Function at 0x1401e3170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, rcx
mov dword [rbp - 0x40], 0x354f4353
xor r13d, r13d
mov dword [rbp - 0x2c], 0x454e494c
mov ecx, 0xa00000
mov dword [rbp - 0x3c], 0x5341454d
mov rbx, r9
mov dword [rbp - 0x1c], 0x43455250
movzx edi, r8b
mov dword [rbp - 0x18], 0x4c544954
lea edx, [r13 + 1]
mov dword [rbp - 0x10], 0x54584554
xor r15b, r15b
mov dword [rbp - 0xc], 0x544e4f46
mov dword [rbp - 0x38], 0x524c4f43
xor r12d, r12d
mov dword [rbp - 0x34], 0x4d555244
mov dword [rbp - 0x30], 0x494e4957
mov dword [rbp - 0x14], 0x44534d4f
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbp - 0x28], rax
mov r14, rax
test rax, rax
je 0x1401e3544
xor edx, edx
mov r8d, 0xa00000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rsi + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, r14
mov qword [rsp + 0x28], rax
mov r8, rbx
movzx edx, dil
mov dword [rsp + 0x20], 0xa00000
call fcn.1401c1720
test eax, eax
je 0x1401e353b
mov eax, dword [rbp - 0x40]
cmp eax, dword [r14]
jne 0x1401e353b
mov esi, dword [rbp - 0x2c]
mov r15d, 0x1d6
mov eax, dword [rbp - 0x3c]
mov ecx, dword [rbp - 0x1c]
mov edx, dword [rbp - 0x18]
mov r8d, dword [rbp - 0x10]
mov r9d, dword [rbp - 0xc]
mov r10d, dword [rbp - 0x38]
mov r11d, dword [rbp - 0x34]
mov ebx, dword [rbp - 0x30]
mov byte [rbp - 0x20], 1
nop dword [rax + rax]
cmp byte [0x1411dd026], 0
jne 0x1401e3527
mov r14d, r15d
add r14, 4
cmp r14, 0xa00000
jae 0x1401e3527
mov rdi, qword [rbp - 0x28]
mov r14d, r15d
cmp esi, dword [r14 + rdi]
mov edi, dword [rbp - 0x14]
je 0x1401e34b9
mov rsi, qword [rbp - 0x28]
cmp ecx, dword [r14 + rsi]
mov esi, dword [rbp - 0x2c]
je 0x1401e34b9
mov rsi, qword [rbp - 0x28]
cmp edx, dword [r14 + rsi]
mov esi, dword [rbp - 0x2c]
je 0x1401e34b9
mov rcx, qword [rbp - 0x28]
cmp r8d, dword [r14 + rcx]
mov ecx, dword [rbp - 0x1c]
je 0x1401e34b9
mov rsi, qword [rbp - 0x28]
cmp r9d, dword [r14 + rsi]
mov esi, dword [rbp - 0x2c]
je 0x1401e34b9
mov rdx, qword [rbp - 0x28]
cmp r10d, dword [r14 + rdx]
mov edx, dword [rbp - 0x18]
je 0x1401e34b9
mov rcx, qword [rbp - 0x28]
cmp r11d, dword [r14 + rcx]
mov ecx, dword [rbp - 0x1c]
je 0x1401e34b9
mov r8, qword [rbp - 0x28]
cmp ebx, dword [r14 + r8]
mov r8d, dword [rbp - 0x10]
je 0x1401e34b9
mov rsi, qword [rbp - 0x28]
cmp eax, dword [r14 + rsi]
mov esi, dword [rbp - 0x2c]
jne 0x1401e33aa
add r15d, 4
mov dword [rbp - 0x40], r15d
xor r15d, r15d
mov r13d, dword [rbp - 0x40]
lea r14, [r13 + 4]
cmp r14, 0xa00000
jae 0x1401e336f
mov r15, qword [rbp - 0x28]
