Function at 0x1400058d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x160
mov r12, rdx
mov r14, rcx
mov rax, qword [0x140014c40]
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x21], 0x4e
mov byte [rsp + 0x22], 0x61
mov byte [rsp + 0x23], 0x66
mov byte [rsp + 0x24], 0x6c
mov byte [rsp + 0x25], 0x4e
mov byte [rsp + 0x26], 0x61
mov byte [rsp + 0x27], 0x7a
mov byte [rsp + 0x28], 0x7b
mov byte [rsp + 0x29], 0x7c
mov byte [rsp + 0x2a], 0x4e
mov byte [rsp + 0x2b], 0x61
mov byte [rsp + 0x2c], 0x64
mov byte [rsp + 0x2d], 0x6d
mov byte [rsp + 0x2e], 0x49
mov byte [rsp + 0x2f], 8
mov cl, byte [rsp + 0x20]
test cl, 1
jne 0x140005997
xor byte [rsp + 0x21], 8
xor byte [rsp + 0x22], 8
xor byte [rsp + 0x23], 8
xor byte [rsp + 0x24], 8
xor byte [rsp + 0x25], 8
xor byte [rsp + 0x26], 8
xor byte [rsp + 0x27], 8
xor byte [rsp + 0x28], 8
xor byte [rsp + 0x29], 8
xor byte [rsp + 0x2a], 8
xor byte [rsp + 0x2b], 8
xor byte [rsp + 0x2c], 8
xor byte [rsp + 0x2d], 8
xor byte [rsp + 0x2e], 8
xor byte [rsp + 0x2f], 8
mov rcx, qword [0x140014c38]
call rax
mov rdi, rax
mov rax, qword [0x140014c40]
mov byte [rsp + 0x20], 0
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x21], 0x59
mov byte [rsp + 0x22], 0x76
mov byte [rsp + 0x23], 0x71
mov byte [rsp + 0x24], 0x7b
mov byte [rsp + 0x25], 0x51
mov byte [rsp + 0x26], 0x7a
mov byte [rsp + 0x27], 0x67
mov byte [rsp + 0x28], 0x6b
mov byte [rsp + 0x29], 0x59
mov byte [rsp + 0x2a], 0x76
mov byte [rsp + 0x2b], 0x73
mov byte [rsp + 0x2c], 0x7a
mov byte [rsp + 0x2d], 0x5e
mov byte [rsp + 0x2e], 0x1f
mov cl, byte [rsp + 0x20]
test cl, 1
jne 0x140005a49
xor byte [rsp + 0x21], 0x1f
xor byte [rsp + 0x22], 0x1f
xor byte [rsp + 0x23], 0x1f
xor byte [rsp + 0x24], 0x1f
xor byte [rsp + 0x25], 0x1f
xor byte [rsp + 0x26], 0x1f
xor byte [rsp + 0x27], 0x1f
xor byte [rsp + 0x28], 0x1f
xor byte [rsp + 0x29], 0x1f
xor byte [rsp + 0x2a], 0x1f
xor byte [rsp + 0x2b], 0x1f
xor byte [rsp + 0x2c], 0x1f
xor byte [rsp + 0x2d], 0x1f
xor byte [rsp + 0x2e], 0x1f
mov rcx, qword [0x140014c38]
call rax
xor r15d, r15d
test rdi, rdi
je 0x140005c0c
mov rbx, rax
test rax, rax
je 0x140005c0c
mov dword [rsp + 0x20], ebx
mov eax, dword [rsp + 0x20]
imul eax, eax, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x140005ab6
mov eax, dword [rsp + 0x20]
add eax, ebx
add eax, 2
mov dword [rsp + 0x20], eax
nop word cs:[rax + rax]
nop dword [rax + rax]
mov eax, dword [rsp + 0x20]
test al, 3
jne 0x140005b9d
add dword [rsp + 0x20], 1
jmp 0x140005aa0
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x20]
test cl, 1
jne 0x140005b14
mov ecx, dword [rsp + 0x20]
test al, 3
je 0x140005b60
add ecx, 2
lea eax, [rbx + 3]
imul eax, ecx
jmp 0x140005ae3
add eax, 0xffffffff
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
test al, 1
jne 0x140005b9d
mov eax, dword [rsp + 0x20]
imul ecx, eax, 0xcccccccd
add ecx, 0x19999999
mov eax, dword [rsp + 0x20]
cmp ecx, 0x33333333
jae 0x140005ae0
add eax, 1
jmp 0x140005ae3
sub eax, ebx
add eax, 2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
imul eax, eax, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
ja 0x140005b9d
nop word cs:[rax + rax]
nop dword [rax]
add dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x20]
imul eax, eax, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x140005b40
jmp 0x140005b9d
imul eax, ecx, 0xcccccccd
add eax, 0x19999999
cmp eax, 0x33333333
jb 0x140005b9d
mov eax, dword [rsp + 0x20]
add eax, 0xb
lea ecx, [rbx + 0x17]
cdq
idiv ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
imul eax, eax, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
jbe 0x140005c42
lea rdx, [rsp + 0x20]
mov rcx, r14
call rdi
cmp rax, 0xffffffffffffffff
je 0x140005c0c
mov rdi, rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbx
test eax, eax
je 0x140005c03
lea rbp, [rsp + 0x4c]
lea rsi, [rsp + 0x20]
jmp 0x140005bdc
mov rcx, rdi
mov rdx, rsi
call rbx
test eax, eax
je 0x140005c03
test byte [rsp + 0x20], 0x10
jne 0x140005bd0
mov rcx, rbp
mov rdx, r12
call fcn.140004ef0
test eax, eax
jne 0x140005bd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15d, 1
jmp 0x140005c0c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, r15d
add rsp, 0x160
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add eax, 0xffffffff
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
imul eax, eax, 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jae 0x140005b9d
mov eax, dword [rsp + 0x20]
imul ecx, eax, 0xcccccccd
add ecx, 0x19999999
mov eax, dword [rsp + 0x20]
cmp ecx, 0x33333333
jb 0x140005c21
add eax, 1
jmp 0x140005c24