Function at 0x140012190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
push r12
push r14
push r15
sub rsp, 0x558
mov rax, qword [0x140074c00]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov rdi, rcx
mov r15, r8
mov r14, rdx
lea rcx, [rsp + 0x2b1]
xor edx, edx
mov r8d, 0xff
mov dword [rsp + 0x40], 0x1c
mov byte [rsp + 0x2b0], 0
call fcn.14003ea70
lea rdx, [rsp + 0xa0]
mov ecx, 0x202
call qword [0x140055cc0]
xor eax, eax
lea rcx, [rsp + 0x3b2]
lea r8d, [rax + 0x7e]
xor r12d, r12d
xor edx, edx
mov byte [rsp + 0x270], 0
mov qword [rsp + 0x271], rax
mov qword [rsp + 0x279], rax
mov qword [rsp + 0x281], rax
mov qword [rsp + 0x289], rax
mov qword [rsp + 0x291], rax
mov qword [rsp + 0x299], rax
mov qword [rsp + 0x2a1], rax
mov dword [rsp + 0x2a9], eax
mov word [rsp + 0x2ad], ax
mov byte [rsp + 0x2af], al
mov word [rsp + 0x3b0], r12w
call fcn.14003ea70
lea rax, [rsp + 0x3b0]
mov r8, r14
lea edx, [r12 + 0x40]
lea rcx, [rsp + 0x3b0]
sub r8, rax
lea rax, [rdx + 0x7fffffbe]
test rax, rax
je 0x1400122ad
movzx eax, word [r8 + rcx + 0x208]
test ax, ax
je 0x1400122ad
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140012284
jmp 0x1400122b2
test rdx, rdx
jne 0x1400122b6
sub rcx, 2
mov qword [rsp + 0x38], r12
lea rax, [rsp + 0x270]
mov word [rcx], r12w
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x3b0]
mov r9d, 0x40
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x40
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r11d, r11d
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, [0x140063180]
lea rcx, [rsp + 0x270]
mov dword [rsp + 0x54], 0x17
mov dword [rsp + 0x58], 2
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x78], r11
call qword [0x140055cd0]
test eax, eax
je 0x14001234c
xor eax, eax
jmp 0x1400126d5
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x580], rbx
mov qword [rsp + 0x550], rbp
mov r8d, dword [rax + 0xc]
mov edx, dword [rax + 8]
mov ecx, dword [rax + 4]
mov qword [rsp + 0x548], rsi
mov qword [rsp + 0x540], r13
call qword [0x140055c90]
movsxd rsi, eax
lea r9, [rsp + 0x44]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rsi
mov byte [rsp + 0x240], 0x30
mov byte [rsp + 0x241], 0x2b
mov byte [rsp + 0x242], 2
mov byte [rsp + 0x243], 1
mov byte [rsp + 0x244], r12b
mov byte [rsp + 0x245], 4
mov byte [rsp + 0x246], 6
mov byte [rsp + 0x247], 0x70
mov byte [rsp + 0x248], 0x75
mov byte [rsp + 0x249], 0x62
mov byte [rsp + 0x24a], 0x6c
mov byte [rsp + 0x24b], 0x69
mov byte [rsp + 0x24c], 0x63
mov byte [rsp + 0x24d], 0xa0
mov byte [rsp + 0x24e], 0x1e
mov byte [rsp + 0x24f], 2
mov byte [rsp + 0x250], 1
mov byte [rsp + 0x251], r12b
mov byte [rsp + 0x252], 2
mov byte [rsp + 0x253], 1
mov byte [rsp + 0x254], r12b
mov byte [rsp + 0x255], 2
mov byte [rsp + 0x256], 1
mov byte [rsp + 0x257], r12b
mov byte [rsp + 0x258], 0x30
mov byte [rsp + 0x259], 0x13
mov byte [rsp + 0x25a], 0x30
mov byte [rsp + 0x25b], 0x11
mov byte [rsp + 0x25c], 6
mov byte [rsp + 0x25d], 0xd
mov byte [rsp + 0x25e], 0x2b
mov byte [rsp + 0x25f], 6
mov byte [rsp + 0x260], 1
mov byte [rsp + 0x261], 4
mov byte [rsp + 0x262], 1
mov byte [rsp + 0x263], 0x82
mov byte [rsp + 0x264], 0xb9
mov byte [rsp + 0x265], 0x1d
mov byte [rsp + 0x266], 1
mov byte [rsp + 0x267], 1
mov byte [rsp + 0x268], 3
mov byte [rsp + 0x269], 0x10
mov byte [rsp + 0x26a], 2
mov byte [rsp + 0x26b], 5
mov byte [rsp + 0x26c], r12b
mov ebp, 3
mov r13d, r12d
mov dword [rsp + 0x44], 5
mov dword [rsp + 0x20], 4
call qword [0x140055ca8]
nop dword [rax]
mov rcx, qword [rsp + 0x48]
mov ebx, 3
lea rdx, [rsp + 0x240]
mov eax, dword [rcx + 0x10]
lea r8d, [rbx + 0x2a]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rax
dec ebp
call qword [0x140055cb0]
test eax, eax
jns 0x140012585
mov rcx, qword [rsp + 0x48]
lea r8d, [rbx + 0x2a]
lea rdx, [rsp + 0x240]
mov eax, dword [rcx + 0x10]
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov rax, qword [rcx + 0x20]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [0x140055cb0]
cmp byte [rdi + 0x94], r12b
je 0x1400125a0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop dword [rax]
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x2b0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov r8d, pe_nt_image_headers64
mov rcx, rsi
dec ebx
mov qword [rsp + 0x20], rax
call qword [0x140055cb8]
test eax, eax
jg 0x1400125fc
cmp byte [rdi + 0x94], r12b
je 0x1400125eb
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
jne 0x1400125a0
test ebp, ebp
jne 0x140012520
jmp 0x14001269c
add eax, 0xffffffc4
lea rcx, [rsp + 0x431]
mov r8d, 0xff
cdq
mov r13d, 1
mov ebx, eax
xor ebx, edx
sub ebx, edx
xor edx, edx
call fcn.14003ea70
mov rax, qword [rsp + rbx + 0x2b0]
lea rcx, [rsp + 0x430]
mov qword [rcx], rax
mov rax, qword [rsp + rbx + 0x2b8]
lea rdx, [rsp + 0x430]
mov qword [rcx + 8], rax
mov rax, qword [rsp + rbx + 0x2c0]
mov r8, r14
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + rbx + 0x2c8]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + rbx + 0x2d0]
mov qword [rcx + 0x20], rax
mov rax, qword [rsp + rbx + 0x2d8]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + rbx + 0x2e0]
mov qword [rcx + 0x30], rax
mov eax, dword [rsp + rbx + 0x2e8]
mov dword [rcx + 0x38], eax
mov rcx, rdi
call fcn.140012700
mov dword [r15], eax
mov rcx, rsi
call qword [0x140055cd8]
call qword [0x140055cc8]
mov rsi, qword [rsp + 0x548]
mov rbp, qword [rsp + 0x550]
mov rbx, qword [rsp + 0x580]
test r13d, r13d
mov r13, qword [rsp + 0x540]
setne r12b
mov eax, r12d
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14003d6d0
add rsp, 0x558
pop r15
pop r14
pop r12
pop rdi
ret