Function at 0x140030528
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov r11, rsp
sub rsp, 0x2e0
mov rax, qword [0x14007bec0]
mov qword [rsp + 0x2d0], rax
xor eax, eax
xor r14d, r14d
mov rsi, rcx
mov byte [r11 - 0x230], r14b
mov qword [r11 - 0x22f], rax
mov byte [r11 - 0x220], r14b
mov qword [r11 - 0x21f], rax
lea rcx, [r11 - 0x20e]
xor edx, edx
mov r8d, 0x1fe
mov dword [rsp + 0xb9], eax
mov word [rsp + 0xbd], ax
mov dword [rsp + 0xc9], eax
mov word [r11 - 0x210], r14w
call fcn.140037b90
lea ebx, [r14 + 8]
lea rdx, [0x14007b620]
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov dword [rsp + 0xa0], 0xaac56b
mov word [rsp + 0xa4], 0xcd44
mov word [rsp + 0xa6], 0x11d0
mov byte [rsp + 0xa8], 0x8c
mov byte [rsp + 0xa9], 0xc2
mov byte [rsp + 0xaa], r14b
mov byte [rsp + 0xab], 0xc0
mov byte [rsp + 0xac], 0x4f
mov byte [rsp + 0xad], 0xc2
mov byte [rsp + 0xae], reloc.OLEAUT32.dll_SysAllocStringByteLen
mov byte [rsp + 0xaf], 0xee
call fcn.14002c848
mov r13, qword [rsp + 0x20]
lea rdx, [0x14007b5f0]
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.14002c848
mov rbp, qword [rsp + 0x20]
lea rdx, [0x14007b628]
lea rcx, [rsp + 0x20]
mov r8d, ebx
call fcn.14002c848
mov r12, qword [rsp + 0x20]
mov rcx, rsi
call fcn.140030988
cmp eax, r14d
jne 0x14003086a
cmp byte [rsi], r14b
mov ebx, r14d
je 0x14003068f
mov rdi, rsi
mov eax, ebx
mov r8d, 1
lea rdx, [rax + rsi]
lea rcx, [rsp + rax*2 + 0xd0]
call fcn.140030898
inc rdi
inc ebx
cmp byte [rdi], r14b
jne 0x14003066c
mov eax, ebx
mov r8d, 1
lea rdx, [rax + rsi]
lea rcx, [rsp + rax*2 + 0xd0]
call fcn.140030898
mov ebx, 0x50
lea rcx, [rsp + 0x30]
mov r8d, ebx
xor edx, edx
mov byte [rsp + 0xc0], 0x77
mov byte [rsp + 0xc1], 0x69
mov byte [rsp + 0xc2], 0x6e
mov byte [rsp + 0xc3], 0x74
mov byte [rsp + 0xc4], 0x72
mov byte [rsp + 0xc5], 0x75
mov byte [rsp + 0xc6], 0x73
mov byte [rsp + 0xc7], 0x74
mov byte [rsp + 0xc8], 0x2e
mov byte [rsp + 0xc9], 0x64
mov byte [rsp + 0xca], 0x6c
mov byte [rsp + 0xcb], 0x6c
mov byte [rsp + 0xcc], r14b
call fcn.140030008
lea rax, [rsp + 0xd0]
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x88], rax
lea rax, [rsp + 0x80]
mov dword [rsp + 0x80], 0x20
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x4c], r14d
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x7c], r14d
mov dword [rsp + 0x78], 0x10
call r13
cmp rax, r14
mov rdi, rax
je 0x140030844
lea rdx, [rsp + 0xb0]
mov rcx, rax
mov byte [rsp + 0xb0], 0x57
mov byte [rsp + 0xb1], 0x69
mov byte [rsp + 0xb2], 0x6e
mov byte [rsp + 0xb3], 0x56
mov byte [rsp + 0xb4], 0x65
mov byte [rsp + 0xb5], 0x72
mov byte [rsp + 0xb6], 0x69
mov byte [rsp + 0xb7], 0x66
mov byte [rsp + 0xb8], 0x79
mov byte [rsp + 0xb9], 0x54
mov byte [rsp + 0xba], 0x72
mov byte [rsp + 0xbb], 0x75
mov byte [rsp + 0xbc], 0x73
mov byte [rsp + 0xbd], 0x74
mov byte [rsp + 0xbe], r14b
call r12
cmp rax, r14
mov qword [0x140089d50], rax
jne 0x14003084b
call fcn.1400308d8
jmp 0x14003086a
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffffffffffff
call rax
mov rcx, rdi
mov ebx, eax
call rbp
mov eax, ebx
mov rcx, qword [rsp + 0x2d0]
call fcn.140033cf0
add rsp, 0x2e0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret