Function at 0x14003a390
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor edi, edi
mov esi, 0x20a
lea ecx, [rdi + 1]
mov edx, esi
mov r14d, edi
call fcn.140077530
mov rbx, rax
test rax, rax
je 0x14003a777
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.1400013f0
movabs r15, 0xfffff78000000030
mov dl, 1
mov rcx, r15
call fcn.14005976c
lea edx, [rdi + 0x5c]
cmp al, 1
jne 0x14003a44b
lea ecx, [rdi + 0x3a]
movabs rax, 0xfffff78000000032
cmp cx, word [rax]
jne 0x14003a44b
movabs rax, 0xfffff78000000034
cmp dx, word [rax]
jne 0x14003a44b
mov r8d, 0x104
mov rdx, r15
mov rcx, rbx
call fcn.14007d514
mov word [rbx + 0x208], di
mov r14, rbx
jmp 0x14003a777
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.1400013f0
mov ecx, 0x421d
call fcn.140029ab4
mov ecx, 0x41db
mov qword [rbp - 0x58], rax
call fcn.140029ab4
mov ecx, 0x4235
mov qword [rbp - 0x60], rax
call fcn.140029ab4
mov ecx, 0x423b
mov rdi, rax
mov qword [rbp - 0x30], rax
call fcn.140029ab4
mov ecx, 0x423e
mov r13, rax
call fcn.140029ab4
mov ecx, 0x4241
mov qword [rbp - 0x48], rax
call fcn.140029ab4
mov ecx, 0x41c6
mov qword [rbp - 0x68], rax
call fcn.140029ab4
mov ecx, 0x4223
mov rsi, rax
call fcn.140029ab4
mov ecx, 0x422f
mov qword [rbp - 0x70], rax
call fcn.140029ab4
mov ecx, 0x4334
mov r12, rax
call fcn.140029ab4
mov r15, rax
xor eax, eax
cmp qword [rbp - 0x58], rax
je 0x14003a76f
cmp qword [rbp - 0x60], rax
je 0x14003a76f
test rdi, rdi
je 0x14003a76f
test r13, r13
je 0x14003a76f
cmp qword [rbp - 0x48], rax
je 0x14003a76f
cmp qword [rbp - 0x68], rax
je 0x14003a76f
test rsi, rsi
je 0x14003a76f
cmp qword [rbp - 0x70], rax
je 0x14003a76f
test r15, r15
je 0x14003a76f
test r12, r12
je 0x14003a76f
lea ecx, [rax + 1]
mov edx, 0x20a
call fcn.140077530
mov rdi, rax
test rax, rax
je 0x14003a76f
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 8]
mov dword [rbp + 0x28], 0x53005c
mov dword [rbp + 0x2c], 0x730079
mov dword [rbp + 0x30], 0x650074
mov dword [rbp + 0x34], 0x52006d
mov dword [rbp + 0x38], 0x6f006f
mov dword [rbp + 0x3c], 0x74
call qword [rbp - 0x58]
xorps xmm0, xmm0
xor ecx, ecx
mov dword [rsp + 0x68], pe_nt_image_headers64
lea rax, [rbp + 8]
movdqu xmmword [rbp - 8], xmm0
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x58], ecx
mov dword [rsp + 0x50], ecx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x40], 0x21
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], ecx
mov qword [rbp - 0x20], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x18]
lea r8, [rbp - 0x28]
lea rcx, [rbp - 0x78]
mov edx, 0x100000
mov dword [rbp - 0x28], 0x30
mov dword [rbp - 0x10], 0x240
mov qword [rbp - 0x18], rax
call qword [rbp - 0x30]
test eax, eax
js 0x14003a762
mov r8, qword [r12]
mov rcx, qword [rbp - 0x78]
and qword [rsp + 0x28], r14
xor r9d, r9d
lea rax, [rbp - 0x80]
lea edx, [r9 + 1]
mov qword [rsp + 0x20], rax
call rsi
xor r12d, r12d
test eax, eax
js 0x14003a75b
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14003a754
call fcn.140077dbc
lea esi, [r12 + 1]
cmp al, sil
jne 0x14003a754
mov rcx, qword [rbp - 0x80]
lea rdx, [rsp + 0x70]
mov rcx, qword [rcx + 8]
call r13
test eax, eax
js 0x14003a754
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14003a754
call qword [rbp - 0x60]
cmp al, sil
jne 0x14003a754
movzx eax, word [rsp + 0x70]
mov ecx, 0x206
sub ax, si
cmp ax, cx
ja 0x14003a747
test byte [rsp + 0x70], sil
jne 0x14003a747
lea r8, [rbp - 0x28]
lea rcx, [rbp - 0x50]
mov edx, esi
call qword [rbp - 0x48]
test eax, eax
js 0x14003a747
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x40]
xor r8d, r8d
mov dword [rbp - 0x40], 0x2080000
mov qword [rbp - 0x38], rdi
call qword [rbp - 0x68]
test eax, eax
js 0x14003a740
movzx eax, word [rbp - 0x40]
lea edx, [rsi + 0x5b]
mov rcx, rdi
shr rax, 1
mov word [rdi + rax*2], r12w
call fcn.14007d5ac
mov rsi, rax
test rax, rax
je 0x14003a740
cmp r12w, word [rax + 2]
je 0x14003a740
movzx r8d, word [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call fcn.1400010a0
movzx eax, word [rsp + 0x70]
mov r8d, 0x104
shr eax, 1
mov rdx, rsi
sub r8d, eax
movzx eax, word [rsp + 0x70]
shr rax, 1
lea rcx, [rbx + rax*2]
call fcn.14007d474
mov r14, rbx
mov rcx, qword [rbp - 0x50]
call r15
mov rcx, qword [rsp + 0x78]
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp - 0x80]
call qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
call r15
mov rcx, rdi
call fcn.140077564
test r14, r14
jne 0x14003a777
mov rcx, rbx
call fcn.140077564
mov rax, r14
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14008c320
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret