Function at 0x140009230
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x6d0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp + 0x6b8], rbx
mov qword [rbp + 0x6c0], rsi
mov rax, qword [0x140176280]
xor rax, rbp
mov qword [rbp + 0x680], rax
mov r14, rcx
xor edi, edi
mov dword [rbp + 0x1c], edi
call fcn.140025340
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x14000928f
mov ecx, 0x80004005
call fcn.140024930
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 8], rbx
lea rdx, [0x1401443c8]
test rdx, 0xffffffffffff0000
jne 0x1400092cf
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.1400247c0
test rax, rax
je 0x1400092df
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140026110
jmp 0x1400092db
xor r8d, r8d
lea rcx, [rbp + 8]
call fcn.140026bc0
mov rbx, qword [rbp + 8]
mov word [rbp + 0x470], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x472]
call fcn.14005bfb0
mov word [rbp + 0x260], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x262]
call fcn.14005bfb0
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
mov dword [rbp + 0x18], edi
mov word [rbp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x52]
call fcn.14005bfb0
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call fcn.140135e90
mov word [rbp + 0x56], di
mov dword [rbp + 0x31], 0x6c6c64
mov dword [rbp + 0x2b], 0x336c656e
mov word [rbp + 0x2f], 0x2e32
mov word [rbp + 0x28], 0x654b
mov byte [rbp + 0x2a], 0x72
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140009420
mov dword [rbp + 0x47], 0x6f697461
mov dword [rbp + 0x38], 0x56746547
mov dword [rbp + 0x42], 0x726f666e
mov dword [rbp + 0x3e], 0x49656d75
mov byte [rbp + 0x46], 0x6d
mov word [rbp + 0x4c], 0x57
mov word [rbp + 0x3c], 0x6c6f
mov byte [rbp + 0x4b], 0x6e
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401860e0], rax
test rax, rax
je 0x140009420
mov dword [rsp + 0x38], 0x105
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x14]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x10]
mov r8d, 0x105
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x50]
call rax
test eax, eax
je 0x140009420
mov dword [rbp], 0x756c25
mov r8d, dword [rbp + 0x10]
lea rdx, [rbp]
lea rcx, [rbp + 8]
call fcn.140024e60
mov rbx, qword [rbp + 8]
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140009484
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140009430
inc edx
cmp edx, 0x3fffffff
jg 0x140009484
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000945c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14005f5d0
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, 3
mov r8d, edx
mov rdx, rbx
call fcn.14002c880
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.14002c590
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400094a5
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r14
mov rcx, qword [rbp + 0x680]
xor rcx, rbp
call fcn.1400596e0
mov rbx, qword [rbp + 0x6b8]
mov rsi, qword [rbp + 0x6c0]
lea rsp, [rbp + 0x690]
pop r14
pop rdi
pop rbp
ret