Function at 0x14000b660
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x6f0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x6d8], rbx
mov qword [rbp + 0x6e0], rsi
mov qword [rbp + 0x6e8], rdi
mov rax, qword [0x1400a7020]
xor rax, rbp
mov qword [rbp + 0x6a0], rax
mov r15, rcx
mov qword [rbp + 8], rcx
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x14000b98d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 8], rax
lea rbx, [0x14009af30]
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.14001b1d0
mov rsi, 0xffffffffffffffff
test al, al
jne 0x14000b6f9
mov rax, rsi
nop
inc rax
cmp byte [rbx + rax], 0
jne 0x14000b6e0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 8]
call fcn.14001b4a0
nop
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x490]
call fcn.14001ef80
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp + 0x280]
call fcn.14001ef80
xor edi, edi
mov dword [rbp + 4], edi
mov dword [rbp + 0x14], edi
mov dword [rbp + 0x10], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x70]
call fcn.14001ef80
mov word [rbp + 0x19], 0x6568
mov byte [rbp + 0x18], 0x53
mov word [rbp + 0x22], 0x6c
mov word [rbp + 0x1c], 0x336c
mov word [rbp + 0x1f], 0x642e
mov byte [rbp + 0x21], 0x6c
mov byte [rbp + 0x1b], 0x6c
mov byte [rbp + 0x1e], 0x32
lea rcx, [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14000b7e3
mov dword [rbp + 0x56], 0x69636570
mov word [rbp + 0x54], 0x5374
mov word [rbp + 0x51], 0x4748
mov word [rbp + 0x60], 0x7265
mov byte [rbp + 0x50], 0x53
mov dword [rbp + 0x5a], 0x6f466c61
mov word [rbp + 0x63], 0x7461
mov word [rbp + 0x66], 0x57
mov word [rbp + 0x5e], 0x646c
mov byte [rbp + 0x65], 0x68
mov byte [rbp + 0x53], 0x65
mov byte [rbp + 0x62], 0x50
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b7da
xor r9d, r9d
lea r8d, [rdi + 0x25]
lea rdx, [rbp + 0x70]
xor ecx, ecx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov word [rbp + 0x76], di
mov dword [rbp + 0x49], 0x576e6f69
mov dword [rbp + 0x3f], 0x6e49656d
mov word [rbp + 0x43], 0x6f66
mov word [rbp + 0x3b], 0x6f56
mov word [rbp + 0x38], 0x6547
mov word [rbp + 0x46], 0x616d
mov byte [rbp + 0x48], 0x74
mov byte [rbp + 0x3a], 0x74
mov word [rbp + 0x3d], 0x756c
mov byte [rbp + 0x45], 0x72
mov byte [rbp + 0x4d], dil
mov word [rbp + 0x29], 0x7265
mov dword [rbp + 0x31], 0x6c6c64
mov dword [rbp + 0x2c], 0x32336c65
mov byte [rbp + 0x2b], 0x6e
mov byte [rbp + 0x28], 0x4b
mov byte [rbp + 0x30], 0x2e
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000b8b8
mov dword [rsp + 0x38], 0x105
lea rcx, [rbp + 0x280]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x14]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 4]
mov r8d, 0x105
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x70]
call rax
test eax, eax
je 0x14000b8b8
mov dword [rbp], 0x756c25
mov r8d, dword [rbp + 4]
lea rdx, [rbp]
lea rcx, [rbp + 8]
call fcn.14001a2b0
mov rbx, qword [rbp + 8]
test rbx, rbx
je 0x14000b935
mov rax, rsi
inc rax
cmp byte [rbx + rax], dil
jne 0x14000b8c4
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000b935
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000b8f5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14001d550
sub rsp, rcx
lea r14, [rsp + 0x40]
test r14, r14
je 0x14000b935
mov word [r14], di
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r14
mov r9d, esi
mov r8, rbx
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove r14, rdi
mov rdi, r14
mov rdx, rdi
mov rcx, r15
call fcn.14001be80
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14000b959
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r15
mov rcx, qword [rbp + 0x6a0]
xor rcx, rbp
call fcn.14001c9b0
mov rbx, qword [rbp + 0x6d8]
mov rsi, qword [rbp + 0x6e0]
mov rdi, qword [rbp + 0x6e8]
lea rsp, [rbp + 0x6b0]
pop r15
pop r14
pop rbp
ret
mov ecx, 0x80004005
call fcn.14001b6d0
int3