Function at 0x140001630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x588
mov qword [rsp + 0x530], 0xfffffffffffffffe
mov rax, qword [0x1400110c0]
xor rax, rsp
mov qword [rsp + 0x570], rax
lea rdx, [rsp + 0x3a0]
mov rcx, qword [rsp + 0x5b8]
call fcn.140002c20
lea rdi, [rsp + 0x520]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x3b0]
mov rcx, qword [rsp + 0x5b8]
call fcn.140002be0
lea rdi, [rsp + 0x510]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea r8, [rsp + 0x520]
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x378]
call fcn.140003f30
nop
mov byte [rsp + 0x320], 0
mov byte [rsp + 0x321], 0xa
mov byte [rsp + 0x322], 0x38
mov byte [rsp + 0x323], 0x3a
mov byte [rsp + 0x324], 0x23
mov byte [rsp + 0x325], 0x10
mov byte [rsp + 0x326], 0x27
mov byte [rsp + 0x327], 0x2c
mov byte [rsp + 0x328], 0x26
mov byte [rsp + 0x329], 0x17
mov byte [rsp + 0x32a], 0x39
mov byte [rsp + 0x32b], 0
mov byte [rsp + 0x370], 0x57
mov byte [rsp + 0x371], 0x63
mov byte [rsp + 0x372], 0x56
mov byte [rsp + 0x373], 0
mov byte [rsp + 0x58], 0x72
mov byte [rsp + 0x59], 0x57
mov byte [rsp + 0x5a], 0x64
mov byte [rsp + 0x5b], 0
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x3e8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0xb
lea rdx, [rsp + 0x320]
mov rcx, qword [rsp + 0x3e8]
call fcn.140001340
mov qword [rsp + 0x538], rax
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov qword [rsp + 0x50], rax
mov byte [rsp + 0x360], 0xf
mov byte [rsp + 0x361], 6
mov byte [rsp + 0x362], 0xc
mov byte [rsp + 0x363], 0x2b
mov byte [rsp + 0x364], 0x15
mov byte [rsp + 0x365], 0x24
mov byte [rsp + 0x366], 0x28
mov byte [rsp + 0x367], 0x2c
mov byte [rsp + 0x368], 0xd
mov byte [rsp + 0x369], 0xd
mov byte [rsp + 0x36a], 0xf
mov byte [rsp + 0x36b], 0x35
mov byte [rsp + 0x36c], 0x3b
mov byte [rsp + 0x36d], 0x1b
mov byte [rsp + 0x36e], 0
lea rdi, [rsp + 0x370]
lea rsi, [0x14000efd0]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x58]
lea rsi, [0x14000efd4]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x3f0]
mov qword [rsp + 0x418], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0xe
lea rdx, [rsp + 0x360]
mov rcx, qword [rsp + 0x418]
call fcn.140001340
mov qword [rsp + 0x540], rax
mov rdx, qword [rsp + 0x540]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
xor r9d, r9d
mov r8w, 0x1bb
lea rdx, [0x14000efe0]
mov rcx, qword [rsp + 0x50]
call rax
mov qword [rsp + 0x68], rax
mov eax, 0x47
mov word [rsp + 0x300], ax
mov eax, 0x45
mov word [rsp + 0x302], ax
mov eax, 0x54
mov word [rsp + 0x304], ax
xor eax, eax
mov word [rsp + 0x306], ax
mov byte [rsp + 0x348], 0x24
mov byte [rsp + 0x349], 0x1b
mov byte [rsp + 0x34a], 8
mov byte [rsp + 0x34b], 0x2f
mov byte [rsp + 0x34c], 0
mov byte [rsp + 0x34d], 0x1c
mov byte [rsp + 0x34e], 3
mov byte [rsp + 0x34f], 0x3d
mov byte [rsp + 0x350], 0x16
mov byte [rsp + 0x351], 2
mov byte [rsp + 0x352], 0x1a
mov byte [rsp + 0x353], 0x3a
mov byte [rsp + 0x354], 0x16
mov byte [rsp + 0x355], 3
mov byte [rsp + 0x356], 0x13
mov byte [rsp + 0x357], 2
mov byte [rsp + 0x358], 7
mov byte [rsp + 0x359], 0x1c
mov byte [rsp + 0x35a], 0
lea rdi, [rsp + 0x370]
lea rsi, [0x14000efd8]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x58]
lea rsi, [0x14000efdc]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x420]
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0x12
lea rdx, [rsp + 0x348]
mov rcx, qword [rsp + 0x448]
call fcn.140001340
mov qword [rsp + 0x548], rax
lea rcx, [rsp + 0x378]
call fcn.140002e90
mov rdi, rax
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rdi
lea rdx, [rsp + 0x300]
mov rcx, qword [rsp + 0x68]
call rax
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x2e8], 0x10
mov byte [rsp + 0x2e9], 0x3e
mov byte [rsp + 0x2ea], 0x24
mov byte [rsp + 0x2eb], 0x3b
mov byte [rsp + 0x2ec], 0x27
mov byte [rsp + 0x2ed], 0x1b
mov byte [rsp + 0x2ee], 0x37
mov byte [rsp + 0x2ef], 4
mov byte [rsp + 0x2f0], 0x2f
mov byte [rsp + 0x2f1], 0x1d
mov byte [rsp + 0x2f2], 0x37
mov byte [rsp + 0x2f3], 0x3d
mov byte [rsp + 0x2f4], 0x22
mov byte [rsp + 0x2f5], 0x26
mov byte [rsp + 0x2f6], 0x3f
mov byte [rsp + 0x2f7], 0x16
mov byte [rsp + 0x2f8], 0x20
mov byte [rsp + 0x2f9], 0x1b
mov byte [rsp + 0x2fa], 0
lea rdi, [rsp + 0x370]
lea rsi, [0x14000f040]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x58]
lea rsi, [0x14000f044]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x450]
mov qword [rsp + 0x478], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0x12
lea rdx, [rsp + 0x2e8]
mov rcx, qword [rsp + 0x478]
call fcn.140001340
mov qword [rsp + 0x550], rax
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call rax
mov byte [rsp + 0x330], 0x2e
mov byte [rsp + 0x331], 1
mov byte [rsp + 0x332], 8
mov byte [rsp + 0x333], 0x3a
mov byte [rsp + 0x334], 0
mov byte [rsp + 0x335], 0x10
mov byte [rsp + 0x336], 9
mov byte [rsp + 0x337], 0x3a
mov byte [rsp + 0x338], 3
mov byte [rsp + 0x339], 0x11
mov byte [rsp + 0x33a], 0x11
mov byte [rsp + 0x33b], 0xd
mov byte [rsp + 0x33c], 0xf
mov byte [rsp + 0x33d], 0xd
mov byte [rsp + 0x33e], 0x34
mov byte [rsp + 0x33f], 0x17
mov byte [rsp + 0x340], 7
mov byte [rsp + 0x341], 0x14
mov byte [rsp + 0x342], 0x16
mov byte [rsp + 0x343], 6
mov byte [rsp + 0x344], 0x15
mov byte [rsp + 0x345], 0x17
mov byte [rsp + 0x346], 0
lea rdi, [rsp + 0x370]
lea rsi, [0x14000f048]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x58]
lea rsi, [0x14000f04c]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x480]
mov qword [rsp + 0x4a8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0x16
lea rdx, [rsp + 0x330]
mov rcx, qword [rsp + 0x4a8]
call fcn.140001340
mov qword [rsp + 0x558], rax
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
xor edx, edx
mov rcx, qword [rsp + 0x48]
call rax
mov r8d, 0x60e
mov edx, 8
mov rcx, qword [rsp + 0x5a0]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdx, rax
mov rax, qword [rsp + 0x5a0]
mov qword [rax], rdx
mov byte [rsp + 0x310], 0xd
mov byte [rsp + 0x311], 0x1e
mov byte [rsp + 0x312], 0x2d
mov byte [rsp + 0x313], 0x11
mov byte [rsp + 0x314], 0x25
mov byte [rsp + 0x315], 0x3b
mov byte [rsp + 0x316], 0x2a
mov byte [rsp + 0x317], 0x25
mov byte [rsp + 0x318], 0x26
mov byte [rsp + 0x319], 0x38
mov byte [rsp + 0x31a], 0x35
mov byte [rsp + 0x31b], 0xb
mov byte [rsp + 0x31c], 0x3b
mov byte [rsp + 0x31d], 3
mov byte [rsp + 0x31e], 0x22
mov byte [rsp + 0x31f], 0
lea rdi, [rsp + 0x370]
lea rsi, [0x14000f050]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x58]
lea rsi, [0x14000f054]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x308], 0
mov dword [rsp + 0x5c], 0
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x4d8], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0xf
lea rdx, [rsp + 0x310]
mov rcx, qword [rsp + 0x4d8]
call fcn.140001340
mov qword [rsp + 0x560], rax
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
mov qword [rsp + 0x308], rax
lea r9, [rsp + 0x5c]
mov r8d, 0x258
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x308]
test eax, eax
je 0x140001ebb
cmp dword [rsp + 0x5c], 0
jne 0x140001e7e
jmp 0x140001ebb
mov ecx, dword [rsp + 0x5c]
mov rax, qword [rsp + 0x5a0]
mov edi, dword [rax + 8]
mov rax, qword [rsp + 0x5a0]
add rdi, qword [rax]
lea rsi, [rsp + 0x70]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x5a0]
mov ecx, dword [rax + 8]
add ecx, dword [rsp + 0x5c]
mov rax, qword [rsp + 0x5a0]
mov dword [rax + 8], ecx
jmp 0x140001e55
mov byte [rsp + 0x2d0], 0x2e
mov byte [rsp + 0x2d1], 0x1c
mov byte [rsp + 0x2d2], 9
mov byte [rsp + 0x2d3], 0x1f
mov byte [rsp + 0x2d4], 0x27
mov byte [rsp + 0x2d5], 0x31
mov byte [rsp + 0x2d6], 9
mov byte [rsp + 0x2d7], 0x36
mov byte [rsp + 0x2d8], 0xb
mov byte [rsp + 0x2d9], 0x38
mov byte [rsp + 0x2da], 0x20
mov byte [rsp + 0x2db], 0x20
mov byte [rsp + 0x2dc], 0x31
mov byte [rsp + 0x2dd], 0x14
mov byte [rsp + 0x2de], 9
mov byte [rsp + 0x2df], 0x33
mov byte [rsp + 0x2e0], 0x3f
mov byte [rsp + 0x2e1], 0x20
mov byte [rsp + 0x2e2], 0
lea rdi, [rsp + 0x370]
lea rsi, [0x14000f058]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rdi, [rsp + 0x58]
lea rsi, [0x14000f05c]
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x508], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x370]
mov r8d, 0x12
lea rdx, [rsp + 0x2d0]
mov rcx, qword [rsp + 0x508]
call fcn.140001340
mov qword [rsp + 0x568], rax
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x5b0]
call fcn.1400015f0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
call qword [rsp + 0x60]
nop
lea rcx, [rsp + 0x378]
call fcn.140002e70
nop
mov rcx, qword [rsp + 0x5b8]
call fcn.140002b60
jmp 0x140002022
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.140005020
add rsp, 0x588
pop rdi
pop rsi
ret