Function at 0x1401dd410
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor ebx, ebx
mov qword [rbp - 9], r9
cmp byte [0x1411dd026], bl
mov r15, r9
movzx r12d, r8b
mov byte [rbp - 0x21], r8b
mov qword [rbp - 1], rdx
mov rdi, rcx
mov qword [rbp - 0x11], rcx
mov r13b, 0x4f
mov byte [rbp - 0x33], 0
mov dword [rbp + 7], 0x424f4200
mov dword [rbp - 0x31], 0x4b4e4843
mov dword [rbp - 0x2d], 0x54455344
mov dword [rbp - 0x29], 0x494e4448
mov dword [rbp - 0x25], 0x4c595453
mov dword [rbp - 0x39], 0x4c425445
mov dword [rbp - 0x1d], ebx
mov byte [rbp - 0x34], bl
mov byte [rbp - 0x35], bl
je 0x1401dd499
xor al, al
jmp 0x1401dd820
mov ecx, dword [rcx + 0x28]
mov edx, 1
imul ecx, dword [rdi + 0x48]
mov qword [rsp + 0x98], r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x1401dd814
mov qword [rsp + 0xa0], rsi
xor edx, edx
mov esi, dword [rdi + 0x48]
mov rcx, r14
mov eax, esi
imul eax, dword [rdi + 0x28]
mov r8d, eax
mov edi, eax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov r9, r14
mov dword [rsp + 0x30], eax
mov r8, r15
mov qword [rsp + 0x28], rax
movzx edx, r12b
mov ecx, esi
mov dword [rsp + 0x20], edi
call fcn.1401c1720
mov rcx, r14
test eax, eax
je 0x1401dd806
mov eax, dword [rbp + 7]
cmp eax, dword [r14 + 3]
jne 0x1401dd806
cmp r13b, byte [r14 + 7]
jne 0x1401dd806
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp byte [0x1411dd026], bl
mov r13d, 8
mov byte [rbp - 0x33], 1
jne 0x1401dd80c
mov edi, dword [rbp - 0x31]
mov esi, dword [rbp - 0x2d]
mov r14d, dword [rbp - 0x29]
mov r15d, dword [rbp - 0x25]
mov r12d, dword [rbp - 0x39]
nop
mov rax, qword [rbp - 0x11]
xor edx, edx
mov r9d, dword [rax + 0x28]
mov ecx, r9d
mov r8d, dword [rax + 0x48]
mov eax, r13d
imul ecx, r8d
div ecx
add rax, qword [rbp - 9]
mov qword [rbp + 7], rax
cmp ebx, ecx
jbe 0x1401dd588
xor edx, edx
mov eax, ebx
div ecx
inc eax
imul eax, r9d
imul eax, r8d
jmp 0x1401dd58b
lea eax, [rcx + rcx]
mov ecx, eax
mov edx, 1
mov dword [rbp - 0x39], eax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbp - 0x19], rax
test rax, rax
je 0x1401dd80c
mov r8d, dword [rbp - 0x39]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbp - 0x19]
xor eax, eax
mov r8, qword [rbp + 7]
movzx edx, byte [rbp - 0x21]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x39]
mov dword [rsp + 0x20], eax
mov rax, qword [rbp - 0x11]
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x1401dd802
mov rax, qword [rbp - 0x11]
xor edx, edx
movzx r10d, byte [0x1411dd028]
movzx r11d, byte [0x1411dd026]
mov r8d, dword [rbp - 0x39]
mov ecx, dword [rax + 0x28]
imul ecx, dword [rax + 0x48]
mov eax, r13d
mov r9d, dword [rbp - 0x1d]
div ecx
mov rcx, qword [rbp - 0x19]
test r11b, r11b
jne 0x1401dd806
lea eax, [rdx + 8]
cmp eax, r8d
jae 0x1401dd7ab
cmp edi, dword [rdx + rcx]
jne 0x1401dd674
add edx, 0xfffffffc
xor r9d, r9d
mov dword [rbp - 0x1d], r9d
mov ebx, dword [rdx + rcx]
test r10b, r10b
jne 0x1401dd660
mov eax, ebx
mov byte [rbp - 0x22], bl
shr eax, 0x18
mov byte [rbp - 0x25], al
mov eax, ebx
shr eax, 0x10
mov byte [rbp - 0x24], al
mov eax, ebx
shr eax, 8
mov byte [rbp - 0x23], al
mov ebx, dword [rbp - 0x25]
add edx, ebx
add r13d, ebx
cmp ebx, 0x64
jb 0x1401dd674
add edx, 0xffffff9c
add r13d, 0xffffff9c
add ebx, 0xffffff9c
lea eax, [rdx + 8]
cmp eax, r8d
jae 0x1401dd7ab
cmp esi, dword [rdx + rcx]
jne 0x1401dd6c4
add edx, 4
xor r9d, r9d
mov dword [rbp - 0x1d], r9d
mov ebx, dword [rdx + rcx]
test r10b, r10b
jne 0x1401dd6b5
mov eax, ebx
mov byte [rbp - 0x26], bl
shr eax, 0x18
mov byte [rbp - 0x29], al
mov eax, ebx
shr eax, 0x10
mov byte [rbp - 0x28], al
mov eax, ebx
shr eax, 8
mov byte [rbp - 0x27], al
mov ebx, dword [rbp - 0x29]
add edx, 4
add r13d, 8
add edx, ebx
add r13d, ebx
add ebx, 4
lea eax, [rdx + 8]
cmp eax, r8d
jae 0x1401dd7ab
cmp r14d, dword [rdx + rcx]
jne 0x1401dd71f
cmp byte [rbp - 0x35], 0
jne 0x1401dd71f
add edx, 4
mov byte [rbp - 0x35], 1
xor r9d, r9d
mov dword [rbp - 0x1d], r9d
mov ecx, dword [rdx + rcx]
test r10b, r10b
jne 0x1401dd710
mov eax, ecx
mov byte [rbp - 0x2a], cl
shr eax, 0x18
mov byte [rbp - 0x2d], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x2c], al
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x2b], al
mov ecx, dword [rbp - 0x2d]
add edx, 4
add edx, ecx
add ecx, 8
add r13d, ecx
mov rcx, qword [rbp - 0x19]
lea eax, [rdx + 8]
cmp eax, r8d
jae 0x1401dd7ab
cmp r15d, dword [rdx + rcx]
jne 0x1401dd77a
cmp byte [rbp - 0x34], 0
jne 0x1401dd77a
add edx, 4
mov byte [rbp - 0x34], 1
xor r9d, r9d
mov dword [rbp - 0x1d], r9d
mov ecx, dword [rdx + rcx]
test r10b, r10b
jne 0x1401dd76b
mov eax, ecx
mov byte [rbp - 0x2e], cl
shr eax, 0x18
mov byte [rbp - 0x31], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp - 0x30], al
mov eax, ecx
shr eax, 8
mov byte [rbp - 0x2f], al
mov ecx, dword [rbp - 0x31]
add edx, 4
add edx, ecx
add ecx, 8
add r13d, ecx
mov rcx, qword [rbp - 0x19]
lea eax, [rdx + 8]
cmp eax, r8d
jae 0x1401dd7ab
cmp r12d, dword [rdx + rcx]
je 0x1401dd7c0
cmp r9d, 0x100000
jae 0x1401dd7ef
cmp r13d, 0x3200000
ja 0x1401dd7ef
inc edx
inc r13d
inc r9d
mov dword [rbp - 0x1d], r9d
jmp 0x1401dd616
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
cmp byte [0x1411dd026], 0
je 0x1401dd550
jmp 0x1401dd80c
add edx, 4
mov edx, dword [rdx + rcx]
test r10b, r10b
jne 0x1401dd7e9
mov eax, edx
mov byte [rbp - 0x36], dl
shr eax, 0x18
mov byte [rbp - 0x39], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x38], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x37], al
mov edx, dword [rbp - 0x39]
add edx, 8
add r13d, edx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 1]
mov eax, r13d
mov qword [rcx + 0x10], rax
jmp 0x1401dd80c
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0xa0]
movzx eax, byte [rbp - 0x33]
mov r14, qword [rsp + 0x98]
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret