Function at 0x1400495f0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push rbp
push rsi
push r13
push r14
lea rbp, [rsp - 0x5e8]
sub rsp, 0x6e8
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov r13d, edx
mov rsi, r8
mov qword [rbp + 0x5a0], rcx
mov r14, rcx
test rcx, rcx
je 0x14004964a
xor ecx, ecx
mov r8d, ecx
test edx, edx
je 0x14004964a
mov rax, r14
cmp qword [rax], 0xffffffffffffffff
jne 0x140049657
inc r8d
add rax, 0x10
cmp r8d, r13d
jb 0x140049638
mov rcx, rsi
call fcn.140049430
jmp 0x140049816
mov qword [rsp + 0x718], rbx
mov r9d, ecx
mov qword [rsp + 0x6e0], rdi
mov r10d, ecx
mov qword [rsp + 0x6d8], r12
mov r8d, ecx
mov r12, 0xffffffffffffffff
mov qword [rsp + 0x6d0], r15
mov r15, r12
mov dword [rsp + 0x30], ecx
mov dword [rbp + 0x140], ecx
mov edi, ecx
mov dword [rbp + 0x350], ecx
mov rbx, r14
mov eax, 0x710
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rbx]
mov word [rbx + 0xa], cx
cmp rdx, r12
je 0x1400497c0
jae 0x1400497ee
movzx r11d, word [rbx + 8]
test ax, r11w
je 0x1400497c0
cmp rdx, r15
mov rax, rdx
cmovbe rax, r15
mov r15, rax
mov eax, 0x300
test ax, r11w
je 0x140049723
test r9d, r9d
je 0x140049702
mov eax, ecx
cmp qword [rsp + rax*8 + 0x38], rdx
je 0x140049702
inc ecx
cmp ecx, r9d
jb 0x1400496f2
cmp ecx, r9d
jne 0x140049721
cmp r9d, 0x40
jae 0x140049721
mov eax, ecx
mov qword [rsp + rax*8 + 0x38], rdx
mov r9d, dword [rsp + 0x30]
inc r9d
mov dword [rsp + 0x30], r9d
xor ecx, ecx
test r11b, 0x10
je 0x140049769
test r10d, r10d
je 0x140049743
nop
mov eax, ecx
cmp qword [rbp + rax*8 + 0x148], rdx
je 0x140049743
inc ecx
cmp ecx, r10d
jb 0x140049730
cmp ecx, r10d
jne 0x140049769
cmp r10d, 0x40
jae 0x140049769
mov eax, ecx
mov qword [rbp + rax*8 + 0x148], rdx
mov r10d, dword [rbp + 0x140]
inc r10d
mov dword [rbp + 0x140], r10d
mov eax, 0x600
test ax, r11w
je 0x1400497b9
xor eax, eax
mov ecx, eax
test r8d, r8d
je 0x140049793
nop dword [rax]
mov eax, ecx
cmp qword [rbp + rax*8 + 0x358], rdx
je 0x140049793
inc ecx
cmp ecx, r8d
jb 0x140049780
cmp ecx, r8d
jne 0x1400497b9
cmp r8d, 0x40
jae 0x1400497b9
mov eax, ecx
mov qword [rbp + rax*8 + 0x358], rdx
mov r8d, dword [rbp + 0x350]
inc r8d
mov dword [rbp + 0x350], r8d
mov eax, 0x710
xor ecx, ecx
inc edi
add rbx, 0x10
cmp edi, r13d
jb 0x1400496b0
test r9d, r9d
jne 0x140049833
test r10d, r10d
jne 0x140049833
test r8d, r8d
jne 0x140049833
mov rcx, rsi
call fcn.140049430
mov r12d, eax
jmp 0x14004996d
call fcn.1400493a0
mov eax, r12d
mov r12, qword [rsp + 0x6d8]
mov rdi, qword [rsp + 0x6e0]
mov rbx, qword [rsp + 0x718]
mov r15, qword [rsp + 0x6d0]
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x6e8
pop r14
pop r13
pop rsi
pop rbp
ret
test rsi, rsi
jns 0x14004983d
mov rbx, rcx
jmp 0x14004989b
jle 0x140049889
mov rcx, rsi
movabs rax, 0x624dd2f1a9fbe77
mul rsi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov edx, 0x7fffffff
shr rcx, 9
imul rax, rcx, 0x3e8
sub rsi, rax
imul rax, rsi, 0x3e8
cmp rcx, rdx
mov dword [rbp + 0x594], eax
cmovg rcx, rdx
mov dword [rbp + 0x590], ecx
xor ecx, ecx
jmp 0x140049894
mov qword [rbp + 0x590], 0
lea rbx, [rbp + 0x590]
test r8d, r8d
mov word [rbp + 0x562], 0x5f32
lea rdi, [rbp + 0x350]
mov word [rbp + 0x565], 0x2e32
cmove rdi, rcx
mov word [rbp + 0x560], 0x7357
test r10d, r10d
mov word [rbp + 0x568], 0x6c6c
lea rsi, [rbp + 0x140]
mov byte [rbp + 0x564], 0x33
cmove rsi, rcx
mov byte [rbp + 0x56a], 0
test r9d, r9d
mov byte [rbp + 0x567], 0x64
lea r14, [rsp + 0x30]
cmove r14, rcx
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140049920
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140049966
lea rdx, [rbp + 0x580]
mov dword [rbp + 0x582], 0x7463656c
mov rcx, rax
mov word [rbp + 0x580], 0x6573
mov byte [rbp + 0x586], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049966
lea ecx, [r15 + 1]
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, rsi
mov rdx, r14
call rax
mov r12d, eax
mov r14, qword [rbp + 0x5a0]
test r12d, r12d
jg 0x140049a3f
cmp r12d, 0xffffffff
jne 0x1400497f3
lea rcx, [rbp + 0x560]
mov word [rbp + 0x562], 0x5f32
mov word [rbp + 0x565], 0x2e32
mov word [rbp + 0x560], 0x7357
mov word [rbp + 0x568], 0x6c6c
mov byte [rbp + 0x564], 0x33
mov byte [rbp + 0x56a], 0
mov byte [rbp + 0x567], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1400499e1
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400497f3
lea rdx, [rbp + 0x570]
mov dword [rbp + 0x57a], 0x6f727245
mov rcx, rax
mov dword [rbp + 0x570], 0x47415357
mov dword [rbp + 0x576], 0x7473614c
mov word [rbp + 0x57e], 0x72
mov word [rbp + 0x574], 0x7465
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400497f3
call rax
cmp eax, 0x2714
mov eax, 0
cmove r12d, eax
jmp 0x1400497f3
xor eax, eax
lea rbx, [r14 + 0xa]
mov r14, r13
mov esi, eax
mov r13d, 0x100
mov r15d, 0x200
mov r12d, 0x400
nop dword [rax]
mov rdi, qword [rbx - 0xa]
mov word [rbx], ax
cmp rdi, 0xffffffffffffffff
je 0x140049cd1
lea rcx, [rbp + 0x560]
mov word [rbp + 0x562], 0x5f32
mov word [rbp + 0x565], 0x2e32
mov word [rbp + 0x560], 0x7357
mov word [rbp + 0x568], 0x6c6c
mov byte [rbp + 0x564], 0x33
mov byte [rbp + 0x56a], 0
mov byte [rbp + 0x567], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140049ace
lea rcx, [rbp + 0x560]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140049b39
lea rdx, [rbp + 0x580]
mov dword [rbp + 0x580], 0x53575f5f
mov rcx, rax
mov word [rbp + 0x587], 0x7349
mov word [rbp + 0x584], 0x4641
mov dword [rbp + 0x589], 0x746553
mov byte [rbp + 0x586], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049b39
lea rdx, [rsp + 0x30]
mov rcx, rdi
call rax
test eax, eax
je 0x140049b39
movzx eax, word [rbx - 2]
test r13w, ax
je 0x140049b2c
or word [rbx], r13w
mov ecx, 0x300
test cx, ax
je 0x140049b39
or word [rbx], cx
mov rdi, qword [rbx - 0xa]
lea rcx, [rbp + 0x5a0]
mov word [rbp + 0x5a2], 0x5f32
mov word [rbp + 0x5a5], 0x2e32
mov word [rbp + 0x5a0], 0x7357
mov word [rbp + 0x5a8], 0x6c6c
mov byte [rbp + 0x5a4], 0x33
mov byte [rbp + 0x5aa], 0
mov byte [rbp + 0x5a7], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140049b9a
lea rcx, [rbp + 0x5a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140049bf6
lea rdx, [rbp + 0x5b0]
mov dword [rbp + 0x5b0], 0x53575f5f
mov rcx, rax
mov word [rbp + 0x5b7], 0x7349
mov word [rbp + 0x5b4], 0x4641
mov dword [rbp + 0x5b9], 0x746553
mov byte [rbp + 0x5b6], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049bf6
lea rdx, [rbp + 0x140]
mov rcx, rdi
call rax
test eax, eax
je 0x140049bf6
test byte [rbx - 2], 0x10
je 0x140049bf6
or word [rbx], 0x10
mov rdi, qword [rbx - 0xa]
lea rcx, [rbp + 0x590]
mov word [rbp + 0x592], 0x5f32
mov word [rbp + 0x595], 0x2e32
mov word [rbp + 0x590], 0x7357
mov word [rbp + 0x598], 0x6c6c
mov byte [rbp + 0x594], 0x33
mov byte [rbp + 0x59a], 0
mov byte [rbp + 0x597], 0x64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140049c57
lea rcx, [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140049cc7
lea rdx, [rbp + 0x570]
mov dword [rbp + 0x570], 0x53575f5f
mov rcx, rax
mov word [rbp + 0x577], 0x7349
mov word [rbp + 0x574], 0x4641
mov dword [rbp + 0x579], 0x746553
mov byte [rbp + 0x576], 0x44
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140049cc7
lea rdx, [rbp + 0x350]
mov rcx, rdi
call rax
test eax, eax
je 0x140049cc7
movzx ecx, word [rbx - 2]
test r15w, cx
je 0x140049cb7
or word [rbx], r15w
movzx eax, word [rbx]
test r12w, cx
je 0x140049cc7
or ax, r12w
mov word [rbx], ax
cmp word [rbx], 0
je 0x140049ccf
inc esi
xor eax, eax
add rbx, 0x10
sub r14, 1
jne 0x140049a60
mov eax, esi
jmp 0x1400497f6