Function at 0x14009ebe0
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x120
movdqa xmm0, xmmword [0x140123090]
mov rdi, rcx
movdqa xmm1, xmmword [0x140123160]
lea rcx, str.hid________cVXpgb6pmqzK
movdqu xmmword [rbp - 0x58], xmm0
xor r14d, r14d
mov r15d, r9d
movdqa xmm0, xmmword [0x140122fb0]
mov esi, r8d
movdqu xmmword [rbp - 0x38], xmm0
mov rbx, rdx
mov dword [rbp - 0x28], r14d
movdqu xmmword [rbp - 0x48], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x140123090]
lea rcx, str.hid________kn8ELUQCfKIn
movdqa xmm1, xmmword [0x140123940]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x140123e40]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm1, xmmword [0x140122dd0]
movdqa xmmword [rbp], xmm0
movdqa xmmword [rbp + 0x10], xmm1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, str.hid________vLOKyiaFZNKj
mov dword [rsp + 0x50], 0x200020
mov dword [rsp + 0x54], 0x20002a
mov dword [rsp + 0x58], 0x6e0055
mov dword [rsp + 0x5c], 0x6e006b
mov dword [rsp + 0x60], 0x77006f
mov dword [rsp + 0x64], 0x20006e
mov dword [rsp + 0x68], 0x65006b
mov dword [rsp + 0x6c], 0x200079
mov dword [rsp + 0x70], 0x730028
mov dword [rsp + 0x74], 0x650065
mov dword [rsp + 0x78], 0x20006e
mov dword [rsp + 0x7c], 0x730061
mov dword [rbp - 0x80], 0x250020
mov dword [rbp - 0x7c], 0x380030
mov dword [rbp - 0x78], 0x290078
mov dword [rbp - 0x74], 0xa
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [rbp - 0x70]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x14009ef39
movzx ecx, word [rbp - 0x70]
lea r12, [0x14010a1e0]
mov rax, qword [rbp - 0x68]
shr rcx, 1
mov word [rax + rcx*2 - 2], r14w
mov r13, qword [rbp - 0x68]
mov eax, dword [rbx]
add r13, 2
mov qword [rbp - 0x60], r13
sub eax, 1
je 0x14009ee7b
cmp eax, 1
je 0x14009ed9d
mov edx, dword [rbx]
lea rcx, [rsp + 0x50]
call fcn.14000b314
mov r8d, 0x200000
mov edx, esi
mov rcx, rbx
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
test r15d, r15d
je 0x14009ef2f
mov r14, rbx
lea r15, str.unknown
jmp 0x14009eec4
lea rcx, [rbp - 0x58]
call fcn.14000b314
mov r8d, dword [rbx + 4]
lea rdx, [rbx + 0xc]
mov r14d, 1
mov rcx, rdi
mov r9d, r14d
call fcn.14008abb0
mov edx, dword [rbx + 4]
lea rdi, str.ntds
mov dword [rsp + 0x40], r15d
lea rcx, [rbx + 0xc]
mov qword [rsp + 0x38], r13
mov r9d, r14d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], r14d
call fcn.140096800
test r15d, r15d
je 0x14009ef2f
mov r14d, dword [rbx + 4]
lea rax, [0x14010a1d0]
mov esi, dword [rbx + 8]
lea r15, str.capi
add r14, 0xc
mov qword [rsp + 0x20], rax
mov r9, r13
xor r8d, r8d
mov rdx, r15
mov rcx, rdi
add r14, rbx
call fcn.140096ed4
mov r13, rax
test rax, rax
je 0x14009ee6e
mov r9d, dword [rbx + 4]
lea r8, [rbx + 0xc]
mov edx, esi
mov qword [rsp + 0x28], rax
mov rcx, r14
call fcn.140004984
test eax, eax
lea rcx, str._tPFX_container__:__s____s_n
lea rax, [0x14010a1d8]
mov rdx, r12
cmovne rdx, rax
mov r8, r13
call fcn.14000b314
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r13, qword [rbp - 0x60]
lea rax, [0x140110a50]
jmp 0x14009eed2
lea rcx, [rbp - 0x20]
call fcn.14000b314
add esi, 0xfffffffc
lea r14, [rbx + 4]
mov r8d, esi
mov rdx, r14
xor r9d, r9d
mov rcx, rdi
call fcn.14008abb0
mov r8d, 0x200000
mov edx, esi
mov rcx, r14
call fcn.1400115ec
lea rcx, reloc.Cabinet.dll_FCICreate
call fcn.14000b314
test r15d, r15d
je 0x14009ef2f
lea r15, str.legacy
lea rax, [0x14010b910]
lea rdi, str.ntds
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov r9, r13
mov rdx, r15
mov rcx, rdi
call fcn.140096ed4
mov rbx, rax
test rax, rax
je 0x14009ef2f
test r14, r14
je 0x14009ef26
test esi, esi
je 0x14009ef26
mov r8d, esi
mov rdx, r14
mov rcx, rax
call fcn.1400090dc
test eax, eax
lea rcx, str._tExport_________:__s____s_n
lea rax, [0x14010a1d8]
mov r8, rbx
cmovne r12, rax
mov rdx, r12
call fcn.14000b314
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rbp - 0x70]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret