Function at 0x401ba0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x258
mov dword [rsp + 0x2a0], ecx
mov r13, rdx
mov r12, r8
mov esi, dword [rsp + 0x2c0]
mov r14d, dword [rsp + 0x2c8]
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x2e0]
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x2e8]
mov dword [rsp + 0x5c], eax
mov ebx, dword [rsp + 0x2f0]
mov byte [rsp + 0x48], sil
mov byte [rsp + 0x50], r14b
mov byte [rsp + 0x82], bl
cmp word [r8], 0x5a4d
jne 0x4029ae
movsxd rbp, dword [r8 + 0x3c]
add rbp, r8
cmp word [rbp + 4], 0x8664
jne 0x4029c9
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, dword [rbp + 0x50]
mov edx, 0
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x248]
mov r15, rax
test rax, rax
je 0x4029d0
mov qword [rsp + 0x200], 0
mov qword [rsp + 0x208], 0
mov qword [rsp + 0x218], 0
mov rax, qword [0x005bb190]
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x1e0], rdx
mov rdx, qword [rax + 0x50]
mov qword [rsp + 0x1e8], rdx
mov rdx, qword [rax + 0x178]
mov qword [rsp + 0x1f0], rdx
mov qword [rsp + 0x1f8], r15
mov edx, dword [rsp + 0x2f8]
mov dword [rsp + 0x208], edx
mov rdx, qword [rsp + 0x300]
mov qword [rsp + 0x210], rdx
movzx ebx, bl
mov dword [rsp + 0x218], ebx
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r12
mov rdx, r15
mov rcx, r13
call qword [rax + 0x268]
test eax, eax
je 0x401d20
lea rax, [rbp + 0x18]
mov qword [rsp + 0x78], rax
movzx ebx, word [rbp + 0x14]
add rbx, rax
cmp word [rbp + 6], 0
je 0x401db7
mov edi, 0
jmp 0x401d58
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x250]
mov esi, 0
jmp 0x4029b3
add edi, 1
add rbx, 0x28
movzx eax, word [rbp + 6]
cmp eax, edi
je 0x401db7
mov r9d, dword [rbx + 0x10]
test r9d, r9d
je 0x401d49
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0xc]
add rdx, r15
mov qword [rsp + 0x20], 0
mov r9d, r9d
lea r8, [r12 + rax]
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x268]
test eax, eax
jne 0x401d49
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x250]
mov esi, 0
jmp 0x4029b3
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
mov edx, 0
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x248]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x401f86
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0x1e0]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x268]
test eax, eax
je 0x401faf
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x14f0
mov edx, 0
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x248]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x401ff2
mov qword [rsp + 0x20], 0
mov r9d, 0x4f0
lea r8, [0x005b5380]
mov rdx, qword [rsp + 0x70]
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x268]
test eax, eax
je 0x402035
mov dword [rsp + 0x1dc], 0
mov rbx, qword [0x005bb190]
lea rdi, [rsp + 0x1dc]
mov qword [rsp + 0x20], rdi
mov r9d, 0x40
mov r8d, dword [rbp + 0x50]
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x258]
mov qword [rsp + 0x20], rdi
mov r9d, 0x40
mov r8d, 0x4f0
mov rdi, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, r13
call qword [rbx + 0x258]
call qword [rbx + 0x1f8]
mov dword [rsp + 0x84], eax
test sil, sil
jne 0x402107
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8d, 0
mov edx, 0
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x1d0]
test rax, rax
je 0x402092
cmp qword [rsp + 0x310], 0
je 0x4020ea
mov rdi, qword [rsp + 0x310]
mov qword [rdi], rax
mov byte [rsp + 0x83], 1
mov rbx, qword [0x005bb190]
mov r12, rbx
mov r14, rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], r15
mov rbp, qword [rsp + 0x68]
mov r15d, dword [rsp + 0x84]
jmp 0x4024f2
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x250]
mov esi, 0
jmp 0x4029b3
mov rbx, qword [0x005bb190]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov esi, 0
jmp 0x4029b3
mov rbx, qword [0x005bb190]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov esi, 0
jmp 0x4029b3
mov rbx, qword [0x005bb190]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x70]
mov rcx, r13
call qword [rbx + 0x250]
mov esi, 0
jmp 0x4029b3
mov rbx, qword [0x005bb190]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x70]
mov rcx, r13
call qword [rbx + 0x250]
jmp 0x4029b3
mov rcx, rax
mov rax, qword [0x005bb190]
call qword [rax + 0xc0]
mov byte [rsp + 0x83], 1
jmp 0x401f5d
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 9]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0xa8]
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x268]
test eax, eax
je 0x40217e
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov rbx, qword [0x005bb190]
mov rsi, rbx
mov rdi, rbx
jmp 0x40222a
mov rbx, qword [0x005bb190]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x70]
mov rcx, r13
call qword [rbx + 0x250]
mov esi, 0
jmp 0x4029b3
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0xb8], rax
jne 0x402262
call qword [rsi + 0x1f8]
sub eax, dword [rsp + 0x84]
cmp eax, dword [rsp + 0x308]
jae 0x402262
mov ecx, dword [rsp + 0x2d0]
call qword [rdi + 0x218]
mov rax, qword [rsp + 0xb0]
cmp rax, qword [rsp + 0xb8]
je 0x40222a
mov qword [rsp + 0xb8], rax
mov eax, dword [rsp + 0x2a0]
mov dword [rsp + 0xd0], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0xd0]
lea rcx, [0x004042bd]
call qword [rbx + 0x280]
jmp 0x4021db
mov rax, qword [rsp + 0xb0]
cmp qword [rsp + 0xb8], rax
je 0x4024a2
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x90], rax
mov rax, qword [0x005bb190]
mov r9, qword [rax + 0xf8]
mov byte [rsp + 0x22a], 0x5d
mov byte [rsp + 0x22b], 0x40
mov byte [rsp + 0x22c], 0x51
mov byte [rsp + 0x22d], 0x5a
mov byte [rsp + 0x22e], 0x5b
mov byte [rsp + 0x22f], 0x16
mov byte [rsp + 0x230], 0x5d
mov byte [rsp + 0x231], 0x56
mov byte [rsp + 0x232], 0x57
mov byte [rsp + 0x233], 0x3c
lea r8, [rsp + 0x22a]
mov ecx, 0
mov r10d, 0x4bda12f7
mov eax, ecx
imul r10d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul eax, edx, 0x36
mov edi, ecx
sub edi, eax
mov eax, edi
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 0xa
jne 0x4022f6
lea rcx, [rsp + 0x22a]
call r9
mov qword [rsp + 0x98], rax
mov rbx, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
cmp r12, rbx
je 0x4024ac
mov byte [rsp + 0x83], 0
mov rdi, qword [0x005bb190]
jmp 0x4023a9
cmp qword [rbx], 0
je 0x40239c
mov dword [rsp + 0xa4], 0
lea rdx, [rsp + 0xa4]
mov rcx, qword [rbx]
mov rax, qword [0x005bb190]
call qword [rax + 0x290]
mov esi, eax
test eax, eax
je 0x40239c
mov eax, dword [rsp + 0x2a0]
cmp dword [rsp + 0xa4], eax
je 0x4023c2
add rbx, 8
cmp r12, rbx
je 0x40246d
lea rdx, [rsp + 0xd0]
mov r8d, 0x104
mov rcx, qword [rbx]
call qword [rdi + 0x288]
jmp 0x40235d
mov r9d, esi
mov r8, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x90]
mov ecx, 3
mov rax, qword [0x005bb190]
call qword [rax + 0x2a8]
mov qword [rsp + 0x88], rax
test rax, rax
je 0x40239c
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, esi
mov rax, qword [0x005bb190]
call qword [rax + 0x2a0]
mov ecx, 0xa
mov rax, qword [0x005bb190]
call qword [rax + 0x218]
mov ecx, 0xa
mov rax, qword [0x005bb190]
call qword [rax + 0x218]
mov rcx, qword [rsp + 0x88]
mov rax, qword [0x005bb190]
call qword [rax + 0x2b0]
cmp byte [rsp + 0x50], 0
jne 0x402465
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x83], al
jmp 0x40239c
mov byte [rsp + 0x83], r14b
mov rax, qword [rsp + 0xb0]
cmp rax, qword [rsp + 0xb8]
je 0x402487
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x401f5d
call fcn.004acb50
jmp 0x401f5d
mov byte [rsp + 0x83], 0
jmp 0x402487
mov byte [rsp + 0x83], 0
jmp 0x402487
cmp rdi, 0x404040
sete sil
movzx edx, byte [rsp + 0x83]
xor edx, 1
or esi, edx
or sil, al
jne 0x40258d
mov ecx, 0xa
mov rax, qword [0x005bb190]
call qword [rax + 0x218]
test rdi, rdi
jne 0x4025ef
mov dword [rsp + 0xb0], 0
lea rdx, [rsp + 0xb0]
mov rcx, r13
call qword [rbx + 0x278]
cmp dword [rsp + 0xb0], 0x103
jne 0x4025e5
lea rdi, [rsp + 0xd0]
mov ecx, 8
mov eax, 0
rep stosq qword [rdi], rax
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0xd0]
mov rdx, rbp
mov rcx, r13
call qword [r12 + 0x270]
mov rdi, qword [rsp + 0xf0]
mov eax, 0
cmp dword [rsp + 0x308], 0
je 0x4024b6
call qword [r14 + 0x1f8]
sub eax, r15d
cmp eax, dword [rsp + 0x308]
setae al
jmp 0x4024b6
mov r15, qword [rsp + 0x48]
mov rbx, qword [0x005bb190]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x70]
mov rcx, r13
call qword [rbx + 0x250]
mov esi, 0
jmp 0x4029b3
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x48]
mov ecx, 0x1400000
call sub.msvcrt.dll_malloc
mov r14, rax
test rax, rax
je 0x4029b3
mov r8d, 0x1400000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
cmp byte [rsp + 0x60], 0
je 0x40264e
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r14
mov rdx, r15
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x268]
cmp dword [rsp + 0x2d0], 0
je 0x40266c
mov ecx, dword [rsp + 0x2d0]
mov rax, qword [0x005bb190]
call qword [rax + 0x218]
cmp byte [rsp + 0x64], 0
je 0x402917
movzx ebx, word [rbp + 0x14]
add rbx, qword [rsp + 0x78]
cmp word [rbp + 6], 0
je 0x4029f4
mov esi, 0
mov rdi, qword [0x005bb190]
lea r12, [rsp + 0x23b]
lea rax, [rsp + 0x241]
mov qword [rsp + 0x48], rax
jmp 0x402763
mov byte [rsp + 0x23b], 0x1d
mov byte [rsp + 0x23c], 0x46
mov byte [rsp + 0x23d], 0x46
mov byte [rsp + 0x23e], 0x44
mov byte [rsp + 0x23f], 0x54
mov byte [rsp + 0x240], 0x38
lea r8, [rsp + 0x23b]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul eax, edx, 0x36
mov edx, ecx
sub edx, eax
mov eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 6
jne 0x4026f4
mov rdx, r12
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402809
mov edx, dword [rbx + 0xc]
add rdx, r15
mov qword [rsp + 0x20], 0
mov r9d, dword [rbx + 8]
mov r8, r14
mov rcx, r13
call qword [rdi + 0x268]
add esi, 1
add rbx, 0x28
movzx eax, word [rbp + 6]
cmp eax, esi
je 0x402917
cmp dword [rbx + 8], 0
je 0x402750
cmp byte [rsp + 0x82], 0
jne 0x4026b1
mov byte [rsp + 0x234], 0x1d
mov byte [rsp + 0x235], 0x44
mov byte [rsp + 0x236], 0x51
mov byte [rsp + 0x237], 0x57
mov byte [rsp + 0x238], 0x43
mov byte [rsp + 0x239], 0x59
mov byte [rsp + 0x23a], 0x39
lea r8, [rsp + 0x234]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul eax, edx, 0x36
mov edx, ecx
sub edx, eax
mov eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 7
jne 0x4027c2
lea rdx, [rsp + 0x234]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402731
jmp 0x4026b1
mov byte [rsp + 0x241], 0x1d
mov byte [rsp + 0x242], 0x46
mov byte [rsp + 0x243], 0x50
mov byte [rsp + 0x244], 0x5a
mov byte [rsp + 0x245], 0x58
mov byte [rsp + 0x246], 0x5b
mov byte [rsp + 0x247], 0x39
lea r8, [rsp + 0x241]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
sar edx, 4
mov eax, ecx
sar eax, 0x1f
sub edx, eax
imul eax, edx, 0x36
mov edx, ecx
sub edx, eax
mov eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 7
jne 0x402854
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402731
mov byte [rsp + 0x248], 0x1d
mov byte [rsp + 0x249], 0x42
mov byte [rsp + 0x24a], 0x59
mov byte [rsp + 0x24b], 0x5f
mov byte [rsp + 0x24c], 0x4d
mov byte [rsp + 0x24d], 0x5d
mov byte [rsp + 0x24e], 0x4b
mov byte [rsp + 0x24f], 0x3a
lea r8, [rsp + 0x248]
mov ecx, 0
mov r9d, 0x4bda12f7
mov eax, ecx
imul r9d
mov eax, edx
sar eax, 4
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul eax, eax, 0x36
mov edx, ecx
sub edx, eax
mov eax, edx
add eax, 0x33
xor byte [r8], al
add ecx, 1
add r8, 1
cmp ecx, 8
jne 0x4028e6
jmp 0x402750
cmp byte [rsp + 0x5c], 0
je 0x402a3a
movzx ebx, word [rbp + 0x14]
add rbx, qword [rsp + 0x78]
cmp word [rbp + 6], 0
je 0x4029fb
mov esi, 0
mov r12, qword [0x005bb190]
lea rdi, [rsp + 0xd0]
jmp 0x402978
mov edx, dword [rbx + 0xc]
add rdx, r15
mov qword [rsp + 0x20], rdi
mov r8d, r8d
mov rcx, r13
call qword [r12 + 0x258]
add esi, 1
add rbx, 0x28
movzx eax, word [rbp + 6]
cmp eax, esi
je 0x4029fb
mov r8d, dword [rbx + 8]
test r8d, r8d
je 0x402965
mov dword [rsp + 0xd0], 0
mov eax, dword [rbx + 0x24]
mov r9d, 4
test eax, eax
js 0x40294c
and eax, 0x20000000
cmp eax, 1
sbb r9d, r9d
and r9d, 0xffffffe2
add r9d, 0x20
jmp 0x40294c
mov esi, 0
mov eax, esi
add rsp, 0x258
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov esi, 0
jmp 0x4029b3
mov esi, 0
jmp 0x4029b3
cmp byte [rsp + 0x5c], 0
je 0x402a3a
mov dword [rsp + 0xd0], 0
movzx eax, word [rbp + 0x14]
mov rdi, qword [rsp + 0x78]
mov r8d, dword [rax + rdi + 0xc]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, r15
mov rcx, r13
mov rax, qword [0x005bb190]
call qword [rax + 0x258]
mov rbx, qword [0x005bb190]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r14
mov rdi, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, r13
call qword [rbx + 0x268]
mov r9d, 0x8000
mov r8d, 0
mov rdx, rdi
mov rcx, r13
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call qword [rbx + 0x250]
mov rcx, r14
call fcn.00421788
mov esi, 1
jmp 0x4029b3