Function at 0x14025e528
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x218]
sub rsp, 0x2e0
mov qword [rbp + 0x90], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r15, rcx
xor r12d, r12d
mov dword [rbp + 0x230], r12d
call fcn.1401c8e4c
test al, al
jne 0x14025da73
lea eax, [r12 + 1]
jmp 0x14025e50a
mov dword [rbp + 0x228], r12d
test r15, r15
setne dl
mov esi, 1
test r15, r15
je 0x14025daa0
mov rcx, r12
mov al, byte [rcx + r15]
add rcx, rsi
test al, al
jne 0x14025da8d
test rcx, rcx
setne al
and dl, al
mov ebx, 2
or rdi, 0xffffffffffffffff
lea r14d, [rbx + 0xd]
test dl, dl
je 0x14025db04
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x70], r12b
mov rbx, rdi
inc rbx
cmp byte [r15 + rbx], r12b
jne 0x14025dac6
lea rcx, [rsp + 0x70]
cmp rbx, r14
ja 0x14025daf0
mov qword [rbp - 0x80], rbx
mov r8, rbx
mov rdx, r15
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rsp + rbx + 0x70], r12b
jmp 0x14025dafb
mov r9, r15
mov rdx, rbx
call fcn.1400ada10
lea r15, [rsp + 0x70]
mov ebx, esi
jmp 0x14025db2c
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x60], r12
xor r8d, r8d
lea rdx, [0x140290df0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp - 0x70], r12b
lea r15, [rbp - 0x70]
mov dword [rbp + 0x230], ebx
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x20], r12
mov qword [rbp + 0x28], r12
mov r8d, 0x20
mov rdx, r15
lea rcx, [rbp + 0x10]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov qword [r15 + 0x10], r12
mov qword [r15 + 0x18], r14
mov byte [r15], r12b
mov ecx, 2
lea r15d, [rcx + 0xe]
mov r13d, 0x1000
test cl, bl
je 0x14025dbbd
and ebx, 0xfffffffd
mov dword [rbp + 0x230], ebx
mov rdx, qword [rbp - 0x58]
cmp rdx, r15
jb 0x14025dbb1
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r13
jb 0x14025dbac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025dbac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r14
mov byte [rbp - 0x70], r12b
test sil, bl
je 0x14025dc12
and ebx, 0xfffffffe
mov dword [rbp + 0x230], ebx
mov rdx, qword [rbp - 0x78]
cmp rdx, r15
jb 0x14025dc05
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r13
jb 0x14025dc00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025dc00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x70], r12b
lea rcx, [rbp + 0x10]
mov r8, qword [rbp + 0x20]
cmp qword [rbp + 0x28], r15
jb 0x14025dc29
mov rdx, qword [rbp + 0x10]
add r8, rdx
jmp 0x14025dc30
add r8, rcx
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1400c42a4
nop
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
setae cl
cmovae rax, qword [rbp - 0x50]
cmp word [rax], 0x22
jne 0x14025dcc2
lea rax, [rbp - 0x50]
test cl, cl
cmovne rax, qword [rbp - 0x50]
mov r9, qword [rbp - 0x40]
cmp word [rax + r9*2 - 2], 0x22
jne 0x14025dcc2
mov eax, 2
cmp r9, rax
jne 0x14025dc85
lea rdx, [0x140290c34]
lea rcx, [rbp - 0x50]
call fcn.1400ac5ec
jmp 0x14025dcc2
add r9, 0xfffffffffffffffe
mov r8, rsi
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0xa0]
call fcn.140173f18
or ebx, 4
mov dword [rbp + 0x230], ebx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x50]
call fcn.1401712a4
nop
lea rcx, [rbp + 0xa0]
call fcn.1400ac668
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1402d7f44], eax
jle 0x14025df1e
lea rcx, [0x1402d7f44]
call fcn.14027b540
cmp dword [0x1402d7f44], edi
jne 0x14025df1e
lea rax, [rbp + 0x30]
mov qword [rbp + 0x238], rax
mov byte [rsp + 0x48], 0x4f
mov byte [rsp + 0x49], 0x7b
mov byte [rsp + 0x4a], 0x79
mov byte [rsp + 0x4b], 0x79
mov byte [rsp + 0x4c], 0x6d
mov byte [rsp + 0x4d], 0x7a
mov byte [rsp + 0x4e], 0x70
mov byte [rsp + 0x4f], 0x58
mov byte [rsp + 0x50], 0x75
mov byte [rsp + 0x51], 0x7a
mov byte [rsp + 0x52], 0x71
mov byte [rsp + 0x53], 0x60
mov byte [rsp + 0x54], 0x7b
mov byte [rsp + 0x55], 0x4d
mov byte [rsp + 0x56], 0x7e
mov byte [rsp + 0x57], 0x73
mov byte [rsp + 0x58], 0x82
mov byte [rsp + 0x59], 0x63
mov byte [rsp + 0x5a], r12b
mov al, byte [rsp + 0x48]
mov rcx, r12
mov al, byte [rsp + rcx + 0x48]
sub al, 0xc
mov byte [rsp + rcx + 0x48], al
add rcx, rsi
cmp rcx, 0x12
jb 0x14025dd6b
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x40], r12
mov qword [rbp + 0x48], r14
lea rax, [rsp + 0x48]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], r12b
jne 0x14025dd92
lea rcx, [rbp + 0x30]
cmp rbx, r14
ja 0x14025ddbd
mov qword [rbp + 0x40], rbx
mov r8, rbx
lea rdx, [rsp + 0x48]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rbx + 0x30], r12b
jmp 0x14025ddcb
lea r9, [rsp + 0x48]
mov rdx, rbx
call fcn.1400ada10
nop
mov dword [rsp + 0x3c], 0x25
mov byte [rsp + 0x40], 0x56
mov byte [rsp + 0x41], 0x4d
mov byte [rsp + 0x42], 0x40
mov byte [rsp + 0x43], 0x49
mov byte [rsp + 0x44], 0x49
mov byte [rsp + 0x45], 0x16
mov byte [rsp + 0x46], 0x17
xor eax, eax
mov byte [rsp + 0x47], al
mov al, byte [rsp + 0x40]
mov rdx, r12
mov al, byte [rsp + rdx + 0x40]
mov ecx, dword [rsp + 0x3c]
xor cl, al
mov byte [rsp + rdx + 0x40], cl
add rdx, rsi
cmp rdx, 7
jb 0x14025de03
mov byte [rsp + 0x47], r12b
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r14
mov byte [rbp - 0x30], r12b
lea rax, [rsp + 0x40]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], r12b
jne 0x14025de37
lea rcx, [rbp - 0x30]
cmp rbx, r14
ja 0x14025de62
mov qword [rbp - 0x20], rbx
mov r8, rbx
lea rdx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rbx - 0x30], r12b
jmp 0x14025de70
lea r9, [rsp + 0x40]
mov rdx, rbx
call fcn.1400ada10
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0xc0]
call fcn.1401a82ac
nop
mov qword [rsp + 0x20], r12
mov r9b, sil
lea r8, [rbp + 0x30]
mov rdx, rax
lea rcx, [0x1402d86a0]
call fcn.14025e554
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, r15
jb 0x14025ded6
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r13
jb 0x14025ded1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025ded1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], r14
mov byte [rbp - 0x30], r12b
xor edx, edx
lea r8d, [rdx + 8]
lea rcx, [rsp + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x13]
lea rcx, [rsp + 0x48]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x14028f72c]
call fcn.14027b36c
nop
lea rcx, [0x1402d7f44]
call fcn.14027b4e0
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rbx, qword [rbp - 0x50]
lea r13, [0x1402d86b8]
mov rcx, r13
cmp qword [0x1402d86d0], r15
cmovae rcx, qword [0x1402d86b8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14025df7a
mov rcx, r13
cmp qword [0x1402d86d0], r15
cmovae rcx, qword [0x1402d86b8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402d86b0], rax
mov r8, rax
mov rdx, r13
call fcn.1400bc1a0
lea rdx, [rbp + 0x228]
mov rcx, rbx
call qword [0x1402d86a8]
mov r13, rax
mov dword [rsp + 0x5c], 0x17
mov ecx, dword [rsp + 0x5c]
xor cx, 0x73
mov word [rsp + 0x60], cx
mov ecx, dword [rsp + 0x5c]
add cx, si
xor cx, 0x68
mov word [rsp + 0x62], cx
mov ecx, dword [rsp + 0x5c]
add cx, 2
xor cx, 0x65
mov word [rsp + 0x64], cx
mov eax, dword [rsp + 0x5c]
add ax, 3
xor ax, 0x6c
mov word [rsp + 0x66], ax
mov eax, dword [rsp + 0x5c]
add ax, 4
xor ax, 0x6c
mov word [rsp + 0x68], ax
mov eax, dword [rsp + 0x5c]
add ax, 5
xor ax, 0x33
mov word [rsp + 0x6a], ax
mov eax, dword [rsp + 0x5c]
add ax, 6
xor ax, 0x32
mov word [rsp + 0x6c], ax
xor eax, eax
mov word [rsp + 0x6e], ax
movzx eax, word [rsp + 0x60]
mov rdx, r12
movzx eax, word [rsp + rdx*2 + 0x60]
mov ecx, dword [rsp + 0x5c]
add cx, dx
xor cx, ax
mov word [rsp + rdx*2 + 0x60], cx
add rdx, rsi
cmp rdx, 7
jb 0x14025e016
mov word [rsp + 0x6e], r12w
lea rcx, [rsp + 0x60]
call fcn.1401c78cc
nop
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x60]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov eax, dword [rbp + 0x228]
test eax, eax
jle 0x14025e4c1
add eax, esi
mov dword [rbp + 0x228], eax
movsxd rcx, eax
mov r15d, 8
mov eax, r15d
mul rcx
cmovo rax, rdi
mov rcx, rax
call fcn.14027b650
mov r12, rax
mov ebx, pe_nt_image_headers64
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0xe0]
call sub.VCRUNTIME140.dll_memset
mov r8d, ebx
lea rdx, [rbp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor ebx, ebx
test eax, eax
jne 0x14025e169
mov dword [rsp + 0x30], 0x6e
mov eax, dword [rsp + 0x30]
xor al, 0x70
mov byte [rsp + 0x34], al
mov eax, dword [rsp + 0x30]
add al, sil
xor al, 0x6f
mov byte [rsp + 0x35], al
mov eax, dword [rsp + 0x30]
add al, 2
xor al, 0x6c
mov byte [rsp + 0x36], al
mov eax, dword [rsp + 0x30]
add al, 3
xor al, 0x2e
mov byte [rsp + 0x37], al
mov eax, dword [rsp + 0x30]
add al, 4
xor al, 0x65
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x30]
add al, 5
xor al, 0x78
mov byte [rsp + 0x39], al
mov eax, dword [rsp + 0x30]
add al, 6
xor al, 0x65
mov byte [rsp + 0x3a], al
xor eax, eax
mov byte [rsp + 0x3b], al
mov al, byte [rsp + 0x34]
mov r8d, ebx
mov al, byte [rsp + r8 + 0x34]
mov ecx, dword [rsp + 0x30]
add cl, r8b
xor cl, al
mov byte [rsp + r8 + 0x34], cl
add r8, rsi
cmp r8, 7
jb 0x14025e122
mov byte [rsp + 0x3b], bl
lea r8, [rsp + 0x34]
mov edx, pe_nt_image_headers64
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov r8, r15
xor edx, edx
lea rcx, [rsp + 0x34]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov qword [rbp - 0x10], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], r14
mov byte [rbp - 0x10], bl
lea rax, [rbp + 0xe0]
inc rdi
cmp byte [rax + rdi], bl
jne 0x14025e17f
lea rcx, [rbp - 0x10]
cmp rdi, r14
ja 0x14025e1aa
mov qword [rbp], rdi
mov r8, rdi
lea rdx, [rbp + 0xe0]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rdi - 0x10], bl
jmp 0x14025e1ba
lea r9, [rbp + 0xe0]
mov rdx, rdi
call fcn.1400ada10
nop
mov rdx, qword [r13]
lea rcx, [rbp + 0x50]
call fcn.1400ac71c
nop
lea rcx, [rbp + 0x50]
cmp qword [rbp + 0x68], r15
setae r9b
cmovae rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0x60]
lea r8, [rcx + rax*2]
lea rdx, [rbp + 0x50]
test r9b, r9b
cmovne rdx, qword [rbp + 0x50]
lea rcx, [rbp + 0x70]
call fcn.1400af5d0
nop
mov r15, rbx
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x70]
call fcn.1402787f0
test al, al
jne 0x14025e257
lea rcx, [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strlen]
lea rbx, [rsi + rax]
mov rcx, rbx
call fcn.14027b650
mov qword [r12], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov r8, rbx
lea rdx, [rbp + 0xe0]
mov rcx, qword [r12]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov r15, rsi
mov ecx, dword [rbp + 0x228]
xor ebx, ebx
jmp 0x14025e265
mov ecx, dword [rbp + 0x228]
sub ecx, esi
mov dword [rbp + 0x228], ecx
movsxd rax, ecx
cmp r15, rax
jae 0x14025e38d
lea rax, [r15*8]
sub rax, r13
add rax, r12
mov qword [rbp + 0x230], rax
mov ebx, 0x3e8
mov rcx, qword [r13]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rdi, [rsi + rax]
cmp rdi, rbx
cmova rdi, rbx
mov rcx, rdi
call fcn.14027b650
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rdx, qword [r13]
lea rcx, [rsp + 0x70]
call fcn.1400ac71c
nop
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
setae r9b
cmovae rcx, qword [rsp + 0x70]
mov rax, qword [rbp - 0x80]
lea r8, [rcx + rax*2]
lea rdx, [rsp + 0x70]
test r9b, r9b
cmovne rdx, qword [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.1400af5d0
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r8, qword [rbp - 0x70]
mov r9, qword [rbp - 0x60]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov rax, qword [rbp + 0x230]
mov qword [rax + r13], rbx
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x14025e35f
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14025e35a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14025e40b
call fcn.14027b384
xor ebx, ebx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], r14
mov byte [rbp - 0x70], bl
lea rcx, [rsp + 0x70]
call fcn.1400ac668
add r15, rsi
add r13, 8
movsxd rcx, dword [rbp + 0x228]
cmp r15, rcx
jb 0x14025e286
mov rdx, r12
call fcn.14025d7c4
mov edi, eax
xor ecx, ecx
call fcn.1401742f0
movsxd rcx, dword [rbp + 0x228]
xor r15d, r15d
test rcx, rcx
je 0x14025e3c5
mov rcx, qword [r12 + rbx*8]
call fcn.14027b384
add rbx, rsi
movsxd rcx, dword [rbp + 0x228]
cmp rbx, rcx
jb 0x14025e3ad
mov rcx, r12
call fcn.14027b384
nop
mov rdx, qword [rbp + 0x88]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x14025e417
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x14025e412
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025e412
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14027b384
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x88], r14
mov byte [rbp + 0x70], r15b
lea rcx, [rbp + 0x50]
call fcn.1400ac668
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14025e46d
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, rbx
jb 0x14025e468
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025e468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp], r15
mov qword [rbp + 8], r14
mov byte [rbp - 0x10], r15b
lea rcx, [rbp - 0x50]
call fcn.1400ac668
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x14025e4bd
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, rbx
jb 0x14025e4b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025e4b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov eax, edi
jmp 0x14025e50a
lea rcx, [rbp - 0x50]
call fcn.1400ac668
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, r15
jb 0x14025e508
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14025e503
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14025e503
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
xor eax, eax
mov rbx, qword [rsp + 0x320]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.1401c8e4c
test al, al
je 0x14025e547
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14025da28
mov eax, 1
add rsp, 0x20
pop rbx
ret