Function at 0x140001bc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x248
mov dword [rsp + 0x290], ecx
mov rbp, rdx
mov r12, r8
mov r13d, dword [rsp + 0x2b0]
mov eax, dword [rsp + 0x2b8]
mov dword [rsp + 0x64], eax
mov esi, dword [rsp + 0x2c8]
mov dword [rsp + 0x50], esi
mov ecx, dword [rsp + 0x2d0]
mov dword [rsp + 0x58], ecx
mov edi, dword [rsp + 0x2d8]
mov dword [rsp + 0x60], edi
mov ebx, dword [rsp + 0x2e0]
mov byte [rsp + 0x40], r13b
mov byte [rsp + 0x48], al
mov byte [rsp + 0x7e], bl
movsxd rdi, dword [r8 + 0x3c]
add rdi, r8
cmp word [rdi + 4], 0x8664
jne 0x1400029f4
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, dword [rdi + 0x50]
mov edx, 0
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x248]
mov r14, rax
test rax, rax
je 0x140002a11
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x208], 0
mov rax, qword [0x14016af10]
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x1d0], rdx
mov rdx, qword [rax + 0x50]
mov qword [rsp + 0x1d8], rdx
mov rdx, qword [rax + 0x178]
mov qword [rsp + 0x1e0], rdx
mov qword [rsp + 0x1e8], r14
mov edx, dword [rsp + 0x2e8]
mov dword [rsp + 0x1f8], edx
mov rdx, qword [rsp + 0x2f0]
mov qword [rsp + 0x200], rdx
movzx ebx, bl
mov dword [rsp + 0x208], ebx
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r12
mov rdx, r14
mov rcx, rbp
call qword [rax + 0x268]
test eax, eax
je 0x140001d3b
lea rax, [rdi + 0x18]
mov qword [rsp + 0x70], rax
movzx ebx, word [rdi + 0x14]
add rbx, rax
cmp word [rdi + 6], 0
je 0x140001dce
mov esi, 0
mov r15, qword [0x14016af10]
jmp 0x140001d74
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x250]
mov r13d, 0
jmp 0x1400029fa
add esi, 1
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp eax, esi
je 0x140001dce
mov r9d, dword [rbx + 0x10]
test r9d, r9d
je 0x140001d65
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], 0
mov r9d, r9d
lea r8, [r12 + rax]
mov rcx, rbp
call qword [r15 + 0x268]
test eax, eax
jne 0x140001d65
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
mov edx, 0
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x248]
mov r15, rax
test rax, rax
je 0x140001f7e
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0x1d0]
mov rdx, rax
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x268]
test eax, eax
je 0x140001fa8
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x14f0
mov edx, 0
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x248]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140001fea
mov qword [rsp + 0x20], 0
mov r9d, 0x4f0
lea r8, [0x140165060]
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x268]
test eax, eax
je 0x14000202c
mov dword [rsp + 0x1cc], 0
mov rbx, qword [0x14016af10]
lea rsi, [rsp + 0x1cc]
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
mov r8d, dword [rdi + 0x50]
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x258]
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
mov r8d, 0x4f0
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call qword [rbx + 0x258]
call qword [rbx + 0x1f8]
mov dword [rsp + 0x78], eax
test r13b, r13b
jne 0x1400020f8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r15
mov r9, rsi
mov r8d, 0
mov edx, 0
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x1d0]
test rax, rax
je 0x140002088
cmp qword [rsp + 0x300], 0
je 0x1400020de
mov rsi, qword [rsp + 0x300]
mov qword [rsi], rax
mov byte [rsp + 0x7f], 1
mov rsi, qword [0x14016af10]
mov r12, rsi
mov qword [rsp + 0x40], rdi
movzx edi, byte [rsp + 0x7f]
jmp 0x1400024cc
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov rbx, qword [0x14016af10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov rbx, qword [0x14016af10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov rbx, qword [0x14016af10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call qword [rbx + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov rbx, qword [0x14016af10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call qword [rbx + 0x250]
jmp 0x1400029fa
mov rcx, rax
mov rax, qword [0x14016af10]
call qword [rax + 0xc0]
mov byte [rsp + 0x7f], 1
jmp 0x140001f65
mov qword [rsp + 0x98], r15
mov rax, qword [rsp + 0x68]
lea rdx, [rax + 9]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x98]
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x268]
test eax, eax
je 0x14000216a
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov rbx, qword [0x14016af10]
mov rsi, rbx
mov r12, rbx
jmp 0x140002214
mov rbx, qword [0x14016af10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call qword [rbx + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], rax
jne 0x14000224c
call qword [rsi + 0x1f8]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x2f8]
jae 0x14000224c
mov ecx, dword [rsp + 0x2c0]
call qword [r12 + 0x218]
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
je 0x140002214
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0xc0], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0xc0]
lea rcx, [0x140004223]
call qword [rbx + 0x280]
jmp 0x1400021c6
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], rax
je 0x140002487
mov rax, qword [0x14016af10]
mov r8, qword [rax + 0xf8]
mov byte [rsp + 0x21a], 0x5a
mov byte [rsp + 0x21b], 0x41
mov byte [rsp + 0x21c], 0x52
mov byte [rsp + 0x21d], 0x5b
mov byte [rsp + 0x21e], 0x54
mov byte [rsp + 0x21f], 0x17
mov byte [rsp + 0x220], 0x5e
mov byte [rsp + 0x221], 0x57
mov byte [rsp + 0x222], 0x50
mov byte [rsp + 0x223], 0x3d
lea rcx, [rsp + 0x21a]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r9d, edx
sar r9d, 0x1f
sub eax, r9d
imul eax, eax, 0x37
mov r9d, edx
sub r9d, eax
lea eax, [r9 + 0x34]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 0xa
jne 0x1400022cd
lea rcx, [rsp + 0x21a]
call r8
mov qword [rsp + 0x88], rax
mov rbx, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xa8]
cmp r13, rbx
je 0x14000248e
mov byte [rsp + 0x7f], 0
mov r12, qword [0x14016af10]
jmp 0x140002386
cmp qword [rbx], 0
je 0x140002379
mov dword [rsp + 0x94], 0
lea rdx, [rsp + 0x94]
mov rcx, qword [rbx]
mov rax, qword [0x14016af10]
call qword [rax + 0x290]
mov esi, eax
test eax, eax
je 0x140002379
mov eax, dword [rsp + 0x290]
cmp dword [rsp + 0x94], eax
je 0x1400023a1
add rbx, 8
cmp r13, rbx
je 0x140002447
lea rdx, [rsp + 0xc0]
mov r8d, 0x104
mov rcx, qword [rbx]
call qword [r12 + 0x288]
jmp 0x14000233a
mov r9d, esi
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
mov ecx, 3
mov rax, qword [0x14016af10]
call qword [rax + 0x2a8]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x140002379
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, esi
mov rax, qword [0x14016af10]
call qword [rax + 0x2a0]
mov ecx, 0xa
mov rax, qword [0x14016af10]
call qword [rax + 0x218]
mov ecx, 0xa
mov rax, qword [0x14016af10]
call qword [rax + 0x218]
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x14016af10]
call qword [rax + 0x2b0]
cmp byte [rsp + 0x48], 0
jne 0x14000243e
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x7f], al
jmp 0x140002379
movzx eax, byte [rsp + 0x64]
mov byte [rsp + 0x7f], al
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
je 0x140002461
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140001f65
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
call fcn.1400bb9a0
jmp 0x140001f65
mov byte [rsp + 0x7f], 0
jmp 0x140002461
mov byte [rsp + 0x7f], 0
jmp 0x140002461
cmp rbx, 0x404040
sete r13b
mov edx, edi
xor edx, 1
or r13d, edx
or r13b, al
jne 0x1400025b9
mov ecx, 0xa
mov rax, qword [0x14016af10]
call qword [rax + 0x218]
test rbx, rbx
jne 0x140002615
mov dword [rsp + 0xa0], 0
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [rsi + 0x278]
cmp dword [rsp + 0xa0], 0x103
jne 0x14000260a
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rbp
call qword [r12 + 0x270]
mov rbx, qword [rsp + 0xe0]
mov eax, 0
cmp dword [rsp + 0x2f8], 0
je 0x140002495
mov rax, qword [0x14016af10]
call qword [rax + 0x1f8]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x2f8]
setae al
jmp 0x140002495
mov rbx, qword [0x14016af10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r14
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rbp
call qword [rbx + 0x250]
mov r13d, 0
jmp 0x1400029fa
mov rdi, qword [rsp + 0x40]
mov ecx, 0x1400000
call sub.msvcrt.dll_malloc
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400029fa
mov r8d, 0x1400000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
cmp byte [rsp + 0x50], 0
je 0x140002674
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x268]
cmp dword [rsp + 0x2c0], 0
je 0x140002692
mov ecx, dword [rsp + 0x2c0]
mov rax, qword [0x14016af10]
call qword [rax + 0x218]
cmp byte [rsp + 0x58], 0
je 0x14000295e
movzx ebx, word [rdi + 0x14]
add rbx, qword [rsp + 0x70]
cmp word [rdi + 6], 0
je 0x140002a41
mov esi, 0
mov r13, qword [0x14016af10]
lea rax, [rsp + 0x22b]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x231]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
movzx r15d, byte [rsp + 0x7e]
jmp 0x1400027a0
mov byte [rsp + 0x22b], 0x1a
mov byte [rsp + 0x22c], 0x47
mov byte [rsp + 0x22d], 0x45
mov byte [rsp + 0x22e], 0x45
mov byte [rsp + 0x22f], 0x5b
mov byte [rsp + 0x230], 0x39
lea rcx, [rsp + 0x22b]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x34]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 6
jne 0x140002724
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140002847
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], 0
mov r9d, r12d
mov r8, qword [rsp + 0x40]
mov rcx, rbp
call qword [r13 + 0x268]
add esi, 1
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp eax, esi
je 0x140002959
mov r12d, dword [rbx + 8]
test r12d, r12d
je 0x14000278d
test r15b, r15b
jne 0x1400026e7
mov byte [rsp + 0x224], 0x1a
mov byte [rsp + 0x225], 0x45
mov byte [rsp + 0x226], 0x52
mov byte [rsp + 0x227], 0x56
mov byte [rsp + 0x228], 0x4c
mov byte [rsp + 0x229], 0x58
mov byte [rsp + 0x22a], 0x3a
lea rcx, [rsp + 0x224]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x34]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 7
jne 0x1400027f7
lea rdx, [rsp + 0x224]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14000276c
jmp 0x1400026e7
mov byte [rsp + 0x231], 0x1a
mov byte [rsp + 0x232], 0x47
mov byte [rsp + 0x233], 0x53
mov byte [rsp + 0x234], 0x5b
mov byte [rsp + 0x235], 0x57
mov byte [rsp + 0x236], 0x5a
mov byte [rsp + 0x237], 0x3a
lea rcx, [rsp + 0x231]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x34]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 7
jne 0x14000288c
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x14000276c
mov byte [rsp + 0x238], 0x1a
mov byte [rsp + 0x239], 0x43
mov byte [rsp + 0x23a], 0x5a
mov byte [rsp + 0x23b], 0x5e
mov byte [rsp + 0x23c], 0x42
mov byte [rsp + 0x23d], 0x5c
mov byte [rsp + 0x23e], 0x48
mov byte [rsp + 0x23f], 0x3b
lea rcx, [rsp + 0x238]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x94f2095
sar rax, 0x21
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x37
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x34]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 8
jne 0x140002921
jmp 0x14000278d
mov r15, qword [rsp + 0x58]
cmp byte [rsp + 0x60], 0
je 0x140002a87
movzx ebx, word [rdi + 0x14]
add rbx, qword [rsp + 0x70]
cmp word [rdi + 6], 0
je 0x140002a48
mov esi, 0
mov r13, qword [0x14016af10]
lea r12, [rsp + 0xc0]
jmp 0x1400029be
mov edx, dword [rbx + 0xc]
add rdx, r14
mov qword [rsp + 0x20], r12
mov r8d, r8d
mov rcx, rbp
call qword [r13 + 0x258]
add esi, 1
add rbx, 0x28
movzx eax, word [rdi + 6]
cmp eax, esi
je 0x140002a48
mov r8d, dword [rbx + 8]
test r8d, r8d
je 0x1400029ab
mov dword [rsp + 0xc0], 0
mov eax, dword [rbx + 0x24]
mov r9d, 4
test eax, eax
js 0x140002993
and eax, 0x20000000
cmp eax, 1
sbb r9d, r9d
and r9d, 0xffffffe2
add r9d, 0x20
jmp 0x140002993
mov r13d, 0
mov eax, r13d
add rsp, 0x248
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r13d, 0
jmp 0x1400029fa
cmp byte [rsp + 0x60], 0
je 0x140002a87
mov dword [rsp + 0xc0], 0
movzx eax, word [rdi + 0x14]
mov rsi, qword [rsp + 0x70]
mov r8d, dword [rax + rsi + 0xc]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, r14
mov rcx, rbp
mov rax, qword [0x14016af10]
call qword [rax + 0x258]
mov rbx, qword [0x14016af10]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov rdi, qword [rsp + 0x40]
mov r8, rdi
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rbp
call qword [rbx + 0x268]
mov r9d, 0x8000
mov r8d, 0
mov rdx, rsi
mov rcx, rbp
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rbp
call qword [rbx + 0x250]
mov rcx, rdi
call fcn.140023238
mov r13d, 1
jmp 0x1400029fa