Function at 0x1401fe1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp], rax
cmp byte [0x1411dd034], 0
mov r12, r9
mov rax, qword [rbp + 0x80]
movzx r15d, r8b
mov qword [rbp - 0x58], rax
mov rdi, rcx
mov qword [rbp - 0x68], r9
mov byte [rsp + 0x54], r8b
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x78], rcx
jne 0x1401fea7b
cmp byte [0x1411dd043], 0
jne 0x1401fea7b
cmp byte [0x1411dd044], 0
jne 0x1401fea7b
cmp byte [0x1411dd035], 0
jne 0x1401fea7b
cmp byte [0x1411dd040], 0
jne 0x1401fea7b
cmp byte [0x1411dd041], 0
jne 0x1401fea7b
cmp byte [0x1411dd03f], 0
jne 0x1401fea7b
cmp byte [0x1411dd045], 0
jne 0x1401fea7b
xor ebx, ebx
mov dword [rsp + 0x60], 0x4034b50
xor r14b, r14b
mov dword [rsp + 0x5c], 0x2014b50
cmp byte [0x1411dd026], bl
mov r13b, 0x2e
mov byte [rsp + 0x40], r14b
mov dword [rsp + 0x48], 0x6054b50
mov dword [rsp + 0x78], 0x64726f77
mov word [rsp + 0x44], 0x6c78
mov word [rsp + 0x7c], 0x7070
mov dword [rsp + 0x4c], 0x74706143
mov dword [rbp - 0x38], 0x74706143
mov dword [rbp - 0x34], 0x4f657275
mov word [rbp - 0x30], 0x656e
mov dword [rbp - 0x10], 0x63697551
mov dword [rbp - 0xc], 0x6f6f4c6b
mov dword [rsp + 0x58], 0x2f53504f
mov dword [rsp + 0x50], 0x65646e49
mov dword [rbp - 0x28], 0x65646e49
mov dword [rbp - 0x24], 0x61432f78
mov dword [rbp - 0x20], 0x6c75636c
mov dword [rbp - 0x1c], 0x6f697461
mov dword [rbp - 0x18], 0x676e456e
mov word [rbp - 0x14], 0x6e69
mov dword [rbp - 0x48], 0x6e65706f
mov dword [rbp - 0x44], 0x75636f64
mov dword [rbp - 0x40], 0x746e656d
mov dword [rsp + 0x6c], ebx
mov dword [rbp - 0x80], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x64], ebx
jne 0x1401fea7b
mov edx, dword [rcx + 0x28]
imul edx, dword [rcx + 0x48]
lea ecx, [rbx + 1]
mov qword [rsp + 0x118], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8d, dword [rdi + 0x28]
xor edx, edx
imul r8d, dword [rdi + 0x48]
mov rcx, rax
mov rsi, rax
mov qword [rbp - 0x70], rax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rdi + 0x28]
xor edx, edx
mov ecx, dword [rdi + 0x48]
mov r9, rsi
mov dword [rsp + 0x30], edx
mov r8, r12
mov qword [rsp + 0x28], rdx
movzx edx, r15b
imul eax, ecx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x20], eax
call fcn.1401c1720
test eax, eax
je 0x1401fe962
mov ebx, dword [rsp + 0x60]
cmp ebx, dword [rsi]
jne 0x1401fe95d
mov rax, qword [rbp - 0x48]
mov qword [0x1411dd043], 0
mov dword [0x1411dd031], 0x1000000
mov word [0x1411dd03f], 0
mov byte [0x1411dd041], r14b
mov byte [0x1411dd035], r14b
mov word [0x1411dd04b], 0
mov byte [0x1411dd04d], r14b
cmp rax, qword [rsi + 0x3c]
jne 0x1401fe424
mov eax, dword [rbp - 0x40]
cmp eax, dword [rsi + 0x44]
jne 0x1401fe424
cmp r13b, byte [rsi + 0x48]
jne 0x1401fe424
mov byte [0x1411dd045], 1
jmp 0x1401fe95d
mov edx, 0x400000
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401fea73
xor edx, edx
mov r8d, 0x400000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsp + 0x70]
xor eax, eax
mov ecx, dword [rdi + 0x48]
mov r8, r12
mov dword [rsp + 0x30], eax
movzx edx, r15b
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400000
call fcn.1401c1720
test eax, eax
je 0x1401fe95d
cmp byte [0x1411dd026], r14b
jne 0x1401fe95d
mov r10d, dword [rdi + 0x48]
mov r9d, dword [rdi + 0x28]
mov edi, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x48]
movzx r14d, word [rsp + 0x44]
mov r15d, dword [rsp + 0x4c]
mov r12d, dword [rsp + 0x50]
mov r8d, dword [rbp - 0x80]
nop word [rax + rax]
mov ecx, r10d
imul ecx, r9d
cmp r8d, ecx
jbe 0x1401fe4df
xor edx, edx
mov eax, r8d
div ecx
inc eax
imul eax, r10d
imul eax, r9d
jmp 0x1401fe4e1
mov eax, ecx
mov r8d, 0x400000
mov edx, 0
sub r8d, dword [rsp + 0x68]
cmp dword [rsp + 0x68], 0x400000
cmovae r8d, edx
cmp r8d, eax
jae 0x1401fe581
mov eax, dword [rsp + 0x6c]
div ecx
mov r8d, edx
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x68], edx
mov eax, r8d
xor edx, edx
div ecx
mov rcx, qword [rsp + 0x70]
xor edx, edx
imul eax, r10d
imul eax, r9d
mov dword [rsp + 0x64], eax
mov eax, 0x400000
sub eax, r8d
mov r8d, 0x400000
mov dword [rsp + 0x48], eax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbp - 0x80]
xor eax, eax
add r8, qword [rbp - 0x68]
mov r9, qword [rsp + 0x70]
movzx edx, byte [rsp + 0x54]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x78]
mov dword [rsp + 0x20], 0x400000
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x1401fe8d3
mov r8d, dword [rsp + 0x48]
mov rax, qword [rbp - 0x78]
xor edx, edx
mov ecx, dword [rax + 0x28]
mov r10d, dword [rax + 0x48]
mov eax, dword [rsp + 0x6c]
imul ecx, r10d
div ecx
mov dword [rsp + 0x4c], ecx
lea eax, [rdx + 4]
cmp eax, r8d
jae 0x1401fe8d3
mov r9d, dword [rsp + 0x64]
mov r11, qword [rsp + 0x70]
mov ecx, edx
add rcx, r9
cmp ebx, dword [rcx + r11]
jne 0x1401fe7f2
lea eax, [rdx + 0x1e]
cmp eax, r8d
jae 0x1401fe8d3
add edx, 0x12
mov eax, edx
add edx, 8
add rax, r9
cmp byte [0x1411dd028], 0
lea r10d, [rdx + 2]
mov ecx, dword [rax + r11]
mov dword [rsp + 0x64], ecx
je 0x1401fe65c
mov eax, ecx
mov byte [rsp + 0x53], cl
shr eax, 0x18
mov byte [rsp + 0x50], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x51], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x52], al
lea rax, [r11 + rdx]
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x59], al
shr cx, 8
mov byte [rsp + 0x58], cl
mov eax, r10d
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x45], al
shr cx, 8
mov byte [rsp + 0x44], cl
movzx eax, word [rsp + 0x44]
movzx ecx, word [rsp + 0x58]
mov word [rsp + 0x4c], ax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x64], eax
mov word [rsp + 0x48], cx
jmp 0x1401fe67b
mov eax, r10d
add rax, r11
mov ecx, edx
add rcx, r11
movzx eax, word [rax + r9]
mov word [rsp + 0x4c], ax
movzx eax, word [rcx + r9]
mov word [rsp + 0x48], ax
add r10d, 2
mov qword [rbp - 0x48], r8
mov edx, r10d
mov qword [rbp - 0x60], rdx
lea rax, [r10 + 4]
cmp rax, r8
jae 0x1401fe8d3
mov eax, dword [rsp + 0x78]
lea rcx, [r10 + r9]
add rcx, r11
mov qword [rbp - 0x80], rcx
cmp eax, dword [rcx]
jne 0x1401fe6c3
mov byte [0x1411dd031], 1
mov word [0x1411dd034], 0
mov word [0x1411dd037], 0x100
lea rax, [r10 + 2]
cmp rax, r8
jae 0x1401fe8d3
cmp r14w, word [rcx]
jne 0x1401fe6ef
mov word [0x1411dd033], 1
mov word [0x1411dd037], 0x100
mov byte [0x1411dd035], 0
lea rax, [r10 + 3]
cmp rax, r8
jae 0x1401fe8d3
movzx eax, word [rsp + 0x7c]
cmp ax, word [rcx]
jne 0x1401fe726
mov al, 0x74
cmp al, byte [rcx + 2]
jne 0x1401fe726
mov byte [0x1411dd032], 1
mov word [0x1411dd034], 0
mov word [0x1411dd037], 0x100
cmp r15d, dword [rcx]
jne 0x1401fe74f
lea rax, [r10 + 0xa]
cmp rax, r8
jae 0x1401fe8d3
mov rax, qword [rbp - 0x38]
cmp rax, qword [rcx]
jne 0x1401fe74f
movzx eax, word [rbp - 0x30]
cmp ax, word [rcx + 8]
je 0x1401fe9a9
cmp r12d, dword [rcx]
jne 0x1401fe787
lea rax, [r10 + 0x16]
cmp rax, r8
jae 0x1401fe8d3
mov rdx, rcx
mov r8d, 0x16
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401fe9c7
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x48]
lea rax, [rdx + 9]
cmp rax, r8
jae 0x1401fe8d3
mov rax, qword [rbp - 0x10]
cmp rax, qword [rcx]
jne 0x1401fe7a8
mov al, 0x6b
cmp al, byte [rcx + 8]
je 0x1401fe9e3
cmp edi, dword [rcx]
je 0x1401fea12
mov rax, qword [rbp - 0x78]
xor edx, edx
mov r11d, dword [rsp + 0x68]
movzx r8d, word [rsp + 0x4c]
add r8d, dword [rsp + 0x64]
mov r9d, dword [rax + 0x28]
mov r10d, dword [rax + 0x48]
movzx ecx, word [rsp + 0x48]
add ecx, 0x1e
add r8d, ecx
mov ecx, r9d
add r11d, r8d
imul ecx, r10d
mov eax, r11d
mov dword [rsp + 0x68], r11d
div ecx
jmp 0x1401fe8b5
cmp r13d, dword [rcx + r11]
jne 0x1401fe8d3
lea eax, [rdx + 0x2e]
cmp eax, r8d
jae 0x1401fe8d3
mov dword [rbp - 0x80], edx
add edx, 0x1c
mov eax, edx
add edx, 2
add rax, r9
cmp byte [0x1411dd028], 0
movzx ecx, word [rax + r11]
mov word [rsp + 0x48], cx
je 0x1401fe85d
movzx eax, cx
mov byte [rsp + 0x61], cl
shr ax, 8
mov byte [rsp + 0x60], al
mov eax, edx
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x5d], al
movzx eax, word [rsp + 0x60]
shr cx, 8
mov byte [rsp + 0x5c], cl
movzx ecx, word [rsp + 0x5c]
jmp 0x1401fe86c
mov eax, edx
add rax, r11
movzx ecx, word [rax + r9]
movzx eax, word [rsp + 0x48]
movzx edx, cx
mov ecx, dword [rbp - 0x80]
movzx eax, ax
add ecx, 0x2e
add edx, eax
add ecx, edx
lea eax, [rcx + 4]
cmp eax, r8d
jae 0x1401fe8d3
mov eax, ecx
add rax, r9
cmp esi, dword [rax + r11]
je 0x1401fea41
mov eax, dword [rsp + 0x68]
lea r8d, [rdx + 0x2e]
mov rcx, qword [rbp - 0x78]
add eax, r8d
xor edx, edx
mov dword [rsp + 0x68], eax
div dword [rsp + 0x4c]
mov r9d, dword [rcx + 0x28]
mov byte [rsp + 0x40], 1
add dword [rsp + 0x6c], r8d
imul eax, r9d
imul eax, r10d
cmp byte [0x1411dd026], 0
mov dword [rsp + 0x64], eax
je 0x1401fe4c0
movzx r14d, byte [rsp + 0x40]
test r14b, r14b
je 0x1401fe959
mov eax, dword [rsp + 0x6c]
cmp byte [0x1411dd034], 0
jne 0x1401fea52
cmp byte [0x1411dd035], 0
jne 0x1401fea52
cmp byte [0x1411dd045], 0
jne 0x1401fea52
cmp byte [0x1411dd040], 0
jne 0x1401fea52
cmp byte [0x1411dd041], 0
jne 0x1401fea52
cmp byte [0x1411dd03f], 0
jne 0x1401fea52
cmp byte [0x1411dd043], 0
jne 0x1401fea52
cmp byte [0x1411dd044], 0
jne 0x1401fea52
mov rcx, qword [rbp - 0x58]
mov byte [rcx], 1
mov rcx, qword [rbp - 0x50]
mov qword [rcx + 0x10], rax
mov rsi, qword [rbp - 0x70]
mov rbx, qword [rsp + 0x70]
test rsi, rsi
je 0x1401fe970
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1401fe97e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r14b
mov rsi, qword [rsp + 0x118]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov byte [0x1411dd032], 0
mov word [0x1411dd034], 0x100
mov word [0x1411dd037], 0
jmp 0x1401fe8d3
mov byte [0x1411dd034], 0
mov word [0x1411dd03f], 0x101
mov byte [0x1411dd041], 1
jmp 0x1401fe8d3
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 1
jmp 0x1401fe8d3
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 0x100
jmp 0x1401fe8d3
mov eax, dword [rsp + 0x6c]
mov r14b, 1
add eax, 0x44
add eax, edx
jmp 0x1401fe8e2
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1401fea61
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x1401fe982
mov rbx, rax
jmp 0x1401fe962
xor al, al
jmp 0x1401fe98a