Function at 0x1402096b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 7], rax
mov qword [rbp - 0x19], rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rbp - 1], 0x49490000
mov ecx, 0x1400000
mov dword [rbp + 3], 0x33525058
mov rsi, r9
mov dword [rbp - 9], 0x410041
movzx edi, r8b
mov word [rbp - 5], 0x4344
lea edx, [r12 + 1]
mov dword [rbp - 0x11], 0x420042
xor r13b, r13b
mov word [rbp - 0xd], 0x4344
mov word [rbp - 0x25], 0xffff
mov word [rbp - 0x21], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x140209938
xor edx, edx
mov r8d, 0x1400000
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rbx + 0x48]
mov r9, r14
mov dword [rsp + 0x30], r12d
mov r8, rsi
mov qword [rsp + 0x28], r12
movzx edx, dil
mov dword [rsp + 0x20], 0x1400000
call fcn.1401c1720
test eax, eax
je 0x14020992b
mov rax, qword [rbp - 1]
cmp rax, qword [r14]
jne 0x14020992b
mov eax, dword [rbp - 9]
cmp eax, dword [r14 + 8]
jne 0x140209796
movzx eax, word [rbp - 5]
cmp ax, word [r14 + 0xc]
je 0x1402097b2
mov eax, dword [rbp - 0x11]
cmp eax, dword [r14 + 8]
jne 0x14020992b
movzx eax, word [rbp - 0xd]
cmp ax, word [r14 + 0xc]
jne 0x14020992b
cmp byte [0x1411dd026], r12b
mov r13b, 1
movzx edx, word [r14 + 0x80]
mov qword [rsp + 0x88], r15
mov r15d, 0xfc
mov byte [rbp - 0x29], r13b
mov dword [rbp - 0x1d], r12d
mov dword [rbp - 1], 0xffff0000
mov dword [rbp - 0x11], 0xffff
mov dword [rbp - 9], 0xffffffff
jne 0x140209918
movzx r13d, byte [0x1411dd028]
mov r11d, r12d
movzx eax, word [rbp - 0x25]
movzx ecx, word [rbp - 0x21]
mov r8d, dword [rbp - 1]
mov r9d, dword [rbp - 0x11]
mov r10d, dword [rbp - 9]
nop dword [rax]
nop dword [rax + rax]
mov edi, r15d
lea rbx, [rdi + 2]
cmp rbx, 0x1400000
jae 0x140209913
cmp dx, word [rdi + r14]
jne 0x140209904
add r15d, 2
cmp r11d, dword [r15 + r14]
je 0x14020986b
cmp r8d, dword [r15 + r14]
je 0x14020986b
cmp r9d, dword [r15 + r14]
je 0x14020986b
cmp r10d, dword [r15 + r14]
je 0x14020986b
and r15d, 0xffffff00
add r15d, 0x100
jmp 0x140209820
mov ebx, r15d
and ebx, 0xffffff00
add ebx, 0xfe
nop word [rax + rax]
lea rdi, [rbx + 2]
cmp rdi, 0x1400000
jae 0x140209904
cmp cx, word [rbx + r14]
jne 0x1402098c6
add ebx, 0xfffffffe
movzx edi, word [rbx + r14]
lea r12d, [rbx + 4]
test r13b, r13b
je 0x1402098b7
movzx ebx, di
mov byte [rbp - 0x20], dil
shr bx, 8
mov byte [rbp - 0x21], bl
movzx edi, word [rbp - 0x21]
movzx ebx, di
test ebx, ebx
je 0x14020990c
shl ebx, 8
sub ebx, 2
jmp 0x140209880
cmp ax, word [rbx + r14]
jne 0x14020990c
lea esi, [rbx + 2]
movzx edi, word [rsi + r14]
lea r12d, [rsi + 2]
test r13b, r13b
je 0x1402098f0
movzx ebx, di
mov byte [rbp - 0x24], dil
shr bx, 8
mov byte [rbp - 0x25], bl
movzx edi, word [rbp - 0x25]
movzx ebx, di
test ebx, ebx
je 0x14020990c
shl ebx, 8
add ebx, 0xfffffffe
add ebx, esi
jmp 0x140209880
inc r15d
jmp 0x140209820
add r12d, 0x19000
movzx r13d, byte [rbp - 0x29]
mov rax, qword [rbp - 0x19]
mov r15, qword [rsp + 0x88]
mov ecx, r12d
mov qword [rax + 0x10], rcx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r13b
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x90
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret