Function at 0x140078a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f8]
sub rsp, 0x4f8
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov r14, r9
mov esi, r8d
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rcx
mov qword [rbp + 0x110], rdx
mov rax, qword [rbp + 0x460]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x118], rax
mov r15d, dword [rbp + 0x468]
mov r13, qword [rbp + 0x470]
mov qword [rbp + 0x120], r13
mov r12, qword [rbp + 0x478]
xor ebx, ebx
mov dword [rsp + 0x58], ebx
mov dword [rbp + 0x128], 0x203e2d20
mov byte [rbp + 0x12c], bl
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x67697254
mov dword [rsp + 0x4c], 0x45726567
mov dword [rsp + 0x50], 0x746e6576
mov byte [rsp + 0x54], bl
lea r8, [rbp + 0x128]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.14005f480
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x2b8]
call fcn.140060060
mov dword [rbp + 0x128], 0x202d3c20
mov byte [rbp + 0x12c], bl
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x67697254
mov dword [rsp + 0x4c], 0x45726567
mov dword [rsp + 0x50], 0x746e6576
mov byte [rsp + 0x54], bl
lea r8, [rbp + 0x128]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x18]
call fcn.14005f480
lea r8, [rsp + 0x30]
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.140060060
mov rdi, qword [0x1400fbc38]
mov qword [rbp - 0x48], rbx
lea rax, [rbp + 0x290]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdi
mov qword [rbp - 0x30], rbx
mov rax, qword [rdi]
lea rbx, [0x1400e01eb]
cmp dword [rax], 0
je 0x140078c12
mov qword [rbp + 0x128], 0
lea rcx, [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp + 0x128]
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.14007cc00
nop
cmp byte [0x1400fbd18], 0
jne 0x140078c28
test byte [0x1400fb900], 0x10
je 0x140079668
mov ecx, dword [0x1400fb894]
mov rax, qword gs:[0x58]
mov edx, 0xb4
add rdx, qword [rax + rcx*8]
mov qword [rbp + 0x128], rdx
cmp byte [rdx], 0
jne 0x140079668
mov byte [rdx], 1
mov qword [rbp - 0x28], rdx
mov byte [rbp - 0x20], 1
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x2e0]
call fcn.14009c250
mov edx, 1
lea rcx, [rbp + 0x2e0]
call fcn.14006b0c0
nop
lea rdx, [0x1400d1508]
lea rcx, [rbp + 0x2f0]
call fcn.14005de80
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov ecx, dword [rdx + rax + 0x18]
and ecx, 0xfffff9ff
bts ecx, 0xb
mov dword [rdx + rax + 0x18], ecx
mov edx, esi
mov rcx, rax
call fcn.14006d400
mov rax, qword [rbp - 0x50]
test rax, rax
je 0x140078cd7
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140087f90
nop
mov edi, 1
xor esi, esi
jmp 0x140078d10
xor esi, esi
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xf
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x130]
call fcn.140004810
lea rax, [rbp + 0x130]
mov edi, 2
mov dword [rsp + 0x58], edi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
test dil, 2
je 0x140078d87
and edi, 0xfffffffd
mov dword [rsp + 0x58], edi
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140078d87
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078d81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796b7
call fcn.14005c5c0
nop
test dil, 1
je 0x140078de4
and edi, 0xfffffffe
mov dword [rsp + 0x58], edi
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140078dd1
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078dcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796bd
call fcn.14005c5c0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
cmp r15d, 2
jne 0x140078e21
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
lea r8d, [r15 + 5]
lea rdx, str.UNKNOWN
lea rcx, [rsp + 0x38]
call fcn.140004810
lea rax, [rsp + 0x38]
or edi, 4
jmp 0x140078e41
mov rax, qword [rbp - 0x58]
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140078e32
mov rdx, qword [rax]
lea rcx, [rbp + 0x130]
call fcn.140087f90
or edi, 8
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
test dil, 8
je 0x140078ec8
and edi, 0xfffffff7
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140078eaf
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078eaa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796c3
call fcn.14005c5c0
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
test dil, 4
je 0x140078f0f
and edi, 0xfffffffb
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140078f0f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140078f09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796c9
call fcn.14005c5c0
nop
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 0xf
mov byte [rbp + 0x130], 0
or edi, 0x20
mov dword [rsp + 0x58], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp + 0x368]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140078f81
mov rax, qword [rbp + 0x338]
mov r8, qword [rax]
test r8, r8
je 0x140078f81
mov rax, qword [rbp + 0x318]
mov rdx, qword [rax]
cmp r8, qword [rbp + 0x360]
cmovb r8, qword [rbp + 0x360]
sub r8, rdx
jmp 0x140078fbb
test cl, 4
jne 0x140078fb1
mov rax, qword [rbp + 0x330]
mov rcx, qword [rax]
test rcx, rcx
je 0x140078fb1
mov rax, qword [rbp + 0x310]
mov rdx, qword [rax]
mov rax, qword [rbp + 0x348]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140078fbb
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
test rdx, rdx
je 0x140078fcc
lea rcx, [rbp + 0x130]
call fcn.140004810
and edi, 0xffffffdf
or edi, 0x10
test r14, r14
cmovne rbx, r14
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140079000
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140004810
nop
mov ecx, r15d
call fcn.14006e5c0
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], bl
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140079040
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140004810
nop
lea rdx, [rbp + 0x150]
cmp qword [rbp + 0x168], 0x10
cmovae rdx, qword [rbp + 0x150]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140079090
lea rcx, [rsp + 0x38]
call fcn.140004810
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x190]
call fcn.140004230
nop
lea rdx, [rbp + 0x170]
lea rcx, [rbp + 0x1b0]
call fcn.140004230
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0x1d0]
call fcn.140004230
nop
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x1f0]
call fcn.140004230
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x210]
call fcn.140004230
mov qword [rbp + 0x230], rbx
movdqa xmm0, xmmword [0x1400e3140]
movdqa xmmword [rbp + 0x240], xmm0
mov byte [rbp + 0x230], 0
mov qword [rbp + 0x250], rbx
movdqa xmmword [rbp + 0x260], xmm0
mov byte [rbp + 0x250], 0
mov qword [rbp + 0x270], rbx
movdqa xmmword [rbp + 0x280], xmm0
mov byte [rbp + 0x270], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140079189
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079183
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796cf
call fcn.14005c5c0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400791c5
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400791bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796d5
call fcn.14005c5c0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140079203
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400791fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796db
call fcn.14005c5c0
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140079244
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007923f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796e1
call fcn.14005c5c0
lea rax, [rbp + 0x270]
cmp rax, r13
je 0x14007926e
mov rdx, r13
cmp qword [r13 + 0x18], 0x10
jb 0x14007925e
mov rdx, qword [r13]
mov r8, qword [r13 + 0x10]
lea rcx, [rbp + 0x270]
call fcn.140004810
test r12, r12
je 0x140079282
mov rdx, r12
lea rcx, [rbp + 0x190]
call fcn.140077e80
mov r15, qword [rbp - 0x80]
cmp qword [r15 + 0x10], 0
jbe 0x140079592
mov r8d, 0xd
lea rdx, str.loaded_dlls:
lea rcx, [rbp + 0x270]
call fcn.140004810
mov r14, qword [r15 + 8]
mov rbx, qword [r14]
xor r12d, r12d
cmp rbx, r14
je 0x14007942b
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x130]
call fcn.1400138b0
nop
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rdx, qword [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.140087f90
or edi, 0x40
mov r8d, 1
lea rdx, [0x1400d1520]
lea rcx, [rbp - 0x78]
call fcn.1400150c0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
bts edi, 7
lea rdx, [rsp + 0x60]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x270]
call fcn.1400150c0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14007939b
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796e7
call fcn.14005c5c0
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400793d7
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400793d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796ed
call fcn.14005c5c0
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x14007941d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079418
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796f3
call fcn.14005c5c0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jmp 0x1400792b7
mov rax, qword [rbp - 0x50]
nop
inc rsi
cmp word [rax + rsi*2], 0
jne 0x140079430
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400043e0
nop
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.14002b490
nop
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1400138b0
nop
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x78]
call fcn.140097b30
nop
mov r8, rax
lea rdx, [0x1400d1524]
lea rcx, [rsp + 0x38]
call fcn.140004c20
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400794b7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.1400150c0
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140079504
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400794ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796f9
call fcn.14005c5c0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov r8, qword [rbp - 0x60]
cmp r8, 0x10
jb 0x140079531
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.140004b50
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
mov r8, qword [rbp + 0x148]
cmp r8, 8
jb 0x140079564
inc r8
mov rdx, qword [rbp + 0x130]
lea rcx, [rbp + 0x130]
call fcn.140004640
mov qword [rbp + 0x140], r12
mov qword [rbp + 0x148], 7
mov word [rbp + 0x130], r12w
lea rcx, [rbp - 0x18]
call fcn.140003e50
nop
lea rcx, [rsp + 0x60]
call fcn.140003e50
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x10]
call fcn.14006b7b0
mov rcx, rax
call fcn.14006e140
nop
lea rcx, [rbp + 0x190]
call fcn.14006cd60
nop
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x1400795fa
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400795f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796ff
call fcn.14005c5c0
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x140079638
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079632
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400796b1
call fcn.14005c5c0
nop
lea rcx, [rbp + 0x2e0]
call fcn.14006db70
nop
mov rax, qword [rbp + 0x128]
mov byte [rax], 0
lea rcx, [rbp - 0x48]
call fcn.14006d200
nop
mov rcx, qword [rbp - 0x58]
call fcn.140003e50
nop
mov rcx, r15
jmp 0x140079680
lea rcx, [rbp - 0x48]
call fcn.14006d200
nop
mov rcx, qword [rbp - 0x58]
call fcn.140003e50
nop
mov rcx, qword [rbp - 0x80]
call fcn.14006c2d0
nop
mov rcx, r13
call fcn.140004190
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14005c5a0
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
nop
call fcn.1400a87d8
int3