Function at 0x14002b33c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x1401040c0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor r15d, r15d
mov dword [r11 - 0x48], 0x5f424a65
mov dword [r11 - 0x44], 0x7075f57
mov dword [r11 - 0x40], 0x55545318
xor eax, eax
mov byte [r11 - 0x3c], al
mov edx, r15d
mov r13b, 0x2e
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x1a0], al
inc edx
cmp edx, 0xc
jb 0x14002b395
mov byte [rsp + 0x1ac], r15b
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x14002b3e2
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x14002bf48
mov dword [rsp + 0x160], 0x5f555f61
mov dword [rsp + 0x164], 0x565b4162
mov dword [rsp + 0x168], 0x4b4453
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xb
jb 0x14002b406
mov byte [rsp + 0x16b], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
or rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002b449
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
mov r12d, reloc.OLEAUT32.dll_SafeArrayDestroy
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1401080b0], rax
mov rdx, qword [rsp + 0x198]
mov r14d, 0x1000
cmp rdx, r12
jbe 0x14002b4dd
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002b4d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf63
call fcn.1400810e0
test rbx, rbx
je 0x14002bf69
movdqa xmm0, xmmword [str.m_UPFV_ZY_PVK]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x3121516d
mov dword [rsp + 0x174], 0x312b2b31
xor eax, eax
mov byte [rsp + 0x178], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x18
jb 0x14002b519
mov byte [rsp + 0x178], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002b558
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1401080e8], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002b5e0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002b5db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bf84
call fcn.1400810e0
test rbx, rbx
je 0x14002bf8a
movdqa xmm0, xmmword [str.__RW_G]
movdqu xmmword [rsp + 0x160], xmm0
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, r12d
jb 0x14002b5fd
mov byte [rsp + 0x16f], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002b63c
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1401080f0], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002b6c4
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002b6bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfa5
call fcn.1400810e0
test rbx, rbx
je 0x14002bfab
mov dword [rsp + 0x160], 0x525f5d7e
mov dword [rsp + 0x164], 0x6474057
mov dword [rsp + 0x168], 0x415d7904
mov word [rsp + 0x16c], 0x6c4e
xor eax, eax
mov byte [rsp + 0x16e], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xe
jb 0x14002b704
mov byte [rsp + 0x16e], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002b743
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x1401080f8], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002b7cb
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002b7c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfc6
call fcn.1400810e0
test rbx, rbx
je 0x14002bfcc
mov dword [rsp + 0x160], 0x44544063
mov dword [rsp + 0x164], 0x707565e
mov dword [rsp + 0x168], 0x4a4a5e70
mov word [rsp + 0x16c], 0x6c4e
xor eax, eax
mov byte [rsp + 0x16e], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xe
jb 0x14002b80b
mov byte [rsp + 0x16e], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002b84a
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140108100], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002b8d2
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002b8cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002bfed
call fcn.1400810e0
test rbx, rbx
je 0x14002bff3
mov dword [rsp + 0x160], 0x44544063
mov dword [rsp + 0x164], 0x707565e
mov dword [rsp + 0x168], 0x4d405278
mov word [rsp + 0x16c], 0x6d
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0xd
jb 0x14002b909
mov byte [rsp + 0x16d], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002b948
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140108108], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002b9d0
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002b9cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c014
call fcn.1400810e0
test rbx, rbx
je 0x14002c01a
movdqa xmm0, xmmword [0x1400f4f30]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x8394d51
mov dword [rsp + 0x174], 0x2b252c
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x17
jb 0x14002ba03
mov byte [rsp + 0x177], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002ba42
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140108110], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002baca
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002bac5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c03b
call fcn.1400810e0
test rbx, rbx
je 0x14002c041
movdqa xmm0, xmmword [str.jJFXQVZuXVMHTP]
movdqu xmmword [rsp + 0x160], xmm0
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, r12d
jb 0x14002bae7
mov byte [rsp + 0x16f], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002bb26
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140108120], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002bbae
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002bba9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c062
call fcn.1400810e0
test rbx, rbx
je 0x14002c068
mov dword [rsp + 0x1b0], 0x50464b6f
mov dword [rsp + 0x1b4], 0x7075a42
mov dword [rsp + 0x1b8], 0x55545318
xor eax, eax
mov byte [rsp + 0x1bc], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x1b0], al
inc edx
cmp edx, 0xc
jb 0x14002bbe4
mov byte [rsp + 0x1bc], r15b
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
jne 0x14002bc31
lea rcx, [rsp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x14002c089
movdqa xmm0, xmmword [0x1400f4f50]
movdqu xmmword [rsp + 0x160], xmm0
xor eax, eax
mov byte [rsp + 0x170], al
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x10
jb 0x14002bc4e
mov byte [rsp + 0x170], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002bc8d
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x140108128], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002bd15
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002bd10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c0aa
call fcn.1400810e0
test rdi, rdi
je 0x14002c0b0
movdqa xmm0, xmmword [0x1400f4f60]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x24275a52
mov word [rsp + 0x174], 0x31
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x15
jb 0x14002bd47
mov byte [rsp + 0x175], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x14002bd86
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
mov qword [0x140108138], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002be0e
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002be09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c0d1
call fcn.1400810e0
test rdi, rdi
je 0x14002c0d7
movdqa xmm0, xmmword [0x1400f4f90]
movdqu xmmword [rsp + 0x160], xmm0
mov dword [rsp + 0x170], 0x2435535f
mov word [rsp + 0x174], SafeArrayUnaccessData
mov edx, r15d
movsxd rcx, edx
lea eax, [rdx + r13]
xor byte [rsp + rcx + 0x160], al
inc edx
cmp edx, 0x15
jb 0x14002be40
mov byte [rsp + 0x175], r15b
xorps xmm0, xmm0
movups xmmword [rsp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x190], xmm1
lea rax, [rsp + 0x160]
inc rsi
cmp byte [rax + rsi], r15b
jne 0x14002be7c
mov r8, rsi
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x180]
call fcn.140013580
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], r12
cmova rdx, qword [rsp + 0x180]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x140108130], rax
mov rdx, qword [rsp + 0x198]
cmp rdx, r12
jbe 0x14002bf07
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, r14
jb 0x14002bf02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002c0f8
call fcn.1400810e0
test rbx, rbx
je 0x14002c0fe
mov al, 1
jmp 0x14002bf16
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1400810c0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, [rsp + 0x28]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x28]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x40]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x40]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x58]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x58]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x70]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x70]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x88]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x88]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0xa0]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0xa0]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0xb8]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0xb8]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0xd0]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0xd0]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0xe8]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0xe8]
call fcn.140083270
lea rcx, [rsp + 0x100]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x100]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x118]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x118]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x130]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x130]
call fcn.140083270
call fcn.140087ff4
int3
lea rcx, [rsp + 0x148]
call fcn.14002a574
lea rdx, [0x140102b18]
lea rcx, [rsp + 0x148]
call fcn.140083270
int3