Function at 0x1400296e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov dword [rbp - 0x40], 0xe62f691c
mov dword [rbp - 0x3c], 0xbfd40699
mov dword [rbp - 0x38], 0x4be20bf7
mov dword [rbp - 0x34], 0xf76778c9
mov dword [rbp - 0x30], 0xa68e1065
mov dword [rbp - 0x2c], 0x74006e
mov dword [rbp - 0x28], 0x6c0064
mov dword [rbp - 0x24], 0x2e006c
mov dword [rbp - 0x20], 0x6c0064
mov dword [rbp - 0x1c], 0x6c
lea rcx, [rbp - 0x2c]
call qword [0x140061098]
mov rdi, rax
mov dword [rbp - 8], 0x46de5930
mov dword [rbp - 4], 0x9f130728
mov dword [rbp], 0xe89d7fad
mov dword [rbp + 4], 0xf68e5532
mov dword [rbp + 8], 0xd4097de
mov dword [rbp + 0xc], 0x9f7923d1
mov dword [rbp + 0x10], 0x6b495f
mov dword [rbp + 0x14], 0x720065
mov dword [rbp + 0x18], 0x65006e
mov dword [rbp + 0x1c], 0x33006c
mov dword [rbp + 0x20], 0x2e0032
mov dword [rbp + 0x24], 0x6c0064
mov dword [rbp + 0x28], 0x6c
lea rcx, [rbp + 0x12]
call qword [0x140061098]
mov r14, rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077c60]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140078130]
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x140078030]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x70], 0x6e
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x20]
call fcn.140007a90
nop
lea rax, [rsp + 0x79]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140029810
lea rdx, [rsp + 0x79]
lea rcx, [rsp + 0x20]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x20]
call fcn.140006030
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077e10]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140077e30]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x140077d10]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140078020]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x1400780c0]
movdqa xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x72
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007a90
nop
lea rax, [rbp - 0x77]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400298c1
lea rdx, [rbp - 0x77]
lea rcx, [rsp + 0x20]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x20]
call fcn.140006030
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077e70]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140077ec0]
movdqu xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x5365646f
mov dword [rbp - 0x7c], 0x6e697274
mov word [rbp - 0x78], 0x67
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007a90
nop
lea rax, [rsp + 0x75]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140029960
lea rdx, [rsp + 0x75]
lea rcx, [rsp + 0x20]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x20]
call fcn.140006030
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077bf0]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140077eb0]
movdqu xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x5365646f
mov dword [rbp - 0x7c], 0x6e697274
mov word [rbp - 0x78], 0x67
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007a90
nop
lea rax, [rsp + 0x75]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140029a00
lea rdx, [rsp + 0x75]
lea rcx, [rsp + 0x20]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x20]
call fcn.140006030
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077c10]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140078090]
movdqu xmmword [rsp + 0x70], xmm1
mov word [rbp - 0x80], 0x73
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007a90
nop
lea rax, [rsp + 0x71]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140029a90
lea rdx, [rsp + 0x71]
lea rcx, [rsp + 0x20]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x20]
call fcn.140006030
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077c20]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str.NtResumeProcess]
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007a90
nop
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140029b15
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x20]
call fcn.140006030
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077d80]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x4464616f
mov dword [rsp + 0x34], 0x65766972
mov word [rsp + 0x38], 0x72
lea rax, [rsp + 0x60]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x60]
call fcn.140007a90
nop
lea rax, [rsp + 0x2d]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140029ba3
lea rdx, [rsp + 0x2d]
lea rcx, [rsp + 0x60]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rsi, rax
movdqa xmm0, xmmword [0x140077d90]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x6c6e5574
mov dword [rsp + 0x34], 0x4464616f
mov dword [rsp + 0x38], 0x65766972
mov word [rsp + 0x3c], 0x72
lea rax, [rsp + 0x60]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x60]
call fcn.140007a90
nop
lea rax, [rsp + 0x2f]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140029c36
mov r8, rbx
lea rdx, [rsp + 0x2f]
lea rcx, [rsp + 0x60]
call fcn.1400074c0
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x90], rax
call fcn.140026a30
mov rbx, rax
movdqa xmm0, xmmword [0x140077bd0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400780b0]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x4d6c6175
mov dword [rsp + 0x44], 0x726f6d65
mov word [rsp + 0x48], 0x79
lea rdx, [rsp + 0x35]
lea rcx, [rsp + 0x60]
call fcn.1400060c0
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x98], rax
call fcn.140026a30
mov rbx, rax
movdqa xmm0, xmmword [0x140077b00]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140078060]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x140077ed0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x737365
lea rdx, [rsp + 0x3a]
lea rcx, [rsp + 0x60]
call fcn.1400060c0
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0xa0], rax
call fcn.140026a30
mov rbx, rax
movdqa xmm0, xmmword [0x1400780a0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x56746553
mov dword [rsp + 0x34], 0x65756c61
mov dword [rsp + 0x38], 0x79654b
lea rdx, [rsp + 0x2e]
lea rcx, [rsp + 0x60]
call fcn.1400060c0
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0xa8], rax
call fcn.140026a30
mov rbx, rax
movdqa xmm0, xmmword [0x140077e30]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [str.DeviceIoControl]
movdqu xmmword [rsp + 0x30], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.1400060c0
nop
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x38], rax
call fcn.140026a30
mov rbx, rax
movdqa xmm0, xmmword [0x140077d50]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x746e6576
mov word [rsp + 0x34], 0x41
lea rdx, [rsp + 0x2b]
lea rcx, [rsp + 0x60]
call fcn.1400060c0
nop
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
call fcn.140026a30
mov rbx, rax
movdqa xmm0, xmmword [0x140077db0]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x140078120]
movdqu xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x140077f30]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x656d614e
mov word [rbp - 0xc], 0x57
lea rdx, [rbp - 0x25]
lea rcx, [rsp + 0x60]
call fcn.1400060c0
nop
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.1400292a0
nop
lea rcx, [rsp + 0x60]
call fcn.140006030
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x48], rax
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret