Function at 0x1401f4f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor edi, edi
mov qword [rbp - 0x29], r9
xor sil, sil
mov byte [rbp - 0x39], r8b
xor r13d, r13d
mov qword [rbp - 0x19], rdx
cmp byte [0x1411dd026], sil
movzx r14d, r8b
mov r12, rcx
mov qword [rbp - 0x21], rcx
mov dword [rbp - 1], 0x69685428
mov bl, 0x3a
mov dword [rbp + 3], 0x69662073
mov word [rbp + 7], 0x656c
mov dword [rbp - 0x11], 0x486e6942
mov dword [rbp - 0xd], 0x34207865
mov word [rbp - 9], 0x302e
mov dword [rbp - 0x35], edi
je 0x1401f4fc1
xor al, al
jmp 0x1401f528f
mov ecx, dword [rcx + 0x28]
mov edx, 1
imul ecx, dword [r12 + 0x48]
mov qword [rsp + 0x98], r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r15, rax
test rax, rax
je 0x1401f5283
mov ecx, dword [r12 + 0x48]
xor edx, edx
mov r8, qword [rbp - 0x29]
mov eax, ecx
imul eax, dword [r12 + 0x28]
mov r9, r15
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rdx
movzx edx, r14b
mov dword [rsp + 0x20], eax
call fcn.1401c1720
test eax, eax
je 0x1401f527a
mov rax, qword [rbp - 1]
cmp rax, qword [r15]
jne 0x1401f527a
movzx eax, word [rbp + 7]
cmp ax, word [r15 + 8]
jne 0x1401f527a
mov rax, qword [rbp - 0x11]
cmp rax, qword [r15 + 0x22]
jne 0x1401f527a
movzx eax, word [rbp - 9]
cmp ax, word [r15 + 0x2a]
jne 0x1401f527a
cmp byte [0x1411dd026], sil
mov r14d, 0x2d
jne 0x1401f508d
mov r8d, dword [r12 + 0x28]
mov ecx, r14d
imul r8d, dword [r12 + 0x48]
mov edx, ecx
lea rax, [rdx + 1]
cmp rax, r8
jae 0x1401f508a
cmp bl, byte [rdx + r15]
je 0x1401f508a
inc edi
inc ecx
jmp 0x1401f5073
mov dword [rbp - 0x35], edi
mov ecx, edi
call fcn.1402b2a70
mov r8d, edi
xor edx, edx
mov rcx, rax
mov qword [rbp - 0x11], rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
test edi, edi
je 0x1401f50d8
mov rdx, rsi
mov r8d, edi
nop dword [rax]
nop word [rax + rax]
mov eax, r14d
lea rdx, [rdx + 1]
inc r14d
movzx ecx, byte [rax + r15]
mov byte [rdx - 1], cl
sub r8, 1
jne 0x1401f50c0
mov rcx, r15
add r14d, 0x40
add edi, 0x6d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [r12 + 0x28]
mov edx, 1
imul eax, dword [r12 + 0x48]
lea ecx, [rax + rax]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
cmp byte [0x1411dd026], r13b
mov r15, rax
jne 0x1401f5252
nop dword [rax]
nop word [rax + rax]
mov esi, dword [r12 + 0x28]
xor edx, edx
imul esi, dword [r12 + 0x48]
mov rcx, r15
lea r8d, [rsi + rsi]
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [r12 + 0x48]
xor edx, edx
mov r8d, ecx
mov eax, r14d
imul r8d, dword [r12 + 0x28]
div r8d
lea r9d, [r8 + r8]
mov eax, r14d
mov r12d, edx
xor edx, edx
div esi
movzx edx, byte [rbp - 0x39]
mov r8d, eax
xor eax, eax
add r8, qword [rbp - 0x29]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9, r15
call fcn.1401c1720
mov rax, qword [rbp - 0x21]
mov esi, dword [rbp - 0x35]
mov ecx, dword [rax + 0x28]
imul ecx, dword [rax + 0x48]
lea eax, [r12 + rsi]
mov dword [rbp - 0x31], ecx
cmp eax, ecx
jae 0x1401f5252
mov rcx, qword [rbp - 0x11]
lea rax, [r15 + r12]
mov rdx, rax
mov qword [rbp - 1], rax
mov r8d, esi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1401f51c5
lea eax, [rsi + 0x40]
mov r13d, esi
add r14d, eax
add edi, eax
jmp 0x1401f51f8
mov rdx, qword [rbp - 0x11]
mov rcx, qword [rbp - 1]
movzx eax, byte [rdx]
cmp al, byte [rcx]
jne 0x1401f520a
movzx eax, word [rdx]
cmp ax, word [rcx]
jne 0x1401f51eb
add r14d, 0x42
mov r13d, 2
add edi, 0x42
jmp 0x1401f51f8
add r14d, 0x41
mov r13d, 1
add edi, 0x41
cmp byte [0x1411dd026], 0
jne 0x1401f5252
mov r12, qword [rbp - 0x21]
jmp 0x1401f5120
mov ecx, 0xffffffc0
mov eax, ecx
sub eax, r13d
add edi, eax
lea eax, [r13 + 0x40]
cmp eax, r12d
jae 0x1401f5225
sub ecx, r13d
add r12d, ecx
cmp byte [0x1411dd026], 0
mov sil, 1
jne 0x1401f5255
mov edx, dword [rbp - 0x31]
lea rax, [r12 + 1]
cmp rax, rdx
jae 0x1401f5255
cmp bl, byte [r12 + r15]
je 0x1401f524b
inc r12d
inc edi
jmp 0x1401f5234
inc edi
add edi, r13d
jmp 0x1401f5255
xor sil, sil
test r15, r15
je 0x1401f5266
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor r15d, r15d
test sil, sil
je 0x1401f5283
mov rax, qword [rbp - 0x19]
mov ecx, edi
mov qword [rax + 0x10], rcx
test r15, r15
je 0x1401f5283
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x98]
movzx eax, sil
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xa0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret