Function at 0x14005a240
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x198]
sub rsp, 0x288
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov qword [r11 + 0x20], rbx
mov rbx, rdx
mov qword [r11 - 0x18], rdi
mov edi, 0x2a8
mov qword [r11 - 0x20], r12
xor r12d, r12d
movsxd rax, r8d
mov esi, r12d
cmp dword [rbx + 0x13c], 2
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r15, rcx
lea rcx, [rax + rax*2]
mov qword [rsp + 0x58], r12
lea rcx, [rdx + rcx*8]
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x50], rcx
lea edx, [rdi + 0x18]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x40], r12
jne 0x14005a2dd
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov eax, edi
cmovne eax, edx
cmp dword [rax + rbx], 2
je 0x14005a2dd
mov r12, qword [rbx + 0x128]
mov qword [rsp + 0x60], r12
xor r12d, r12d
jmp 0x14005a2e9
mov rax, qword [rbx + 0xa0]
mov qword [rsp + 0x60], rax
mov rcx, qword [rcx + 0x280]
lea r8, [rsp + 0x58]
mov rax, qword [0x1400ce758]
mov edx, 0x53
mov qword [rsp + 0x270], r13
mov rcx, qword [rcx + 8]
call qword [rax + 0x58]
mov r14d, eax
test eax, eax
jne 0x14005aaaf
mov r13, qword [rsp + 0x58]
test r13, r13
je 0x14005aaaf
mov ecx, dword [rbx + 0x13c]
mov edx, 0x2c0
cmp ecx, 2
jne 0x14005a356
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov rax, rdi
cmovne rax, rdx
cmp dword [rax + rbx], ecx
je 0x14005a356
mov rax, qword [rbx + 0x360]
jmp 0x14005a35d
mov rax, qword [rbx + 0x2f0]
test rax, rax
jne 0x14005a394
cmp ecx, 2
jne 0x14005a384
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov rax, rdi
cmovne rax, rdx
cmp dword [rax + rbx], ecx
je 0x14005a384
mov rax, qword [rbx + 0x3a0]
jmp 0x14005a38b
mov rax, qword [rbx + 0x330]
test rax, rax
je 0x14005a616
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x280]
cmp byte [rax + 0x6b], sil
je 0x14005a616
mov edx, 1
mov dword [rsp + 0x20], r12d
lea ecx, [rdx + 5]
call fcn.14003ce80
test al, al
je 0x14005a3d9
lea rdx, str.schannel:_this_version_of_Windows_is_too_old_to_support_certificate_verification_via_CA_bundle_file.
mov rcx, r15
call fcn.14002b570
mov esi, 0x4d
jmp 0x14005ab24
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x40], r12
mov r14, r12
mov word [rbp - 0x1b], 0x3233
mov dword [rbp - 0x20], 0x70797243
mov dword [rbp - 0x18], 0x6c6c64
mov byte [rbp - 0x19], 0x2e
mov byte [rbp - 0x1c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14005a462
lea rdx, [rbp + 0x38]
mov dword [rbp + 0x40], 0x726f7453
mov rcx, rax
mov dword [rbp + 0x38], 0x74726543
mov word [rbp + 0x44], 0x65
mov dword [rbp + 0x3c], 0x6e65704f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a459
xor edx, edx
mov qword [rsp + 0x20], r12
mov r9d, 0x2000
xor r8d, r8d
lea ecx, [rdx + 2]
call rax
mov r14, rax
mov qword [rsp + 0x40], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
jne 0x14005a492
call fcn.14003d670
mov ecx, eax
lea rdx, [rbp + 0x50]
call fcn.140050120
mov r8, rax
lea rdx, str.schannel:_failed_to_create_certificate_store:__s
mov rcx, r15
call fcn.14002b570
lea esi, [r14 + 0x4d]
jmp 0x14005ab29
mov ecx, dword [rbx + 0x13c]
mov r8d, 0x2c0
cmp ecx, 2
jne 0x14005a4c0
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov rax, rdi
cmovne rax, r8
cmp dword [rax + rbx], ecx
je 0x14005a4c0
mov rdx, qword [rbx + 0x3a0]
jmp 0x14005a4c7
mov rdx, qword [rbx + 0x330]
test rdx, rdx
je 0x14005a4e9
mov r8, qword [rdx + 8]
lea r9, str._memory_blob_
mov rdx, qword [rdx]
mov rcx, r14
mov qword [rsp + 0x20], r15
call fcn.1400595d0
jmp 0x14005a51d
cmp ecx, 2
jne 0x14005a50b
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov rax, rdi
cmovne rax, r8
cmp dword [rax + rbx], ecx
je 0x14005a50b
mov rdx, qword [rbx + 0x360]
jmp 0x14005a512
mov rdx, qword [rbx + 0x2f0]
mov r8, r15
mov rcx, r14
call fcn.1400599f0
mov esi, eax
test eax, eax
jne 0x14005ab29
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x7c], r12
mov qword [rbp - 0x74], r12
mov qword [rbp - 0x6c], r12
mov qword [rbp - 0x64], r12
mov qword [rbp - 0x5c], r12
mov qword [rbp - 0x54], r12
mov qword [rbp - 0x4c], r12
mov dword [rbp - 0x44], r12d
mov qword [rbp - 0x38], r12
mov dword [rbp - 0x80], 0x50
mov qword [rbp - 0x40], r14
mov word [rbp - 0x1b], 0x3233
mov dword [rbp - 0x20], 0x70797243
mov dword [rbp - 0x18], 0x6c6c64
mov byte [rbp - 0x19], 0x2e
mov byte [rbp - 0x1c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x14005a655
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x16], 0x65746165
mov rcx, rax
mov word [rbp + 0x29], 0x456e
mov word [rbp + 0x26], 0x6168
mov word [rbp + 0x1e], 0x6669
mov word [rbp + 0x11], 0x7265
mov word [rbp + 0x2e], 0x656e
mov dword [rbp + 0x21], 0x65746163
mov byte [rbp + 0x28], 0x69
mov dword [rbp + 0x1a], 0x74726543
mov word [rbp + 0x14], 0x7243
mov byte [rbp + 0x30], sil
mov word [rbp + 0x2b], 0x676e
mov byte [rbp + 0x20], 0x69
mov byte [rbp + 0x13], 0x74
mov byte [rbp + 0x2d], 0x69
mov byte [rbp + 0x10], 0x43
mov byte [rbp + 0x25], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a603
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call rax
mov r12d, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r12d, r12d
je 0x14005a655
mov r13, qword [rsp + 0x58]
cmp dword [rbx + 0x13c], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov dword [rbp + 0x10], 0x20
movups xmmword [rbp + 0x20], xmm0
jne 0x14005a681
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov rax, rdi
mov ecx, 0x2c0
cmovne rax, rcx
cmp dword [rax + rbx], 2
je 0x14005a681
movzx r12d, byte [r15 + 0x6d3]
jmp 0x14005a689
call fcn.14003d670
mov ecx, eax
lea rdx, [rbp + 0x50]
call fcn.140050120
mov r8, rax
lea rdx, str.schannel:_failed_to_create_certificate_chain_engine:__s
mov rcx, r15
call fcn.14002b570
mov esi, 0x4d
jmp 0x14005ab24
movzx r12d, byte [r15 + 0x61b]
mov rax, qword [r13 + 0x20]
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x70]
mov qword [rbp - 0x20], rax
mov dword [rsp + 0x48], 0
mov word [rbp - 0x2b], 0x3233
mov dword [rbp - 0x30], 0x70797243
mov dword [rbp - 0x28], 0x6c6c64
mov byte [rbp - 0x29], 0x2e
mov byte [rbp - 0x2c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
test rax, rax
je 0x14005aa2a
lea rdx, [rbp - 0x10]
mov dword [rbp + 1], 0x61684365
mov rcx, rax
mov dword [rbp - 0xd], 0x74654774
mov dword [rbp - 9], 0x74726543
mov dword [rbp - 4], 0x61636966
mov word [rbp + 6], 0x6e
mov byte [rbp], 0x74
mov word [rbp - 0x10], 0x6543
mov byte [rbp - 5], 0x69
mov byte [rbp - 0xe], 0x72
mov byte [rbp + 5], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005a766
mov r9, qword [rsp + 0x50]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
test r12b, r12b
mov r12d, 0
lea rcx, [rbp + 0x10]
mov r8d, 0x20000000
mov qword [rsp + 0x30], r12
cmovne r8d, r12d
mov rdx, r13
mov dword [rsp + 0x28], r8d
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp - 0x20]
call rax
mov dword [rsp + 0x48], eax
jmp 0x14005a769
xor r12d, r12d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [rsp + 0x48], 0
je 0x14005aa2a
cmp byte [r15 + 0x61d], 0
mov eax, 0xfffffffd
mov r8d, 0xfeffffbd
cmove r8d, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
and r8d, dword [rax + 4]
je 0x14005a832
mov rcx, r15
test r8b, 4
je 0x14005a7c4
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_REVOKED
call fcn.14002b570
jmp 0x14005ab1f
bt r8d, 0x10
jae 0x14005a7dc
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_PARTIAL_CHAIN
call fcn.14002b570
jmp 0x14005ab1f
test r8b, 0x20
je 0x14005a7f3
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_UNTRUSTED_ROOT
call fcn.14002b570
jmp 0x14005ab1f
test r8b, 1
je 0x14005a80a
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_IS_NOT_TIME_VALID
call fcn.14002b570
jmp 0x14005ab1f
test r8b, 0x40
je 0x14005a821
lea rdx, str.schannel:_CertGetCertificateChain_trust_error_CERT_TRUST_REVOCATION_STATUS_UNKNOWN
call fcn.14002b570
jmp 0x14005ab1f
lea rdx, str.schannel:_CertGetCertificateChain_error_mask:_0x_08x
call fcn.14002b570
jmp 0x14005ab1f
cmp dword [rbx + 0x13c], 2
jne 0x14005a85b
cmp qword [rbx + 0x1f8], 0xffffffffffffffff
mov eax, 0x2c0
cmovne rdi, rax
cmp dword [rdi + rbx], 2
je 0x14005a85b
movzx eax, byte [rbx + 0x3ba]
jmp 0x14005a862
movzx eax, byte [rbx + 0x34a]
test al, al
je 0x14005ab24
mov rdi, qword [rsp + 0x58]
mov r13, 0xffffffffffffffff
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x48], r12
inc r13
cmp byte [r14 + r13], 0
jne 0x14005a880
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call fcn.140059e70
mov ebx, eax
test eax, eax
jne 0x14005a8c7
lea rdx, str.schannel:_CertGetNameString___returned_no_certificate_name_information
mov rcx, r15
call fcn.14002b570
mov rcx, qword [rsp + 0x48]
mov ebx, 0x3c
call qword [fcn.14006baa8]
mov esi, ebx
jmp 0x14005ab24
mov rcx, rbx
mov qword [rsp + 0x50], rbx
call qword [fcn.14006bcf0]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14005a8f2
mov rcx, rax
lea ebx, [rax + 0x1b]
call qword [fcn.14006baa8]
mov esi, ebx
jmp 0x14005ab24
mov r9d, ebx
mov r8, rax
mov rdx, rdi
mov rcx, r15
call fcn.140059e70
cmp eax, ebx
je 0x14005a92d
lea rdx, str.schannel:_CertGetNameString___returned_certificate_name_information_of_unexpected_size
mov rcx, r15
call fcn.14002b570
mov rcx, qword [rsp + 0x48]
mov ebx, 0x3c
call qword [fcn.14006baa8]
mov esi, ebx
jmp 0x14005ab24
cmp qword [rsp + 0x50], 0
mov esi, 0x3c
mov ebx, esi
jbe 0x14005aa06
mov r14, qword [rsp + 0x48]
add r14, r12
cmp byte [r14], 0
je 0x14005a9d8
cmp ebx, esi
jne 0x14005a9dc
mov rcx, r14
call case.0x14002e419.0
mov rdi, rax
test rax, rax
jne 0x14005a96f
lea ebx, [rax + 0x1b]
jmp 0x14005a9cd
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x14005a976
cmp byte [rax], 0
je 0x14005a9ac
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14005a9ac
cmp byte [rax], 0
je 0x14005a9ac
mov r8, rdi
mov rdx, r13
mov rcx, rax
call fcn.14005f360
test al, al
je 0x14005a9ac
xor eax, eax
mov ebx, eax
jmp 0x14005a9c5
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r14 + rax], 0
jne 0x14005a9b3
inc r12
mov ebx, esi
add r12, rax
mov rcx, rdi
call fcn.14006baa8
cmp r12, qword [rsp + 0x50]
jb 0x14005a940
cmp ebx, esi
je 0x14005aa01
test ebx, ebx
je 0x14005aa18
lea rdx, str.schannel:_server_certificate_name_verification_failed
mov rcx, r15
call fcn.14002b570
mov rcx, qword [rsp + 0x48]
call qword [fcn.14006baa8]
mov esi, ebx
jmp 0x14005ab24
mov r14, qword [rsp + 0x60]
mov r8, r14
lea rdx, str.schannel:_CertGetNameString___failed_to_match_connection_hostname___s__against_server_certificate_names
mov rcx, r15
call fcn.14002b570
mov rcx, qword [rsp + 0x48]
call qword [fcn.14006baa8]
mov esi, ebx
jmp 0x14005ab24
call fcn.14003d670
mov ebx, eax
call fcn.14003d670
mov edi, eax
call fcn.14006ac68
lea rdx, str.No_error
test ebx, ebx
lea rcx, str.Error
mov r8d, 0x100
cmove rcx, rdx
mov esi, dword [rax]
mov rdx, rcx
lea rcx, [rbp + 0x50]
mov byte [rbp + 0x50], 0
call fcn.14006e660
mov byte [rbp + 0x14f], 0
call fcn.14006ac68
cmp dword [rax], esi
je 0x14005aa80
call fcn.14006ac68
mov dword [rax], esi
call fcn.14003d670
cmp edi, eax
je 0x14005aa90
mov ecx, edi
call fcn.14004fed0
lea r8, [rbp + 0x50]
mov rcx, r15
lea rdx, str.schannel:_CertGetCertificateChain_failed:__s
call fcn.14002b570
xor eax, eax
mov qword [rsp + 0x68], rax
jmp 0x14005ab1f
call fcn.14003d670
mov ebx, eax
call fcn.14006ac68
lea rcx, str.Error
test r14d, r14d
lea rdx, str.No_error
mov r8d, 0x100
cmovne rdx, rcx
lea rcx, [rbp + 0x50]
mov edi, dword [rax]
mov byte [rbp + 0x50], sil
call fcn.14006e660
mov byte [rbp + 0x14f], sil
call fcn.14006ac68
cmp dword [rax], edi
je 0x14005aafc
call fcn.14006ac68
mov dword [rax], edi
call fcn.14003d670
cmp ebx, eax
je 0x14005ab0c
mov ecx, ebx
call fcn.14004fed0
lea r8, [rbp + 0x50]
mov rcx, r15
lea rdx, str.schannel:_Failed_to_read_remote_certificate_context:__s
call fcn.14002b570
mov esi, 0x3c
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x260]
mov r13, qword [rsp + 0x270]
mov r12, qword [rsp + 0x278]
test rdi, rdi
je 0x14005abeb
lea rcx, [rbp - 0x30]
mov word [rbp - 0x2b], 0x3233
mov dword [rbp - 0x30], 0x70797243
mov dword [rbp - 0x28], 0x6c6c64
mov byte [rbp - 0x29], 0x2e
mov byte [rbp - 0x2c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005abeb
lea rdx, [rbp - 0x10]
mov dword [rbp + 3], 0x69616843
mov rcx, rax
mov dword [rbp - 0xf], 0x46747265
mov word [rbp - 2], 0x6369
mov dword [rbp + 8], 0x69676e45
mov dword [rbp - 9], 0x72654365
mov byte [rbp - 0x10], 0x43
mov word [rbp - 5], 0x6974
mov word [rbp + 1], 0x6574
mov byte [rbp - 3], 0x66
mov byte [rbp], 0x61
mov word [rbp + 0xd], 0x65
mov byte [rbp + 7], 0x6e
mov word [rbp - 0xb], 0x6572
mov byte [rbp + 0xc], 0x6e
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005abe2
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14, r14
je 0x14005ac6a
lea rcx, [rbp - 0x30]
mov word [rbp - 0x2b], 0x3233
mov dword [rbp - 0x30], 0x70797243
mov dword [rbp - 0x28], 0x6c6c64
mov byte [rbp - 0x29], 0x2e
mov byte [rbp - 0x2c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005ac6a
lea rdx, [rbp - 0x20]
mov word [rbp - 0x1b], 0x6f6c
mov rcx, rax
mov dword [rbp - 0x18], 0x6f745365
mov dword [rbp - 0x20], 0x74726543
mov word [rbp - 0x14], 0x6572
mov byte [rbp - 0x19], 0x73
mov byte [rbp - 0x12], 0
mov byte [rbp - 0x1c], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005ac61
xor edx, edx
mov rcx, r14
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x268]
test rdi, rdi
je 0x14005ad0f
lea rcx, [rbp - 0x30]
mov word [rbp - 0x2b], 0x3233
mov dword [rbp - 0x30], 0x70797243
mov dword [rbp - 0x28], 0x6c6c64
mov byte [rbp - 0x29], 0x2e
mov byte [rbp - 0x2c], 0x74
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14005ad0f
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x74726543
mov rcx, rax
mov word [rbp - 1], 0x6163
mov dword [rbp + 2], 0x61684365
mov word [rbp - 4], 0x6669
mov dword [rbp - 9], 0x72654365
mov byte [rbp - 5], 0x74
mov word [rbp - 0xc], 0x7246
mov word [rbp + 6], 0x6e69
mov byte [rbp + 8], 0
mov byte [rbp + 1], 0x74
mov byte [rbp - 0xa], 0x65
mov byte [rbp - 2], 0x69
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14005ad06
mov rcx, rdi
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2b8]
test rcx, rcx
je 0x14005ad2e
call fcn.14003d3c0
mov eax, esi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x288
pop rsi
pop rbp
ret