Function at 0x180072c79
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rax
pushf
mov eax, 0xd3416c8b
pushf
not eax
add eax, 0xbe0fecb6
xor eax, 0xa7c7cbdd
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xd5ca77cf
xor eax, 0xac4b8e2d
rol eax, 0x4f
popf
cmp eax, 4
jne 0x180072cb6
popf
pop rax
jmp 0x18007310e
cmp eax, 0
jne 0x180072cc5
popf
pop rax
jmp 0x180072d6a
cmp eax, 3
jne 0x180072cd4
popf
pop rax
jmp 0x180072f8c
cmp eax, 1
jne 0x180072ce3
popf
pop rax
jmp 0x180072e6e
cmp eax, 0xa
jne 0x180072cf2
popf
pop rax
jmp 0x180073520
cmp eax, 7
jne 0x180072d01
popf
pop rax
jmp 0x1800733cd
cmp eax, 6
jne 0x180072d10
popf
pop rax
jmp 0x1800732c4
cmp eax, 0xb
jne 0x180072d1f
popf
pop rax
jmp 0x18007355d
cmp eax, 0xc
jne 0x180072d2e
popf
pop rax
jmp 0x180073592
cmp eax, 8
jne 0x180072d3d
popf
pop rax
jmp 0x18007343a
cmp eax, 5
jne 0x180072d4c
popf
pop rax
jmp 0x1800731d9
cmp eax, 2
jne 0x180072d5b
popf
pop rax
jmp 0x180072eeb
cmp eax, 9
jne 0x180072d6a
popf
pop rax
jmp 0x1800734cd
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
jmp 0x180072d82
call qword [0x180022cb8]
xor edx, edx
mov ecx, 0x1250fde5
pushf
not ecx
add ecx, 0xfed53981
xor ecx, 0x8667393b
rol ecx, 0xfd
popf
pushf
not ecx
add ecx, 0x931e9e58
xor ecx, 0x843dc1f3
rol ecx, 0x3c
popf
mov r8d, eax
jmp 0x180072dbd
call qword [0x180022d78]
mov rbx, rax
test rax, rax
je 0x180072e15
push rax
pushf
mov eax, 0xd27c742f
pushf
not eax
add eax, 0xefc01162
xor eax, 0xa6185772
rol eax, 0x99
popf
pushf
not eax
add eax, 0x821eaabe
xor eax, 0xd61395b7
rol eax, 0x85
popf
pushf
not eax
add eax, 0xbd7e96c3
xor eax, 0xc6f1c2e8
rol eax, 3
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0x7de4b024
pushf
not eax
add eax, 0xdc601661
xor eax, 0xe039e771
rol eax, 0x70
popf
pushf
not eax
add eax, 0xa03df231
xor eax, 0xa042b064
rol eax, 0xd8
popf
pushf
not eax
add eax, 0x9a879cf4
xor eax, 0x93597a93
rol eax, 0x43
popf
pushf
not eax
add eax, 0xb2595fa6
xor eax, 0xcdccd8a5
rol eax, 0xfe
popf
jmp 0x180072ca7
mov byte [rbp - 9], WSAStartup
xor edi, edi
mov byte [rbp - 8], 0x77
mov edx, edi
mov byte [rbp - 7], 0x67
mov byte [rbp - 6], 0x6f
mov byte [rbp - 5], 0x6f
mov byte [rbp - 4], 0x31
mov byte [rbp - 3], 0x67
mov byte [rbp - 2], 0x6f
mov byte [rbp - 1], 0x6f
mov byte [rbp], 0
movzx ecx, byte [rbp - 9]
nop dword [rax]
push rax
pushf
mov eax, 0x52e0bc24
pushf
not eax
add eax, 0x8225d0d9
xor eax, 0xbcfe86f7
rol eax, 0xad
popf
pushf
not eax
add eax, 0xdfbf303f
xor eax, 0x9020f50e
rol eax, 0x55
popf
pushf
not eax
add eax, 0xb7a6901f
xor eax, 0x9e66a555
rol eax, 0x93
popf
jmp 0x180072ca7
movsx ecx, byte [rbp + rdx - 9]
sub ecx, 3
mov byte [rbp + rdx - 9], cl
inc rdx
cmp rdx, 9
jb 0x180072f46
push rax
pushf
mov eax, 0x536f8851
pushf
not eax
add eax, 0xf36c8022
xor eax, 0xedc4faac
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x8df9a7ff
xor eax, 0xe8820fd8
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xc02c1438
xor eax, 0xf401ae42
rol eax, 0xbc
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0xa707dc86
pushf
not eax
add eax, 0xb1ea1f65
xor eax, 0xa522511a
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xc7666551
xor eax, 0xd6034f39
rol eax, 0x62
popf
pushf
not eax
add eax, 0x9fc251b2
xor eax, 0x9a397541
rol eax, 0xd5
popf
jmp 0x180072ca7
lea rcx, [rbp - 9]
jmp 0x180072f91
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r8, rax
mov dword [rbp + 3], 0x43
mov ecx, dword [rbp + 3]
xor ecx, 0x5a
mov byte [rbp + 7], cl
mov ecx, dword [rbp + 3]
inc cl
xor ecx, 0x77
mov byte [rbp + 8], cl
mov ecx, dword [rbp + 3]
add cl, 2
xor ecx, 0x51
mov byte [rbp + 9], cl
mov eax, dword [rbp + 3]
add al, 3
xor eax, 0x75
mov byte [rbp + 0xa], al
mov eax, dword [rbp + 3]
add al, 4
xor eax, 0x65
mov byte [rbp + 0xb], al
mov eax, dword [rbp + 3]
add al, 5
xor eax, 0x72
mov byte [rbp + 0xc], al
mov eax, dword [rbp + 3]
add al, 6
xor eax, 0x79
mov byte [rbp + 0xd], al
mov eax, dword [rbp + 3]
add al, 7
xor eax, 0x49
mov byte [rbp + 0xe], al
mov eax, dword [rbp + 3]
add al, 8
xor eax, 0x6e
mov byte [rbp + 0xf], al
mov eax, dword [rbp + 3]
add al, 9
xor eax, 0x66
mov byte [rbp + 0x10], al
mov eax, dword [rbp + 3]
add al, 0xa
xor eax, 0x6f
mov byte [rbp + 0x11], al
mov eax, dword [rbp + 3]
add al, 0xb
xor eax, 0x72
mov byte [rbp + 0x12], al
mov eax, dword [rbp + 3]
add al, 0xc
xor eax, 0x6d
mov byte [rbp + 0x13], al
mov eax, dword [rbp + 3]
add al, 0xd
xor eax, 0x61
mov byte [rbp + 0x14], al
mov eax, dword [rbp + 3]
add al, 0xe
xor eax, 0x74
mov byte [rbp + 0x15], al
mov eax, dword [rbp + 3]
add al, 0xf
xor eax, 0x69
mov byte [rbp + 0x16], al
mov eax, dword [rbp + 3]
add al, 0x10
xor eax, 0x6f
mov byte [rbp + 0x17], al
mov eax, dword [rbp + 3]
add al, 0x11
xor eax, 0x6e
mov byte [rbp + 0x18], al
mov eax, dword [rbp + 3]
add al, 0x12
xor eax, 0x50
mov byte [rbp + 0x19], al
mov eax, dword [rbp + 3]
add al, 0x13
xor eax, 0x72
mov byte [rbp + 0x1a], al
mov eax, dword [rbp + 3]
add al, 0x14
xor eax, 0x6f
mov byte [rbp + 0x1b], al
mov eax, dword [rbp + 3]
add al, 0x15
xor eax, 0x63
mov byte [rbp + 0x1c], al
mov eax, dword [rbp + 3]
add al, 0x16
xor eax, 0x65
mov byte [rbp + 0x1d], al
mov eax, dword [rbp + 3]
add al, 0x17
xor eax, 0x73
mov byte [rbp + 0x1e], al
mov eax, dword [rbp + 3]
add al, 0x18
xor eax, 0x73
mov byte [rbp + 0x1f], al
xor eax, eax
mov byte [rbp + 0x20], al
movzx eax, byte [rbp + 7]
mov rax, rdi
nop word [rax + rax]
push rax
pushf
mov eax, 0xa1b4f252
pushf
not eax
add eax, 0xa845443c
xor eax, 0xf52dedc9
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x9f6fc009
xor eax, 0xd276f044
rol eax, 0x19
popf
pushf
not eax
add eax, 0x9bbdffa1
xor eax, 0xbf97ac35
rol eax, 0x82
popf
jmp 0x180072ca7
movsx ecx, byte [rbp + rax + 7]
mov edx, dword [rbp + 3]
add dl, al
xor edx, ecx
mov byte [rbp + rax + 7], dl
inc rax
cmp rax, 0x19
jb 0x180073180
push rax
pushf
mov eax, 0x9eff4a64
pushf
not eax
add eax, 0xfe139370
xor eax, 0xab55abe1
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xdd5c98be
xor eax, 0xedb77b85
rol eax, 0x97
popf
pushf
not eax
add eax, 0xe8a5583d
xor eax, 0x88c6c6d9
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x9ace04f0
xor eax, 0xe82b2799
rol eax, 0x85
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0xa09d6f56
pushf
not eax
add eax, 0xc14527ee
xor eax, 0x9cb0e8c5
rol eax, 0xfd
popf
pushf
not eax
add eax, 0x81a266a7
xor eax, 0xd8dbcea8
rol eax, 0x67
popf
pushf
not eax
add eax, 0x8b6904f9
xor eax, 0xb90af05c
rol eax, 0x10
popf
pushf
not eax
add eax, 0xfd3c0c27
xor eax, 0xe3187e21
rol eax, 0x39
popf
jmp 0x180072ca7
lea rdx, [rbp + 7]
mov byte [rbp + 0x20], dil
mov rcx, r8
jmp 0x1800731e5
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 0x8eaba0b
pushf
not r9d
add r9d, 0xdbefe57f
xor r9d, 0xcd0be403
rol r9d, 0xc7
popf
pushf
not r9d
add r9d, 0xdcfb232e
xor r9d, 0xd9936b1e
rol r9d, 0x6a
popf
mov qword [rsp + 0x20], rdi
lea r8, [rbp + 0x27]
xor edx, edx
mov rcx, rbx
jmp 0x180073232
call rax
test eax, eax
js 0x18007327e
push rax
pushf
mov eax, 0xb557ea18
pushf
not eax
add eax, 0x9e28e642
xor eax, 0xa20504cc
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xbb1d8dda
xor eax, 0x8ab48e7a
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xe5125307
xor eax, 0xeb907015
rol eax, 0xff
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0x1eea4097
pushf
not eax
add eax, 0x8e28ee91
xor eax, 0x928a4cd3
rol eax, 0x5f
popf
pushf
not eax
add eax, 0xedc7e535
xor eax, 0xf5420a4f
rol eax, 0x61
popf
pushf
not eax
add eax, 0xbf5375df
xor eax, 0x87f4797d
rol eax, 0x7b
popf
jmp 0x180072ca7
mov edx, dword [rbp + 0x2f]
lea rax, [rbp + 0x6f]
add edx, 0xbc
mov qword [rbp + 0x6f], rdi
mov r9d, 0x5a2653a9
pushf
not r9d
add r9d, 0x8f2c158e
xor r9d, 0xad13a637
rol r9d, 0xbe
popf
pushf
not r9d
add r9d, 0x932ab381
xor r9d, 0xf55f652f
rol r9d, 0x7c
popf
pushf
not r9d
add r9d, 0xea2dfe00
xor r9d, 0xb4a65675
rol r9d, 0x9b
popf
mov word [rbp + 0x67], di
lea r8, [rbp + 0x67]
mov qword [rsp + 0x20], rax
mov rcx, rbx
jmp 0x180073337
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x18007339a
push rax
pushf
mov eax, 0x31dfb186
pushf
not eax
add eax, 0xcf8810ea
xor eax, 0xf642db29
rol eax, 0x25
popf
pushf
not eax
add eax, 0x945d4da6
xor eax, 0xdc9fee5b
rol eax, 0xea
popf
pushf
not eax
add eax, 0xb420a869
xor eax, 0x95508be9
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xb9938f35
xor eax, 0xb4df52aa
rol eax, 0x72
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0xab3460aa
pushf
not eax
add eax, 0xfe036f3b
xor eax, 0xf3192009
rol eax, 0x15
popf
pushf
not eax
add eax, 0x9af8f9d2
xor eax, 0xc7c4bf5c
rol eax, 0x3d
popf
jmp 0x180072ca7
cmp qword [rbp + 0x6f], 2
jne 0x180073407
push rax
pushf
mov eax, 0x31eaacea
pushf
not eax
add eax, 0xd0cfa56f
xor eax, 0xfcce76e8
rol eax, 0x39
popf
pushf
not eax
add eax, 0xc5719704
xor eax, 0xecad41f7
rol eax, 0x5f
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0x22a00cdc
pushf
not eax
add eax, 0xfdda0294
xor eax, 0xe1f1580b
rol eax, 0xce
popf
pushf
not eax
add eax, 0xaf7a240e
xor eax, 0x840b455b
rol eax, 0x55
popf
jmp 0x180072ca7
cmp word [rbp + 0x67], 0x70
jne 0x180073474
push rax
pushf
mov eax, 0x131fd42e
pushf
not eax
add eax, 0xa804769e
xor eax, 0xfb28670f
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xe3ffebb6
xor eax, 0x934fb3cf
rol eax, 0x27
popf
jmp 0x180072ca7
push rax
pushf
mov eax, 0x2e90750a
pushf
not eax
add eax, 0xe95e980f
xor eax, 0x9c5adad9
rol eax, 0xe1
popf
pushf
not eax
add eax, 0xe2a8f5d2
xor eax, 0xcb0e00c1
rol eax, 0x86
popf
pushf
not eax
add eax, 0xa21b96df
xor eax, 0xfbd72cf0
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xff84f4e3
xor eax, 0xe34984e6
rol eax, 0x2c
popf
jmp 0x180072ca7
mov eax, 0x3f579932
pushf
not eax
add eax, 0xac136e7d
xor eax, 0xba285f84
rol eax, 0x79
popf
pushf
not eax
add eax, 0xdcbbb8ff
xor eax, 0xb2c52b31
rol eax, 0x76
popf
pushf
not eax
add eax, 0x8e7cf4e3
xor eax, 0xb520c494
rol eax, 0x12
popf
pushf
not eax
add eax, 0xf10e92b3
xor eax, 0xdb8cdcc5
rol eax, 0x3d
popf
jmp 0x180073592
mov rcx, rbx
jmp 0x180073524
call qword [sym.imp.KERNEL32.dll_CloseHandle]
push rax
pushf
mov eax, 0x9f53db18
pushf
not eax
add eax, 0xfe6a076c
xor eax, 0x9c94f7d8
rol eax, 0x39
popf
pushf
not eax
add eax, 0xef3cba8d
xor eax, 0xd7b5bfd5
rol eax, 0xd8
popf
jmp 0x180072ca7
xor eax, eax
push rax
pushf
mov eax, 0xaa0a955a
pushf
not eax
add eax, 0xd8714c3b
xor eax, 0xa36f5703
rol eax, 0x13
popf
pushf
not eax
add eax, 0xea8b339c
xor eax, 0xdb6dcb4c
rol eax, 0xb2
popf
jmp 0x180072ca7
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret