Function at 0x140002040
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x138
mov dword [rsp + 0x58], 0x400000
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x30], 0x89
mov byte [rsp + 0x31], 0x83
mov byte [rsp + 0x32], 0xb2
mov byte [rsp + 0x33], 0x8e
mov byte [rsp + 0x34], 0x83
mov byte [rsp + 0x35], 0x8c
mov byte [rsp + 0x36], 0x71
mov byte [rsp + 0x37], 0x72
mov byte [rsp + 0x38], 0x4e
mov byte [rsp + 0x39], 0x84
mov byte [rsp + 0x3a], 0x8c
mov byte [rsp + 0x3b], 0x8c
mov byte [rsp + 0x3c], 0
mov dword [rsp + 0xb8], 0
jmp 0x1400020f0
mov eax, dword [rsp + 0xb8]
inc eax
mov dword [rsp + 0xb8], eax
movsxd rax, dword [rsp + 0xb8]
cmp rax, 0xd
jae 0x1400021b7
movsxd rax, dword [rsp + 0xb8]
movzx eax, byte [rsp + rax + 0x30]
xor eax, 0xbf
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 0xb8]
movzx eax, byte [rsp + rax + 0x30]
sub eax, 0xbf
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 0xb8]
movzx eax, byte [rsp + rax + 0x30]
xor eax, 0xee
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 0xb8]
movzx eax, byte [rsp + rax + 0x30]
sub eax, 0xee
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 0xb8]
movzx eax, byte [rsp + rax + 0x30]
xor eax, 0x60
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 0xb8]
movzx eax, byte [rsp + rax + 0x30]
sub eax, 0x60
movsxd rcx, dword [rsp + 0xb8]
mov byte [rsp + rcx + 0x30], al
jmp 0x1400020e0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x60], 0
jne 0x1400021d9
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x48], 0
jne 0x14000238d
mov byte [rsp + 0xc0], 0x7e
mov byte [rsp + 0xc1], 0x8f
mov byte [rsp + 0xc2], 0xa2
mov byte [rsp + 0xc3], 0x9c
mov byte [rsp + 0xc4], 0xa3
mov byte [rsp + 0xc5], 0x67
mov byte [rsp + 0xc6], 0x74
mov byte [rsp + 0xc7], 0x57
mov byte [rsp + 0xc8], 0xa3
mov byte [rsp + 0xc9], 0x93
mov byte [rsp + 0xca], 0xa2
mov byte [rsp + 0xcb], 0x9f
mov byte [rsp + 0xcc], 0x73
mov byte [rsp + 0xcd], 0x98
mov byte [rsp + 0xce], 0
mov dword [rsp + 0xd8], 0
jmp 0x14000227a
mov eax, dword [rsp + 0xd8]
inc eax
mov dword [rsp + 0xd8], eax
movsxd rax, dword [rsp + 0xd8]
cmp rax, 0xf
jae 0x140002365
movsxd rax, dword [rsp + 0xd8]
movzx eax, byte [rsp + rax + 0xc0]
xor eax, 0x82
movsxd rcx, dword [rsp + 0xd8]
mov byte [rsp + rcx + 0xc0], al
movsxd rax, dword [rsp + 0xd8]
movzx eax, byte [rsp + rax + 0xc0]
sub eax, 0x82
movsxd rcx, dword [rsp + 0xd8]
mov byte [rsp + rcx + 0xc0], al
movsxd rax, dword [rsp + 0xd8]
movzx eax, byte [rsp + rax + 0xc0]
xor eax, 9
movsxd rcx, dword [rsp + 0xd8]
mov byte [rsp + rcx + 0xc0], al
movsxd rax, dword [rsp + 0xd8]
movzx eax, byte [rsp + rax + 0xc0]
sub eax, 9
movsxd rcx, dword [rsp + 0xd8]
mov byte [rsp + rcx + 0xc0], al
movsxd rax, dword [rsp + 0xd8]
movzx eax, byte [rsp + rax + 0xc0]
xor eax, 0x8e
movsxd rcx, dword [rsp + 0xd8]
mov byte [rsp + rcx + 0xc0], al
movsxd rax, dword [rsp + 0xd8]
movzx eax, byte [rsp + rax + 0xc0]
sub eax, 0x8e
movsxd rcx, dword [rsp + 0xd8]
mov byte [rsp + rcx + 0xc0], al
jmp 0x14000226a
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xd0], rax
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x70], 0
jne 0x14000252d
mov byte [rsp + 0xe0], 0x61
mov byte [rsp + 0xe1], 0x30
mov byte [rsp + 0xe2], 0x3f
mov byte [rsp + 0xe3], 0x46
mov byte [rsp + 0xe4], 0x50
mov byte [rsp + 0xe5], 0x3a
mov byte [rsp + 0xe6], 0x41
mov byte [rsp + 0xe7], 0x25
mov byte [rsp + 0xe8], 0x3f
mov byte [rsp + 0xe9], 0x35
mov byte [rsp + 0xea], 0x35
mov byte [rsp + 0xeb], 0
mov dword [rsp + 0xf8], 0
jmp 0x140002416
mov eax, dword [rsp + 0xf8]
inc eax
mov dword [rsp + 0xf8], eax
movsxd rax, dword [rsp + 0xf8]
cmp rax, 0xc
jae 0x140002505
movsxd rax, dword [rsp + 0xf8]
movzx eax, byte [rsp + rax + 0xe0]
xor eax, 0xf2
movsxd rcx, dword [rsp + 0xf8]
mov byte [rsp + rcx + 0xe0], al
movsxd rax, dword [rsp + 0xf8]
movzx eax, byte [rsp + rax + 0xe0]
sub eax, 0xf2
movsxd rcx, dword [rsp + 0xf8]
mov byte [rsp + rcx + 0xe0], al
movsxd rax, dword [rsp + 0xf8]
movzx eax, byte [rsp + rax + 0xe0]
xor eax, 0xbb
movsxd rcx, dword [rsp + 0xf8]
mov byte [rsp + rcx + 0xe0], al
movsxd rax, dword [rsp + 0xf8]
movzx eax, byte [rsp + rax + 0xe0]
sub eax, 0xbb
movsxd rcx, dword [rsp + 0xf8]
mov byte [rsp + rcx + 0xe0], al
movsxd rax, dword [rsp + 0xf8]
movzx eax, byte [rsp + rax + 0xe0]
xor eax, 0xa8
movsxd rcx, dword [rsp + 0xf8]
mov byte [rsp + rcx + 0xe0], al
movsxd rax, dword [rsp + 0xf8]
movzx eax, byte [rsp + rax + 0xe0]
sub eax, 0xa8
movsxd rcx, dword [rsp + 0xf8]
mov byte [rsp + rcx + 0xe0], al
jmp 0x140002406
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x40], 0
jne 0x1400026f9
mov byte [rsp + 0x100], 0xce
mov byte [rsp + 0x101], 0xe5
mov byte [rsp + 0x102], 0xd9
mov byte [rsp + 0x103], 0xdc
mov byte [rsp + 0x104], 0xd0
mov byte [rsp + 0x105], 0xee
mov byte [rsp + 0x106], 3
mov byte [rsp + 0x107], 0xdf
mov byte [rsp + 0x108], 0xe5
mov byte [rsp + 0x109], 0xef
mov byte [rsp + 0x10a], 0xef
mov byte [rsp + 0x10b], 0xdd
mov byte [rsp + 0x10c], 0xe5
mov byte [rsp + 0x10d], 0xfd
mov byte [rsp + 0x10e], 3
mov byte [rsp + 0x10f], 0xee
mov byte [rsp + 0x110], 1
mov byte [rsp + 0x111], 0
mov dword [rsp + 0x120], 0
jmp 0x1400025e6
mov eax, dword [rsp + 0x120]
inc eax
mov dword [rsp + 0x120], eax
movsxd rax, dword [rsp + 0x120]
cmp rax, 0x12
jae 0x1400026d1
movsxd rax, dword [rsp + 0x120]
movzx eax, byte [rsp + rax + 0x100]
xor eax, 0x7d
movsxd rcx, dword [rsp + 0x120]
mov byte [rsp + rcx + 0x100], al
movsxd rax, dword [rsp + 0x120]
movzx eax, byte [rsp + rax + 0x100]
sub eax, 0x7d
movsxd rcx, dword [rsp + 0x120]
mov byte [rsp + rcx + 0x100], al
movsxd rax, dword [rsp + 0x120]
movzx eax, byte [rsp + rax + 0x100]
xor eax, 0xbb
movsxd rcx, dword [rsp + 0x120]
mov byte [rsp + rcx + 0x100], al
movsxd rax, dword [rsp + 0x120]
movzx eax, byte [rsp + rax + 0x100]
sub eax, 0xbb
movsxd rcx, dword [rsp + 0x120]
mov byte [rsp + rcx + 0x100], al
movsxd rax, dword [rsp + 0x120]
movzx eax, byte [rsp + rax + 0x100]
xor eax, 0xc8
movsxd rcx, dword [rsp + 0x120]
mov byte [rsp + rcx + 0x100], al
movsxd rax, dword [rsp + 0x120]
movzx eax, byte [rsp + rax + 0x100]
sub eax, 0xc8
movsxd rcx, dword [rsp + 0x120]
mov byte [rsp + rcx + 0x100], al
jmp 0x1400025d6
lea rax, [rsp + 0x100]
mov qword [rsp + 0x118], rax
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x140]
xor edx, edx
mov ecx, 0x1fffff
call qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
mov eax, dword [rsp + 0x58]
mov r9d, 0x30
lea r8, [rsp + 0x80]
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x48]
test eax, eax
je 0x1400028d3
cmp dword [rsp + 0xa8], 0x20000
jne 0x1400028be
cmp dword [rsp + 0xa4], 0x10
je 0x1400028be
cmp dword [rsp + 0xa4], 1
je 0x1400028be
cmp dword [rsp + 0xa4], 0x80
je 0x1400028be
mov rcx, qword [rsp + 0x98]
call fcn.14000c870
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x140002799
jmp 0x140002714
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x98]
mov r8, qword [rsp + 0x68]
mov edx, eax
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x40]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
je 0x1400028be
movsxd rax, dword [rsp + 0x150]
cmp qword [rsp + 0x98], rax
jb 0x1400028be
mov dword [rsp + 0x124], 0
jmp 0x140002803
mov eax, dword [rsp + 0x124]
inc eax
mov dword [rsp + 0x124], eax
movsxd rax, dword [rsp + 0x124]
cmp rax, qword [rsp + 0x98]
jae 0x1400028be
mov dword [rsp + 0x128], 0
mov dword [rsp + 0x12c], 0
jmp 0x140002841
mov eax, dword [rsp + 0x12c]
inc eax
mov dword [rsp + 0x12c], eax
mov eax, dword [rsp + 0x150]
cmp dword [rsp + 0x12c], eax
jge 0x140002898
mov eax, dword [rsp + 0x12c]
mov ecx, dword [rsp + 0x124]
add ecx, eax
mov eax, ecx
cdqe
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x12c]
mov rdx, qword [rsp + 0x148]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
jne 0x140002896
mov eax, dword [rsp + 0x128]
inc eax
mov dword [rsp + 0x128], eax
jmp 0x140002831
mov eax, dword [rsp + 0x150]
cmp dword [rsp + 0x128], eax
jne 0x1400028b9
mov eax, dword [rsp + 0x124]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
jmp 0x1400028e3
jmp 0x1400027f3
mov eax, dword [rsp + 0x58]
add rax, qword [rsp + 0x98]
mov dword [rsp + 0x58], eax
jmp 0x140002714
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x138
ret