Function at 0x140208dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 7], rax
mov qword [rbp - 9], rdx
mov r14, rcx
xor r13d, r13d
mov dword [rbp - 0x1d], 0x53502125
mov ecx, 0xa00000
mov word [rbp - 0x11], 0x2e32
mov r12, r9
mov word [rbp - 0xd], 0x2e33
movzx r15d, r8b
mov dword [rbp - 0x15], 0xd312e33
lea edx, [r13 + 1]
mov dword [rbp - 0x21], 0x464f4525
xor sil, sil
mov word [rbp - 0x29], 0xd0d
mov word [rbp - 0x25], 0xa0a
mov bl, 0x25
mov dword [rbp - 1], 0x65676150
mov dword [rbp + 3], 0x31203a73
mov dword [rbp - 0x19], 0x46535045
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x1402090ae
xor edx, edx
mov r8d, 0xa00000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r14 + 0x48]
mov r9, rdi
mov dword [rsp + 0x30], r13d
mov r8, r12
mov qword [rsp + 0x28], r13
movzx edx, r15b
mov dword [rsp + 0x20], 0xa00000
call fcn.1401c1720
test eax, eax
je 0x1402090a5
mov eax, dword [rbp - 0x1d]
cmp eax, dword [rdi]
jne 0x1402090a5
mov eax, dword [rbp - 0x19]
cmp eax, dword [rdi + 0xf]
je 0x1402090a5
movzx eax, word [rbp - 0x11]
lea r9d, [r13 + 0xb]
cmp ax, word [rdi + 0xb]
jne 0x140208fe2
mov al, 0x30
cmp al, byte [rdi + 0xd]
jne 0x140208fe2
cmp byte [0x1411dd026], sil
jne 0x140209097
mov edx, dword [rbp - 0x21]
movzx r8d, word [rbp - 0x29]
movzx eax, word [rbp - 0x25]
mov rcx, qword [rbp - 1]
nop dword [rax + rax]
mov r11d, r9d
lea r10, [r11 + 4]
cmp r10, 0xa00000
jae 0x140209097
lea r10, [r11 + 8]
cmp r10, 0xa00000
jae 0x140209097
cmp edx, dword [r11 + rdi]
lea r10, [r11 + rdi]
jne 0x140208f5b
add r9d, 4
lea r10, [r9 + 2]
cmp r10, 0xa00000
jae 0x140209097
cmp r8w, word [r9 + rdi]
je 0x140208f56
cmp ax, word [r9 + rdi]
jne 0x140208fd9
inc r9d
jmp 0x140208f00
cmp rcx, qword [r10]
jne 0x140208f56
add r9d, 8
lea r11d, [r9 + 4]
mov r10d, r11d
add r10, 2
cmp r10, 0xa00000
jae 0x140209097
cmp ax, word [r9 + rdi]
jne 0x140208f8c
add r9d, 2
jmp 0x140208f00
cmp bl, byte [r9 + rdi]
jne 0x140208f9a
inc r9d
jmp 0x140208f00
cmp bl, byte [r9 + rdi + 1]
jne 0x140208faa
add r9d, 2
jmp 0x140208f00
cmp bl, byte [r9 + rdi + 2]
jne 0x140208fba
add r9d, 3
jmp 0x140208f00
cmp bl, byte [r9 + rdi + 3]
jne 0x140208fc9
mov r9d, r11d
jmp 0x140208f00
cmp bl, byte [r9 + rdi + 4]
jne 0x140208fd9
add r9d, 5
jmp 0x140208f00
lea r13d, [r9 + 3]
jmp 0x140209097
mov eax, dword [rbp - 0x15]
cmp eax, dword [rdi + 0xb]
jne 0x14020904a
cmp byte [0x1411dd026], sil
jne 0x140209097
mov eax, dword [rbp - 0x21]
movzx edx, word [rbp - 0x29]
movzx ecx, word [rbp - 0x25]
nop dword [rax]
nop word [rax + rax]
mov r10d, r9d
lea r8, [r10 + 4]
cmp r8, 0xa00000
jae 0x140209097
cmp eax, dword [r10 + rdi]
jne 0x140209045
add r9d, 3
lea r8, [r9 + 2]
cmp r8, 0xa00000
jae 0x140209097
cmp dx, word [r9 + rdi]
je 0x140209045
cmp cx, word [r9 + rdi]
jne 0x140208fd9
inc r9d
jmp 0x140209010
movzx eax, word [rbp - 0xd]
mov cl, 0x30
cmp ax, word [rdi + 0xb]
jne 0x14020905b
cmp cl, byte [rdi + 0xd]
je 0x140209066
cmp ax, word [rdi + 0xc]
jne 0x1402090a5
cmp cl, byte [rdi + 0xe]
jne 0x1402090a5
cmp byte [0x1411dd026], sil
jne 0x140209097
mov eax, dword [rbp - 0x21]
lea edx, [r9 + 1]
mov ecx, edx
add rcx, 4
cmp rcx, 0xa00000
jae 0x140209097
mov ecx, r9d
cmp eax, dword [rcx + rdi + 1]
je 0x140209093
mov r9d, edx
jmp 0x140209072
lea r13d, [r9 + 6]
mov rcx, qword [rbp - 9]
mov sil, 1
mov eax, r13d
mov qword [rcx + 0x10], rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, sil
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret