0x69d45bf4
lea eax, [r12 - 1]
mov rsi, qword [rbx]
lea r14, [r13 + 4]
xor r12d, r12d
lea rax, [rax + rax*2]
lea rbx, [r13 + rax*8 + 0x1c]
nop dword [rax]
mov rcx, qword [r14 + 4]
mov rdx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x69d45beb
mov r12d, dword [r14]
add r14, 0x18
cmp rbx, r14
jne 0x69d45bd8
test r13, r13
je 0x69d45cb0
movabs rax, 0x3233697061737457
mov rcx, rdi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rax
movabs rax, 0x4d65657246535457
mov dword [rsp + 0x98], 0x6c6c642e
mov qword [rsp + 0x88], 0xc
mov byte [rsp + 0x9c], 0
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x726f6d65
mov byte [rsp + 0x7c], 0x79
mov qword [rsp + 0x68], 0xd
mov byte [rsp + 0x7d], 0
call r15
mov rcx, rax
test rax, rax
je 0x69d45cf0
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x38]
call rax
test rax, rax
je 0x69d45d3f
mov rcx, qword [rsp + 0x50]
call rax
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x69d45c9e
call fcn.69dfe2a0
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
je 0x69d45cb0
call fcn.69dfe2a0
mov eax, r12d
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
jmp 0x69d45cb0
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d45b48
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
jmp 0x69d45c73
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
mov ecx, 0x10
call fcn.69dfe3d0
lea rdx, str.Invalid_API
mov rcx, rax
mov r13, rax
call fcn.69dd8a80
lea r8, [fcn.69dd8bb0]
lea rdx, [0x69e0c5e0]
mov rcx, r13
call fcn.69dfebf0
mov rcx, r13
mov r12, rax
call fcn.69dfe720
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x69d45d8b
call fcn.69dfe2a0
mov rcx, qword [rsp + 0x80]
cmp rcx, rdi
je 0x69d45d9d
call fcn.69dfe2a0
mov rcx, r12
call fcn.69d5c710
jmp 0x69d45d71