Function at 0x5000026b0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov dword [rbp - 9], 0xec8b4855
mov esi, 0x1000000
mov dword [rbp - 5], 0x41575653
xor edi, edi
mov dword [rbp - 1], 0x41554154
movabs r14, 0x200000000
mov dword [rbp + 3], 0x48574156
mov dword [rbp + 7], 0x88ec81
mov dword [rbp + 0xb], 0x89480000
mov dword [rbp + 0xf], 0xffff488d
mov dword [rbp + 0x13], 0xf28b48ff
mov dword [rbp + 0x17], 0x8948c033
mov word [rbp + 0x1b], 0x8845
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [rbp + 0x27]
mov r9d, 0x30
mov rdx, rsi
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
lea rcx, [r9 - 0x31]
movups xmmword [rbp + 0x47], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov rbx, qword [rbp + 0x27]
mov r11, qword [rbp + 0x3f]
test rbx, rbx
je 0x5000027ce
cmp dword [rbp + 0x47], 0x1000
jne 0x5000027ce
cmp dword [rbp + 0x4b], 0x40
jne 0x5000027ce
lea r10, [r11 - 0x26]
mov r8, rdi
test r10, r10
je 0x5000027ce
lea rax, [rbp - 9]
mov r9, rbx
sub r9, rax
nop dword [rax + rax]
mov rax, rdi
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp - 9]
add rcx, rax
lea rdx, [r9 + rcx]
movzx ecx, byte [rcx]
cmp byte [rdx + r8], cl
jne 0x5000027c3
cmp rax, 0x25
je 0x5000027fc
inc rax
cmp rax, 0x26
jb 0x5000027a0
inc rbx
inc r8
cmp r8, r10
jb 0x500002790
add rsi, r11
cmp rsi, r14
jb 0x500002730
xor r9d, r9d
lea r8, str.error
lea rdx, str.GetTeamaddress
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
test rbx, rbx
je 0x5000027da
mov esi, edi
cmp byte [rsi + rbx], 0x48
jne 0x500002817
cmp byte [rsi + rbx + 1], 0x8b
jne 0x500002817
cmp byte [rsi + rbx + 2], 0x80
je 0x50000283e
inc edi
cmp edi, 0x100
jb 0x500002801
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
xor ecx, ecx
mov edx, 0x1000
mov r8d, edx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov qword [0x500008270], rax
add rax, 0x200
mov qword [rbp - 0x13], rcx
mov qword [rbp - 6], rax
mov eax, dword [0x5000081e8]
mov dword [rbp + 9], eax
lea rax, [rbx + 0xe]
add rax, rsi
mov word [rbp + 6], 0x8b48
mov qword [rbp + 0x1a], rax
movzx eax, word [rbp + 0x1f]
mov dword [rbp + 0x15], 0x25
mov word [rbp - 9], 0x4851
mov byte [rbp - 7], 0xb9
mov dword [rbp + 2], 0x59018948
movups xmm0, xmmword [rbp - 9]
mov byte [rbp + 8], pe_nt_image_headers64
mov dword [rbp + 0xd], 0x68858948
movups xmmword [rcx], xmm0
mov dword [rbp + 0x11], 0xffffffff
movups xmm1, xmmword [rbp + 7]
mov byte [rbp + 0x19], 0
movsd xmm0, qword [rbp + 0x17]
movups xmmword [rcx + 0x10], xmm1
mov dword [rbp - 0x19], 0x25ff
movsd qword [rcx + 0x20], xmm0
mov word [rcx + 0x28], ax
movzx eax, byte [rbp + 0x21]
mov byte [rcx + 0x2a], al
mov eax, dword [rbp - 0x11]
mov word [rbp - 0x15], 0
movsd xmm0, qword [rbp - 0x19]
movsd qword [rsi + rbx], xmm0
mov dword [rsi + rbx + 8], eax
movzx eax, word [rbp - 0xd]
mov word [rsi + rbx + 0xc], ax
jmp 0x500002821