Function at 0x1401dd840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 7], rax
mov r12d, dword [rcx + 0x28]
mov r13, rcx
imul r12d, dword [rcx + 0x48]
mov r14, r9
mov qword [rbp - 0x29], rdx
movzx edi, r8b
mov edx, 1
mov qword [rbp - 0x31], r9
xor r15b, r15b
mov dword [rbp - 0x21], 0x46444889
mov dword [rbp - 0x1d], 0xa1a0a0d
shl r12d, 3
mov ecx, r12d
mov dword [rbp - 0x19], 0
mov dword [rbp - 0x15], 0x80800
mov dword [rbp - 0x11], 0x5f697863
mov dword [rbp - 0xd], 0x73726576
mov dword [rbp - 9], 0x6e6f69
mov dword [rbp - 1], 0x72746e65
mov dword [rbp + 3], 0x315f79
mov dword [rbp - 0x39], 0x50414548
mov ebx, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test rax, rax
je 0x1401dda6d
mov r8d, ebx
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r13 + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, r14
movzx edx, dil
mov dword [rsp + 0x20], r12d
call fcn.1401c1720
test eax, eax
je 0x1401dda64
mov rax, qword [rbp - 0x21]
cmp rax, qword [rsi]
jne 0x1401dda64
mov rax, qword [rbp - 0x19]
cmp rax, qword [rsi + 8]
jne 0x1401dda64
movzx r8d, byte [0x1411dd028]
mov eax, dword [rsi + 0x28]
test r8b, r8b
je 0x1401dd995
mov byte [rbp - 0x1e], al
mov ecx, eax
shr ecx, 0x18
mov byte [rbp - 0x21], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x20], cl
mov ecx, eax
mov eax, dword [rsi + 0x58]
shr ecx, 8
mov byte [rbp - 0x1f], cl
mov ecx, eax
mov r9d, dword [rbp - 0x21]
shr ecx, 0x18
mov byte [rbp - 0x21], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbp - 0x20], cl
mov ecx, eax
shr ecx, 8
mov byte [rbp - 0x1f], cl
mov byte [rbp - 0x1e], al
mov edx, dword [rbp - 0x21]
mov qword [rbp - 0x19], r9
jmp 0x1401dd99c
mov edx, dword [rsi + 0x58]
mov qword [rbp - 0x19], rax
mov eax, dword [rbp - 0x39]
mov ecx, edx
cmp eax, dword [rcx + rsi]
jne 0x1401dda64
lea eax, [rdx + 0x18]
mov r14d, dword [rax + rsi]
test r8b, r8b
je 0x1401dd9d9
mov eax, r14d
mov byte [rbp - 0x36], r14b
shr eax, 0x18
mov byte [rbp - 0x39], al
mov eax, r14d
shr eax, 0x10
mov byte [rbp - 0x38], al
mov eax, r14d
shr eax, 8
mov byte [rbp - 0x37], al
mov r14d, dword [rbp - 0x39]
mov r9d, dword [r13 + 0x48]
xor edx, edx
imul r9d, dword [r13 + 0x28]
mov rcx, rsi
mov eax, r14d
mov r8d, r12d
div r9
xor edx, edx
mov rbx, rax
add rbx, qword [rbp - 0x31]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r13 + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rsi
mov qword [rsp + 0x28], rax
mov r8, rbx
movzx edx, dil
mov dword [rsp + 0x20], r12d
call fcn.1401c1720
test eax, eax
je 0x1401dda64
mov ecx, dword [r13 + 0x28]
xor edx, edx
imul ecx, dword [r13 + 0x48]
mov eax, r14d
div ecx
mov rax, qword [rbp - 0x11]
add edx, 8
cmp rax, qword [rdx + rsi]
jne 0x1401dda4b
mov eax, dword [rbp - 9]
cmp eax, dword [rdx + rsi + 8]
je 0x1401dda55
mov rax, qword [rbp - 1]
cmp rax, qword [rdx + rsi]
jne 0x1401dda64
mov rcx, qword [rbp - 0x29]
mov r15b, 1
mov rax, qword [rbp - 0x19]
mov qword [rcx + 0x10], rax
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r15b
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret