Function at 0x14004a020
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
lea rbp, [rsp - 0x120]
sub rsp, 0x220
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
xchg r8, rdx
movups xmm0, xmmword [r8]
xchg r8, rdx
xchg r13, rcx
movups xmmword [r13], xmm0
xchg rcx, r13
mov dword [rcx + 0x10], 0x5af74f43
sub dword [rcx + 0x10], 0xe87239
sub dword [rcx + 0x10], 0x43418e6a
xor dword [rcx + 0x10], 0x7f67e9ea
xor dword [rcx + 0x10], 0x6513b0cb
add dword [rcx + 0x10], 0x4452fb52
sub dword [rcx + 0x10], 0x1d56728f
add dword [rcx + 0x10], 0x24d05864
add dword [rcx + 0x10], 0xa77a0757
xor eax, eax
mov qword [rcx + 0x18], rax
mov byte [rcx + 0x20], 0x43
xor byte [rcx + 0x20], 0x51
xor byte [rcx + 0x20], 0x69
sub byte [rcx + 0x20], 0x73
add byte [rcx + 0x20], 0x50
add byte [rcx + 0x20], 3
xor byte [rcx + 0x20], 0x7e
sub byte [rcx + 0x20], 0x24
mov dword [rcx + 0x24], r8d
mov qword [rcx + 0x28], rax
movdqa xmm0, xmmword [0x140002cd0]
movdqa xmm1, xmmword [0x140002ce0]
xchg rbp, rcx
movups xmmword [rbp + 0x30], xmm0
xchg rcx, rbp
xchg r8, rcx
movups xmmword [r8 + 0x40], xmm1
xchg rcx, r8
mov dword [rbp + 0xa0], 0x37031f7e
sub dword [rbp + 0xa0], 0x242ff7d2
sub dword [rbp + 0xa0], 0x9fb9164
xor dword [rbp + 0xa0], 0x7dc4aab
add dword [rbp + 0xa0], 0x154597f7
xor dword [rbp + 0xa0], 0x713e59cc
sub dword [rbp + 0xa0], 0x556f2ca1
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
movdqa xmm1, xmmword [0x140002cc0]
xchg rbp, r11
movdqu xmmword [r11 + 0xb8], xmm1
xchg r11, rbp
mov eax, dword [0x140001878]
mov dword [rbp + 0xa8], eax
movzx eax, word [0x14000187c]
mov word [rbp + 0xac], ax
mov byte [rbp + 0xae], 0x48
sub byte [rbp + 0xae], 0x29
xor byte [rbp + 0xae], 0x66
sub byte [rbp + 0xae], 0x5f
xor byte [rbp + 0xae], 0x43
sub byte [rbp + 0xae], 0x3b
xor byte [rbp + 0xae], 0x4b
sub byte [rbp + 0xae], 0x55
mov dword [rbp + 0x78], 0x1c9332f4
add dword [rbp + 0x78], 0x33608ce3
add dword [rbp + 0x78], 0x2563a835
xor dword [rbp + 0x78], 0x68ed0124
add dword [rbp + 0x78], 0x21224e5
add dword [rbp + 0x78], 0x3262859b
sub dword [rbp + 0x78], 0x11a51106
xor dword [rbp + 0x78], 0x2a06bdc9
sub dword [rbp + 0x78], 0x6a8cbefe
xchg r14, rbp
movups xmmword [r14 + 0x80], xmm0
xchg r14, rbp
xchg rbp, rdx
movdqu xmmword [rdx + 0x90], xmm1
xchg rdx, rbp
mov eax, dword [0x140001880]
mov dword [rbp + 0x80], eax
movzx eax, word [0x140001884]
mov word [rbp + 0x84], ax
mov byte [rbp + 0x86], 0x41
add byte [rbp + 0x86], 0x3d
add byte [rbp + 0x86], 0
xor byte [rbp + 0x86], 0x26
xor byte [rbp + 0x86], 0x5a
xor byte [rbp + 0x86], 0x39
sub byte [rbp + 0x86], 0x3b
mov dword [rbp + 0x50], 0x252cba17
xor dword [rbp + 0x50], 0x53f2f3bc
xor dword [rbp + 0x50], 0x12e8969
add dword [rbp + 0x50], 0x1a9160e
sub dword [rbp + 0x50], 0x8d1444a
sub dword [rbp + 0x50], 0x3232a615
sub dword [rbp + 0x50], 0x3e95ec05
xchg rbp, r14
movups xmmword [r14 + 0x58], xmm0
xchg r14, rbp
movdqa xmm1, xmmword [0x140002cb0]
xchg rdx, rbp
movdqu xmmword [rdx + 0x68], xmm1
xchg rbp, rdx
mov eax, dword [0x140001888]
mov dword [rbp + 0x58], eax
movzx eax, byte [0x14000188c]
mov byte [rbp + 0x5c], al
mov byte [rbp + 0x5d], 0x35
