Function at 0x4021d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
movabs rax, 0x3233697061766461
lea r12, [rsp + 0x70]
mov rbx, rcx
mov rbp, rdx
mov r14, r8
mov qword [rsp + 0xa0], rax
mov rcx, r12
mov r13d, r9d
movabs rax, 0x6572437470797243
lea r15, [rsp + 0x90]
mov qword [rsp + 0x80], rax
lea rsi, [rsp + 0xa0]
mov eax, 0x7361
lea rdi, [rsp + 0x80]
mov rdx, r15
mov qword [rsp + 0x90], rsi
mov dword [rsp + 0xa8], 0x6c6c642e
mov qword [rsp + 0x98], 0xc
mov byte [rsp + 0xac], 0
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x88], 0x48657461
mov word [rsp + 0x8c], ax
mov byte [rsp + 0x8e], 0x68
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x8f], 0
call fcn.00405b10
lea rdx, [rsp + 0x60]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov edx, 0x8004
call rax
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x4022c2
call fcn.004bee60
mov rcx, qword [rsp + 0x90]
cmp rcx, rsi
je 0x4022d4
call fcn.004bee60
mov rcx, qword [rbx + 0x20]
add rcx, qword [rbx + 0x28]
call fcn.004beeb0
mov qword [rsp + 0x30], r14
mov r9d, dword [rbp + 8]
mov r8d, 0x3e8
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
mov edx, 0x40
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x20]
add eax, dword [rbx + 0x28]
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x38], eax
mov rax, qword [rbp]
mov qword [rsp + 0x20], rax
call fcn.00402f70
mov r10, qword [rsp + 0x58]
test eax, eax
jne 0x402454
mov rax, qword [rbx + 0x28]
mov qword [rbx + 8], r10
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x90], rsi
shr rax, 3
mov byte [rsp + 0xac], 0
add r10, rax
mov qword [rsp + 0x70], rdi
movabs rax, 0x3233697061766461
mov qword [rbx + 0x10], r10
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0x6c6c642e
mov qword [rsp + 0x98], 0xc
mov qword [rsp + 0x68], 0x10
call fcn.004abbf0
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
movabs rcx, 0x68736148796f7274
mov qword [rsp + 0x80], rdx
movabs rdx, 0x7365447470797243
mov qword [rax + 8], rcx
mov rcx, r12
mov qword [rax], rdx
mov rax, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov byte [rdx + rax], 0
mov rdx, r15
call fcn.00405b10
mov rcx, qword [rsp + 0x60]
call rax
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x4023fa
call fcn.004bee60
mov rcx, qword [rsp + 0x90]
cmp rcx, rsi
je 0x40240d
call fcn.004bee60
nop
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.004c0290
nop
nop word [rax + rax]
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov rsi, qword [rcx + 0x28]
mov rdi, qword [rcx + 0x30]
shr rsi, 3
mov rbx, rcx
lea ecx, [rsi + 0xc]
lea r14, [rsp + 0x60]
mov dword [rsp + 0x34], 1
mov rbp, rcx
lea r13, [rsp + 0x40]
call fcn.004beeb0
mov rdx, qword [rbx + 8]
mov r8d, esi
mov r12, rax
lea rcx, [rax + 0xc]
call sub.msvcrt.dll_memcpy
mov dword [r12 + 8], esi
mov rdx, r14
mov rcx, r13
mov dword [r12], 0x208
mov eax, dword [rdi]
lea rsi, [rsp + 0x70]
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x60], rsi
mov dword [r12 + 4], eax
movabs rax, 0x3233697061766461
mov qword [rsp + 0x70], rax
movabs rax, 0x706d497470797243
mov qword [rsp + 0x50], rax
mov eax, 0x7965
mov dword [rsp + 0x78], 0x6c6c642e
mov qword [rsp + 0x68], 0xc
mov byte [rsp + 0x7c], 0
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x58], 0x4b74726f
mov word [rsp + 0x5c], ax
mov qword [rsp + 0x48], 0xe
mov byte [rsp + 0x5e], 0
call fcn.00405b10
lea rdx, [rbx + 0x38]
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov r8d, ebp
mov qword [rsp + 0x28], rdx
mov rdx, r12
mov dword [rsp + 0x20], 0
call rax
mov rcx, qword [rsp + 0x40]
mov ebp, eax
cmp rcx, rdi
je 0x40256a
call fcn.004bee60
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x402579
call fcn.004bee60
test ebp, ebp
je 0x402764
lea r15, [rsp + 0x38]
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x60], rsi
movabs rax, 0x3233697061766461
mov rdx, r15
mov dword [rsp + 0x78], 0x6c6c642e
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], 0xc
mov byte [rsp + 0x7c], 0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], 0x10
call fcn.004abbf0
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs rcx, 0x6d6172615079654b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7465537470797243
mov qword [rax + 8], rcx
mov rcx, r13
mov qword [rax], rdx
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov byte [rdx + rax], 0
mov rdx, r14
call fcn.00405b10
mov rcx, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
xor r9d, r9d
mov edx, 1
call rax
mov rcx, qword [rsp + 0x40]
mov ebp, eax
cmp rcx, rdi
je 0x402637
call fcn.004bee60
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x402646
call fcn.004bee60
test ebp, ebp
je 0x402764
xor r8d, r8d
mov rdx, r15
mov rcx, r13
mov qword [rsp + 0x60], rsi
movabs rax, 0x3233697061766461
mov dword [rsp + 0x78], 0x6c6c642e
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], 0xc
mov byte [rsp + 0x7c], 0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], 0x10
call fcn.004abbf0
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs rcx, 0x6d6172615079654b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7465537470797243
mov qword [rax + 8], rcx
mov rcx, r13
mov qword [rax], rdx
mov rax, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov byte [rdx + rax], 0
mov rdx, r14
call fcn.00405b10
mov rcx, qword [rbx + 0x38]
xor r9d, r9d
lea r8, [rsp + 0x34]
mov edx, 4
call rax
mov rcx, qword [rsp + 0x40]
mov ebx, eax
cmp rcx, rdi
je 0x402700
call fcn.004bee60
mov rcx, qword [rsp + 0x60]
cmp rcx, rsi
je 0x40270f
call fcn.004bee60
test ebx, ebx
je 0x402764
mov rcx, r12
call fcn.004bee60
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.004c0290
nop
nop word [rax + rax]