Function at 0x1400a2af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x90
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rsi
mov rax, qword [0x1400cc020]
xor rax, rbp
mov qword [rbp + 0x48], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
xor r12d, r12d
mov dword [rbp], r12d
mov qword [rcx], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r12b
mov dword [rbp], 1
mov qword [rbp + 8], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov r15, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1400a2b67
mov r15, qword [rdx]
call fcn.140007580
mov r14, rax
test rax, rax
je 0x1400a2bcb
mov edx, 0x2bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400a2b92
lea rdx, [rbp + 0x20]
mov rcx, r15
call rax
jmp 0x1400a2bc3
call fcn.1400a3820
mov rdi, rax
test rax, rax
je 0x1400a2bc3
mov edx, 0x10d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400a2bbb
lea rdx, [rbp + 0x20]
mov rcx, r15
call rax
mov rcx, rdi
call fcn.140098790
mov rcx, r14
call fcn.140098790
mov r14d, 0x80004005
call fcn.140007580
mov rdi, rax
test rax, rax
je 0x1400a2d36
mov dword [rbp + 0x38], 0x6f466e77
mov dword [rbp + 0x33], 0x6e4b7465
mov byte [rbp + 0x37], 0x6f
mov dword [rbp + 0x3e], 0x61507265
mov word [rbp + 0x31], 0x4748
mov word [rbp + 0x42], 0x6874
mov word [rbp + 0x3c], 0x646c
mov byte [rbp + 0x30], 0x53
mov byte [rbp + 0x44], 0
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400a2c39
lea r9, [rbp + 8]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x20]
call rax
mov r14d, eax
mov rcx, rdi
call fcn.140098790
test r14d, r14d
jne 0x1400a2d36
mov r14, qword [rbp + 8]
test r14, r14
je 0x1400a2d36
mov rcx, r14
call fcn.14006bea8
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400a2cd5
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400a2c87
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140061b50
sub rsp, rcx
lea rdi, [rsp + 0x40]
test rdi, rdi
je 0x1400a2cd5
mov byte [rdi], 0
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, r12
jmp 0x1400a2cd8
mov rdi, r12
mov rdx, rdi
mov rcx, rsi
call fcn.14001cdc0
mov r14, qword [rbp + 8]
call fcn.140018810
mov rdi, rax
test rax, rax
je 0x1400a2d36
mov word [rbp + 0x38], 0x466d
mov dword [rbp + 0x30], 0x61546f43
mov dword [rbp + 0x3a], 0x656572
mov word [rbp + 0x35], 0x4d6b
mov byte [rbp + 0x37], 0x65
mov byte [rbp + 0x34], 0x73
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400a2d2d
mov rcx, r14
call rax
mov rcx, rdi
call fcn.140098790
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400a2d6c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400a2d67
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a2da5
mov rcx, r8
call fcn.14006126c
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rsi
mov rcx, qword [rbp + 0x48]
xor rcx, rbp
call fcn.140060fb0
mov rbx, qword [rbp + 0x90]
mov rsi, qword [rbp + 0x98]
lea rsp, [rbp + 0x50]
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140067948
int3