add byte [rbp + 0x5d], 0x26
xor byte [rbp + 0x5d], 0x77
add byte [rbp + 0x5d], 0x34
sub byte [rbp + 0x5d], 0x1e
xor byte [rbp + 0x5d], 0x42
mov dword [rbp + 0xf0], 0x44d942fd
add dword [rbp + 0xf0], 0x5892c3f
sub dword [rbp + 0xf0], 0x1215ebaf
add dword [rbp + 0xf0], 0x900d1f9
add dword [rbp + 0xf0], 0x3a73ad03
sub dword [rbp + 0xf0], 0x7bc10220
movups xmmword [rbp + 0xf8], xmm0
movdqa xmm1, xmmword [0x140002ca0]
movdqu xmmword [rbp + 0x108], xmm1
mov dword [rbp + 0xf8], 0x76d46a40
sub dword [rbp + 0xf8], 0x90be82c
xor dword [rbp + 0xf8], 0x3c1cab78
xor dword [rbp + 0xf8], 0x2fc94bc5
sub dword [rbp + 0xf8], 0x6956110b
sub dword [rbp + 0xf8], 0x34d01e1
add dword [rbp + 0xf8], 0x1d6e9859
sub dword [rbp + 0xf8], 0x28fd41ba
xor dword [rbp + 0xf8], 0x3d9fc835
mov byte [rbp + 0xfc], 0x3a
add byte [rbp + 0xfc], 0x31
sub byte [rbp + 0xfc], 0x60
add byte [rbp + 0xfc], 0x39
add byte [rbp + 0xfc], 4
sub byte [rbp + 0xfc], 0x3c
add byte [rbp + 0xfc], 0x64
xor byte [rbp + 0xfc], 0x65
sub byte [rbp + 0xfc], 0x15
mov dword [rbp + 0x28], 0x2f7ec696
add dword [rbp + 0x28], 0x457f21
add dword [rbp + 0x28], 0x4ae79e4d
sub dword [rbp + 0x28], 0x37088a24
add dword [rbp + 0x28], 0x3705f2b
xor dword [rbp + 0x28], 0x14cebc2a
sub dword [rbp + 0x28], 0x48105dab
sub dword [rbp + 0x28], 0xbcca712
xchg rbp, r14
movups xmmword [r14 + 0x30], xmm0
xchg rbp, r14
movdqa xmm1, xmmword [0x140002cc0]
xchg r11, rbp
movdqu xmmword [r11 + 0x40], xmm1
xchg r11, rbp
mov eax, dword [0x140001890]
mov dword [rbp + 0x30], eax
movzx eax, word [0x140001894]
mov word [rbp + 0x34], ax
mov byte [rbp + 0x36], 0x3e
sub byte [rbp + 0x36], 0x38
add byte [rbp + 0x36], 0x60
sub byte [rbp + 0x36], 0x19
sub byte [rbp + 0x36], 0x1b
sub byte [rbp + 0x36], 0x1f
add byte [rbp + 0x36], 0x2f
sub byte [rbp + 0x36], 0x42
mov dword [rbp], 0x4dfe2fef
xor dword [rbp], 0x3d723a30
sub dword [rbp], 0xe4df6ba
sub dword [rbp], 0xdf07c51
sub dword [rbp], 0x578c62
sub dword [rbp], 0x53f6161d
movups xmmword [rbp + 8], xmm0
movdqa xmm1, xmmword [0x140002cb0]
xchg rdi, rbp
movdqu xmmword [rdi + 0x18], xmm1
xchg rdi, rbp
mov eax, dword [0x140001898]
mov dword [rbp + 8], eax
movzx eax, byte [0x14000189c]
mov byte [rbp + 0xc], al
mov byte [rbp + 0xd], 0x2d
sub byte [rbp + 0xd], 1
xor byte [rbp + 0xd], 0x58
xor byte [rbp + 0xd], 0x11
add byte [rbp + 0xd], 0xc
sub byte [rbp + 0xd], 0x24
sub byte [rbp + 0xd], 0x4d
mov dword [rbp - 0x28], 0x1dd233ff
add dword [rbp - 0x28], 0x55e0a43
xor dword [rbp - 0x28], 0x1494b35
add dword [rbp - 0x28], 0x2fa16ff8
sub dword [rbp - 0x28], 0x48fdf940
sub dword [rbp - 0x28], 0x4f24a92
xor dword [rbp - 0x28], 0x42aa1d0
xchg r10, rbp
movups xmmword [r10 - 0x20], xmm0
xchg r10, rbp
movdqa xmm1, xmmword [0x140002cc0]
xchg r10, rbp
movdqu xmmword [r10 - 0x10], xmm1
xchg r10, rbp
mov eax, dword [0x1400018a0]
mov dword [rbp - 0x20], eax
movzx eax, word [0x1400018a4]
mov word [rbp - 0x1c], ax
mov byte [rbp - 0x1a], 0x2c
xor byte [rbp - 0x1a], 0x37
add byte [rbp - 0x1a], 0x46
add byte [rbp - 0x1a], 0x1d
xor byte [rbp - 0x1a], 0x4c
add byte [rbp - 0x1a], 0
xor byte [rbp - 0x1a], 0x50
add byte [rbp - 0x1a], 0x1c
sub byte [rbp - 0x1a], 0x7e
mov dword [rbp - 0x50], 0x7c53e1da
sub dword [rbp - 0x50], 0x3259d7c7
sub dword [rbp - 0x50], 0x753fa14
xor dword [rbp - 0x50], 0x464e45db
xor dword [rbp - 0x50], 0x317e3deb
xor dword [rbp - 0x50], 0x35967783
movups xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x140002cb0]
xchg rcx, rbp
movdqu xmmword [rcx - 0x38], xmm1
xchg rbp, rcx
mov eax, dword [0x1400018a8]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x1400018ac]
mov byte [rbp - 0x44], al
mov byte [rbp - 0x43], 0xe
add byte [rbp - 0x43], 0x60
xor byte [rbp - 0x43], 0x12
xor byte [rbp - 0x43], 0x26
sub byte [rbp - 0x43], 0x31
xor byte [rbp - 0x43], 6
xor byte [rbp - 0x43], 8
xor byte [rbp - 0x43], 0x27
mov dword [rbp - 0x78], 0x336cf654
add dword [rbp - 0x78], 0x353ac283
sub dword [rbp - 0x78], 0x62eff350
add dword [rbp - 0x78], 0x205c7958
xor dword [rbp - 0x78], 0x7c36452
add dword [rbp - 0x78], 0x14e7c469
add dword [rbp - 0x78], 0xafa7445
sub dword [rbp - 0x78], 0x41b992f2
xchg rbp, rdx
movups xmmword [rdx - 0x70], xmm0
xchg rbp, rdx
xchg rbp, r9
movdqu xmmword [r9 - 0x60], xmm1
xchg r9, rbp
mov eax, dword [0x1400018b0]
mov dword [rbp - 0x70], eax
movzx eax, byte [0x1400018b4]
mov byte [rbp - 0x6c], al
mov byte [rbp - 0x6b], 0x7c
sub byte [rbp - 0x6b], 0x66
xor byte [rbp - 0x6b], 0xb
sub byte [rbp - 0x6b], 0xb
xor byte [rbp - 0x6b], 0x51
xor byte [rbp - 0x6b], 0x6a
sub byte [rbp - 0x6b], 0x15
xor byte [rbp - 0x6b], 0x16
xor byte [rbp - 0x6b], 2
mov dword [rsp + 0x60], 0x5d84992d
sub dword [rsp + 0x60], 0x967899e
xor dword [rsp + 0x60], 0x5eceb7a8
xor dword [rsp + 0x60], 0x5422e2db
add dword [rsp + 0x60], 0x1e8584ae
xor dword [rsp + 0x60], 0x7d76dfee
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140002cc0]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [0x1400018b8]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1400018bc]
mov word [rsp + 0x6c], ax
mov byte [rsp + 0x6e], 0x78
sub byte [rsp + 0x6e], 0x5b
xor byte [rsp + 0x6e], 0x11
xor byte [rsp + 0x6e], 8
add byte [rsp + 0x6e], 0x6f
sub byte [rsp + 0x6e], 0x45
sub byte [rsp + 0x6e], 0x2e
mov dword [rbp + 0xc8], 0x343ff694
add dword [rbp + 0xc8], 0x494c933
xor dword [rbp + 0xc8], 0x5ca393b2
sub dword [rbp + 0xc8], 0x26a17304
add dword [rbp + 0xc8], 0x1e77b89a
add dword [rbp + 0xc8], 0x18da5d56
sub dword [rbp + 0xc8], 0x7527cf1e
xchg rbp, r8
movups xmmword [r8 + 0xd0], xmm0
xchg rbp, r8
movdqa xmm1, xmmword [0x140002ca0]
xchg rbp, r14
movdqu xmmword [r14 + 0xe0], xmm1
xchg rbp, r14
mov dword [rbp + 0xd0], 0x723a3b05
xor dword [rbp + 0xd0], 0x2471edc0
xor dword [rbp + 0xd0], 0x86c828b
add dword [rbp + 0xd0], 0xa7f415f
sub dword [rbp + 0xd0], 0x5988efb
sub dword [rbp + 0xd0], 0x223894ae
add dword [rbp + 0xd0], 0x318bf65f
mov byte [rbp + 0xd4], 0x32
add byte [rbp + 0xd4], 0x41
sub byte [rbp + 0xd4], 0x28
xor byte [rbp + 0xd4], 0x2c
sub byte [rbp + 0xd4], 0x28
sub byte [rbp + 0xd4], 0x3f
nop
add rcx, 0x45590b44
sub rcx, 0x45590af4
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x28]
xchg r8, rax
mov qword [rsp + 0x38], r8
xchg r8, rax
lea rax, [rbp]
xchg r8, rax
mov qword [rsp + 0x30], r8
xchg r8, rax
lea rax, [rbp - 0x28]
xchg r12, rax
mov qword [rsp + 0x28], r12
xchg r12, rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0xc8]
call fcn.140048800
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14004a860
inc rdx
xchg r11, rcx
mov r11, qword [rbp + 0xd0]
xchg r11, rcx
xchg rdi, rax
mov rdi, rcx
xchg rdi, rax
cmp rdx, 0x1000
jb 0x14004a85b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffffcfc010eb
sub rax, 0xffffffffcfc010f3
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
xchg r8, rdx
mov r8, qword [rbp - 0x80]
xchg r8, rdx
cmp rdx, 0x10
jb 0x14004a8ae
inc rdx
mov rcx, qword [rsp + 0x68]
xchg r11, rax
mov r11, rcx
xchg r11, rax
cmp rdx, 0x1000
jb 0x14004a8a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14004a8f7
inc rdx
mov rcx, qword [rbp - 0x70]
xchg rcx, r12
mov rax, r12
xchg rcx, r12
cmp rdx, 0x1000
jb 0x14004a8f2
sub rdx, 0xffffffffffffffd9
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14004a940
inc rdx
mov rcx, qword [rbp - 0x48]
xchg r15, rcx
mov rax, r15
xchg r15, rcx
cmp rdx, 0x1000
jb 0x14004a93b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
xchg rdx, rdi
mov rdi, qword [rbp - 8]
xchg rdx, rdi
cmp rdx, 0x10
jb 0x14004a9a9
inc rdx
xchg rcx, r12
mov r12, qword [rbp - 0x20]
xchg rcx, r12
xchg r11, rcx
mov rax, r11
xchg rcx, r11
cmp rdx, 0x1000
jb 0x14004a9a4
nop
sub rdx, 0x385b0220
add rdx, 0x385b0247
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
sub rax, 0xffffffffbdf01ba7
add rax, 0xffffffffbdf01b9f
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14004a9f8
inc rdx
mov rcx, qword [rbp + 8]
xchg r14, rcx
mov rax, r14
xchg r14, rcx
cmp rdx, 0x1000
jb 0x14004a9f3
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14004aa3b
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004aa36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x14004aa99
inc rdx
xchg rcx, rdx
mov rdx, qword [rbp + 0xf8]
xchg rdx, rcx
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
cmp rdx, 0x1000
jb 0x14004aa94
nop
sub rdx, 0x4c9e2eab
add rdx, 0x4c9e2ed2
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x14004aaf3
inc rdx
mov rcx, qword [rbp + 0x58]
xchg rcx, r11
mov rax, r11
xchg r11, rcx
cmp rdx, 0x1000
jb 0x14004aaee
nop
sub rdx, 0x460876b3
add rdx, 0x460876da
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
xchg r15, rdx
mov r15, qword [rbp + 0x98]
xchg rdx, r15
cmp rdx, 0x10
jb 0x14004ab4f
inc rdx
mov rcx, qword [rbp + 0x80]
xchg rbx, rax
mov rbx, rcx
xchg rbx, rax
cmp rdx, 0x1000
jb 0x14004ab4a
sub rdx, 0xffffffffffffffd9
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffffe7a8b5fc
sub rax, 0xffffffffe7a8b604
cmp rax, 0x1f
ja 0x14004aba5
call fcn.1401fd468
xchg r14, rdx
mov r14, qword [rbp + 0xc0]
xchg r14, rdx
cmp rdx, 0x10
jb 0x14004abb1
inc rdx
xchg rsi, rcx
mov rsi, qword [rbp + 0xa8]
xchg rsi, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004abac
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004abac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fd468
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
push rdx
push rbx
push rbx
xchg qword [rsp + 0x18], rbp
add rsp, 0x20
ret