Function at 0x14004fb40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x100
mov rax, qword [0x140451b38]
xor rax, rsp
mov qword [rbp + 0xf], rax
xor r13d, r13d
mov qword [rbp - 0x79], rcx
cmp dword [r9 + 0xc], 2
mov ebx, r13d
mov rcx, qword [rbp + 0x7f]
mov rax, rdx
mov qword [rsp + 0x30], rbx
mov qword [rbp - 0x71], r8
mov qword [rbp - 0x69], rcx
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x38], r13
mov dword [rbp - 0x61], 0x4f004f
mov dword [rbp - 0x5d], 0x42
mov dword [rbp - 0x59], 0x4f004f
mov dword [rbp - 0x55], 0x54
mov dword [rbp - 0x41], 0x410056
mov dword [rbp - 0x3d], 0x49004c
mov dword [rbp - 0x39], 0x490044
mov dword [rbp - 0x35], 0x590054
mov word [rbp - 0x31], r13w
mov dword [rbp - 0x51], 0x4f004e
mov dword [rbp - 0x4d], 0x45004e
mov word [rbp - 0x49], r13w
mov dword [rbp - 0x29], 0x73006d
mov dword [rbp - 0x25], 0x740066
mov dword [rbp - 0x21], 0x73003a
mov dword [rbp - 0x1d], 0x2f006c
mov dword [rbp - 0x19], 0x690074
mov dword [rbp - 0x15], 0x65006d
mov dword [rbp - 0x11], 0x2f0072
mov dword [rbp - 0xd], 0x730025
mov dword [rbp - 9], 0x25002f
mov dword [rbp - 5], 0x2f0073
mov dword [rbp - 1], 0x730025
mov dword [rbp + 3], 0x25002f
mov dword [rbp + 7], 0x73
je 0x14004fc86
cmp dword [r9 + 0xc], 6
je 0x14004fc7c
cmp dword [r9 + 0xc], 9
je 0x14004fc72
mov edi, 0x80070057
mov ecx, edi
call fcn.14007ac40
jmp 0x14004fdd8
mov rsi, qword [r9 + 0x48]
lea r15, [rbp - 0x41]
jmp 0x14004fc8e
lea r15, [rbp - 0x61]
lea rsi, [rbp - 0x51]
jmp 0x14004fc8e
mov rsi, qword [r9 + 0x40]
lea r15, [rbp - 0x59]
mov edx, 0x3b
lea r8, [rsp + 0x40]
mov rcx, rax
call fcn.14006b2ec
mov edi, eax
test eax, eax
jns 0x14004fcaa
mov ecx, eax
jmp 0x14004fc68
test rsi, rsi
je 0x14004fd86
mov r14d, r13d
cmp dword [rsp + 0x44], r13d
jle 0x14004fd86
mov r13, qword [rsp + 0x48]
test rbx, rbx
je 0x14004fce5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
and qword [rsp + 0x30], 0
mov r9, qword [rbp - 0x79]
lea rdx, [rbp - 0x29]
and dword [rsp + 0x3c], 0
lea rcx, [rsp + 0x30]
and dword [rsp + 0x38], 0
mov r8, r15
movsxd rax, r14d
mov qword [rsp + 0x28], rsi
mov rax, qword [r13 + rax*8]
mov qword [rsp + 0x20], rax
call fcn.14006aa38
mov edi, eax
test eax, eax
js 0x14004fe96
mov rax, qword [rbp - 0x71]
test rax, rax
je 0x14004fd40
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14006ab64
mov edi, eax
test eax, eax
js 0x14004fe96
mov rbx, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.14007ab14
mov edi, eax
test eax, eax
js 0x14004fca6
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.14007a4dc
mov edi, eax
test eax, eax
js 0x14004fca6
inc r14d
cmp r14d, dword [rsp + 0x44]
jl 0x14004fcc6
xor r13d, r13d
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], r13
call fcn.14007900c
mov rdx, qword [rbp - 0x69]
lea rcx, [rsp + 0x30]
call fcn.14007900c
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14007a644
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x14004fdd8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, edi
call fcn.14007ace8
test rbx, rbx
je 0x14004fdf8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14004fe21
lea rbx, [rax - 4]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor ecx, ecx
call fcn.14007ace8
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.14007a644
mov rbx, qword [rsp + 0x60]
test rbx, rbx
je 0x14004fe4b
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14007a644
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x14004fe75
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140388a40
add rsp, 0x100
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.14007ac40
mov rbx, qword [rsp + 0x30]
jmp 0x14004fdd8