Function at 0x1401f6bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0xd0
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp - 1], rax
cmp byte [0x1411dd026], 0
movzx r13d, r8b
mov qword [rbp - 0x41], r9
mov rbx, rcx
mov byte [rbp - 0x51], r8b
mov qword [rbp - 0x31], rdx
mov qword [rbp - 0x39], rcx
je 0x1401f6bf6
xor al, al
jmp 0x1401f6ff9
mov eax, dword [rcx + 0x28]
imul eax, dword [rcx + 0x48]
mov qword [rsp + 0xc8], rsi
xor esi, esi
mov qword [rsp + 0xc0], rdi
xor edi, edi
mov qword [rsp + 0xb8], r12
xor r12d, r12d
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xa8], r15
lea edx, [rsi + 1]
imul r15d, eax, 0x1f4
mov byte [rbp - 0x50], 0
mov dword [rbp - 0x29], 0x55434f44
mov dword [rbp - 0x25], 0x544e454d
mov dword [rbp - 0x11], 0x70783f3c
mov ecx, r15d
mov dword [rbp - 0xd], 0x656b6361
mov dword [rbp - 9], 0x65622074
mov dword [rbp - 5], 0x3d6e6967
mov dword [rbp - 0x21], 0x70783f3c
mov dword [rbp - 0x1d], 0x656b6361
mov dword [rbp - 0x19], 0x6e652074
mov word [rbp - 0x15], 0x3d64
mov dword [rbp - 0x45], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1401f6fcd
mov r8, qword [rbp - 0x41]
mov r9, rax
mov ecx, dword [rbx + 0x48]
movzx edx, r13b
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r15d
call fcn.1401c1720
test eax, eax
je 0x1401f6fc4
mov rax, qword [rbp - 0x29]
cmp rax, qword [r14 + 0x10]
jne 0x1401f6fc4
movzx eax, byte [r14 + 0x18]
xor edx, edx
mov r8d, dword [rbx + 0x28]
mov ecx, r8d
mov r10d, dword [rbx + 0x48]
movzx r9d, byte [0x1411dd026]
imul ecx, r10d
mov byte [rbp - 0x49], al
mov eax, 0x8000
div ecx
xor ecx, ecx
mov r13d, eax
mov dword [rbp - 0x29], ecx
nop
test r9b, r9b
jne 0x1401f6dd4
mov r8, qword [rbp - 0x41]
mov r9, r14
movzx edx, byte [rbp - 0x51]
add r8, r13
mov dword [rsp + 0x30], ecx
mov ebx, 0x80
mov qword [rsp + 0x28], rcx
mov ecx, r10d
mov dword [rsp + 0x20], r15d
call fcn.1401c1720
test eax, eax
je 0x1401f6fc4
movzx r10d, byte [0x1411dd028]
xor r8d, r8d
movzx r9d, byte [0x1411dd026]
nop dword [rax]
test r9b, r9b
jne 0x1401f6da0
lea edx, [rbx + 4]
cmp edx, r15d
jae 0x1401f6d89
mov eax, ebx
add rax, r14
test r10b, r10b
je 0x1401f6d87
movzx ecx, byte [rax + 3]
mov byte [rbp - 0x4d], cl
movzx ecx, byte [rax + 2]
mov byte [rbp - 0x4c], cl
movzx ecx, byte [rax + 1]
mov byte [rbp - 0x4b], cl
movzx ecx, byte [rax]
mov byte [rbp - 0x4a], cl
mov edi, dword [rbp - 0x4d]
jmp 0x1401f6d89
mov edi, dword [rax]
inc r8d
mov eax, edi
cmp edi, esi
mov ebx, edx
cmovbe eax, esi
mov esi, eax
cmp r8d, 0x3df
jb 0x1401f6d50
mov rbx, qword [rbp - 0x39]
xor edx, edx
mov eax, 0x1000
mov r8d, dword [rbx + 0x28]
mov ecx, r8d
mov r10d, dword [rbx + 0x48]
imul ecx, r10d
div rcx
mov rcx, r12
add r13, rax
mov eax, dword [rbp - 0x29]
inc eax
mov dword [rbp - 0x29], eax
cmp eax, 2
jb 0x1401f6d00
imul r8d, r10d
lea eax, [rsi + 1]
xor edx, edx
shl rax, 0xc
mov dword [rsp + 0x30], ecx
mov r9, r14
mov qword [rsp + 0x28], rcx
mov ebx, 0x24
mov ecx, r10d
mov dword [rsp + 0x20], r15d
div r8
movzx edx, byte [rbp - 0x51]
mov rsi, rax
add rsi, qword [rbp - 0x41]
mov r8, rsi
call fcn.1401c1720
test eax, eax
je 0x1401f6fc4
mov r8, qword [rbp - 9]
mov r9, qword [rbp - 0x11]
movzx edx, byte [0x1411dd026]
mov r10d, r15d
nop word [rax + rax]
test dl, dl
jne 0x1401f6ee4
mov ecx, ebx
lea rax, [rcx + 0x10]
cmp rax, r10
ja 0x1401f6fc4
cmp r9, qword [rcx + r14]
jne 0x1401f6e54
cmp r8, qword [rcx + r14 + 8]
je 0x1401f6e65
add ebx, 0x1000
inc r12d
cmp r12d, 0x32
jb 0x1401f6e30
jmp 0x1401f6ee4
cmp byte [rbp - 0x49], 1
je 0x1401f6ea5
cmp rcx, 4
jb 0x1401f6ee4
cmp ebx, r15d
jae 0x1401f6ee4
lea ecx, [rbx - 4]
add rcx, r14
cmp byte [0x1411dd028], 0
jne 0x1401f6edf
movzx eax, byte [rcx + 3]
mov byte [rbp - 0x4d], al
movzx eax, byte [rcx + 2]
mov byte [rbp - 0x4c], al
movzx eax, byte [rcx + 1]
mov byte [rbp - 0x4b], al
movzx eax, byte [rcx]
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x4d]
jmp 0x1401f6ee1
cmp rcx, 4
jb 0x1401f6ee4
cmp ebx, r15d
jae 0x1401f6ee4
lea ecx, [rbx - 4]
add rcx, r14
cmp byte [0x1411dd028], 0
je 0x1401f6edf
movzx eax, byte [rcx + 3]
mov byte [rbp - 0x4d], al
movzx eax, byte [rcx + 2]
mov byte [rbp - 0x4c], al
movzx eax, byte [rcx + 1]
mov byte [rbp - 0x4b], al
movzx eax, byte [rcx]
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x4d]
jmp 0x1401f6ee1
mov eax, dword [rcx]
mov dword [rbp - 0x45], eax
mov r13, qword [rbp - 0x39]
xor edx, edx
mov ecx, dword [rbp - 0x45]
add ecx, ebx
mov eax, ecx
mov edi, dword [r13 + 0x48]
mov r8d, edi
imul r8d, dword [r13 + 0x28]
div r8
xor edx, edx
add rsi, rax
mov eax, ecx
div r8d
mov ebx, edx
add ebx, 0xffffffed
cmp edx, 0x13
jb 0x1401f6f19
xor r12b, r12b
jmp 0x1401f6f22
dec rsi
mov r12b, 1
add ebx, r8d
mov r8, r10
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x51]
mov r9, r14
mov dword [rsp + 0x30], 0
mov r8, rsi
mov qword [rsp + 0x28], 0
mov ecx, edi
mov dword [rsp + 0x20], r15d
call fcn.1401c1720
test eax, eax
je 0x1401f6fc4
mov rax, qword [rbp - 0x21]
cmp rax, qword [rbx + r14]
jne 0x1401f6fc4
mov eax, dword [rbp - 0x19]
cmp eax, dword [rbx + r14 + 8]
jne 0x1401f6fc4
movzx eax, word [rbp - 0x15]
cmp ax, word [rbx + r14 + 0xc]
jne 0x1401f6fc4
mov ecx, dword [r13 + 0x28]
lea r8, [rsi + 1]
test r12b, r12b
mov byte [rbp - 0x50], 1
cmove r8, rsi
imul ecx, dword [r13 + 0x48]
sub r8, qword [rbp - 0x41]
imul r8, rcx
mov rax, r8
cqo
and edx, 0xfff
add rax, rdx
and eax, 0xfff
sub rax, rdx
je 0x1401f6fbc
sub r8, rax
add r8, 0x1000
mov rax, qword [rbp - 0x31]
mov qword [rax + 0x10], r8
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, byte [rbp - 0x50]
mov r15, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xd0
pop r13
pop rbx
pop rbp
ret