Function at 0x14004d8e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x200
xor r13d, r13d
mov r15d, r13d
mov dword [rsp + 0x240], r13d
lea rcx, [rsp + 0xf8]
call fcn.14004d530
nop
mov rbx, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0x100]
cmp rbx, rdi
je 0x14004e53c
mov rsi, rbx
mov qword [rsp + 0x258], rdi
mov r12d, 0x3523
mov qword [rsp + 0x248], rsi
cmp rsi, qword [rsp + 0x258]
je 0x14004e53c
mov dword [rsp + 0x58], 0x3541356e
mov dword [rsp + 0x5c], 0x35493548
mov dword [rsp + 0x60], 0x35513555
mov dword [rsp + 0x64], 0x357c3509
mov dword [rsp + 0x68], 0x35493542
mov dword [rsp + 0x6c], 0x354b355a
mov dword [rsp + 0x70], 0x355d
mov byte [rsp + 0x74], 1
mov rcx, r13
nop
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0x58], ax
inc rcx
cmp rcx, 0xd
jb 0x14004d990
mov byte [rsp + 0x74], 0
lea r8, [rsp + 0x72]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x1d0]
call fcn.140050e00
or r15d, 0x180
or r15d, 1
mov dword [rsp + 0x240], r15d
lea r14, [rsi + 0x20]
lea rdx, [rsp + 0x1d0]
mov rcx, r14
call fcn.140048d40
test al, al
jne 0x14004e2a8
mov dword [rsp + 0x20], 0x354c3560
mov dword [rsp + 0x24], 0x35473540
mov dword [rsp + 0x28], 0x35083553
mov dword [rsp + 0x2c], 0x3544356c
mov dword [rsp + 0x30], 0x3545354c
mov dword [rsp + 0x34], 0x354b3543
mov word [rsp + 0x38], r13w
mov byte [rsp + 0x3a], 1
mov rcx, r13
nop dword [rax + rax]
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0xc
jb 0x14004da30
mov byte [rsp + 0x3a], 0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x1b0]
call fcn.140050e00
or r15d, 0x600
or r15d, 2
mov dword [rsp + 0x240], r15d
lea rdx, [rsp + 0x1b0]
mov rcx, r14
call fcn.140048d40
test al, al
jne 0x14004e2a8
mov dword [rsp + 0xb2], 0x3541356e
mov dword [rsp + 0xb6], 0x35493548
mov dword [rsp + 0xba], 0x35513555
mov dword [rsp + 0xbe], 0x35583509
mov dword [rsp + 0xc2], 0x354b354e
mov dword [rsp + 0xc6], 0x35413544
mov dword [rsp + 0xca], 0x35433541
mov word [rsp + 0xce], r13w
mov byte [rsp + 0xd0], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0xb2], ax
inc rcx
cmp rcx, 0xe
jb 0x14004daf0
mov byte [rsp + 0xd0], 0
lea r8, [rsp + 0xce]
lea rdx, [rsp + 0xb2]
lea rcx, [rsp + 0x190]
call fcn.140050e00
or r15d, 0x1800
or r15d, 4
mov dword [rsp + 0x240], r15d
lea r11, [rsp + 0x190]
mov rcx, qword [rsp + 0x190]
mov qword [rsp + 0x250], rcx
cmp qword [rsp + 0x1a8], 7
cmova r11, rcx
mov rax, qword [r14 + 0x10]
mov rsi, r14
cmp qword [r14 + 0x18], 7
jbe 0x14004db73
mov rsi, qword [r14]
mov rbx, qword [rsp + 0x1a0]
cmp rbx, rax
ja 0x14004dca0
sub rax, rbx
test rbx, rbx
je 0x14004dc9b
lea rdi, [rax + 1]
lea rdi, [rsi + rdi*2]
mov rdx, rsi
movzx r10d, word [r11]
nop
mov rax, rdi
sub rax, rdx
sar rax, 1
mov rcx, r13
je 0x14004dbca
cmp word [rdx], r10w
je 0x14004dbc7
cmp rax, 1
je 0x14004dbca
dec rax
add rdx, 2
cmp word [rdx], r10w
jne 0x14004dbb4
mov rcx, rdx
mov rdx, rcx
test rcx, rcx
je 0x14004dca0
mov r8, rbx
mov rcx, r11
test rbx, rbx
je 0x14004dc08
mov r9, rdx
sub r9, r11
nop word [rax + rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14004dc92
add rcx, 2
sub r8, 1
jne 0x14004dbf0
sub rdx, rsi
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x14004dca0
mov rdi, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x248]
mov bl, 1
test r15b, 0x40
je 0x14004e2bb
and r15d, 0xffffffbf
mov dword [rsp + 0x240], r15d
mov rdx, qword [rsp + 0x128]
cmp rdx, 7
jbe 0x14004e2bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e2b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e2b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
add rdx, 2
jmp 0x14004dba0
mov rdi, rcx
jmp 0x14004dc20
mov dword [rsp + 0x76], 0x354b3564
mov dword [rsp + 0x7a], 0x35523505
mov dword [rsp + 0x7e], 0x35083548
mov dword [rsp + 0x82], 0x354e3568
mov dword [rsp + 0x86], 0x355e354f
mov dword [rsp + 0x8a], 0x355d3548
mov dword [rsp + 0x8e], 0x355c
mov byte [rsp + 0x92], 1
mov rcx, r13
nop
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0x76], ax
inc rcx
cmp rcx, 0xd
jb 0x14004dcf0
mov byte [rsp + 0x92], 0
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x76]
lea rcx, [rsp + 0x170]
call fcn.140050e00
or r15d, 0x6000
or r15d, 8
mov dword [rsp + 0x240], r15d
lea r11, [rsp + 0x170]
cmp qword [rsp + 0x188], 7
cmova r11, qword [rsp + 0x170]
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 7
jbe 0x14004dd5f
mov r14, qword [r14]
mov rbx, qword [rsp + 0x180]
cmp rbx, rax
ja 0x14004de08
sub rax, rbx
test rbx, rbx
je 0x14004dc18
lea rdi, [rax + 1]
lea rdi, [r14 + rdi*2]
mov rdx, r14
movzx r10d, word [r11]
nop dword [rax + rax]
mov rax, rdi
sub rax, rdx
sar rax, 1
mov rcx, r13
je 0x14004ddba
cmp word [rdx], r10w
je 0x14004ddb7
cmp rax, 1
je 0x14004ddba
dec rax
add rdx, 2
cmp word [rdx], r10w
jne 0x14004dda4
mov rcx, rdx
mov rdx, rcx
test rcx, rcx
je 0x14004de08
mov r8, rbx
mov rcx, r11
test rbx, rbx
je 0x14004ddf8
mov r9, rdx
sub r9, r11
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14004df69
add rcx, 2
sub r8, 1
jne 0x14004dde0
sub rdx, r14
sar rdx, 1
cmp rdx, 0xffffffffffffffff
jne 0x14004dc18
mov dword [rsp + 0x3c], 0x354d3567
mov dword [rsp + 0x40], 0x35553556
mov dword [rsp + 0x44], 0x354b3542
mov dword [rsp + 0x48], 0x350a355d
mov dword [rsp + 0x4c], 0x35433568
mov dword [rsp + 0x50], 0x354b3549
mov word [rsp + 0x54], r13w
mov byte [rsp + 0x56], 1
mov rcx, r13
nop word [rax + rax]
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0x3c], ax
inc rcx
cmp rcx, 0xc
jb 0x14004de50
mov byte [rsp + 0x56], 0
lea r8, [rsp + 0x54]
lea rdx, [rsp + 0x3c]
lea rcx, [rsp + 0x150]
call fcn.140050e00
or r15d, 0x18000
or r15d, 0x10
mov dword [rsp + 0x240], r15d
mov rsi, qword [rsp + 0x248]
lea rdi, [rsi + 0x20]
lea r11, [rsp + 0x150]
cmp qword [rsp + 0x168], 7
cmova r11, qword [rsp + 0x150]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004dec5
mov rdi, qword [rdi]
mov rbx, qword [rsp + 0x160]
cmp rbx, rax
ja 0x14004df83
sub rax, rbx
test rbx, rbx
je 0x14004df5c
lea rsi, [rax + 1]
lea rsi, [rdi + rsi*2]
mov rdx, rdi
movzx r10d, word [r11]
mov rax, rsi
sub rax, rdx
sar rax, 1
mov rcx, r13
je 0x14004df1b
cmp word [rdx], r10w
je 0x14004df18
cmp rax, 1
je 0x14004df1b
dec rax
add rdx, 2
cmp word [rdx], r10w
jne 0x14004df05
mov rcx, rdx
mov rdx, rcx
test rcx, rcx
je 0x14004df7b
mov r8, rbx
mov rcx, r11
test rbx, rbx
je 0x14004df48
mov r9, rdx
sub r9, r11
movzx eax, word [rcx + r9]
cmp ax, word [rcx]
jne 0x14004df72
add rcx, 2
sub r8, 1
jne 0x14004df34
sub rdx, rdi
sar rdx, 1
mov rsi, qword [rsp + 0x248]
cmp rdx, 0xffffffffffffffff
je 0x14004df83
mov rdi, qword [rsp + 0x250]
jmp 0x14004dc28
add rdx, 2
jmp 0x14004dd90
add rdx, 2
jmp 0x14004def1
mov rsi, qword [rsp + 0x248]
mov dword [rsp + 0xd2], 0x35413571
mov dword [rsp + 0xd6], 0x35433543
mov dword [rsp + 0xda], 0x354d3555
mov dword [rsp + 0xde], 0x35493547
mov dword [rsp + 0xe2], 0x350c354e
mov dword [rsp + 0xe6], 0x355a357e
mov dword [rsp + 0xea], 0x3559355d
mov dword [rsp + 0xee], 0x3555355f
mov dword [rsp + 0xf2], 0x3540
mov byte [rsp + 0xf6], 1
mov rcx, r13
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0xd2], ax
inc rcx
cmp rcx, 0x11
jb 0x14004dff1
mov byte [rsp + 0xf6], 0
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd2]
lea rcx, [rsp + 0x130]
call fcn.140050e00
or r15d, 0x60000
or r15d, 0x20
mov dword [rsp + 0x240], r15d
lea rdi, [rsi + 0x20]
lea r11, [rsp + 0x130]
cmp qword [rsp + 0x148], 7
cmova r11, qword [rsp + 0x130]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004e06a
mov rdi, qword [rdi]
mov rbx, qword [rsp + 0x140]
cmp rbx, rax
ja 0x14004e126
sub rax, rbx
test rbx, rbx
je 0x14004df5c
lea rsi, [rax + 1]
lea rsi, [rdi + rsi*2]
mov rdx, rdi
movzx r10d, word [r11]
nop word [rax + rax]
mov rax, rsi
sub rax, rdx
sar rax, 1
mov rcx, r13
je 0x14004e0ca
cmp word [rdx], r10w
je 0x14004e0c7
cmp rax, 1
je 0x14004e0ca
dec rax
add rdx, 2
cmp word [rdx], r10w
jne 0x14004e0b4
mov rcx, rdx
mov rdx, rcx
test rcx, rcx
je 0x14004e11e
mov r8, rbx
mov rcx, r11
test rbx, rbx
je 0x14004e0f7
mov r9, rdx
sub r9, r11
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14004e118
add rcx, 2
sub r8, 1
jne 0x14004e0e3
sub rdx, rdi
sar rdx, 1
mov rsi, qword [rsp + 0x248]
cmp rdx, 0xffffffffffffffff
je 0x14004e126
mov rdi, qword [rsp + 0x250]
jmp 0x14004dc28
add rdx, 2
jmp 0x14004e0a0
mov rsi, qword [rsp + 0x248]
mov dword [rsp + 0x94], 0x354c3560
mov dword [rsp + 0x98], 0x35483544
mov dword [rsp + 0x9c], 0x354d3540
mov dword [rsp + 0xa0], 0x357c3509
mov dword [rsp + 0xa4], 0x3540354a
mov dword [rsp + 0xa8], 0x354b3558
mov dword [rsp + 0xac], 0x355c
mov byte [rsp + 0xb0], 1
mov rcx, r13
nop
lea eax, [r12 + rcx]
xor word [rsp + rcx*2 + 0x94], ax
inc rcx
cmp rcx, 0xd
jb 0x14004e180
mov byte [rsp + 0xb0], 0
lea r8, [rsp + 0xae]
lea rdx, [rsp + 0x94]
lea rcx, [rsp + 0x110]
call fcn.140050e00
or r15d, 0x180040
mov dword [rsp + 0x240], r15d
lea rdi, [rsi + 0x20]
lea r11, [rsp + 0x110]
cmp qword [rsp + 0x128], 7
cmova r11, qword [rsp + 0x110]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 7
jbe 0x14004e1f5
mov rdi, qword [rdi]
mov rbx, qword [rsp + 0x120]
cmp rbx, rax
ja 0x14004e290
sub rax, rbx
test rbx, rbx
je 0x14004df5c
lea rsi, [rax + 1]
lea rsi, [rdi + rsi*2]
mov rdx, rdi
movzx r10d, word [r11]
mov rax, rsi
sub rax, rdx
sar rax, 1
mov rcx, r13
je 0x14004e24b
cmp word [rdx], r10w
je 0x14004e248
cmp rax, 1
je 0x14004e24b
dec rax
add rdx, 2
cmp word [rdx], r10w
jne 0x14004e235
mov rcx, rdx
mov rdx, rcx
test rcx, rcx
je 0x14004e288
mov r8, rbx
mov rcx, r11
test rbx, rbx
je 0x14004e278
mov r9, rdx
sub r9, r11
movzx eax, word [r9 + rcx]
cmp ax, word [rcx]
jne 0x14004e29f
add rcx, 2
sub r8, 1
jne 0x14004e264
sub rdx, rdi
sar rdx, 1
cmp rdx, 0xffffffffffffffff
jne 0x14004dc18
mov rsi, qword [rsp + 0x248]
xor bl, bl
mov rdi, qword [rsp + 0x250]
jmp 0x14004dc2a
add rdx, 2
jmp 0x14004e221
mov rdi, qword [rsp + 0x190]
jmp 0x14004dc28
call fcn.14011f7b8
nop
test r15b, 0x20
je 0x14004e319
and r15d, 0xffffffdf
mov dword [rsp + 0x240], r15d
mov rdx, qword [rsp + 0x148]
cmp rdx, 7
jbe 0x14004e319
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e313
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e313
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
nop
test r15b, 0x10
je 0x14004e377
and r15d, 0xffffffef
mov dword [rsp + 0x240], r15d
mov rdx, qword [rsp + 0x168]
cmp rdx, 7
jbe 0x14004e377
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e371
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e371
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
nop
test r15b, 8
je 0x14004e3d5
and r15d, 0xfffffff7
mov dword [rsp + 0x240], r15d
mov rdx, qword [rsp + 0x188]
cmp rdx, 7
jbe 0x14004e3d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e3cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e3cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
nop
test r15b, 4
je 0x14004e42e
and r15d, 0xfffffffb
mov dword [rsp + 0x240], r15d
mov rax, qword [rsp + 0x1a8]
cmp rax, 7
jbe 0x14004e42e
lea rdx, [rax*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004e425
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e425
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14011f7b8
nop
test r15b, 2
je 0x14004e48c
and r15d, 0xfffffffd
mov dword [rsp + 0x240], r15d
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 7
jbe 0x14004e48c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e486
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e486
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
nop
test r15b, 1
je 0x14004e4e9
and r15d, 0xfffffffe
mov dword [rsp + 0x240], r15d
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 7
jbe 0x14004e4e9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e4e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e4e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004e5b1
add rsi, 0x40
mov rdi, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf8]
jmp 0x14004d939
test rbx, rbx
je 0x14004e59e
cmp rbx, rdi
je 0x14004e55f
mov rcx, rbx
call fcn.14004d820
add rbx, 0x40
cmp rbx, rdi
jne 0x14004e546
mov rbx, qword [rsp + 0xf8]
mov rdx, qword [rsp + 0x108]
sub rdx, rbx
and rdx, 0xffffffffffffffc0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004e596
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e596
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14011f7b8
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400490b0
nop
int3