Function at 0x140215110
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor r13b, r13b
mov qword [rbp - 0x41], r9
xor esi, esi
mov byte [rbp - 0x48], r8b
cmp byte [0x1411dd026], sil
mov r12, r9
mov qword [rbp - 0x39], rdx
mov r15, rcx
mov byte [rbp - 0x49], r13b
mov dword [rbp - 9], 0x6f685069
mov dword [rbp - 5], 0x65536f74
mov dword [rbp - 1], 0x6e656d67
mov dword [rbp + 3], 0x63614374
mov word [rbp + 7], 0x6568
mov dword [rbp - 0x11], 0x200000
mov word [rbp - 0xd], 0
mov dword [rbp - 0x31], 0xe1ffd8ff
mov dword [rbp - 0x2d], 0x7845c400
mov word [rbp - 0x29], 0x6669
mov dword [rbp - 0x21], 0xe0ffd8ff
mov dword [rbp - 0x1d], 0x464a1000
mov word [rbp - 0x19], 0x4649
jne 0x14021559d
mov eax, dword [rcx + 0x28]
lea edx, [rsi + 1]
imul eax, dword [rcx + 0x48]
imul ecx, eax, 0x19
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x14021559d
mov eax, dword [r15 + 0x48]
xor edx, edx
imul eax, dword [r15 + 0x28]
mov rcx, r14
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rdi
imul ebx, eax, 0x19
mov r8d, ebx
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x48]
xor eax, eax
mov ecx, dword [r15 + 0x48]
mov r9, r14
mov dword [rsp + 0x30], eax
mov r8, r12
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x140215577
mov rax, qword [rbp - 9]
cmp rax, qword [r14]
jne 0x1402153c2
mov rax, qword [rbp - 1]
cmp rax, qword [r14 + 8]
jne 0x1402153c2
movzx eax, word [rbp + 7]
cmp ax, word [r14 + 0x10]
jne 0x1402153c2
mov ecx, dword [r15 + 0x28]
imul ecx, dword [r15 + 0x48]
imul eax, ecx, 0x19
lea edi, [rcx*8]
cmp edi, eax
jae 0x140215577
mov rdx, qword [rbp - 0x31]
cmp rdx, qword [rdi + r14]
jne 0x140215281
movzx edx, word [rbp - 0x29]
cmp dx, word [rdi + r14 + 8]
je 0x14021529f
mov rdx, qword [rbp - 0x21]
cmp rdx, qword [rdi + r14]
jne 0x140215577
movzx edx, word [rbp - 0x19]
cmp dx, word [rdi + r14 + 8]
jne 0x140215577
shl ecx, 4
add edi, ecx
mov rcx, r14
mov r12d, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp byte [0x1411dd026], sil
jne 0x140215587
nop dword [rax]
mov r8d, dword [r15 + 0x28]
xor edx, edx
mov ecx, dword [r15 + 0x48]
mov ebx, r8d
imul ebx, ecx
mov eax, r12d
div ebx
mov r13d, eax
add r13, qword [rbp - 0x41]
cmp esi, ebx
jbe 0x1402152f2
xor edx, edx
mov eax, esi
div ebx
lea ebx, [rax + 2]
imul ebx, r8d
imul ebx, ecx
jmp 0x1402152f4
add ebx, ebx
mov edx, 1
mov ecx, ebx
mov esi, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x140215582
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x48]
xor eax, eax
mov ecx, dword [r15 + 0x48]
mov r9, r14
mov dword [rsp + 0x30], eax
mov r8, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x140215572
mov eax, r12d
and eax, 0x1ff
cmp eax, ebx
jae 0x14021554e
mov rcx, qword [rbp - 0x31]
cmp rcx, qword [rax + r14]
jne 0x14021536c
movzx ecx, word [rbp - 0x29]
cmp cx, word [rax + r14 + 8]
je 0x14021538a
mov rcx, qword [rbp - 0x21]
cmp rcx, qword [rax + r14]
jne 0x14021554e
movzx ecx, word [rbp - 0x19]
cmp cx, word [rax + r14 + 8]
jne 0x14021554e
mov esi, dword [r15 + 0x28]
mov rcx, r14
imul esi, dword [r15 + 0x48]
mov byte [rbp - 0x49], 1
shl esi, 4
add r12d, esi
add edi, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r14d, r14d
cmp byte [0x1411dd026], r14b
je 0x1402152c0
movzx r13d, byte [rbp - 0x49]
jmp 0x140215558
mov eax, dword [rbp - 0x11]
cmp eax, dword [r14]
jne 0x140215577
movzx eax, word [rbp - 0xd]
cmp ax, word [r14 + 4]
jne 0x140215577
mov ecx, dword [r15 + 0x28]
imul ecx, dword [r15 + 0x48]
imul eax, ecx, 0x19
lea edi, [rcx*8 + 4]
cmp edi, eax
jae 0x140215577
mov rdx, qword [rbp - 0x31]
cmp rdx, qword [rdi + r14]
jne 0x14021540e
movzx edx, word [rbp - 0x29]
cmp dx, word [rdi + r14 + 8]
je 0x14021542c
mov rdx, qword [rbp - 0x21]
cmp rdx, qword [rdi + r14]
jne 0x140215577
movzx edx, word [rbp - 0x19]
cmp dx, word [rdi + r14 + 8]
jne 0x140215577
shl ecx, 4
add edi, ecx
mov rcx, r14
mov r12d, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp byte [0x1411dd026], sil
jne 0x14021553c
nop word [rax + rax]
mov r8d, dword [r15 + 0x28]
xor edx, edx
mov ecx, dword [r15 + 0x48]
mov ebx, r8d
imul ebx, ecx
mov eax, r12d
div ebx
mov r13d, eax
add r13, qword [rbp - 0x41]
cmp esi, ebx
jbe 0x140215482
xor edx, edx
mov eax, esi
div ebx
lea ebx, [rax + 2]
imul ebx, r8d
imul ebx, ecx
jmp 0x140215484
add ebx, ebx
mov edx, 1
mov ecx, ebx
mov esi, ebx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x140215544
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
movzx edx, byte [rbp - 0x48]
xor eax, eax
mov ecx, dword [r15 + 0x48]
mov r9, r14
mov dword [rsp + 0x30], eax
mov r8, r13
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
call fcn.1401c1720
test eax, eax
je 0x140215572
mov eax, r12d
and eax, 0x1ff
cmp eax, ebx
jae 0x140215544
mov rcx, qword [rbp - 0x31]
cmp rcx, qword [rax + r14]
jne 0x1402154f8
movzx ecx, word [rbp - 0x29]
cmp cx, word [rax + r14 + 8]
je 0x14021550e
mov rcx, qword [rbp - 0x21]
cmp rcx, qword [rax + r14]
jne 0x140215544
movzx ecx, word [rbp - 0x19]
cmp cx, word [rax + r14 + 8]
jne 0x140215544
mov esi, dword [r15 + 0x28]
mov rcx, r14
imul esi, dword [r15 + 0x48]
mov byte [rbp - 0x49], 1
shl esi, 4
add r12d, esi
add edi, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp byte [0x1411dd026], 0
je 0x140215450
mov r13b, 1
xor r14d, r14d
add edi, 0xfffffffc
jmp 0x140215553
movzx r13d, byte [rbp - 0x49]
add edi, 0xfffffffc
jmp 0x140215553
movzx r13d, byte [rbp - 0x49]
test r13b, r13b
je 0x140215562
mov rax, qword [rbp - 0x39]
mov ecx, edi
mov qword [rax + 0x10], rcx
test r14, r14
je 0x140215587
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140215587
movzx r13d, byte [rbp - 0x49]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140215587
movzx r13d, byte [rbp - 0x49]
mov rdi, qword [rsp + 0xa8]
movzx eax, r13b
mov rbx, qword [rsp + 0xb0]
jmp 0x14021559f
xor al, al
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret