Function at 0x140002530
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x2c8
mov qword [rsp + 0x278], 0xfffffffffffffffe
mov rax, qword [0x1400110c0]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov byte [rsp + 0x70], 0x22
mov byte [rsp + 0x71], 3
mov byte [rsp + 0x72], 0x16
mov byte [rsp + 0x73], 0x23
mov byte [rsp + 0x74], 0x15
mov byte [rsp + 0x75], 0x1f
mov byte [rsp + 0x76], 0x5a
mov byte [rsp + 0x77], 0x54
mov byte [rsp + 0x78], 0x4a
mov byte [rsp + 0x79], 0x29
mov byte [rsp + 0x7a], 0x1c
mov byte [rsp + 0x7b], 0x1f
mov byte [rsp + 0x7c], 0
mov byte [rsp + 0xe8], 0x69
mov byte [rsp + 0xe9], 0x66
mov byte [rsp + 0xea], 0x64
mov byte [rsp + 0xeb], 0
mov byte [rsp + 0x130], 0x4d
mov byte [rsp + 0x131], 0x70
mov byte [rsp + 0x132], 0x73
mov byte [rsp + 0x133], 0
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe8]
mov r8d, 0xc
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x38]
call fcn.140001340
nop
lea rax, [rsp + 0x148]
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x170]
call fcn.140002b10
mov qword [rsp + 0x280], rax
mov dl, 1
mov rcx, qword [rsp + 0x280]
call fcn.140001480
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x120], 0xe
mov byte [rsp + 0x121], 0x2a
mov byte [rsp + 0x122], 0xb
mov byte [rsp + 0x123], 0x15
mov byte [rsp + 0x124], 0x28
mov byte [rsp + 0x125], 0x21
mov byte [rsp + 0x126], 0x23
mov byte [rsp + 0x127], 0x2e
mov byte [rsp + 0x128], 0x1e
mov byte [rsp + 0x129], 0
mov byte [rsp + 0x12a], 0
lea rdi, [rsp + 0xe8]
lea rsi, [0x14000f084]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x130]
lea rsi, [0x14000f088]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x178]
mov qword [rsp + 0x1a0], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe8]
mov r8d, 0xa
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x1a0]
call fcn.140001340
mov qword [rsp + 0x288], rax
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x140]
call fcn.1400015f0
mov qword [rsp + 0x138], rax
mov r8d, 0x1000
mov edx, 0x5dc
mov ecx, 0x40000
call qword [rsp + 0x138]
mov qword [rsp + 0x118], rax
mov qword [rsp + 0xd0], 0
lea rdi, [rsp + 0xd8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x61], 0xc
mov byte [rsp + 0x62], 0x2a
mov byte [rsp + 0x63], 0x2c
mov byte [rsp + 0x64], 0x1d
mov byte [rsp + 0x65], 0x38
mov byte [rsp + 0x66], 7
mov byte [rsp + 0x67], 0x4b
mov byte [rsp + 0x68], 0x20
mov byte [rsp + 0x69], 0x28
mov byte [rsp + 0x6a], 5
mov byte [rsp + 0x6b], 0
lea rdi, [rsp + 0xe8]
lea rsi, [0x14000f08c]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x130]
lea rsi, [0x14000f090]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe8]
mov r8d, 0xb
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xa8]
call fcn.140001340
nop
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x1d0], rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x1d0]
call fcn.140002b10
mov qword [rsp + 0x290], rax
xor edx, edx
mov rcx, qword [rsp + 0x290]
call fcn.140001480
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
jne 0x140002886
mov dword [rsp + 0x1d8], 0
lea rcx, [rsp + 0xa8]
call fcn.140002b60
nop
lea rcx, [rsp + 0x38]
call fcn.140002b60
mov eax, dword [rsp + 0x1d8]
jmp 0x140002a8f
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x208], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x238], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
mov rcx, qword [rsp + 0x238]
call fcn.140002ab0
mov qword [rsp + 0x298], rax
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x208]
call fcn.1400022f0
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x2a8], rax
mov r9, qword [rsp + 0x2a8]
mov r8, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x140]
lea rcx, [rsp + 0xd0]
call fcn.140001630
mov byte [rsp + 0x90], 4
mov byte [rsp + 0x91], 0x15
mov byte [rsp + 0x92], 0x26
mov byte [rsp + 0x93], 0x23
mov byte [rsp + 0x94], 0x33
mov byte [rsp + 0x95], 0x19
mov byte [rsp + 0x96], 0x76
mov byte [rsp + 0x97], 0x43
mov byte [rsp + 0x98], 0x7e
mov byte [rsp + 0x99], 0x26
mov byte [rsp + 0x9a], 0x2f
mov byte [rsp + 0x9b], 0x1c
mov byte [rsp + 0x9c], 0
lea rdi, [rsp + 0xe8]
lea rsi, [0x14000f094]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x130]
lea rsi, [0x14000f098]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xe8]
mov r8d, 0xc
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xf0]
call fcn.140001340
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x268], rax
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x268]
call fcn.140002b10
mov qword [rsp + 0x2b0], rax
xor edx, edx
mov rcx, qword [rsp + 0x2b0]
call fcn.140001480
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x80]
call fcn.140002040
xor r8d, r8d
mov rdx, qword [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumThreadWindows]
mov dword [rsp + 0x270], 0
lea rcx, [rsp + 0xf0]
call fcn.140002b60
nop
lea rcx, [rsp + 0xa8]
call fcn.140002b60
nop
lea rcx, [rsp + 0x38]
call fcn.140002b60
mov eax, dword [rsp + 0x270]
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140005020
add rsp, 0x2c8
pop rdi
pop rsi
ret