mov r15d, dword [r13 + r15]
cmp byte [0x1411dd028], 0
jne 0x1401e33a1
mov r14d, r15d
mov byte [rbp - 0x2d], r15b
shr r14d, 0x18
mov byte [rbp - 0x30], r14b
mov r14d, r15d
shr r14d, 0x10
mov byte [rbp - 0x2f], r14b
mov r14d, r15d
shr r14d, 8
mov byte [rbp - 0x2e], r14b
mov r15d, dword [rbp - 0x30]
add r13d, 0x3a
jmp 0x1401e3514
mov r9, qword [rbp - 0x28]
cmp edi, dword [r14 + r9]
mov r9d, dword [rbp - 0xc]
jne 0x1401e3527
add r15d, 4
mov dword [rbp - 0x40], r15d
xor r15d, r15d
mov r13d, dword [rbp - 0x40]
lea r14, [r13 + 4]
cmp r14, 0xa00000
jae 0x1401e33e1
mov r15, qword [rbp - 0x28]
mov r15d, dword [r13 + r15]
cmp byte [0x1411dd028], 0
jne 0x1401e3413
mov r14d, r15d
mov byte [rbp - 0x31], r15b
shr r14d, 0x18
mov byte [rbp - 0x34], r14b
mov r14d, r15d
shr r14d, 0x10
mov byte [rbp - 0x33], r14b
mov r14d, r15d
shr r14d, 8
mov byte [rbp - 0x32], r14b
mov r15d, dword [rbp - 0x34]
add r13d, 4
add r13d, r15d
nop word [rax + rax]
lea r14d, [r12 + r13]
add r14, 4
cmp r14, 0xa00000
jae 0x1401e3517
mov edx, dword [rbp - 0x18]
mov r14d, r12d
add r14, qword [rbp - 0x28]
cmp eax, dword [r13 + r14]
je 0x1401e3457
inc r12d
cmp r12d, 0x400
jbe 0x1401e3420
jmp 0x1401e3517
lea r14d, [r13 + 4]
xor r15d, r15d
add r14d, r12d
mov dword [rbp - 0x40], r14d
mov r13d, r14d
add r14, 4
cmp r14, 0xa00000
jae 0x1401e347d
mov r14, qword [rbp - 0x28]
mov r15d, dword [r14 + r13]
cmp byte [0x1411dd028], 0
jne 0x1401e34af
mov r14d, r15d
mov byte [rbp - 0x35], r15b
shr r14d, 0x18
mov byte [rbp - 0x38], r14b
mov r14d, r15d
shr r14d, 0x10
mov byte [rbp - 0x37], r14b
mov r14d, r15d
shr r14d, 8
mov byte [rbp - 0x36], r14b
mov r15d, dword [rbp - 0x38]
mov r13d, dword [rbp - 0x40]
add r13d, 0x3a
jmp 0x1401e3514
add r15d, 4
mov dword [rbp - 0x40], r15d
xor r15d, r15d
mov r13d, dword [rbp - 0x40]
lea r14, [r13 + 4]
cmp r14, 0xa00000
jae 0x1401e34de
mov r15, qword [rbp - 0x28]
mov r15d, dword [r13 + r15]
cmp byte [0x1411dd028], 0
jne 0x1401e3510
mov r14d, r15d
mov byte [rbp - 0x39], r15b
shr r14d, 0x18
mov byte [rbp - 0x3c], r14b
mov r14d, r15d
shr r14d, 0x10
mov byte [rbp - 0x3b], r14b
mov r14d, r15d
shr r14d, 8
mov byte [rbp - 0x3a], r14b
mov r15d, dword [rbp - 0x3c]
add r13d, 4
add r13d, r15d
mov r15d, r13d
cmp r12d, 0x200
jb 0x1401e3290
mov rax, qword [rbp + 0x38]
mov r14, qword [rbp - 0x28]
movzx r15d, byte [rbp - 0x20]
mov ecx, r13d
mov qword [rax + 0x10], rcx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x80]
movzx eax, r15b
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret