Function at 0x14006e2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov dword [rbp - 9], 0x203e2d20
mov byte [rbp - 5], 0
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x51], xmm0
mov dword [rbp - 0x41], 0x506c6c44
mov dword [rbp - 0x3d], 0x65746f72
mov dword [rbp - 0x39], 0x6e457463
mov word [rbp - 0x35], 0x64
lea r8, [rbp - 9]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x31]
call fcn.14005f5e0
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp + 0x27]
call fcn.1400604d0
mov dword [rbp - 9], 0x202d3c20
mov byte [rbp - 5], 0
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x51], xmm0
mov dword [rbp - 0x41], 0x506c6c44
mov dword [rbp - 0x3d], 0x65746f72
mov dword [rbp - 0x39], 0x6e457463
mov word [rbp - 0x35], 0x64
lea r8, [rbp - 9]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x31]
call fcn.14005f5e0
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.1400604d0
mov rbx, qword [0x1400fbc38]
xor edi, edi
mov qword [rbp - 0x51], rdi
lea rax, [rbp - 1]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x39], rdi
mov rax, qword [rbx]
cmp dword [rax], edi
je 0x14006e3ce
mov qword [rbp - 9], rdi
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 9]
mov qword [rbp - 0x51], rax
lea r8, [0x1400e01eb]
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.14007cc00
nop
lea rcx, [0x1400fba90]
call fcn.140035fdc
test eax, eax
jne 0x14006e5b8
mov byte [0x1400fba40], 1
cmp dword [0x1400fbae0], eax
je 0x14006e40d
lea rdx, [0x1400fba90]
lea rcx, [0x1400fba48]
call fcn.1400c62c8
cmp dword [0x1400fbae0], 0
jne 0x14006e3f1
lea rcx, [0x1400fba90]
call fcn.140036000
mov rbx, qword [0x1400fbd78]
test rbx, rbx
je 0x14006e45f
lea rcx, [rbx + 0xc0]
call fcn.14006c200
lea rcx, [rbx + 0x78]
call fcn.1400c6254
lea rcx, [rbx + 0x28]
call fcn.140035f90
mov rcx, rbx
call fcn.14006c5a0
mov edx, 0xe8
mov rcx, rbx
call fcn.14005c5c0
mov qword [0x1400fbd78], rdi
mov ebx, 1
mov rcx, qword [0x1400fbd70]
test rcx, rcx
je 0x14006e47e
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
mov qword [0x1400fbd70], rdi
call fcn.1400969a0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140097020
lea rdx, [0x140075a80]
lea rcx, [0x1400fb908]
call fcn.1400966e0
test eax, eax
jne 0x14006e585
lea rdx, [0x1400758b0]
lea rcx, [0x1400fbae8]
call fcn.1400966e0
test eax, eax
jne 0x14006e585
lea rdx, [0x140075420]
lea rcx, [0x1400fbc50]
call fcn.1400966e0
test eax, eax
jne 0x14006e585
lea rdx, [0x140075650]
lea rcx, [0x1400fbcd8]
call fcn.1400966e0
test eax, eax
jne 0x14006e585
lea rdx, [0x140079b40]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.1400966e0
test eax, eax
jne 0x14006e585
cmp byte [0x1400fbd19], al
je 0x14006e533
lea rdx, [0x140075dd0]
lea rcx, [0x1400fb8d0]
call fcn.1400966e0
test eax, eax
jne 0x14006e585
call fcn.140096a80
mov rcx, qword [0x1400fb8f0]
test rcx, rcx
je 0x14006e551
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400fb8f0], rdi
mov rcx, qword [0x1400fb8e8]
test rcx, rcx
je 0x14006e56a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400fb8e8], rdi
mov rcx, qword [0x1400fb8e0]
test rcx, rcx
je 0x14006e58c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400fb8e0], rdi
jmp 0x14006e58c
call fcn.140096850
mov ebx, edi
lea rcx, [rbp - 0x51]
call fcn.14006d200
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14005c5a0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, eax
call fcn.140035b50
int3