Function at 0x140049cb0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
push rbp
lea rbp, [rsp - 0x120]
sub rsp, 0x220
xchg rcx, rbx
mov rcx, rbx
xchg rcx, rbx
xchg r11, rdx
movups xmm0, xmmword [r11]
xchg rdx, r11
xchg rcx, r12
movups xmmword [r12], xmm0
xchg r12, rcx
mov dword [rcx + 0x10], 0x79be7848
xor dword [rcx + 0x10], 0x76eacf62
add dword [rcx + 0x10], 0x66839728
sub dword [rcx + 0x10], 0xc089f10
add dword [rcx + 0x10], 0x4a3adb9
xor dword [rcx + 0x10], 0x14b4d48
add dword [rcx + 0x10], 0x90c7ee4c
xor eax, eax
xchg r10, rax
mov qword [rcx + 0x18], r10
xchg r10, rax
mov byte [rcx + 0x20], 0x3c
add byte [rcx + 0x20], 7
add byte [rcx + 0x20], 0x2a
sub byte [rcx + 0x20], 0x49
add byte [rcx + 0x20], 0x3e
sub byte [rcx + 0x20], 0x35
sub byte [rcx + 0x20], 0x14
xor byte [rcx + 0x20], 0x2d
sub byte [rcx + 0x20], 0x33
mov dword [rcx + 0x24], r8d
xchg r10, rax
mov qword [rcx + 0x28], r10
xchg r10, rax
movdqa xmm0, xmmword [0x140002cd0]
movdqa xmm1, xmmword [0x140002ce0]
xchg r10, rcx
movups xmmword [r10 + 0x30], xmm0
xchg r10, rcx
movups xmmword [rcx + 0x40], xmm1
mov dword [rbp + 0xa0], 0x57e8629f
xor dword [rbp + 0xa0], 0x280772b0
sub dword [rbp + 0xa0], 0x12036ce4
sub dword [rbp + 0xa0], 0x151428a0
add dword [rbp + 0xa0], 0x124ede8c
sub dword [rbp + 0xa0], 0x49b21e20
sub dword [rbp + 0xa0], 0x21743aa2
xorps xmm0, xmm0
xchg rbp, r12
movups xmmword [r12 + 0xa8], xmm0
xchg rbp, r12
movdqa xmm1, xmmword [0x140002cc0]
xchg rbp, rsi
movdqu xmmword [rsi + 0xb8], xmm1
xchg rsi, rbp
mov eax, dword [0x140001878]
mov dword [rbp + 0xa8], eax
movzx eax, word [0x14000187c]
mov word [rbp + 0xac], ax
mov byte [rbp + 0xae], 0x4b
xor byte [rbp + 0xae], 0x57
add byte [rbp + 0xae], 0x49
sub byte [rbp + 0xae], 0x52
xor byte [rbp + 0xae], 0x53
xor byte [rbp + 0xae], 0x25
xor byte [rbp + 0xae], 0x65
mov dword [rbp + 0x78], 0x5dc98ffd
add dword [rbp + 0x78], 0x17258921
xor dword [rbp + 0x78], 0x3846558e
sub dword [rbp + 0x78], 0x31cd9d0c
sub dword [rbp + 0x78], 0x16737bd7
add dword [rbp + 0x78], 0xfae9808
add dword [rbp + 0x78], 0x672ac47e
sub dword [rbp + 0x78], 0x62723897
sub dword [rbp + 0x78], 0x18cf572f
xchg rdi, rbp
movups xmmword [rdi + 0x80], xmm0
xchg rdi, rbp
xchg rbp, r9
movdqu xmmword [r9 + 0x90], xmm1
xchg rbp, r9
mov eax, dword [0x140001880]
mov dword [rbp + 0x80], eax
movzx eax, word [0x140001884]
mov word [rbp + 0x84], ax
mov byte [rbp + 0x86], SHCreateMemStream
xor byte [rbp + 0x86], 0x5a
sub byte [rbp + 0x86], 0x1b
add byte [rbp + 0x86], 0x3e
xor byte [rbp + 0x86], 0x46
sub byte [rbp + 0x86], 0x1a
xor byte [rbp + 0x86], 0x18
mov dword [rbp + 0x50], 0x188353a4
add dword [rbp + 0x50], 0x151c00b
xor dword [rbp + 0x50], 0x3d4d640f
add dword [rbp + 0x50], 0x43c9f420
sub dword [rbp + 0x50], 0x63b68952
xor dword [rbp + 0x50], 0x4abe202
xchg rbp, rdi
movups xmmword [rdi + 0x58], xmm0
xchg rdi, rbp
movdqa xmm1, xmmword [0x140002cb0]
xchg rcx, rbp
movdqu xmmword [rcx + 0x68], xmm1
xchg rcx, rbp
mov eax, dword [0x140001888]
mov dword [rbp + 0x58], eax
movzx eax, byte [0x14000188c]
mov byte [rbp + 0x5c], al
mov byte [rbp + 0x5d], 0xa
xor byte [rbp + 0x5d], 0x2d
add byte [rbp + 0x5d], 0x2a
sub byte [rbp + 0x5d], 0x3e
xor byte [rbp + 0x5d], 0x2b
xor byte [rbp + 0x5d], 0x75
xor byte [rbp + 0x5d], 0x4d
mov dword [rbp + 0xf0], 0x3dfb5518
add dword [rbp + 0xf0], 0x1029309d
add dword [rbp + 0xf0], 0xb525951
xor dword [rbp + 0xf0], 0x229cc81d
sub dword [rbp + 0xf0], 0x6ebaafc9
add dword [rbp + 0xf0], 0x49f40cf2
sub dword [rbp + 0xf0], 0x572373db
xchg rbp, r12
movups xmmword [r12 + 0xf8], xmm0
xchg r12, rbp
movdqa xmm1, xmmword [0x140002ca0]
xchg r8, rbp
movdqu xmmword [r8 + 0x108], xmm1
xchg rbp, r8
mov dword [rbp + 0xf8], 0x2603339b
xor dword [rbp + 0xf8], 0x5fe5de4f
add dword [rbp + 0xf8], 0x26c3c0e
sub dword [rbp + 0xf8], 0x736743c9
add dword [rbp + 0xf8], 0x5caab7c
add dword [rbp + 0xf8], 0x5ab36c79
sub dword [rbp + 0xf8], 0x45cc2716
sub dword [rbp + 0xf8], 0x141937e3
add dword [rbp + 0xf8], 0x28efcf54
mov byte [rbp + 0xfc], 0x29
add byte [rbp + 0xfc], 0x3c
xor byte [rbp + 0xfc], 0x2f
xor byte [rbp + 0xfc], 0x67
add byte [rbp + 0xfc], 0x3a
xor byte [rbp + 0xfc], 0x14
sub byte [rbp + 0xfc], 0x54
add byte [rbp + 0xfc], 0xe
sub byte [rbp + 0xfc], 0x2d
mov dword [rbp + 0x28], 0x219d8996
add dword [rbp + 0x28], 0x37aa1b04
sub dword [rbp + 0x28], 0x176c4549
xor dword [rbp + 0x28], 0x516ed2ce
xor dword [rbp + 0x28], 0x72a64d78
xor dword [rbp + 0x28], 0x509447c3
add dword [rbp + 0x28], 0xc6f444c
xor dword [rbp + 0x28], 0x68b5edd7
sub dword [rbp + 0x28], 0x56432643
xchg rbp, rdi
movups xmmword [rdi + 0x30], xmm0
xchg rdi, rbp
movdqa xmm1, xmmword [0x140002cc0]
xchg rdx, rbp
movdqu xmmword [rdx + 0x40], xmm1
xchg rdx, rbp
mov eax, dword [0x140001890]
mov dword [rbp + 0x30], eax
movzx eax, word [0x140001894]
mov word [rbp + 0x34], ax
mov byte [rbp + 0x36], 0x2c
sub byte [rbp + 0x36], 2
xor byte [rbp + 0x36], 0x34
xor byte [rbp + 0x36], 0x5d
add byte [rbp + 0x36], 0x18
sub byte [rbp + 0x36], 0x3c
sub byte [rbp + 0x36], 0x1f
mov dword [rbp], 0x57a70006
sub dword [rbp], 0xd90d737
add dword [rbp], 0x22c72287
xor dword [rbp], 0x38d65e01
add dword [rbp], 0x287d124a
xor dword [rbp], 0x3f79125b
add dword [rbp], 0x252f7836
sub dword [rbp], 0x1efa790a
xor dword [rbp], 0x4a263573
xchg rbp, r12
movups xmmword [r12 + 8], xmm0
xchg rbp, r12
movdqa xmm1, xmmword [0x140002cb0]
movdqu xmmword [rbp + 0x18], xmm1
mov eax, dword [0x140001898]
mov dword [rbp + 8], eax
movzx eax, byte [0x14000189c]
mov byte [rbp + 0xc], al
mov byte [rbp + 0xd], 0x53
xor byte [rbp + 0xd], 0x73
add byte [rbp + 0xd], 0x2a
xor byte [rbp + 0xd], 2
sub byte [rbp + 0xd], 1
xor byte [rbp + 0xd], 5
add byte [rbp + 0xd], 0x1e
sub byte [rbp + 0xd], 0x2b
xor byte [rbp + 0xd], 0x35
mov dword [rbp - 0x28], 0x2b9a2a1e
add dword [rbp - 0x28], 0x245222f3
xor dword [rbp - 0x28], 0x3f626416
xor dword [rbp - 0x28], 0x7722e12e
xor dword [rbp - 0x28], 0x2d531d30
sub dword [rbp - 0x28], 0x5702f01
xor dword [rbp - 0x28], 0x258fa655
movups xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [0x140002cc0]
xchg rbp, rsi
movdqu xmmword [rsi - 0x10], xmm1
xchg rbp, rsi
mov eax, dword [0x1400018a0]
mov dword [rbp - 0x20], eax
movzx eax, word [0x1400018a4]
mov word [rbp - 0x1c], ax
mov byte [rbp - 0x1a], 0x3b
xor byte [rbp - 0x1a], 3
xor byte [rbp - 0x1a], 0x65
add byte [rbp - 0x1a], 0x13
xor byte [rbp - 0x1a], 0x7d
add byte [rbp - 0x1a], 0xd
xor byte [rbp - 0x1a], 0x22
sub byte [rbp - 0x1a], 0xb
sub byte [rbp - 0x1a], 0x2d
mov dword [rbp - 0x50], 0x2d858c63
sub dword [rbp - 0x50], 0x267474b1
add dword [rbp - 0x50], 0x77a55fa8
sub dword [rbp - 0x50], 0x2f25e50d
sub dword [rbp - 0x50], 0x327cd531
add dword [rbp - 0x50], 0x14cd1a9b
sub dword [rbp - 0x50], 0x31e0d76b
xchg rdx, rbp
movups xmmword [rdx - 0x48], xmm0
xchg rdx, rbp
movdqa xmm1, xmmword [0x140002cb0]
xchg rdi, rbp
movdqu xmmword [rdi - 0x38], xmm1
xchg rdi, rbp
mov eax, dword [0x1400018a8]
mov dword [rbp - 0x48], eax
movzx eax, byte [0x1400018ac]
mov byte [rbp - 0x44], al
mov byte [rbp - 0x43], 0x21
add byte [rbp - 0x43], 0
sub byte [rbp - 0x43], 0x12
add byte [rbp - 0x43], 0x4d
xor byte [rbp - 0x43], 0x3e
xor byte [rbp - 0x43], 0x46
add byte [rbp - 0x43], 0x45
xor byte [rbp - 0x43], 0x5a
sub byte [rbp - 0x43], 0x33
mov dword [rbp - 0x78], 0x45ef4a95
sub dword [rbp - 0x78], 0x2ebd6d1f
xor dword [rbp - 0x78], 0x6db42437
sub dword [rbp - 0x78], 0x7830a623
add dword [rbp - 0x78], 0x440e29c0
xor dword [rbp - 0x78], 0x46637c97
movups xmmword [rbp - 0x70], xmm0
xchg r13, rbp
movdqu xmmword [r13 - 0x60], xmm1
xchg r13, rbp
mov eax, dword [0x1400018b0]
mov dword [rbp - 0x70], eax
movzx eax, byte [0x1400018b4]
mov byte [rbp - 0x6c], al
mov byte [rbp - 0x6b], 0x2d
xor byte [rbp - 0x6b], 0x44
sub byte [rbp - 0x6b], 0x29
sub byte [rbp - 0x6b], 0x37
add byte [rbp - 0x6b], 0x42
xor byte [rbp - 0x6b], 0x1c
sub byte [rbp - 0x6b], 0x57
mov dword [rsp + 0x60], 0x21e40b36
sub dword [rsp + 0x60], 0x10a76255
add dword [rsp + 0x60], 0x55b7cf2e
sub dword [rsp + 0x60], 0x604740f6
add dword [rsp + 0x60], 0x7482ae8e
xor dword [rsp + 0x60], 0x7b2fe5e3
movups xmmword [rsp + 0x68], xmm0
movdqa xmm1, xmmword [0x140002cc0]
movdqu xmmword [rsp + 0x78], xmm1
mov eax, dword [0x1400018b8]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1400018bc]
mov word [rsp + 0x6c], ax
mov byte [rsp + 0x6e], 0x50
sub byte [rsp + 0x6e], 0x2b
sub byte [rsp + 0x6e], 7
add byte [rsp + 0x6e], 0x2f
xor byte [rsp + 0x6e], 0x73
add byte [rsp + 0x6e], 0x10
sub byte [rsp + 0x6e], 0x20
sub byte [rsp + 0x6e], 0x2e
mov dword [rbp + 0xc8], 0x6c46822b
sub dword [rbp + 0xc8], 0x2130428b
sub dword [rbp + 0xc8], 0x71e1050
add dword [rbp + 0xc8], 0x192b6b3
sub dword [rbp + 0xc8], 0xbc84c5f
sub dword [rbp + 0xc8], 0x39c29961
xchg rsi, rbp
movups xmmword [rsi + 0xd0], xmm0
xchg rbp, rsi
movdqa xmm1, xmmword [0x140002ca0]
xchg r9, rbp
movdqu xmmword [r9 + 0xe0], xmm1
xchg rbp, r9
mov dword [rbp + 0xd0], 0x2b3cd781
add dword [rbp + 0xd0], 0x5425f8ea
xor dword [rbp + 0xd0], 0x211cceae
xor dword [rbp + 0xd0], 0x6d78eaf8
add dword [rbp + 0xd0], 0x930dcf4
sub dword [rbp + 0xd0], 0x12d89326
add dword [rbp + 0xd0], 0x567dce3c
sub dword [rbp + 0xd0], 0xd7ba3e4
mov byte [rbp + 0xd4], 0x61
sub byte [rbp + 0xd4], 0x36
xor byte [rbp + 0xd4], 0x53
sub byte [rbp + 0xd4], 0x73
add byte [rbp + 0xd4], 0x2e
sub byte [rbp + 0xd4], 0x24
sub byte [rbp + 0xd4], 0xf
neg rcx
add rcx, 0xffffffffffffffb0
neg rcx
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x78]
mov qword [rsp + 0x50], rax
lea rax, [rbp + 0x50]
xchg r11, rax
mov qword [rsp + 0x48], r11
xchg r11, rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x28]
xchg r11, rax
mov qword [rsp + 0x38], r11
xchg r11, rax
lea rax, [rbp]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x28]
xchg rbp, rax
mov qword [rsp + 0x28], rbp
xchg rbp, rax
lea rax, [rbp - 0x50]
xchg rdx, rax
mov qword [rsp + 0x20], rdx
xchg rdx, rax
lea r9, [rbp - 0x78]
lea r8, [rsp + 0x60]
lea rdx, [rbp + 0xc8]
call fcn.1400484f0
xchg rdx, r12
mov r12, qword [rbp + 0xe8]
xchg r12, rdx
cmp rdx, 0x10
jb 0x14004a50e
inc rdx
xchg rcx, rbx
mov rbx, qword [rbp + 0xd0]
xchg rcx, rbx
xchg r14, rax
mov r14, rcx
xchg r14, rax
cmp rdx, 0x1000
jb 0x14004a509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14004a563
inc rdx
xchg rcx, r12
mov r12, qword [rsp + 0x68]
xchg r12, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a55e
nop
sub rdx, 0x64fa2bbe
add rdx, 0x64fa2be5
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14004a5bd
inc rdx
xchg rcx, rbx
mov rbx, qword [rbp - 0x70]
xchg rcx, rbx
xchg rcx, rdx
mov rax, rdx
xchg rdx, rcx
cmp rdx, 0x1000
jb 0x14004a5b8
nop
add rdx, 0x54740697
sub rdx, 0x54740670
mov rcx, qword [rcx - 8]
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
xchg rdx, r12
mov r12, qword [rbp - 0x30]
xchg rdx, r12
cmp rdx, 0x10
jb 0x14004a615
inc rdx
xchg rcx, r12
mov r12, qword [rbp - 0x48]
xchg rcx, r12
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a610
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
add rax, 0xffffffffdbdaa49e
sub rax, 0xffffffffdbdaa4a6
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14004a66c
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a667
nop
add rdx, 0x395206ea
sub rdx, 0x395206c3
mov rcx, qword [rcx - 8]
sub rax, rcx
nop
sub rax, 0xffffffffe601bfc1
add rax, 0xffffffffe601bfb9
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14004a6b9
inc rdx
xchg r11, rcx
mov r11, qword [rbp + 8]
xchg rcx, r11
xchg r15, rax
mov r15, rcx
xchg r15, rax
cmp rdx, 0x1000
jb 0x14004a6b4
sub rdx, 0xffffffffffffffd9
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14004a706
inc rdx
mov rcx, qword [rbp + 0x30]
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
cmp rdx, 0x1000
jb 0x14004a701
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
mov rcx, qword [rcx - 8]
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp + 0x110]
cmp rdx, 0x10
jb 0x14004a75b
inc rdx
xchg rcx, r10
mov r10, qword [rbp + 0xf8]
xchg rcx, r10
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a756
sub rdx, 0xffffffffffffffd9
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
xchg r9, rdx
mov r9, qword [rbp + 0x70]
xchg r9, rdx
cmp rdx, 0x10
jb 0x14004a7bf
inc rdx
xchg r13, rcx
mov r13, qword [rbp + 0x58]
xchg rcx, r13
xchg r12, rax
mov r12, rcx
xchg r12, rax
cmp rdx, 0x1000
jb 0x14004a7ba
nop
sub rdx, 0xc321df8
add rdx, 0xc321e1f
mov rcx, qword [rcx - 8]
sub rax, rcx
neg rax
add rax, 8
neg rax
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14004a808
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a84c
call fcn.1401fcba8
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x14004a858
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a853
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
jbe 0x14004a853
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401fcba8
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x230]
add rsp, 0x220
nop
xchg qword [rsp], rbp
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]