Function at 0x140011127
Capabilities:
Contain obfuscated stackstrings
Read file via mapping

Disassembly:
jmp 0x140015740
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x4d8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0xbe
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x4f8]
mov rax, qword [0x140024158]
xor rax, rbp
mov qword [rbp + 0x468], rax
lea rcx, [0x14002d036]
call fcn.140011609
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp + 8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x1000002
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 4
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbp + 0x48], rax
xor r9d, r9d
lea r8, str.ntdll_handle
mov rdx, qword [rbp + 0x48]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x64], 0
mov byte [rbp + 0x88], 0x4e
mov byte [rbp + 0x89], 0x74
mov byte [rbp + 0x8a], 0x50
mov byte [rbp + 0x8b], 0x72
mov byte [rbp + 0x8c], 0x6f
mov byte [rbp + 0x8d], 0x74
mov byte [rbp + 0x8e], 0x65
mov byte [rbp + 0x8f], 0x63
mov byte [rbp + 0x90], 0x74
mov byte [rbp + 0x91], 0x56
mov byte [rbp + 0x92], 0x69
mov byte [rbp + 0x93], 0x72
mov byte [rbp + 0x94], 0x74
mov byte [rbp + 0x95], 0x75
mov byte [rbp + 0x96], 0x61
mov byte [rbp + 0x97], 0x6c
mov byte [rbp + 0x98], 0x4d
mov byte [rbp + 0x99], 0x65
mov byte [rbp + 0x9a], 0x6d
mov byte [rbp + 0x9b], 0x6f
mov byte [rbp + 0x9c], 0x72
mov byte [rbp + 0x9d], 0x79
mov byte [rbp + 0x9e], 0
mov byte [rbp + 0xb8], 0x4e
mov byte [rbp + 0xb9], 0x74
mov byte [rbp + 0xba], 0x57
mov byte [rbp + 0xbb], 0x72
mov byte [rbp + 0xbc], 0x69
mov byte [rbp + 0xbd], 0x74
mov byte [rbp + 0xbe], 0x65
mov byte [rbp + 0xbf], 0x56
mov byte [rbp + 0xc0], 0x69
mov byte [rbp + 0xc1], 0x72
mov byte [rbp + 0xc2], 0x74
mov byte [rbp + 0xc3], 0x75
mov byte [rbp + 0xc4], 0x61
mov byte [rbp + 0xc5], 0x6c
mov byte [rbp + 0xc6], 0x4d
mov byte [rbp + 0xc7], 0x65
mov byte [rbp + 0xc8], 0x6d
mov byte [rbp + 0xc9], 0x6f
mov byte [rbp + 0xca], 0x72
mov byte [rbp + 0xcb], 0x79
mov byte [rbp + 0xcc], 0
mov byte [rbp + 0xe8], 0x4e
mov byte [rbp + 0xe9], 0x74
mov byte [rbp + 0xea], 0x43
mov byte [rbp + 0xeb], 0x72
mov byte [rbp + 0xec], 0x65
mov byte [rbp + 0xed], 0x61
mov byte [rbp + 0xee], 0x74
mov byte [rbp + 0xef], 0x65
mov byte [rbp + 0xf0], 0x54
mov byte [rbp + 0xf1], 0x68
mov byte [rbp + 0xf2], 0x72
mov byte [rbp + 0xf3], 0x65
mov byte [rbp + 0xf4], 0x61
mov byte [rbp + 0xf5], 0x64
mov byte [rbp + 0xf6], 0x45
mov byte [rbp + 0xf7], 0x78
mov byte [rbp + 0xf8], 0
mov byte [rbp + 0x118], 0x4e
mov byte [rbp + 0x119], 0x74
mov byte [rbp + 0x11a], 0x57
mov byte [rbp + 0x11b], 0x61
mov byte [rbp + 0x11c], 0x69
mov byte [rbp + 0x11d], 0x74
mov byte [rbp + 0x11e], 0x46
mov byte [rbp + 0x11f], 0x6f
mov byte [rbp + 0x120], 0x72
mov byte [rbp + 0x121], 0x53
mov byte [rbp + 0x122], 0x69
mov byte [rbp + 0x123], 0x6e
mov byte [rbp + 0x124], 0x67
mov byte [rbp + 0x125], 0x6c
mov byte [rbp + 0x126], 0x65
mov byte [rbp + 0x127], 0x4f
mov byte [rbp + 0x128], 0x62
mov byte [rbp + 0x129], 0x6a
mov byte [rbp + 0x12a], 0x65
mov byte [rbp + 0x12b], 0x63
mov byte [rbp + 0x12c], 0x74
mov byte [rbp + 0x12d], 0
mov byte [rbp + 0x148], 0x4e
mov byte [rbp + 0x149], 0x74
mov byte [rbp + 0x14a], 0x41
mov byte [rbp + 0x14b], 0x6c
mov byte [rbp + 0x14c], 0x6c
mov byte [rbp + 0x14d], 0x6f
mov byte [rbp + 0x14e], 0x63
mov byte [rbp + 0x14f], 0x61
mov byte [rbp + 0x150], 0x74
mov byte [rbp + 0x151], 0x65
mov byte [rbp + 0x152], 0x56
mov byte [rbp + 0x153], 0x69
mov byte [rbp + 0x154], 0x72
mov byte [rbp + 0x155], 0x74
mov byte [rbp + 0x156], 0x75
mov byte [rbp + 0x157], 0x61
mov byte [rbp + 0x158], 0x6c
mov byte [rbp + 0x159], 0x4d
mov byte [rbp + 0x15a], 0x65
mov byte [rbp + 0x15b], 0x6d
mov byte [rbp + 0x15c], 0x6f
mov byte [rbp + 0x15d], 0x72
mov byte [rbp + 0x15e], 0x79
mov byte [rbp + 0x15f], 0
mov byte [rbp + 0x178], 0x4e
mov byte [rbp + 0x179], 0x74
mov byte [rbp + 0x17a], 0x47
mov byte [rbp + 0x17b], 0x65
mov byte [rbp + 0x17c], 0x74
mov byte [rbp + 0x17d], 0x43
mov byte [rbp + 0x17e], 0x75
mov byte [rbp + 0x17f], 0x72
mov byte [rbp + 0x180], 0x72
mov byte [rbp + 0x181], 0x65
mov byte [rbp + 0x182], 0x6e
mov byte [rbp + 0x183], 0x74
mov byte [rbp + 0x184], 0x50
mov byte [rbp + 0x185], 0x72
mov byte [rbp + 0x186], 0x6f
mov byte [rbp + 0x187], 0x63
mov byte [rbp + 0x188], 0x65
mov byte [rbp + 0x189], 0x73
mov byte [rbp + 0x18a], 0x73
mov byte [rbp + 0x18b], 0x6f
mov byte [rbp + 0x18c], 0x72
mov byte [rbp + 0x18d], 0x4e
mov byte [rbp + 0x18e], 0x75
mov byte [rbp + 0x18f], 0x6d
mov byte [rbp + 0x190], 0x62
mov byte [rbp + 0x191], 0x65
mov byte [rbp + 0x192], 0x72
mov byte [rbp + 0x193], 0
mov qword [rbp + 0x1f8], 0x1000
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x88]
mov rcx, rax
call fcn.1400110fa
mov qword [rbp + 0x218], rax
mov rcx, qword [rbp + 0x218]
call fcn.1400114e7
test eax, eax
je 0x140015c30
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0xb8]
mov rcx, rax
call fcn.1400110fa
mov rcx, rax
call fcn.1400114e7
test eax, eax
je 0x140015c60
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0xe8]
mov rcx, rax
call fcn.1400110fa
mov rcx, rax
call fcn.1400114e7
test eax, eax
je 0x140015c90
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x118]
mov rcx, rax
call fcn.1400110fa
mov rcx, rax
call fcn.1400114e7
test eax, eax
je 0x140015cc0
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x148]
mov rcx, rax
call fcn.1400110fa
mov rcx, rax
call fcn.1400114e7
test eax, eax
je 0x140015cf0
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x178]
mov rcx, rax
call fcn.1400110fa
mov rcx, rax
call fcn.1400114e7
test eax, eax
je 0x140015d20
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
movsxd rax, dword [rbp + 0x64]
xor r9d, r9d
lea r8, str.ntdll_handle
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x234], 0
lea rdx, [rbp + 0x234]
mov ecx, 0x64
call fcn.1400111e5
mov qword [rbp + 0x258], rax
cmp qword [rbp + 0x258], 0
jne 0x140015d6c
xor eax, eax
jmp 0x140015eb6
xor r9d, r9d
lea r8, str.ntdll_handle
mov rdx, qword [rbp + 0x258]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov qword [rbp + 0x278], 0
mov qword [rbp + 0x298], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x1000
lea r9, [rbp + 0x298]
xor r8d, r8d
lea rdx, [rbp + 0x278]
mov rcx, rax
call fcn.14001167c
mov r8d, 0x114
lea rdx, section..data
mov rcx, qword [rbp + 0x278]
call fcn.1400111c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x2b4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20
lea r8, [rbp + 0x298]
lea rdx, [rbp + 0x278]
mov rcx, rax
call fcn.140011145
mov qword [rbp + 0x2d8], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rbp + 0x278]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, 0x1fffff
lea rcx, [rbp + 0x2d8]
call fcn.140011361
mov r8d, 0xffffffff
xor edx, edx
mov rcx, qword [rbp + 0x2d8]
call fcn.14001164a
xor r9d, r9d
lea r8, [0x140020a8c]
lea rdx, [0x140020a8c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp + 0x2d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x14001fc98]
call fcn.140011528
mov rax, rdi
mov rcx, qword [rbp + 0x468]
xor rcx, rbp
call fcn.140011307
lea rsp, [rbp + 0x478]
pop rdi
pop rbp
ret