Function at 0x140002ed0
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x328
mov qword [rsp + 0x2a8], 0xfffffffffffffffe
mov rax, qword [0x1400140c0]
xor rax, rsp
mov qword [rsp + 0x318], rax
lea rcx, [rsp + 0x70]
call fcn.140003570
nop
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xd8], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
mov rcx, qword [rsp + 0xd8]
call fcn.1400035c0
mov qword [rsp + 0x2b0], rax
mov rdx, qword [rsp + 0x2b0]
lea rcx, [rsp + 0xe0]
call fcn.1400018c0
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x2c0], rax
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
call fcn.140003690
nop
lea rcx, [rsp + 0xe0]
call fcn.140003670
lea rdx, [0x140010fcc]
lea rcx, [rsp + 0x70]
call fcn.140003860
test eax, eax
jne 0x140002fbc
mov dword [rsp + 0x108], 0
lea rcx, [rsp + 0x70]
call fcn.140003670
mov eax, dword [rsp + 0x108]
jmp 0x140003395
mov byte [rsp + 0x98], 0x6d
mov byte [rsp + 0x99], 0x6d
mov byte [rsp + 0x9a], 0x76
mov byte [rsp + 0x9b], 0x69
mov byte [rsp + 0x9c], 0x76
mov byte [rsp + 0x9d], 0x78
mov byte [rsp + 0x9e], 0x6f
mov byte [rsp + 0x9f], 0x2e
mov byte [rsp + 0xa0], 0x74
mov byte [rsp + 0xa1], 0x70
mov byte [rsp + 0xa2], 0x74
mov byte [rsp + 0xa3], 0
mov byte [rsp + 0x40], 0x71
mov byte [rsp + 0x41], 0x45
mov byte [rsp + 0x42], 0x69
mov byte [rsp + 0x43], 0x42
mov byte [rsp + 0x44], 0x63
mov byte [rsp + 0x45], 0x65
mov byte [rsp + 0x46], 0x7a
mov byte [rsp + 0x47], 0
lea rax, [rsp + 0x110]
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x168], rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x138]
call fcn.1400033b0
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x2d0], rax
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x168]
call fcn.1400033b0
mov qword [rsp + 0x2d8], rax
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2d8]
call fcn.140001630
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1400030ee
mov dword [rsp + 0x170], 0
lea rcx, [rsp + 0x70]
call fcn.140003670
mov eax, dword [rsp + 0x170]
jmp 0x140003395
lea rax, [rsp + 0x188]
mov qword [rsp + 0x1b0], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x1b0]
call fcn.140003620
mov qword [rsp + 0x2e0], rax
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x1b8]
call fcn.1400021c0
lea rdi, [rsp + 0x298]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x178]
lea rsi, [rsp + 0x298]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x50]
lea rsi, [rsp + 0x178]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x60], 0x4b
mov byte [rsp + 0x61], 0x6c
mov byte [rsp + 0x62], 0x63
mov byte [rsp + 0x63], 0x7a
mov byte [rsp + 0x64], 0x66
mov byte [rsp + 0x65], 0x73
mov byte [rsp + 0x66], 0x33
mov byte [rsp + 0x67], 0x32
mov byte [rsp + 0x68], 0x2e
mov byte [rsp + 0x69], 0x6c
mov byte [rsp + 0x6a], 0x73
mov byte [rsp + 0x6b], 0x6b
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x38], 0x4b
mov byte [rsp + 0x39], 0x49
mov byte [rsp + 0x3a], 0x68
mov byte [rsp + 0x3b], 0x5a
mov byte [rsp + 0x3c], 0x71
mov byte [rsp + 0x3d], 0
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x220], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x1f0]
call fcn.1400033b0
mov qword [rsp + 0x2e8], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x2f0], rax
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x220]
call fcn.1400033b0
mov qword [rsp + 0x2f8], rax
mov rdx, qword [rsp + 0x2f0]
mov rcx, qword [rsp + 0x2f8]
call fcn.140001630
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1400026f0
test eax, eax
jne 0x140003280
mov dword [rsp + 0x228], 0
lea rcx, [rsp + 0x70]
call fcn.140003670
mov eax, dword [rsp + 0x228]
jmp 0x140003395
mov byte [rsp + 0x28], 0x43
mov byte [rsp + 0x29], 0x6f
mov byte [rsp + 0x2a], 0x67
mov byte [rsp + 0x2b], 0x65
mov byte [rsp + 0x2c], 0x77
mov byte [rsp + 0x2d], 0x76
mov byte [rsp + 0x2e], 0x33
mov byte [rsp + 0x2f], 0x32
mov byte [rsp + 0x30], 0x2e
mov byte [rsp + 0x31], 0x73
mov byte [rsp + 0x32], 0x63
mov byte [rsp + 0x33], 0x64
mov byte [rsp + 0x34], 0
mov byte [rsp + 0xa8], 0x73
mov byte [rsp + 0xa9], 0x4b
mov byte [rsp + 0xaa], 0x50
mov byte [rsp + 0xab], 0x52
mov byte [rsp + 0xac], 0
lea rax, [rsp + 0x230]
mov qword [rsp + 0x258], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x288], rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x258]
call fcn.1400033b0
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x308], rax
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x288]
call fcn.1400033b0
mov qword [rsp + 0x310], rax
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x310]
call fcn.140001630
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.140002d70
mov dword [rsp + 0x290], 1
lea rcx, [rsp + 0x70]
call fcn.140003670
mov eax, dword [rsp + 0x290]
mov rcx, qword [rsp + 0x318]
xor rcx, rsp
call fcn.140006630
add rsp, 0x328
pop rdi
pop rsi
ret