Function at 0x14009c0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
mov rax, qword [0x14015c040]
xor rax, rsp
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rbp + 0x2d8], 0x626f5206
mov dword [rbp + 0x2dc], 0x786f6c
lea rdx, [rbp + 0x2d9]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm11, dword [rbp + 0x2e0]
cvtdq2ps xmm11, xmm11
movd xmm12, dword [rbp + 0x2e4]
cvtdq2ps xmm12, xmm12
mov rax, qword [0x1404382d0]
mov qword [rbp + 0x2d8], rax
movss xmm8, dword [0x1401426bc]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x2d8]
call fcn.1400877d0
nop
mov r15, qword [rbp + 0x360]
mov r12, qword [rbp + 0x368]
mov rdi, qword [rbp + 0x40]
cmp r15, r12
je 0x14009cc57
mov r13, qword [rbp + 0x2d8]
add r13, 0x110
xor esi, esi
xorps xmm9, xmm9
movsd xmm10, qword [0x140142538]
nop dword [rax + rax]
mov rbx, qword [r15]
mov dword [rbp + 0x331], esi
mov word [rbp + 0x335], si
mov byte [rbp + 0x337], 0
mov dword [rbp + 0x310], 0x12b2d92
mov qword [rbp + 0x318], r13
lea rax, [rbp + 0x378]
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], 8
mov eax, dword [0x140439128]
mov dword [rbp + 0x314], eax
mov byte [rbp + 0x330], 0
test eax, eax
je 0x14009c28a
mov rcx, qword [0x140439120]
test rcx, rcx
je 0x14009c28a
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x310]
mov edx, 0x224a14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rbx, 0x298
mov dword [rbp + 0x359], esi
mov word [rbp + 0x35d], si
mov byte [rbp + 0x35f], 0
mov dword [rbp + 0x338], 0x12b2d92
mov qword [rbp + 0x340], rbx
lea rax, [rbp + 0x2d8]
mov qword [rbp + 0x348], rax
mov qword [rbp + 0x350], 8
mov eax, dword [0x140439128]
mov dword [rbp + 0x33c], eax
mov byte [rbp + 0x358], 0
test eax, eax
je 0x14009c328
mov rcx, qword [0x140439120]
test rcx, rcx
je 0x14009c328
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x338]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x338]
mov edx, 0x224a14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp qword [rbp + 0x2d8], 0
je 0x14009cc43
mov dword [rsp + 0x60], 0x6d754814
mov dword [rsp + 0x64], 0x696f6e61
mov word [rsp + 0x68], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea rax, [rsp + 0x61]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c370
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x50]
call fcn.14000c8c0
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov qword [rbp + 0x300], rsi
mov dword [rsp + 0x48], 0x61654806
mov word [rsp + 0x4c], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea rax, [rsp + 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c3d0
lea rdx, [rsp + 0x49]
lea rcx, [rbp + 0x50]
call fcn.14000c8c0
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x60], 0x7070556f
mov dword [rbp - 0x5c], 0x6f547265
mov dword [rbp - 0x58], 0x6f7372
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c440
lea rdx, [rbp - 0x5f]
lea rcx, [rbp + 0x90]
call fcn.14000c8c0
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x50], 0x776f4c3c
mov dword [rbp - 0x4c], 0x6f547265
mov dword [rbp - 0x48], 0x6f7372
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rsi
lea rax, [rbp - 0x4f]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c4b0
lea rdx, [rbp - 0x4f]
lea rcx, [rbp + 0xb0]
call fcn.14000c8c0
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x10], 0x66654c2e
mov dword [rbp - 0xc], 0x70705574
mov dword [rbp - 8], 0x72417265
mov word [rbp - 4], 0x6d
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
lea rax, [rbp - 0xf]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c522
lea rdx, [rbp - 0xf]
lea rcx, [rbp + 0xd0]
call fcn.14000c8c0
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x40], 0x66654c6b
mov dword [rbp - 0x3c], 0x776f4c74
mov dword [rbp - 0x38], 0x72417265
mov word [rbp - 0x34], 0x6d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], rsi
lea rax, [rbp - 0x3f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c594
lea rdx, [rbp - 0x3f]
lea rcx, [rbp + 0xf0]
call fcn.14000c8c0
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rsp + 0x70], 0x66654c45
mov dword [rsp + 0x74], 0x6e614874
mov word [rsp + 0x78], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], rsi
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c603
lea rdx, [rsp + 0x71]
lea rcx, [rbp + 0x110]
call fcn.14000c8c0
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp + 0x10], 0x67695208
mov dword [rbp + 0x14], 0x70557468
mov dword [rbp + 0x18], 0x41726570
mov word [rbp + 0x1c], 0x6d72
mov byte [rbp + 0x1e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rsi
lea rax, [rbp + 0x11]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c680
lea rdx, [rbp + 0x11]
lea rcx, [rbp + 0x130]
call fcn.14000c8c0
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp + 0x20], 0x6769522a
mov dword [rbp + 0x24], 0x6f4c7468
mov dword [rbp + 0x28], 0x41726577
mov word [rbp + 0x2c], 0x6d72
mov byte [rbp + 0x2e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], rsi
lea rax, [rbp + 0x21]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c6f6
lea rdx, [rbp + 0x21]
lea rcx, [rbp + 0x150]
call fcn.14000c8c0
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x80], 0x67695208
mov dword [rbp - 0x7c], 0x61487468
mov word [rbp - 0x78], 0x646e
mov byte [rbp - 0x76], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rsi
lea rax, [rbp - 0x7f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c765
lea rdx, [rbp - 0x7f]
lea rcx, [rbp + 0x170]
call fcn.14000c8c0
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x30], 0x66654c4b
mov dword [rbp - 0x2c], 0x70705574
mov dword [rbp - 0x28], 0x654c7265
mov word [rbp - 0x24], 0x67
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a8], rsi
lea rax, [rbp - 0x2f]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c7e0
lea rdx, [rbp - 0x2f]
lea rcx, [rbp + 0x190]
call fcn.14000c8c0
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x20], 0x66654c7c
mov dword [rbp - 0x1c], 0x776f4c74
mov dword [rbp - 0x18], 0x654c7265
mov word [rbp - 0x14], 0x67
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], rsi
lea rax, [rbp - 0x1f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c852
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0x1b0]
call fcn.14000c8c0
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rsp + 0x50], 0x66654c6a
mov dword [rsp + 0x54], 0x6f6f4674
mov word [rsp + 0x58], 0x74
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rsi
lea rax, [rsp + 0x51]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c8c1
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1d0]
call fcn.14000c8c0
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp + 0x30], 0x67695245
mov dword [rbp + 0x34], 0x70557468
mov dword [rbp + 0x38], 0x4c726570
mov word [rbp + 0x3c], 0x6765
mov byte [rbp + 0x3e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], rsi
lea rax, [rbp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c940
lea rdx, [rbp + 0x31]
lea rcx, [rbp + 0x1f0]
call fcn.14000c8c0
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp], 0x6769527c
mov dword [rbp + 4], 0x6f4c7468
mov dword [rbp + 8], 0x4c726577
mov word [rbp + 0xc], 0x6765
mov byte [rbp + 0xe], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], rsi
lea rax, [rbp + 1]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c9b6
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x210]
call fcn.14000c8c0
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
mov dword [rbp - 0x70], 0x6769524f
mov dword [rbp - 0x6c], 0x6f467468
mov word [rbp - 0x68], 0x746f
mov byte [rbp - 0x66], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], rsi
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009ca25
lea rdx, [rbp - 0x6f]
lea rcx, [rbp + 0x230]
call fcn.14000c8c0
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x2d8]
call fcn.140087a60
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2f8], xmm0
mov qword [rbp + 0x308], rsi
mov ecx, 0x78
call fcn.1401136b0
mov qword [rbp + 0x2f8], rax
mov qword [rbp + 0x300], rax
lea r14, [rax + 0x78]
mov qword [rbp + 0x308], r14
mov r8d, 0x78
lea rdx, [rbp + 0x250]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x300], r14
mov rsi, qword [rbp + 0x2f8]
cmp rsi, r14
je 0x14009cbfd
nop word [rax + rax]
mov rbx, qword [rsi]
test rbx, rbx
je 0x14009cbe9
lea rdx, [rbx + 0x158]
call fcn.140089b20
lea r8, [rax + 0x140]
lea rdx, [rbp + 0x2e8]
call fcn.14008a160
movsd xmm0, qword [rbp + 0x2e8]
movsd qword [rbp + 0x70], xmm0
mov eax, dword [rbp + 0x2f0]
mov dword [rbp + 0x78], eax
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x48]
call fcn.140087d50
movss xmm6, dword [rbp + 0x48]
comiss xmm9, xmm6
ja 0x14009cbe9
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
ja 0x14009cbe9
movss xmm6, dword [rbp + 0x4c]
comiss xmm9, xmm6
ja 0x14009cbe9
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
ja 0x14009cbe9
movsd xmm0, qword [rbp + 0x2e8]
movsd qword [rbp + 0x80], xmm0
mov eax, dword [rbp + 0x2f0]
mov dword [rbp + 0x88], eax
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x40]
call fcn.140087d50
movss xmm6, dword [rbp + 0x40]
subss xmm6, xmm11
movss xmm0, dword [rbp + 0x44]
subss xmm0, xmm12
cvtps2pd xmm0, xmm0
movaps xmm1, xmm10
call fcn.140114937
movaps xmm7, xmm0
cvtps2pd xmm0, xmm6
movaps xmm1, xmm10
call fcn.140114937
addsd xmm7, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm7
ja 0x14009cbd0
xorps xmm0, xmm0
sqrtsd xmm0, xmm7
jmp 0x14009cbd8
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
cvtsd2ss xmm0, xmm0
comiss xmm8, xmm0
jbe 0x14009cbe9
mov rdi, rbx
movaps xmm8, xmm0
add rsi, 8
cmp rsi, r14
jne 0x14009cac0
mov rsi, qword [rbp + 0x2f8]
test rsi, rsi
je 0x14009cc41
mov rax, qword [rbp + 0x308]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14009cc39
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009cc92
mov rcx, rsi
call fcn.140113934
xor esi, esi
add r15, 8
cmp r15, r12
jne 0x14009c1f0
mov r15, qword [rbp + 0x360]
test r15, r15
je 0x14009cca1
mov rdx, qword [rbp + 0x370]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x14009cc99
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009cc99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r15
call fcn.140113934
mov rax, rdi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140113570
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret