Function at 0x1400028a0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rbp + 0x160], rax
test cl, cl
je 0x140002b24
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x1400030b5
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x40], 0x104
mov dword [rbp - 0x36], 0x6e616d6d
mov word [rbp - 0x3f], 0x5c6c
mov dword [rbp - 0x3c], 0x5c6e6570
mov word [rbp - 0x32], 0x64
mov dword [rbp - 0x48], 0x70747468
mov dword [rbp - 0x43], 0x6c656873
mov word [rbp - 0x38], 0x6f63
mov byte [rbp - 0x3d], 0x6f
mov byte [rbp - 0x44], 0x5c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140002966
mov edx, 0x104
lea rcx, [rsp + 0x70]
call fcn.14001b440
mov rbx, qword [rsp + 0x70]
mov word [rsp + 0x4f], 0x642e
mov dword [rsp + 0x49], 0x61776c68
mov word [rsp + 0x52], 0x6c
mov word [rsp + 0x4d], 0x6970
mov byte [rsp + 0x51], 0x6c
mov byte [rsp + 0x48], 0x53
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140002a14
mov word [rsp + 0x63], 0x7465
mov word [rsp + 0x66], 0x6c61
mov word [rsp + 0x69], 0x4165
mov word [rsp + 0x61], 0x4748
mov byte [rsp + 0x6b], 0
mov byte [rsp + 0x65], 0x56
mov byte [rsp + 0x60], 0x53
mov byte [rsp + 0x68], 0x75
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002a0b
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
lea r8, [0x14009af30]
lea rdx, [rbp - 0x48]
mov rcx, 0xffffffff80000000
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140027150
test eax, eax
js 0x1400030c0
cmp eax, dword [rbx - 0xc]
jg 0x1400030c0
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rcx, [rsp + 0x70]
call fcn.140019cc0
mov word [rsp + 0x7b], 0x45
mov word [rsp + 0x78], 0x4946
mov byte [rsp + 0x7a], 0x52
mov rbx, qword [rsp + 0x70]
cmp dword [rbx - 0x10], 0
jl 0x140002a86
lea rdx, [rsp + 0x78]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002a86
cmp eax, ebx
js 0x140002a86
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
jmp 0x140002dde
mov dword [rsp + 0x5b], 0x454d4f
mov word [rsp + 0x58], 0x4843
mov byte [rsp + 0x5a], 0x52
cmp dword [rbx - 0x10], 0
jl 0x140002ae0
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002ae0
cmp eax, ebx
js 0x140002ae0
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140002e86
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 1
jmp 0x140002df6
mov word [rsp + 0x34], 0x4549
mov byte [rsp + 0x36], 0
cmp dword [rbx - 0x10], 0
jl 0x140002b16
lea rdx, [rsp + 0x34]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002b16
cmp eax, ebx
js 0x140002b16
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
jmp 0x140002ee0
lea rdx, [rbx - 0x18]
mov ebx, 0xffffffff
jmp 0x14000300b
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x1400030cb
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x44], 0x104
mov dword [rbp + 0x46], 0x6f684372
mov dword [rbp + 0x12], 0x6e69575c
mov word [rbp + 0xd], 0x736f
mov word [rbp + 0x2f], 0x6c72
mov word [rbp + 0x1e], 0x6c6c
mov word [rbp], 0x6f53
mov word [rbp + 0xa], 0x6369
mov dword [rbp + 0x16], 0x73776f64
mov dword [rbp + 3], 0x72617774
mov dword [rbp + 0x2a], 0x5c736e6f
mov word [rbp + 0x22], 0x7373
mov word [rbp + 0x1b], 0x6853
mov dword [rbp + 0x4a], 0x656369
mov dword [rbp + 0x31], 0x6f737341
mov dword [rbp + 0x3e], 0x70747468
mov dword [rbp + 0x35], 0x74616963
mov dword [rbp + 0x39], 0x736e6f69
mov word [rbp + 0x25], 0x6963
mov byte [rbp + 0xc], 0x72
mov word [rbp + 0xf], 0x666f
mov word [rbp + 0x28], 0x6974
mov word [rbp + 0x20], 0x415c
mov word [rbp + 7], 0x5c65
mov dword [rbp + 0x42], 0x6573555c
mov byte [rbp + 0x11], 0x74
mov byte [rbp + 0x24], 0x6f
mov byte [rbp + 0x1a], 0x5c
mov byte [rbp + 0x2e], 0x55
mov byte [rbp + 0x1d], 0x65
mov byte [rbp + 2], 0x66
mov byte [rbp + 0x3d], 0x5c
mov byte [rbp + 0x27], 0x61
mov byte [rbp + 9], 0x4d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x50]
call fcn.14001ef80
lea rcx, [rbp + 0x50]
call fcn.1400808c0
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x14000309f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov dword [rbp - 0x60], 0x255c7325
mov word [rbp - 0x5c], 0x73
lea r9, [rbp]
lea r8, [rbp + 0x50]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.14001a2b0
mov dword [rbp - 0x57], 0x69676f72
mov word [rbp - 0x53], 0x64
mov byte [rbp - 0x58], 0x50
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x140002ca7
mov edx, 0x104
lea rcx, [rsp + 0x58]
call fcn.14001b440
mov rbx, qword [rsp + 0x58]
mov word [rsp + 0x67], 0x642e
mov dword [rsp + 0x61], 0x61776c68
mov word [rsp + 0x6a], 0x6c
mov word [rsp + 0x65], 0x6970
mov byte [rsp + 0x69], 0x6c
mov byte [rsp + 0x60], 0x53
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rdi, qword [rsp + 0x70]
test rax, rax
je 0x140002d56
mov word [rsp + 0x4b], 0x7465
mov word [rsp + 0x4e], 0x6c61
mov word [rsp + 0x51], 0x4165
mov word [rsp + 0x49], 0x4748
mov byte [rsp + 0x53], 0
mov byte [rsp + 0x4d], 0x56
mov byte [rsp + 0x48], 0x53
mov byte [rsp + 0x50], 0x75
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140002d4d
lea rcx, [rsp + 0x44]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x3c]
lea r8, [rbp - 0x58]
mov rdx, rdi
mov rcx, 0xffffffff80000003
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140027150
test eax, eax
js 0x1400030aa
cmp eax, dword [rbx - 0xc]
jg 0x1400030aa
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
lea rcx, [rsp + 0x58]
call fcn.140019cc0
mov word [rbp - 0x7d], 0x45
mov word [rbp - 0x80], 0x4946
mov byte [rbp - 0x7e], 0x52
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jl 0x140002e1e
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002e1e
cmp eax, ebx
js 0x140002e1e
lea rdx, [rdi - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002dd5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140002df1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 2
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14001c9b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov dword [rbp - 0x50], 0x4f524843
mov word [rbp - 0x4c], 0x454d
mov byte [rbp - 0x4a], 0
cmp dword [rbx - 0x10], 0
jl 0x140002e90
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002e90
cmp eax, ebx
js 0x140002e90
lea rdx, [rdi - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002e69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140002e86
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov eax, 1
jmp 0x140002df6
mov word [rsp + 0x38], 0x4549
mov byte [rsp + 0x3a], 0
cmp dword [rbx - 0x10], 0
jl 0x140002efd
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002efd
cmp eax, ebx
js 0x140002efd
lea rdx, [rdi - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002ed7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140002ef3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 3
jmp 0x140002df6
mov dword [rbp - 0x2f], 0x51585050
mov dword [rbp - 0x11], 0x38524b59
mov dword [rbp - 0x17], 0x45503741
mov word [rbp - 0x20], 0x3236
mov dword [rbp - 0x1b], 0x51424630
mov word [rbp - 0x23], 0x5950
mov dword [rbp - 0x2b], 0x56454630
mov word [rbp - 0x26], 0x454d
mov word [rbp - 0x1d], 0x4533
mov word [rbp - 0x13], 0x5041
mov word [rbp - 0xd], 0x56
mov byte [rbp - 0x30], 0x41
mov byte [rbp - 0x24], 0x32
mov byte [rbp - 0x27], 0x5a
mov byte [rbp - 0x21], 0x53
mov byte [rbp - 0x1e], 0x4e
cmp dword [rbx - 0x10], 0
jl 0x140002f73
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002f73
cmp eax, ebx
jns 0x140002f9e
mov word [rbp - 0x75], 0x45
mov word [rbp - 0x78], 0x4445
mov byte [rbp - 0x76], 0x47
cmp dword [rbx - 0x10], 0
jl 0x140002fe3
lea rdx, [rbp - 0x78]
mov rcx, rbx
call fcn.140027d44
test rax, rax
je 0x140002fe3
cmp eax, ebx
js 0x140002fe3
mov ebx, 0xffffffff
lea rdx, [rdi - 0x18]
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002fbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140002fd9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov eax, 4
jmp 0x140002df6
lea rdx, [rdi - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140003002
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14000301e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dword [rbp - 0x70], 0x70747468
mov byte [rbp - 0x6c], 0
lea rcx, [rbp - 0x70]
call fcn.14000d4b0
test eax, eax
jne 0x140002df6
mov word [rsp + 0x4c], 0x73
mov word [rsp + 0x49], 0x7474
mov byte [rsp + 0x4b], 0x70
mov byte [rsp + 0x48], 0x68
lea rcx, [rsp + 0x48]
call fcn.14000d4b0
test eax, eax
jne 0x140002df6
mov dword [rbp - 0x68], 0x6d74682e
mov byte [rbp - 0x64], al
lea rcx, [rbp - 0x68]
call fcn.14000d4b0
test eax, eax
jne 0x140002df6
mov dword [rsp + 0x71], 0x6c6d7468
mov byte [rsp + 0x70], 0x2e
mov byte [rsp + 0x75], al
lea rcx, [rsp + 0x70]
call fcn.14000d4b0
jmp 0x140002df6
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80070057
call fcn.14001b6d0
nop
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80070057
call fcn.14001b6d0
nop
mov ecx, 0x80004005
call fcn.14001b6d0
int3