Function at 0x14004999c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov rbx, rcx
lea rcx, [0x140091f1a]
call fcn.14005d040
lea rdx, [rbp - 0x80]
mov qword [rbx + 0x298], rax
lea rcx, [0x140091f34]
call fcn.14005d45c
lea rsi, [rbx + 0x2a8]
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.14005e2dc
test eax, eax
jne 0x140049d25
mov rcx, qword [rsi]
call fcn.14005dee4
mov r8, qword [rsi]
lea rcx, [rbp - 0x80]
mov rdx, rax
mov qword [rbx + 0x2a0], rax
call fcn.14005e220
test eax, eax
jne 0x140049d41
lea rdx, [0x1400920aa]
lea rcx, [0x14009209e]
call fcn.140060c18
mov qword [rbx + 0x2b0], rax
test rax, rax
je 0x140049d5b
movsxd rdx, dword [rsi]
lea r8, [0x140092132]
mov rcx, qword [rbx + 0x2a0]
xor r9d, r9d
call fcn.14005c16c
mov rdi, rax
test eax, eax
jne 0x140049aae
movsxd rdx, dword [rsi]
lea r8, [0x1400921bc]
mov rcx, qword [rbx + 0x2a0]
xor r9d, r9d
call fcn.14005c16c
mov edi, eax
test eax, eax
jne 0x140049aae
movsxd rdx, dword [rsi]
lea r8, [0x14009225e]
mov rcx, qword [rbx + 0x2a0]
xor r9d, r9d
call fcn.14005c16c
mov edi, eax
test eax, eax
je 0x140049d75
mov byte [rsp + 0x30], 0x48
xor esi, esi
mov byte [rsp + 0x31], 0x8b
mov byte [rsp + 0x32], 0xc4
mov byte [rsp + 0x33], 0x48
mov byte [rsp + 0x34], 0x89
lea r13d, [rsi + 0xf]
mov byte [rsp + 0x35], 0x58
mov byte [rsp + 0x36], 8
mov byte [rsp + 0x37], 0x48
mov byte [rsp + 0x38], 0x89
mov byte [rsp + 0x39], 0x70
mov byte [rsp + 0x3a], 0x10
mov byte [rsp + 0x3b], 0x48
mov byte [rsp + 0x3c], 0x89
mov byte [rsp + 0x3d], 0x78
mov byte [rsp + 0x3e], 0x18
mov byte [rsp + 0x40], 0x4c
mov byte [rsp + 0x41], 0x8b
mov byte [rsp + 0x42], 0xdc
mov byte [rsp + 0x43], 0x49
mov byte [rsp + 0x44], 0x89
mov byte [rsp + 0x45], 0x5b
mov byte [rsp + 0x46], 8
mov byte [rsp + 0x47], 0x49
mov byte [rsp + 0x48], 0x89
mov byte [rsp + 0x49], 0x73
mov byte [rsp + 0x4a], 0x10
mov byte [rsp + 0x4b], 0x49
mov byte [rsp + 0x4c], 0x89
mov byte [rsp + 0x4d], 0x7b
mov byte [rsp + 0x4e], 0x18
movsxd r15, edi
movsxd r14, esi
lea rdx, [rsp + 0x30]
mov rcx, r15
mov r8, r13
sub rcx, r14
add rcx, qword [rbx + 0x2a0]
call sub.ntdll.dll_memcmp
test eax, eax
je 0x140049b9b
mov rcx, r15
lea rdx, [rsp + 0x40]
sub rcx, r14
mov r8, r13
add rcx, qword [rbx + 0x2a0]
call sub.ntdll.dll_memcmp
test eax, eax
je 0x140049b9b
inc esi
cmp esi, 0x80
jl 0x140049b4d
jmp 0x140049d8f
sub edi, esi
cmp edi, 0xffffffff
je 0x140049d8f
mov rcx, qword [rbx + 0x2a0]
mov edx, edi
call fcn.140060cc0
mov r14d, eax
add r14, qword [rbx + 0x298]
mov qword [rbx + 0x2b8], r14
and r14d, 0xfff
mov byte [rsp + 0x20], 0x48
xor esi, esi
mov byte [rsp + 0x21], 0xb8
mov byte [rsp + 0x22], 0
mov byte [rsp + 0x23], 0
mov byte [rsp + 0x24], 0
lea r13d, [rsi + 0xc]
mov byte [rsp + 0x25], 0
mov byte [rsp + 0x26], 0
mov byte [rsp + 0x27], 0
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
mov byte [rsp + 0x2a], 0xff
mov byte [rsp + 0x2b], 0xe0
mov qword [rbx + 0x68], 2
movsxd r15, edi
mov ecx, esi
lea rdx, [rsp + 0x50]
add rcx, r15
add rcx, qword [rbx + 0x2a0]
call section..text
test al, al
je 0x140049d0b
test dword [rsp + 0x72], 0x1000
jne 0x140049d0b
movzx eax, al
add esi, eax
cmp esi, r13d
jb 0x140049c19
mov ecx, esi
mov dword [rbx + 0x60], esi
call fcn.14005dee4
mov r8, r13
mov qword [rbx + 0x58], rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.ntdll.dll_memcpy
mov r8d, dword [rbx + 0x60]
mov edx, 0xcc
mov rcx, qword [rbx + 0x58]
sub r8, r13
add rcx, r13
call sub.ntdll.dll_memset
xor eax, eax
lea rdi, [rsp + 0x20]
mov rcx, r13
rep stosb byte [rdi], al
mov ecx, dword [rbx + 0x60]
inc rcx
call fcn.14005dee4
mov r8d, dword [rbx + 0x60]
xor edx, edx
mov rcx, rax
mov qword [rbx + 0x48], rax
and ecx, 0xfff
cmp rcx, r14
sete dl
lea rcx, [rdx + rax]
mov rdx, qword [rbx + 0x2a0]
add rdx, r15
mov qword [rbx + 0x50], rcx
call sub.ntdll.dll_memcpy
cmp byte [rbx + 0x40], 0
je 0x140049cea
mov rcx, rbx
call fcn.1400469c4
mov rcx, rbx
call fcn.140046b08
mov rcx, rbx
call fcn.1400463ec
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea rcx, [0x1400923d6]
call fcn.14005e468
mov rcx, rbx
call fcn.140047400
call fcn.140061c8c
int3
mov edx, eax
lea rcx, [0x140091f4e]
call fcn.14005e468
mov rcx, rbx
call fcn.140047400
call fcn.140061c8c
int3
lea rcx, [0x140091fc2]
call fcn.14005e468
mov rcx, rbx
call fcn.140047400
call fcn.140061c8c
int3
lea rcx, [0x1400920d8]
call fcn.14005e468
mov rcx, rbx
call fcn.140047400
call fcn.140061c8c
int3
lea rcx, [0x1400922fa]
call fcn.14005e468
mov rcx, rbx
call fcn.140047400
call fcn.140061c8c
int3
lea rcx, [0x140092368]
call fcn.14005e468
mov rcx, rbx
call fcn.140047400
call fcn.140061c8c
int3