Function at 0x14003ed80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x6d0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp + 0x6b8], rbx
mov qword [rbp + 0x6c0], rsi
mov rax, qword [0x14017b250]
xor rax, rbp
mov qword [rbp + 0x680], rax
mov r14, rcx
xor edi, edi
mov dword [rbp + 0x1c], edi
call fcn.1400155d0
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x14003eddf
mov ecx, 0x80004005
call fcn.14000f2a0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 8], rbx
lea rdx, [0x140149380]
test rdx, 0xffffffffffff0000
jne 0x14003ee1f
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.14000f130
test rax, rax
je 0x14003ee2f
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140019410
jmp 0x14003ee2b
xor r8d, r8d
lea rcx, [rbp + 8]
call fcn.140023790
mov rbx, qword [rbp + 8]
mov word [rbp + 0x470], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x472]
call fcn.14006eac0
mov word [rbp + 0x260], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x262]
call fcn.14006eac0
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
mov dword [rbp + 0x18], edi
mov word [rbp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x52]
call fcn.14006eac0
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call fcn.140036880
mov word [rbp + 0x56], di
mov dword [rbp + 0x31], 0x6c6c64
mov dword [rbp + 0x2b], 0x336c656e
mov word [rbp + 0x2f], 0x2e32
mov word [rbp + 0x28], 0x654b
mov byte [rbp + 0x2a], 0x72
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14003ef70
mov dword [rbp + 0x47], 0x6f697461
mov dword [rbp + 0x38], 0x56746547
mov dword [rbp + 0x42], 0x726f666e
mov dword [rbp + 0x3e], 0x49656d75
mov byte [rbp + 0x46], 0x6d
mov word [rbp + 0x4c], 0x57
mov word [rbp + 0x3c], 0x6c6f
mov byte [rbp + 0x4b], 0x6e
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14018ad70], rax
test rax, rax
je 0x14003ef70
mov dword [rsp + 0x38], 0x105
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x14]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x10]
mov r8d, 0x105
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x50]
call rax
test eax, eax
je 0x14003ef70
mov dword [rbp], 0x756c25
mov r8d, dword [rbp + 0x10]
lea rdx, [rbp]
lea rcx, [rbp + 8]
call fcn.140011d20
mov rbx, qword [rbp + 8]
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x14003efd4
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x14003ef80
inc edx
cmp edx, 0x3fffffff
jg 0x14003efd4
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14003efac
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400720e0
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, 3
mov r8d, edx
mov rdx, rbx
call fcn.14003df50
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14003dc40
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14003eff5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r14
mov rcx, qword [rbp + 0x680]
xor rcx, rbp
call fcn.14006c1f0
mov rbx, qword [rbp + 0x6b8]
mov rsi, qword [rbp + 0x6c0]
lea rsp, [rbp + 0x690]
pop r14
pop rdi
pop rbp
ret