Function at 0x14009b7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x428]
sub rsp, 0x500
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
mov rax, qword [0x14015a040]
xor rax, rsp
mov qword [rbp + 0x380], rax
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov dword [rbp + 0x2d8], 0x626f523f
mov dword [rbp + 0x2dc], 0x786f6c
lea rdx, [rbp + 0x2d9]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rbp + 0x2e0]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm11, dword [rbp + 0x2e0]
cvtdq2ps xmm11, xmm11
movd xmm12, dword [rbp + 0x2e4]
cvtdq2ps xmm12, xmm12
mov rax, qword [0x1404362a0]
mov qword [rbp + 0x2d8], rax
movss xmm8, dword [0x140140f14]
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x2d8]
call fcn.140087ff0
nop
mov r15, qword [rbp + 0x360]
mov r12, qword [rbp + 0x368]
mov rdi, qword [rbp + 0x40]
cmp r15, r12
je 0x14009c367
mov r13, qword [rbp + 0x2d8]
add r13, 0x110
xor esi, esi
xorps xmm9, xmm9
movsd xmm10, qword [0x140140d90]
nop dword [rax + rax]
mov rbx, qword [r15]
mov dword [rbp + 0x331], esi
mov word [rbp + 0x335], si
mov byte [rbp + 0x337], 0
mov dword [rbp + 0x310], 0x12b2d92
mov qword [rbp + 0x318], r13
lea rax, [rbp + 0x378]
mov qword [rbp + 0x320], rax
mov qword [rbp + 0x328], 8
mov eax, dword [0x1404370f8]
mov dword [rbp + 0x314], eax
mov byte [rbp + 0x330], 0
test eax, eax
je 0x14009b99a
mov rcx, qword [0x1404370f0]
test rcx, rcx
je 0x14009b99a
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x310]
mov edx, 0x224a14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
add rbx, 0x298
mov dword [rbp + 0x359], esi
mov word [rbp + 0x35d], si
mov byte [rbp + 0x35f], 0
mov dword [rbp + 0x338], 0x12b2d92
mov qword [rbp + 0x340], rbx
lea rax, [rbp + 0x2d8]
mov qword [rbp + 0x348], rax
mov qword [rbp + 0x350], 8
mov eax, dword [0x1404370f8]
mov dword [rbp + 0x33c], eax
mov byte [rbp + 0x358], 0
test eax, eax
je 0x14009ba38
mov rcx, qword [0x1404370f0]
test rcx, rcx
je 0x14009ba38
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x28
lea rax, [rbp + 0x338]
mov qword [rsp + 0x20], rax
mov r9d, 0x28
lea r8, [rbp + 0x338]
mov edx, 0x224a14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp qword [rbp + 0x2d8], 0
je 0x14009c353
mov dword [rsp + 0x60], 0x6d754849
mov dword [rsp + 0x64], 0x696f6e61
mov word [rsp + 0x68], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea rax, [rsp + 0x61]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009ba80
lea rdx, [rsp + 0x61]
lea rcx, [rbp + 0x50]
call fcn.14000c790
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov qword [rbp + 0x300], rsi
mov dword [rsp + 0x48], 0x61654843
mov word [rsp + 0x4c], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea rax, [rsp + 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009bae0
lea rdx, [rsp + 0x49]
lea rcx, [rbp + 0x50]
call fcn.14000c790
lea r8, [rbp + 0x50]
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x60], 0x7070553d
mov dword [rbp - 0x5c], 0x6f547265
mov dword [rbp - 0x58], 0x6f7372
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], rsi
lea rax, [rbp - 0x5f]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009bb50
lea rdx, [rbp - 0x5f]
lea rcx, [rbp + 0x90]
call fcn.14000c790
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x258]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x50], 0x776f4c19
mov dword [rbp - 0x4c], 0x6f547265
mov dword [rbp - 0x48], 0x6f7372
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rsi
mov qword [rbp + 0xc8], rsi
lea rax, [rbp - 0x4f]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009bbc0
lea rdx, [rbp - 0x4f]
lea rcx, [rbp + 0xb0]
call fcn.14000c790
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x10], 0x66654c74
mov dword [rbp - 0xc], 0x70705574
mov dword [rbp - 8], 0x72417265
mov word [rbp - 4], 0x6d
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], rsi
lea rax, [rbp - 0xf]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009bc32
lea rdx, [rbp - 0xf]
lea rcx, [rbp + 0xd0]
call fcn.14000c790
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x268]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x40], 0x66654c02
mov dword [rbp - 0x3c], 0x776f4c74
mov dword [rbp - 0x38], 0x72417265
mov word [rbp - 0x34], 0x6d
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x108], rsi
lea rax, [rbp - 0x3f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009bca4
lea rdx, [rbp - 0x3f]
lea rcx, [rbp + 0xf0]
call fcn.14000c790
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rsp + 0x70], 0x66654c5e
mov dword [rsp + 0x74], 0x6e614874
mov word [rsp + 0x78], 0x64
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], rsi
lea rax, [rsp + 0x71]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009bd13
lea rdx, [rsp + 0x71]
lea rcx, [rbp + 0x110]
call fcn.14000c790
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x278]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp + 0x10], 0x67695277
mov dword [rbp + 0x14], 0x70557468
mov dword [rbp + 0x18], 0x41726570
mov word [rbp + 0x1c], 0x6d72
mov byte [rbp + 0x1e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], rsi
lea rax, [rbp + 0x11]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009bd90
lea rdx, [rbp + 0x11]
lea rcx, [rbp + 0x130]
call fcn.14000c790
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp + 0x20], 0x6769527c
mov dword [rbp + 0x24], 0x6f4c7468
mov dword [rbp + 0x28], 0x41726577
mov word [rbp + 0x2c], 0x6d72
mov byte [rbp + 0x2e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x168], rsi
lea rax, [rbp + 0x21]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009be06
lea rdx, [rbp + 0x21]
lea rcx, [rbp + 0x150]
call fcn.14000c790
lea r8, [rbp + 0x150]
lea rdx, [rbp + 0x288]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x80], 0x6769522b
mov dword [rbp - 0x7c], 0x61487468
mov word [rbp - 0x78], 0x646e
mov byte [rbp - 0x76], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rsi
lea rax, [rbp - 0x7f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009be75
lea rdx, [rbp - 0x7f]
lea rcx, [rbp + 0x170]
call fcn.14000c790
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x30], 0x66654c36
mov dword [rbp - 0x2c], 0x70705574
mov dword [rbp - 0x28], 0x654c7265
mov word [rbp - 0x24], 0x67
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1a8], rsi
lea rax, [rbp - 0x2f]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009bef0
lea rdx, [rbp - 0x2f]
lea rcx, [rbp + 0x190]
call fcn.14000c790
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x298]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x20], 0x66654c4e
mov dword [rbp - 0x1c], 0x776f4c74
mov dword [rbp - 0x18], 0x654c7265
mov word [rbp - 0x14], 0x67
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], rsi
mov qword [rbp + 0x1c8], rsi
lea rax, [rbp - 0x1f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009bf62
lea rdx, [rbp - 0x1f]
lea rcx, [rbp + 0x1b0]
call fcn.14000c790
lea r8, [rbp + 0x1b0]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rsp + 0x50], 0x66654c55
mov dword [rsp + 0x54], 0x6f6f4674
mov word [rsp + 0x58], 0x74
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], rsi
lea rax, [rsp + 0x51]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009bfd1
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x1d0]
call fcn.14000c790
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp + 0x30], 0x67695277
mov dword [rbp + 0x34], 0x70557468
mov dword [rbp + 0x38], 0x4c726570
mov word [rbp + 0x3c], 0x6765
mov byte [rbp + 0x3e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
mov qword [rbp + 0x200], rsi
mov qword [rbp + 0x208], rsi
lea rax, [rbp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14009c050
lea rdx, [rbp + 0x31]
lea rcx, [rbp + 0x1f0]
call fcn.14000c790
lea r8, [rbp + 0x1f0]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp], 0x6769526b
mov dword [rbp + 4], 0x6f4c7468
mov dword [rbp + 8], 0x4c726577
mov word [rbp + 0xc], 0x6765
mov byte [rbp + 0xe], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], rsi
mov qword [rbp + 0x228], rsi
lea rax, [rbp + 1]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c0c6
lea rdx, [rbp + 1]
lea rcx, [rbp + 0x210]
call fcn.14000c790
lea r8, [rbp + 0x210]
lea rdx, [rbp + 0x2b8]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
mov dword [rbp - 0x70], 0x67695227
mov dword [rbp - 0x6c], 0x6f467468
mov word [rbp - 0x68], 0x746f
mov byte [rbp - 0x66], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], rsi
lea rax, [rbp - 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14009c135
lea rdx, [rbp - 0x6f]
lea rcx, [rbp + 0x230]
call fcn.14000c790
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x2d8]
call fcn.140088160
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2f8], xmm0
mov qword [rbp + 0x308], rsi
mov ecx, 0x78
call fcn.140113090
mov qword [rbp + 0x2f8], rax
mov qword [rbp + 0x300], rax
lea r14, [rax + 0x78]
mov qword [rbp + 0x308], r14
mov r8d, 0x78
lea rdx, [rbp + 0x250]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x300], r14
mov rsi, qword [rbp + 0x2f8]
cmp rsi, r14
je 0x14009c30d
nop word [rax + rax]
mov rbx, qword [rsi]
test rbx, rbx
je 0x14009c2f9
lea rdx, [rbx + 0x158]
call fcn.14008a220
lea r8, [rax + 0x140]
lea rdx, [rbp + 0x2e8]
call fcn.14008a6c0
movsd xmm0, qword [rbp + 0x2e8]
movsd qword [rbp + 0x70], xmm0
mov eax, dword [rbp + 0x2f0]
mov dword [rbp + 0x78], eax
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x48]
call fcn.140088450
movss xmm6, dword [rbp + 0x48]
comiss xmm9, xmm6
ja 0x14009c2f9
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
ja 0x14009c2f9
movss xmm6, dword [rbp + 0x4c]
comiss xmm9, xmm6
ja 0x14009c2f9
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm6, xmm0
ja 0x14009c2f9
movsd xmm0, qword [rbp + 0x2e8]
movsd qword [rbp + 0x80], xmm0
mov eax, dword [rbp + 0x2f0]
mov dword [rbp + 0x88], eax
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x40]
call fcn.140088450
movss xmm6, dword [rbp + 0x40]
subss xmm6, xmm11
movss xmm0, dword [rbp + 0x44]
subss xmm0, xmm12
cvtps2pd xmm0, xmm0
movaps xmm1, xmm10
call fcn.140114317
movaps xmm7, xmm0
cvtps2pd xmm0, xmm6
movaps xmm1, xmm10
call fcn.140114317
addsd xmm7, xmm0
xorps xmm1, xmm1
ucomisd xmm1, xmm7
ja 0x14009c2e0
xorps xmm0, xmm0
sqrtsd xmm0, xmm7
jmp 0x14009c2e8
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrt
cvtsd2ss xmm0, xmm0
comiss xmm8, xmm0
jbe 0x14009c2f9
mov rdi, rbx
movaps xmm8, xmm0
add rsi, 8
cmp rsi, r14
jne 0x14009c1d0
mov rsi, qword [rbp + 0x2f8]
test rsi, rsi
je 0x14009c351
mov rax, qword [rbp + 0x308]
sub rax, rsi
sar rax, 3
lea rdx, [rax*8]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14009c349
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14009c3a2
mov rcx, rsi
call fcn.140113314
xor esi, esi
add r15, 8
cmp r15, r12
jne 0x14009b900
mov r15, qword [rbp + 0x360]
test r15, r15
je 0x14009c3b1
mov rdx, qword [rbp + 0x370]
sub rdx, r15
and rdx, 0xfffffffffffffff8
mov rax, r15
cmp rdx, 0x1000
jb 0x14009c3a9
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009c3a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, r15
call fcn.140113314
mov rax, rdi
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.140112f50
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret