Function at 0x14020a160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 7], rax
mov qword [rbp - 0x39], rdx
mov r12, rcx
mov qword [rbp - 0x49], rcx
mov edx, 1
mov ecx, 0xa00000
mov qword [rbp - 0x41], r9
mov rsi, r9
mov byte [rbp - 0x51], r8b
movzx edi, r8b
mov dword [rbp - 0x21], 0x4d4d0000
xor bl, bl
mov dword [rbp - 0x1d], 0x33525058
mov dword [rbp - 0x29], 0x43004300
mov r13b, 0x58
mov dword [rbp - 0x31], 0x43204320
mov r14b, 0xff
mov dword [rbp - 0x19], 0x44004400
mov dword [rbp - 0x11], 0x44204420
mov dword [rbp - 9], 0x45004500
mov dword [rbp - 1], 0x45204520
mov dword [rbp - 0x55], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x14020a55a
xor edx, edx
mov r8d, 0xa00000
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r12 + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, r15
mov qword [rsp + 0x28], rax
mov r8, rsi
movzx edx, dil
mov dword [rsp + 0x20], 0xa00000
call fcn.1401c1720
test eax, eax
je 0x14020a54e
mov rax, qword [rbp - 0x21]
cmp rax, qword [r15]
jne 0x14020a54e
mov eax, dword [rbp - 0x29]
xor r9b, r9b
xor r10b, r10b
xor r8b, r8b
cmp eax, dword [r15 + 8]
jne 0x14020a268
cmp r13b, byte [r15 + 0xc]
je 0x14020a277
mov eax, dword [rbp - 0x31]
cmp eax, dword [r15 + 8]
jne 0x14020a27c
cmp r13b, byte [r15 + 0xc]
jne 0x14020a27c
mov r9b, 1
jmp 0x14020a2c8
mov eax, dword [rbp - 0x19]
cmp eax, dword [r15 + 8]
jne 0x14020a28b
cmp r13b, byte [r15 + 0xc]
je 0x14020a29a
mov eax, dword [rbp - 0x11]
cmp eax, dword [r15 + 8]
jne 0x14020a29f
cmp r13b, byte [r15 + 0xc]
jne 0x14020a29f
mov r10b, 1
jmp 0x14020a2c8
mov eax, dword [rbp - 9]
cmp eax, dword [r15 + 8]
jne 0x14020a2ae
cmp r13b, byte [r15 + 0xc]
je 0x14020a2c5
mov eax, dword [rbp - 1]
cmp eax, dword [r15 + 8]
jne 0x14020a54e
cmp r13b, byte [r15 + 0xc]
jne 0x14020a54e
mov r8b, 1
movzx edx, byte [0x1411dd028]
mov ecx, dword [r15 + 0x41c]
mov byte [rbp - 0x58], 1
test dl, dl
jne 0x14020a2fc
mov eax, ecx
mov byte [rbp - 0x2e], cl
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x2f], al
mov ecx, dword [rbp - 0x31]
cmp ecx, 0x3d8
jae 0x14020a358
lea eax, [rcx + 0x424]
mov ebx, dword [rax + r15]
test dl, dl
jne 0x14020a330
mov eax, ebx
mov byte [rbp - 0x2e], bl
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, ebx
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, ebx
shr eax, 8
mov byte [rbp - 0x2f], al
mov ebx, dword [rbp - 0x31]
mov edi, ebx
test r9b, r9b
jne 0x14020a343
test r10b, r10b
jne 0x14020a341
test r8b, r8b
je 0x14020a346
inc ebx
shl ebx, 0xa
add ebx, 0xfffffffc
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbp - 0x59], 1
jmp 0x14020a3bc
test r9b, r9b
je 0x14020a364
mov eax, 0x63fc
jmp 0x14020a380
test r10b, r10b
je 0x14020a370
mov eax, 0x7ffc
jmp 0x14020a380
test r8b, r8b
mov eax, 0x41c
mov ecx, 0x8bfc
cmovne eax, ecx
mov edi, dword [rax + r15]
test dl, dl
jne 0x14020a3a7
mov eax, edi
mov byte [rbp - 0x2e], dil
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, edi
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, edi
shr eax, 8
mov byte [rbp - 0x2f], al
mov edi, dword [rbp - 0x31]
mov ebx, edi
mov rcx, r15
shl ebx, 0xa
sub ebx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbp - 0x59], 0
xor r15d, r15d
cmp byte [0x1411dd026], r15b
jne 0x14020a537
mov esi, dword [rbp - 0x55]
mov r13d, ebx
mov rax, qword [rbp - 0x49]
mov edx, 1
mov r12d, dword [r12 + 0x48]
imul r12d, dword [rax + 0x28]
lea eax, [r12*4]
mov ecx, eax
mov dword [rbp - 0x29], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x14020a537
lea r8d, [r12*4]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov eax, r13d
div r12d
mov r12d, dword [rbp - 0x29]
mov r9, r15
movzx edx, byte [rbp - 0x51]
mov r8d, eax
xor eax, eax
add r8, qword [rbp - 0x41]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x49]
mov dword [rsp + 0x20], r12d
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x14020a54a
mov ecx, r13d
and ecx, 0x1ff
lea rax, [rcx + 4]
cmp rax, r12
jae 0x14020a54a
cmp r14b, byte [rcx + r15]
jne 0x14020a49d
cmp byte [0x1411dd028], 0
lea eax, [rcx + 4]
movzx edx, word [rax + r15]
jne 0x14020a492
movzx eax, dx
mov byte [rbp - 0x30], dl
shr ax, 8
mov byte [rbp - 0x31], al
movzx edx, word [rbp - 0x31]
movzx ebx, dx
shl ebx, 0xa
add ebx, r13d
jmp 0x14020a4dc
cmp esi, dword [rcx + r15]
je 0x14020a502
cmp byte [0x1411dd028], 0
mov ebx, dword [rcx + r15]
jne 0x14020a4ce
mov eax, ebx
mov byte [rbp - 0x52], bl
shr eax, 0x18
mov byte [rbp - 0x55], al
mov eax, ebx
shr eax, 0x10
mov byte [rbp - 0x54], al
mov eax, ebx
shr eax, 8
mov byte [rbp - 0x53], al
mov ebx, dword [rbp - 0x55]
cmp ebx, 0x1f400000
jae 0x14020a4fe
shl ebx, 0xa
sub ebx, 4
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rbp - 0x49]
xor r15d, r15d
cmp byte [0x1411dd026], r15b
mov r13d, ebx
je 0x14020a3d2
jmp 0x14020a537
xor bl, bl
jmp 0x14020a54e
cmp byte [rbp - 0x59], 0
je 0x14020a530
cmp edi, 0x190
ja 0x14020a519
mov eax, 0x19000
add ebx, eax
jmp 0x14020a537
cmp edi, 0x1770
mov eax, 0x177000
mov ecx, 0x7d000
cmovbe eax, ecx
add ebx, eax
jmp 0x14020a537
mov ecx, 0x7d000
add ebx, ecx
mov rcx, qword [rbp - 0x39]
mov eax, ebx
mov qword [rcx + 0x10], rax
mov bl, 1
test r15, r15
je 0x14020a557
jmp 0x14020a54e
movzx ebx, byte [rbp - 0x58]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, bl
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret