Function at 0x140049f2c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0xf0], rbx
mov rax, qword [0x1400e3020]
xor rax, rbp
mov qword [rbp + 0x90], rax
mov rdi, rdx
mov r14, rcx
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x50], rdx
xor r12d, r12d
mov dword [rbp + 4], r12d
mov qword [rcx], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r12b
mov dword [rbp + 4], 1
mov qword [rbp + 0x10], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov dword [rbp + 0x6a], 0x336c6c65
mov dword [rbp + 0x70], 0x6c6c64
mov word [rbp + 0x68], 0x6873
mov word [rbp + 0x6e], 0x2e32
lea rcx, [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
mov qword [rbp + 0x20], rax
test rax, rax
je 0x14004a1ad
mov edx, 0x2bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400eacf8], rax
test rax, rax
je 0x140049ff6
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140049ff0
mov rcx, qword [rdi]
lea rdx, [rbp + 0x58]
call rax
mov word [rbp + 0x7f], 0x776f
mov dword [rbp + 0x82], 0x646c6f46
mov dword [rbp + 0x7a], 0x4b746547
mov word [rbp + 0x86], 0x7265
mov dword [rbp + 0x89], 0x687461
mov word [rbp + 0x78], 0x4853
mov byte [rbp + 0x7e], 0x6e
mov byte [rbp + 0x81], 0x6e
mov byte [rbp + 0x88], 0x50
lea rdx, [rbp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400eacf0], rax
test rax, rax
je 0x14004a1a3
lea r9, [rbp + 0x10]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x58]
call rax
test eax, eax
jne 0x14004a1a3
mov r13, qword [rbp + 0x10]
test r13, r13
je 0x14004a1a3
mov word [rbp], 0x7325
mov byte [rbp + 2], r12b
or rsi, 0xffffffffffffffff
inc rsi
cmp word [r13 + rsi*2], r12w
jne 0x14004a087
mov cl, 1
call fcn.140005b1c
mov r15, rax
mov qword [rbp + 0x48], rax
mov dword [rbp + 4], 3
lea eax, [rsi + rsi]
cdqe
mov qword [rbp + 0x28], rax
add rax, 2
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14004a0c7
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400073f0
sub rsp, rcx
lea r12, [rsp + 0x40]
xor eax, eax
mov byte [r12], al
test esi, esi
jle 0x14004a162
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x30], r13
lea rcx, [rbp + 0x40]
call fcn.140004d9c
mov rcx, rax
xor eax, eax
mov qword [rbp + 8], rax
mov rbx, qword [rbp + 0x28]
add rbx, 2
lea rdx, [rbx + r12]
mov r10, qword [rcx]
movsxd rax, esi
lea r9, [rax*2]
add r9, r13
lea rax, [rbp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r12
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, r13
lea rdx, [rbp + 8]
call qword [r10 + 0x38]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
sub rax, r12
cmp rax, rbx
jle 0x14004a15a
xor eax, eax
mov byte [rbx + r12], al
jmp 0x14004a15e
xor eax, eax
mov byte [rcx], al
mov rbx, qword [rbp + 0x20]
mov r8, r12
lea rdx, [rbp]
mov rcx, r14
call fcn.1400044a8
nop
mov esi, 1
mov dword [rbp + 4], esi
xor r12d, r12d
test r15, r15
je 0x14004a19a
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x14004a19a
mov rax, qword [rax]
mov edx, esi
call qword [rax]
mov rcx, qword [rbp + 0x10]
call fcn.140051ba4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14004a1e3
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004a1de
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004a21e
mov rcx, r8
call fcn.140006b0c
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r12b
mov rax, r14
mov rcx, qword [rbp + 0x90]
xor rcx, rbp
call fcn.140006850
mov rbx, qword [rbp + 0xf0]
lea rsp, [rbp + 0xa0]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14000d1ec
int3