Function at 0x140209d20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xb8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 7], rax
movzx ebx, r8b
mov qword [rbp - 0x39], rdx
mov r12, rcx
mov qword [rbp - 0x49], rcx
mov edx, 1
mov byte [rbp - 0x51], bl
mov ecx, 0xa00000
mov qword [rbp - 0x41], r9
mov rdi, r9
mov dword [rbp - 0x21], 0x49490000
mov dword [rbp - 0x1d], 0x33525058
mov sil, 0x58
mov dword [rbp - 0x29], 0x430043
mov r14b, 0xff
mov dword [rbp - 0x31], 0x20432043
mov dword [rbp - 0x19], 0x440044
mov dword [rbp - 0x11], 0x20442044
mov dword [rbp - 9], 0x450045
mov dword [rbp - 1], 0x20452045
mov dword [rbp - 0x55], 0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x14020a135
xor edx, edx
mov r8d, 0xa00000
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r12 + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, r15
mov qword [rsp + 0x28], rax
mov r8, rdi
movzx edx, bl
mov dword [rsp + 0x20], 0xa00000
call fcn.1401c1720
test eax, eax
je 0x14020a121
mov rax, qword [rbp - 0x21]
cmp rax, qword [r15]
jne 0x14020a121
mov eax, dword [rbp - 0x29]
xor r9b, r9b
xor r10b, r10b
xor r8b, r8b
cmp eax, dword [r15 + 8]
jne 0x140209e24
cmp sil, byte [r15 + 0xc]
je 0x140209e33
mov eax, dword [rbp - 0x31]
cmp eax, dword [r15 + 8]
jne 0x140209e38
cmp sil, byte [r15 + 0xc]
jne 0x140209e38
mov r9b, 1
jmp 0x140209e84
mov eax, dword [rbp - 0x19]
cmp eax, dword [r15 + 8]
jne 0x140209e47
cmp sil, byte [r15 + 0xc]
je 0x140209e56
mov eax, dword [rbp - 0x11]
cmp eax, dword [r15 + 8]
jne 0x140209e5b
cmp sil, byte [r15 + 0xc]
jne 0x140209e5b
mov r10b, 1
jmp 0x140209e84
mov eax, dword [rbp - 9]
cmp eax, dword [r15 + 8]
jne 0x140209e6a
cmp sil, byte [r15 + 0xc]
je 0x140209e81
mov eax, dword [rbp - 1]
cmp eax, dword [r15 + 8]
jne 0x14020a121
cmp sil, byte [r15 + 0xc]
jne 0x14020a121
mov r8b, 1
movzx edx, byte [0x1411dd028]
mov ecx, dword [r15 + 0x41c]
mov byte [rbp - 0x59], 1
test dl, dl
je 0x140209eb8
mov eax, ecx
mov byte [rbp - 0x2e], cl
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x2f], al
mov ecx, dword [rbp - 0x31]
cmp ecx, 0x3d8
jae 0x140209f14
lea eax, [rcx + 0x424]
mov ebx, dword [rax + r15]
test dl, dl
je 0x140209eec
mov eax, ebx
mov byte [rbp - 0x2e], bl
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, ebx
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, ebx
shr eax, 8
mov byte [rbp - 0x2f], al
mov ebx, dword [rbp - 0x31]
mov edi, ebx
test r9b, r9b
jne 0x140209eff
test r10b, r10b
jne 0x140209efd
test r8b, r8b
je 0x140209f02
inc ebx
shl ebx, 0xa
add ebx, 0xfffffffc
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbp - 0x58], 1
jmp 0x140209f78
test r9b, r9b
je 0x140209f20
mov eax, 0x63fc
jmp 0x140209f3c
test r10b, r10b
je 0x140209f2c
mov eax, 0x7ffc
jmp 0x140209f3c
test r8b, r8b
mov eax, 0x41c
mov ecx, 0x8bfc
cmovne eax, ecx
mov edi, dword [rax + r15]
test dl, dl
je 0x140209f63
mov eax, edi
mov byte [rbp - 0x2e], dil
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, edi
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, edi
shr eax, 8
mov byte [rbp - 0x2f], al
mov edi, dword [rbp - 0x31]
mov ebx, edi
mov rcx, r15
shl ebx, 0xa
sub ebx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbp - 0x58], 0
xor r15d, r15d
cmp byte [0x1411dd026], r15b
jne 0x14020a0f6
mov esi, dword [rbp - 0x55]
mov r13d, ebx
nop
mov rax, qword [rbp - 0x49]
mov edx, 1
mov r12d, dword [r12 + 0x48]
imul r12d, dword [rax + 0x28]
lea eax, [r12*4]
mov ecx, eax
mov dword [rbp - 0x29], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x14020a12e
lea r8d, [r12*4]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov eax, r13d
div r12d
mov r12d, dword [rbp - 0x29]
mov r9, r15
movzx edx, byte [rbp - 0x51]
mov r8d, eax
xor eax, eax
add r8, qword [rbp - 0x41]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x49]
mov dword [rsp + 0x20], r12d
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x14020a112
mov ecx, r13d
and ecx, 0x1ff
lea rax, [rcx + 4]
cmp rax, r12
jae 0x14020a112
cmp r14b, byte [rcx + r15 + 3]
jne 0x14020a05c
cmp byte [0x1411dd028], 0
lea eax, [rcx + 4]
movzx edx, word [rax + r15]
je 0x14020a051
movzx eax, dx
mov byte [rbp - 0x30], dl
shr ax, 8
mov byte [rbp - 0x31], al
movzx edx, word [rbp - 0x31]
movzx ebx, dx
shl ebx, 0xa
add ebx, r13d
jmp 0x14020a09f
cmp esi, dword [rcx + r15]
je 0x14020a0c1
cmp byte [0x1411dd028], 0
mov ebx, dword [rcx + r15]
je 0x14020a08d
mov eax, ebx
mov byte [rbp - 0x52], bl
shr eax, 0x18
mov byte [rbp - 0x55], al
mov eax, ebx
shr eax, 0x10
mov byte [rbp - 0x54], al
mov eax, ebx
shr eax, 8
mov byte [rbp - 0x53], al
mov ebx, dword [rbp - 0x55]
cmp ebx, 0x1f400000
jae 0x14020a121
shl ebx, 0xa
sub ebx, 4
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r12, qword [rbp - 0x49]
xor r15d, r15d
cmp byte [0x1411dd026], r15b
mov r13d, ebx
je 0x140209f90
jmp 0x14020a0f6
cmp byte [rbp - 0x58], 0
je 0x14020a0ef
cmp edi, 0x190
ja 0x14020a0d8
mov eax, 0x19000
add ebx, eax
jmp 0x14020a0f6
cmp edi, 0x1770
mov eax, 0x177000
mov ecx, 0x7d000
cmovbe eax, ecx
add ebx, eax
jmp 0x14020a0f6
mov ecx, 0x7d000
add ebx, ecx
mov rcx, qword [rbp - 0x39]
mov eax, ebx
mov qword [rcx + 0x10], rax
mov bl, 1
test r15, r15
je 0x14020a132
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14020a132
movzx ebx, byte [rbp - 0x59]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14020a132
xor bl, bl
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14020a132
movzx ebx, byte [rbp - 0x59]
movzx eax, bl
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret