Function at 0x1400782a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f8]
sub rsp, 0x4f8
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r14, r9
mov esi, r8d
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rcx
mov qword [rbp + 0x110], rdx
mov rax, qword [rbp + 0x460]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x118], rax
mov r15d, dword [rbp + 0x468]
mov r13, qword [rbp + 0x470]
mov qword [rbp + 0x120], r13
mov r12, qword [rbp + 0x478]
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov dword [rbp + 0x128], 0x203e2d20
mov byte [rbp + 0x12c], bl
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x67697254
mov dword [rsp + 0x4c], 0x45726567
mov dword [rsp + 0x50], 0x746e6576
mov byte [rsp + 0x54], bl
lea r8, [rbp + 0x128]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.14005ecc0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x2b8]
call fcn.14005f8a0
mov dword [rbp + 0x128], 0x202d3c20
mov byte [rbp + 0x12c], bl
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x67697254
mov dword [rsp + 0x4c], 0x45726567
mov dword [rsp + 0x50], 0x746e6576
mov byte [rsp + 0x54], bl
lea r8, [rbp + 0x128]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.14005ecc0
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.14005f8a0
mov rdi, qword [0x1400fbc38]
mov qword [rbp - 0x48], rbx
lea rax, [rbp + 0x290]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rbx
mov rax, qword [rdi]
lea rbx, [0x1400e01eb]
cmp dword [rax], 0
je 0x140078452
mov qword [rbp + 0x128], 0
lea rcx, [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x128]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14007c440
nop
cmp byte [0x1400fbd18], 0
jne 0x140078468
test byte [0x1400fb900], 0x10
je 0x140078ea8
mov ecx, dword [0x1400fb894]
mov rax, qword gs:[0x58]
mov edx, 0xb4
add rdx, qword [rax + rcx*8]
mov qword [rbp + 0x128], rdx
cmp byte [rdx], 0
jne 0x140078ea8
mov byte [rdx], 1
mov qword [rbp - 0x28], rdx
mov byte [rbp - 0x20], 1
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x2e0]
call fcn.14009ba90
mov edx, 1
lea rcx, [rbp + 0x2e0]
call fcn.14006a900
nop
lea rdx, [0x1400d1508]
lea rcx, [rbp + 0x2f0]
call fcn.14005d6c0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, esi
mov rcx, rax
call fcn.14006cc40
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140078517
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400877d0
nop
mov edi, 1
xor esi, esi
jmp 0x140078550
xor esi, esi
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xf
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x130]
call fcn.140004810
lea rax, [rbp + 0x130]
mov edi, 2
mov dword [rsp + 0x58], edi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
test dil, 2
je 0x1400785c7
and edi, 0xfffffffd
mov dword [rsp + 0x58], edi
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400785c7
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400785c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078ef7
call fcn.14005be00
nop
test dil, 1
je 0x140078624
and edi, 0xfffffffe
mov dword [rsp + 0x58], edi
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140078611
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007860c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078efd
call fcn.14005be00
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp r15d, 2
jne 0x140078661
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
lea r8d, [r15 + 5]
lea rdx, str.UNKNOWN
lea rcx, [rsp + 0x38]
call fcn.140004810
lea rax, [rsp + 0x38]
or edi, 4
jmp 0x140078681
mov rax, qword [rbp - 0x58]
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140078672
mov rdx, qword [rax]
lea rcx, [rbp + 0x130]
call fcn.1400877d0
or edi, 8
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
test dil, 8
je 0x140078708
and edi, 0xfffffff7
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400786ef
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400786ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f03
call fcn.14005be00
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
test dil, 4
je 0x14007874f
and edi, 0xfffffffb
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14007874f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f09
call fcn.14005be00
nop
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
or edi, 0x20
mov dword [rsp + 0x58], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp + 0x368]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x1400787c1
mov rax, qword [rbp + 0x338]
mov r8, qword [rax]
test r8, r8
je 0x1400787c1
mov rax, qword [rbp + 0x318]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x360]
cmovb r8, qword [rbp + 0x360]
sub r8, rdx
jmp 0x1400787fb
test cl, 4
jne 0x1400787f1
mov rax, qword [rbp + 0x330]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400787f1
mov rax, qword [rbp + 0x310]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x348]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x1400787fb
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x14007880c
lea rcx, [rbp + 0x130]
call fcn.140004810
and edi, 0xffffffdf
or edi, 0x10
test r14, r14
cmovne rbx, r14
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140078840
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140004810
nop
mov ecx, r15d
call fcn.14006de00
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], bl
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140078880
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140004810
nop
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0x10
