Function at 0x4017bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x4e0
lea rbp, [rsp + 0x80]
call fcn.00402e80
movabs rcx, 0xde0b6b3a76409bd
call fcn.00401654
movabs rcx, 0xde0b6b3a76409b1
call fcn.00401654
movabs rcx, 0xde0b6b3a764090f
call fcn.00401654
movabs rcx, 0xde0b6b3a76408df
call fcn.00401654
movabs rcx, 0xde0b6b3a76408a9
call fcn.00401654
movabs rcx, 0xde0b6b3a7640859
call fcn.00401654
movabs rcx, 0xde0b6b3a7640831
call fcn.00401654
movabs rcx, 0xde0b6b3a7640801
call fcn.00401654
movabs rcx, 0xde0b6b3a76407a1
call fcn.00401654
movabs rcx, 0xde0b6b3a76409b1
call fcn.00401654
lea rdx, [rbp + 0x360]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x330]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
lea rdx, [rbp + 0x300]
mov eax, 0
mov ecx, 6
mov rdi, rdx
rep stosq qword [rdi], rax
mov word [rbp + 0x2e0], 0x6c
mov word [rbp + 0x2e2], 0x6c
mov word [rbp + 0x2e4], 0x64
mov word [rbp + 0x2e6], 0x2e
mov word [rbp + 0x2e8], 0x33
mov word [rbp + 0x2ea], 0x32
mov word [rbp + 0x2ec], 0x65
mov word [rbp + 0x2ee], 0x73
mov word [rbp + 0x2f0], 0x55
mov word [rbp + 0x2f2], 0
mov word [rbp + 0x2c0], 0x6c
mov word [rbp + 0x2c2], 0x6c
mov word [rbp + 0x2c4], 0x64
mov word [rbp + 0x2c6], 0x2e
mov word [rbp + 0x2c8], 0x32
mov word [rbp + 0x2ca], 0x33
mov word [rbp + 0x2cc], 0x6c
mov word [rbp + 0x2ce], 0x65
mov word [rbp + 0x2d0], 0x6e
mov word [rbp + 0x2d2], 0x72
mov word [rbp + 0x2d4], 0x65
mov word [rbp + 0x2d6], 0x4b
mov word [rbp + 0x2d8], 0
mov word [rbp + 0x2a0], 0x6c
mov word [rbp + 0x2a2], 0x6c
mov word [rbp + 0x2a4], 0x64
mov word [rbp + 0x2a6], 0x2e
mov word [rbp + 0x2a8], 0x6c
mov word [rbp + 0x2aa], 0x6c
mov word [rbp + 0x2ac], 0x64
mov word [rbp + 0x2ae], 0x74
mov word [rbp + 0x2b0], 0x6e
mov word [rbp + 0x2b2], 0
lea rax, [rbp + 0x2e0]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x2c0]
mov rcx, rax
call fcn.0040172d
lea rax, [rbp + 0x2a0]
mov rcx, rax
call fcn.0040172d
mov byte [rbp + 0x295], 0x6c
mov byte [rbp + 0x296], 0x6c
mov byte [rbp + 0x297], 0x44
mov byte [rbp + 0x298], 0x64
mov byte [rbp + 0x299], 0x61
mov byte [rbp + 0x29a], 0x6f
mov byte [rbp + 0x29b], 0x4c
mov byte [rbp + 0x29c], 0x72
mov byte [rbp + 0x29d], 0x64
mov byte [rbp + 0x29e], 0x4c
mov byte [rbp + 0x29f], 0
mov byte [rbp + 0x28b], 0x6c
mov byte [rbp + 0x28c], 0x6c
mov byte [rbp + 0x28d], 0x64
mov byte [rbp + 0x28e], 0x2e
mov byte [rbp + 0x28f], 0x6c
mov byte [rbp + 0x290], 0x6c
mov byte [rbp + 0x291], 0x64
mov byte [rbp + 0x292], 0x74
mov byte [rbp + 0x293], 0x6e
mov byte [rbp + 0x294], 0
mov byte [rbp + 0x27e], 0x6c
mov byte [rbp + 0x27f], 0x6c
mov byte [rbp + 0x280], 0x64
mov byte [rbp + 0x281], 0x2e
mov byte [rbp + 0x282], 0x32
mov byte [rbp + 0x283], 0x33
mov byte [rbp + 0x284], 0x6c
mov byte [rbp + 0x285], 0x65
mov byte [rbp + 0x286], 0x6e
mov byte [rbp + 0x287], 0x72
mov byte [rbp + 0x288], 0x65
mov byte [rbp + 0x289], 0x4b
mov byte [rbp + 0x28a], 0
lea rax, [rbp + 0x295]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x28b]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x27e]
mov rcx, rax
call fcn.004016b0
lea rdx, [rbp + 0x2e0]
lea rax, [rbp + 0x3b0]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x2c0]
lea rax, [rbp + 0x3a0]
mov rcx, rax
call fcn.004015e6
lea rdx, [rbp + 0x2a0]
lea rax, [rbp + 0x390]
mov rcx, rax
call fcn.004015e6
mov dword [rbp + 0x360], 0x30
mov qword [rbp + 0x368], 0
mov dword [rbp + 0x378], 0x40
lea rax, [rbp + 0x3b0]
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x380], 0
mov qword [rbp + 0x388], 0
mov dword [rbp + 0x330], 0x30
mov qword [rbp + 0x338], 0
mov dword [rbp + 0x348], 0x40
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x350], 0
mov qword [rbp + 0x358], 0
mov dword [rbp + 0x300], 0x30
mov qword [rbp + 0x308], 0
mov dword [rbp + 0x318], 0x40
lea rax, [rbp + 0x390]
mov qword [rbp + 0x310], rax
mov qword [rbp + 0x320], 0
mov qword [rbp + 0x328], 0
mov byte [rbp + 0x260], 0x41
mov byte [rbp + 0x261], 0x65
mov byte [rbp + 0x262], 0x6c
mov byte [rbp + 0x263], 0x64
mov byte [rbp + 0x264], 0x6e
mov byte [rbp + 0x265], 0x61
mov byte [rbp + 0x266], 0x48
mov byte [rbp + 0x267], 0x65
mov byte [rbp + 0x268], 0x6c
mov byte [rbp + 0x269], 0x75
mov byte [rbp + 0x26a], 0x64
mov byte [rbp + 0x26b], 0x6f
mov byte [rbp + 0x26c], 0x4d
mov byte [rbp + 0x26d], 0x74
mov byte [rbp + 0x26e], 0x65
mov byte [rbp + 0x26f], 0x47
mov byte [rbp + 0x270], 0
lea rax, [rbp + 0x260]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x27e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x260]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x450], rax
mov byte [rbp + 0x251], 0x73
mov byte [rbp + 0x252], 0x73
mov byte [rbp + 0x253], 0x65
mov byte [rbp + 0x254], 0x72
mov byte [rbp + 0x255], 0x64
mov byte [rbp + 0x256], 0x64
mov byte [rbp + 0x257], 0x41
mov byte [rbp + 0x258], 0x63
mov byte [rbp + 0x259], 0x6f
mov byte [rbp + 0x25a], 0x72
mov byte [rbp + 0x25b], 0x50
mov byte [rbp + 0x25c], 0x74
mov byte [rbp + 0x25d], 0x65
mov byte [rbp + 0x25e], 0x47
mov byte [rbp + 0x25f], 0
lea rax, [rbp + 0x251]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x27e]
mov rdx, qword [rbp + 0x450]
mov rcx, rax
call rdx
mov rcx, rax
lea rax, [rbp + 0x251]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x448], rax
mov byte [rbp + 0x244], 0x63
mov byte [rbp + 0x245], 0x6f
mov byte [rbp + 0x246], 0x6c
mov byte [rbp + 0x247], 0x6c
mov byte [rbp + 0x248], 0x41
mov byte [rbp + 0x249], 0x6c
mov byte [rbp + 0x24a], 0x61
mov byte [rbp + 0x24b], 0x75
mov byte [rbp + 0x24c], 0x74
mov byte [rbp + 0x24d], 0x72
mov byte [rbp + 0x24e], 0x69
mov byte [rbp + 0x24f], 0x56
mov byte [rbp + 0x250], 0
lea rax, [rbp + 0x244]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x27e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x244]
mov r8, qword [rbp + 0x448]
mov rdx, rax
call r8
mov qword [rbp + 0x440], rax
mov byte [rbp + 0x235], 0x74
mov byte [rbp + 0x236], 0x63
mov byte [rbp + 0x237], 0x65
mov byte [rbp + 0x238], 0x74
mov byte [rbp + 0x239], 0x6f
mov byte [rbp + 0x23a], 0x72
mov byte [rbp + 0x23b], 0x50
mov byte [rbp + 0x23c], 0x6c
mov byte [rbp + 0x23d], 0x61
mov byte [rbp + 0x23e], 0x75
mov byte [rbp + 0x23f], 0x74
mov byte [rbp + 0x240], 0x72
mov byte [rbp + 0x241], 0x69
mov byte [rbp + 0x242], 0x56
mov byte [rbp + 0x243], 0
lea rax, [rbp + 0x235]
mov rcx, rax
call fcn.004016b0
lea rax, [rbp + 0x27e]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x235]
mov r8, qword [rbp + 0x448]
mov rdx, rax
call r8
mov qword [rbp + 0x438], rax
lea rax, [rbp + 0x28b]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
lea rax, [rbp + 0x295]
mov r8, qword [rbp + 0x448]
mov rdx, rax
call r8
mov qword [rbp + 0x430], rax
mov byte [rbp + 0x233], 0x49
mov byte [rbp + 0x234], 0xbb
mov byte [rbp + 0x22b], 0xde
mov byte [rbp + 0x22c], 0xad
mov byte [rbp + 0x22d], 0xbe
mov byte [rbp + 0x22e], 0xef
mov byte [rbp + 0x22f], 0xde
mov byte [rbp + 0x230], 0xad
mov byte [rbp + 0x231], 0xbe
mov byte [rbp + 0x232], 0xef
mov byte [rbp + 0x227], 0x41
mov byte [rbp + 0x228], 0xff
mov byte [rbp + 0x229], 0xe3
mov byte [rbp + 0x22a], 0xc3
mov rax, qword [rbp + 0x430]
add rax, 5
mov qword [rbp + 0x428], rax
lea rax, [rbp + 0x22b]
mov rdx, qword [rbp + 0x428]
mov qword [rax], rdx
mov rax, qword [rbp + 0x440]
mov r9d, 4
mov r8d, 0x3000
mov edx, 0x13
mov ecx, 0
call rax
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x420]
mov r8d, 5
lea rdx, section..rdata
mov rcx, rax
call fcn.00401550
mov rax, qword [rbp + 0x420]
lea rcx, [rax + 5]
lea rax, [rbp + 0x233]
mov r8d, 2
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x420]
lea rcx, [rax + 7]
lea rax, [rbp + 0x22b]
mov r8d, 8
mov rdx, rax
call fcn.00401550
mov rax, qword [rbp + 0x420]
lea rcx, [rax + 0xf]
lea rax, [rbp + 0x227]
mov r8d, 4
mov rdx, rax
call fcn.00401550
mov dword [rbp + 0x220], 0
lea rdx, [rbp + 0x220]
mov rcx, qword [rbp + 0x420]
mov rax, qword [rbp + 0x438]
mov r9, rdx
mov r8d, 0x20
mov edx, 0x1e
call rax
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x218], 0
lea rcx, [rbp + 0x218]
lea rdx, [rbp + 0x3b0]
mov rax, qword [rbp + 0x418]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x210], 0
lea rcx, [rbp + 0x210]
lea rdx, [rbp + 0x3a0]
mov rax, qword [rbp + 0x418]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov qword [rbp + 0x208], 0
lea rcx, [rbp + 0x208]
lea rdx, [rbp + 0x390]
mov rax, qword [rbp + 0x418]
mov r9, rcx
mov r8, rdx
mov edx, 0
mov ecx, 0
call rax
mov rcx, qword [rbp + 0x210]
lea rax, [rbp + 0x251]
mov r8, qword [rbp + 0x448]
mov rdx, rax
call r8
mov qword [rbp + 0x410], rax
mov rcx, qword [rbp + 0x210]
lea rax, [rbp + 0x244]
mov r8, qword [rbp + 0x410]
mov rdx, rax
call r8
mov qword [rbp + 0x408], rax
mov rcx, qword [rbp + 0x210]
lea rax, [rbp + 0x235]
mov r8, qword [rbp + 0x410]
mov rdx, rax
call r8
mov qword [rbp + 0x400], rax
mov byte [rbp + 0x1f0], 0x79
mov byte [rbp + 0x1f1], 0x72
mov byte [rbp + 0x1f2], 0x6f
mov byte [rbp + 0x1f3], 0x6d
mov byte [rbp + 0x1f4], 0x65
mov byte [rbp + 0x1f5], 0x4d
mov byte [rbp + 0x1f6], 0x73
mov byte [rbp + 0x1f7], 0x73
mov byte [rbp + 0x1f8], 0x65
mov byte [rbp + 0x1f9], 0x63
mov byte [rbp + 0x1fa], 0x6f
mov byte [rbp + 0x1fb], 0x72
mov byte [rbp + 0x1fc], 0x50
mov byte [rbp + 0x1fd], 0x65
mov byte [rbp + 0x1fe], 0x74
mov byte [rbp + 0x1ff], 0x69
mov byte [rbp + 0x200], 0x72
mov byte [rbp + 0x201], 0x57
mov byte [rbp + 0x202], 0
lea rax, [rbp + 0x1f0]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x210]
lea rax, [rbp + 0x1f0]
mov r8, qword [rbp + 0x410]
mov rdx, rax
call r8
mov qword [rbp + 0x3f8], rax
mov byte [rbp + 0x1d0], 0x73
mov byte [rbp + 0x1d1], 0x73
mov byte [rbp + 0x1d2], 0x65
mov byte [rbp + 0x1d3], 0x63
mov byte [rbp + 0x1d4], 0x6f
mov byte [rbp + 0x1d5], 0x72
mov byte [rbp + 0x1d6], 0x50
mov byte [rbp + 0x1d7], 0x74
mov byte [rbp + 0x1d8], 0x6e
mov byte [rbp + 0x1d9], 0x65
mov byte [rbp + 0x1da], 0x72
mov byte [rbp + 0x1db], 0x72
mov byte [rbp + 0x1dc], 0x75
mov byte [rbp + 0x1dd], 0x43
mov byte [rbp + 0x1de], 0x74
mov byte [rbp + 0x1df], 0x65
mov byte [rbp + 0x1e0], 0x47
mov byte [rbp + 0x1e1], 0
lea rax, [rbp + 0x1d0]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x210]
lea rax, [rbp + 0x1d0]
mov r8, qword [rbp + 0x410]
mov rdx, rax
call r8
mov qword [rbp + 0x3f0], rax
lea rax, [rbp - 0x20]
lea rdx, str.00039ce8_eb00_9c05_fabc_b6666b1da91f
mov ecx, 0x1f0
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov dword [rbp + 0x3ec], 0x3e
mov eax, dword [rbp + 0x3ec]
cdqe
shl rax, 4
mov rcx, rax
call sub.msvcrt.dll_malloc
mov qword [rbp + 0x3e0], rax
cmp qword [rbp + 0x3e0], 0
jne 0x402316
mov eax, 0xffffffff
jmp 0x40252b
mov dword [rbp + 0x45c], 0
jmp 0x402383
mov eax, dword [rbp + 0x45c]
cdqe
shl rax, 4
mov rdx, rax
mov rax, qword [rbp + 0x3e0]
add rdx, rax
mov eax, dword [rbp + 0x45c]
cdqe
mov rax, qword [rbp + rax*8 - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.RPCRT4.dll_UuidFromStringA]
call rax
mov dword [rbp + 0x3dc], eax
cmp dword [rbp + 0x3dc], 0
je 0x40237c
mov rax, qword [rbp + 0x3e0]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0xffffffff
jmp 0x40252b
add dword [rbp + 0x45c], 1
mov eax, dword [rbp + 0x45c]
cmp eax, dword [rbp + 0x3ec]
jl 0x402322
mov eax, dword [rbp + 0x3ec]
cdqe
shl eax, 4
mov dword [rbp + 0x3d8], eax
mov eax, dword [rbp + 0x3d8]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0x3c8], 0
mov byte [rbp - 0x40], 0x41
mov byte [rbp - 0x3f], 0x6f
mov byte [rbp - 0x3e], 0x66
mov byte [rbp - 0x3d], 0x6e
mov byte [rbp - 0x3c], 0x49
mov byte [rbp - 0x3b], 0x72
mov byte [rbp - 0x3a], 0x61
mov byte [rbp - 0x39], 0x64
mov byte [rbp - 0x38], 0x6e
mov byte [rbp - 0x37], 0x65
mov byte [rbp - 0x36], 0x6c
mov byte [rbp - 0x35], 0x61
mov byte [rbp - 0x34], 0x43
mov byte [rbp - 0x33], 0x6d
mov byte [rbp - 0x32], 0x75
mov byte [rbp - 0x31], 0x6e
mov byte [rbp - 0x30], 0x45
mov byte [rbp - 0x2f], 0
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.004016b0
mov rcx, qword [rbp + 0x210]
lea rax, [rbp - 0x40]
mov r8, qword [rbp + 0x410]
mov rdx, rax
call r8
mov qword [rbp + 0x3c0], rax
mov rdx, qword [rbp + 0x3d0]
mov rax, qword [rbp + 0x408]
mov r9d, 4
mov r8d, 0x3000
mov ecx, 0
call rax
mov qword [rbp + 0x3c8], rax
movabs rcx, 0xde0b6b3a7640859
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x3d0]
mov rcx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x400]
mov r9, r8
mov r8d, 0x20
call rax
movabs rcx, 0xde0b6b3a7640801
call fcn.00401654
lea r8, [rbp - 0x44]
mov rdx, qword [rbp + 0x3d0]
mov rcx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x400]
mov r9, r8
mov r8d, 0x40
call rax
movabs rcx, 0xde0b6b3a76409b1
call fcn.00401654
mov ebx, dword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3f0]
call rax
mov r10, rax
mov rcx, qword [rbp + 0x3e0]
mov rdx, qword [rbp + 0x3c8]
mov qword [rsp + 0x20], 0
mov rax, qword [rbp + 0x3f8]
mov r9, rbx
mov r8, rcx
mov rcx, r10
call rax
mov rcx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3c0]
mov r9d, 0x15
mov r8d, 0xffffffff
mov edx, 0x400
call rax
mov eax, 0
add rsp, 0x4e0
pop rbx
pop rdi
pop rbp
ret