Function at 0x14000c850
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x1d0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov rax, qword [0x1400ab088]
xor rax, rsp
mov qword [rsp + 0x1c8], rax
mov dword [r11 - 0x30], 0x746b7d5c
mov dword [r11 - 0x2c], 0x2c2e707e
mov dword [r11 - 0x28], 0x4e4d4431
xor eax, eax
mov byte [r11 - 0x24], al
xor ebx, ebx
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x1a8]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000c8b0
mov byte [rsp + 0x1b4], bl
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r14, rax
test rax, rax
jne 0x14000c901
lea rcx, [rsp + 0x1a8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x14000d53f
mov dword [rsp + 0x168], 0x747c6858
mov dword [rsp + 0x16c], 0x7d726e4b
mov dword [rsp + 0x170], 0x52537a
mov edx, ebx
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xb
jb 0x14000c930
mov byte [rsp + 0x173], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14000c980
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b04f0], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000ca12
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ca0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d561
call fcn.1400357d4
test sil, sil
jne 0x14000d567
movdqa xmm0, xmmword [str.TjoyIqpLIGOT]
movdqu xmmword [rsp + 0x168], xmm0
mov dword [rsp + 0x178], 0x5a484674
mov dword [rsp + 0x17c], 0x5a424458
xor eax, eax
mov byte [rsp + 0x180], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x18
jb 0x14000ca50
mov byte [rsp + 0x180], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000ca94
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0528], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000cb26
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cb21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d589
call fcn.1400357d4
test sil, sil
jne 0x14000d58f
movdqa xmm0, xmmword [str.Gjvyon__fHPPPr]
movdqu xmmword [rsp + 0x168], xmm0
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x14000cb42
mov byte [rsp + 0x177], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000cb86
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0530], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000cc18
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cc13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d5b1
call fcn.1400357d4
test sil, sil
jne 0x14000d5b7
mov dword [rsp + 0x168], 0x79766a47
mov dword [rsp + 0x16c], 0x2d6e6f7e
mov dword [rsp + 0x170], 0x5a446e2d
mov word [rsp + 0x174], 0x7357
xor eax, eax
mov byte [rsp + 0x176], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000cc60
mov byte [rsp + 0x176], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000cca4
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0538], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000cd36
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cd31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d5d9
call fcn.1400357d4
test sil, sil
jne 0x14000d5df
mov dword [rsp + 0x168], 0x6f7d775a
mov dword [rsp + 0x16c], 0x2c2e7977
mov dword [rsp + 0x170], 0x51534959
mov word [rsp + 0x174], 0x7357
xor eax, eax
mov byte [rsp + 0x176], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xe
jb 0x14000cd80
mov byte [rsp + 0x176], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000cdc4
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0540], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000ce56
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ce51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d607
call fcn.1400357d4
test sil, sil
jne 0x14000d60d
mov dword [rsp + 0x168], 0x6f7d775a
mov dword [rsp + 0x16c], 0x2c2e7977
mov dword [rsp + 0x170], 0x56594551
mov word [rsp + 0x174], 0x74
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xd
jb 0x14000ce90
mov byte [rsp + 0x175], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000ced4
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0548], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000cf66
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000cf61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d635
call fcn.1400357d4
test sil, sil
jne 0x14000d63b
movdqa xmm0, xmmword [0x140097250]
movdqu xmmword [rsp + 0x168], xmm0
mov dword [rsp + 0x178], 0x63505a48
mov dword [rsp + 0x17c], 0x424a45
mov edx, ebx
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x17
jb 0x14000cfa0
mov byte [rsp + 0x17f], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000cfe4
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0550], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000d076
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d071
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d663
call fcn.1400357d4
test sil, sil
jne 0x14000d669
movdqa xmm0, xmmword [str.SosxyTqOOVQKI]
movdqu xmmword [rsp + 0x168], xmm0
mov edx, ebx
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xf
jb 0x14000d092
mov byte [rsp + 0x177], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000d0d6
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0560], rax
test rax, rax
sete sil
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000d168
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d163
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d691
call fcn.1400357d4
test sil, sil
jne 0x14000d697
mov dword [rsp + 0x1b8], 0x7b6f7c56
mov dword [rsp + 0x1bc], 0x2c2e756b
mov dword [rsp + 0x1c0], 0x4e4d4431
xor eax, eax
mov byte [rsp + 0x1c4], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x1b8]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0xc
jb 0x14000d1a0
mov byte [rsp + 0x1c4], bl
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
jne 0x14000d1f1
lea rcx, [rsp + 0x1b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14000d6bf
movdqa xmm0, xmmword [0x140097230]
movdqu xmmword [rsp + 0x168], xmm0
xor eax, eax
mov byte [rsp + 0x178], al
mov edx, ebx
nop dword [rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x10
jb 0x14000d210
mov byte [rsp + 0x178], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000d254
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0568], rax
test rax, rax
sete r14b
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000d2e6
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d2e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d6e7
call fcn.1400357d4
test r14b, r14b
jne 0x14000d6ed
movdqa xmm0, xmmword [0x140097260]
movdqu xmmword [rsp + 0x168], xmm0
mov dword [rsp + 0x178], 0x4f4e4d4b
mov word [rsp + 0x17c], 0x58
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rdx + 0x17]
xor byte [rcx], al
inc edx
cmp edx, 0x15
jb 0x14000d320
mov byte [rsp + 0x17d], bl
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], bl
lea rax, [rsp + 0x168]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x14000d364
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0578], rax
test rax, rax
sete r14b
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000d3f6
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d3f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d715
call fcn.1400357d4
test r14b, r14b
jne 0x14000d71b
movdqa xmm0, xmmword [0x140097290]
movdqu xmmword [rsp + 0x168], xmm0
mov dword [rsp + 0x178], 0x4f5c4446
mov word [rsp + 0x17c], 0x7c
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rsp + 0x168]
add rcx, rax
lea eax, [rbx + 0x17]
xor byte [rcx], al
inc ebx
cmp ebx, 0x15
jb 0x14000d430
mov byte [rsp + 0x17d], 0
movdqa xmm0, xmmword [0x1400971d0]
movdqu xmmword [rsp + 0x198], xmm0
mov byte [rsp + 0x188], 0
lea rax, [rsp + 0x168]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000d473
mov r8, rdi
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x188]
call fcn.140002320
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0x10
cmovae rdx, qword [rsp + 0x188]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400b0570], rax
test rax, rax
sete bl
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0x10
jb 0x14000d507
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000d743
call fcn.1400357d4
test bl, bl
jne 0x14000d749
mov al, 1
jmp 0x14000d515
mov rcx, qword [rsp + 0x1c8]
xor rcx, rsp
call fcn.1400357b0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
lea rdx, str.dll_1__not_found.
lea rcx, [rsp + 0x30]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x30]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_1.
lea rcx, [rsp + 0x48]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x48]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_8.
lea rcx, [rsp + 0x60]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x60]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_9.
lea rcx, [rsp + 0x78]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x78]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_10.
lea rcx, [rsp + 0x90]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x90]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_11.
lea rcx, [rsp + 0xa8]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0xa8]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_12.
lea rcx, [rsp + 0xc0]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0xc0]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_13.
lea rcx, [rsp + 0xd8]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0xd8]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_15.
lea rcx, [rsp + 0xf0]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0xf0]
call fcn.140053b84
lea rdx, str.dll_2__not_found.
lea rcx, [rsp + 0x108]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x108]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_a1.
lea rcx, [rsp + 0x120]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x120]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_a3.
lea rcx, [rsp + 0x138]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x138]
call fcn.140053b84
call fcn.140056d64
int3
lea rdx, str.Cannot_find_function_a2.
lea rcx, [rsp + 0x150]
call fcn.140001150
lea rdx, [0x1400a9060]
lea rcx, [rsp + 0x150]
call fcn.140053b84
int3