cmovae rdx, qword [rbp + 0x150]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400788d0
lea rcx, [rsp + 0x38]
call fcn.140004810
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x190]
call fcn.140004230
nop
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x1b0]
call fcn.140004230
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x1d0]
call fcn.140004230
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1f0]
call fcn.140004230
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x210]
call fcn.140004230
mov qword [rbp + 0x230], rbx
movdqa xmm0, xmmword [0x1400e3040]
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
mov qword [rbp + 0x250], rbx
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
mov qword [rbp + 0x270], rbx
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x1400789c9
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400789c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f0f
call fcn.14005be00
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140078a05
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400789ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f15
call fcn.14005be00
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140078a43
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078a3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f1b
call fcn.14005be00
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140078a84
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078a7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f21
call fcn.14005be00
lea rax, [rbp + 0x270]
cmp rax, r13
je 0x140078aae
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x140078a9e
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
lea rcx, [rbp + 0x270]
call fcn.140004810
test r12, r12
je 0x140078ac2
mov rdx, r12
lea rcx, [rbp + 0x190]
call fcn.1400776c0
mov r15, qword [rbp - 0x80]
cmp qword [r15 + 0x10], 0
jbe 0x140078dd2
mov r8d, 0xd
lea rdx, str.loaded_dlls:
lea rcx, [rbp + 0x270]
call fcn.140004810
mov r14, qword [r15 + 8]
mov rbx, qword [r14]
xor r12d, r12d
cmp rbx, r14
je 0x140078c6b
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x130]
call fcn.1400130f0
nop
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rdx, qword [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.1400877d0
or edi, 0x40
mov r8d, 1
lea rdx, [0x1400d1520]
lea rcx, [rbp - 0x78]
call fcn.140014900
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts edi, 7
lea rdx, [rsp + 0x60]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x270]
call fcn.140014900
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140078bdb
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078bd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f27
call fcn.14005be00
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140078c17
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078c11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f2d
call fcn.14005be00
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x140078c5d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078c58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f33
call fcn.14005be00
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jmp 0x140078af7
mov rax, qword [rbp - 0x50]
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140078c70
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400043e0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.14002acd0
nop
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1400130f0
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.140097370
nop
mov r8, rax
lea rdx, [0x1400d1524]
lea rcx, [rsp + 0x38]
call int.140004c20
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140078cf7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140014900
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140078d44
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078d3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f39
call fcn.14005be00
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov r8, qword [rbp - 0x60]
cmp r8, 0x10
jb 0x140078d71
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140004b50
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov r8, qword [rbp + 0x148]
cmp r8, 8
jb 0x140078da4
inc r8
mov rdx, qword [rbp + 0x130]
lea rcx, [rbp + 0x130]
call fcn.140004640
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], r12w
lea rcx, [rbp - 0x18]
call fcn.140003e50
nop
lea rcx, [rsp + 0x60]
call fcn.140003e50
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x10]
call fcn.14006aff0
mov rcx, rax
call fcn.14006d980
nop
lea rcx, [rbp + 0x190]
call fcn.14006c5a0
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x140078e3a
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078e34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078f3f
call fcn.14005be00
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140078e78
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078e72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140078ef1
call fcn.14005be00
nop
lea rcx, [rbp + 0x2e0]
call fcn.14006d3b0
nop
mov rax, qword [rbp + 0x128]
mov byte [rax], 0
lea rcx, [rbp - 0x48]
call fcn.14006ca40
nop
mov rcx, qword [rbp - 0x58]
call fcn.140003e50
nop
mov rcx, r15
jmp 0x140078ec0
lea rcx, [rbp - 0x48]
call fcn.14006ca40
nop
mov rcx, qword [rbp - 0x58]
call fcn.140003e50
nop
mov rcx, qword [rbp - 0x80]
call fcn.14006bb10
nop
mov rcx, r13
call fcn.140004190
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14005bde0
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
nop
call fcn.1400a8018
int3