Function at 0x1401fd5e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xc8
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 7], rax
mov rax, qword [rbp + 0x7f]
xor r15d, r15d
mov qword [rbp - 0x11], rdx
mov rbx, rcx
mov qword [rbp - 0x21], rcx
xor dil, dil
mov edx, 0x1400000
mov qword [rbp - 0x19], r9
lea ecx, [r15 + 1]
mov byte [rbp - 0x61], r8b
mov r14, r9
mov qword [rbp - 0x31], rax
movzx esi, r8b
mov byte [rbp - 0x70], dil
mov dword [rbp - 0x4d], 0xba010000
mov r13d, r15d
mov dword [rbp - 0x69], 0xb3010000
mov r12d, r15d
mov dword [rbp - 0x51], 0xbb010000
mov word [rbp - 0x41], 0
mov dword [rbp - 0x55], 0xb9010000
mov dword [rbp - 0x39], 0xb7010000
mov dword [rbp - 0x59], 0xe0010000
mov dword [rbp - 0x5d], 0xc0010000
mov dword [rbp - 0x6d], 0xb8010000
mov dword [rbp - 0x3d], 0xb2010000
mov dword [rbp - 9], 0x64666f53
mov dword [rbp - 5], 0x74536365
mov dword [rbp - 1], 0x6d616572
mov qword [rbp - 0x49], r15
mov dword [rbp - 0x65], r15d
mov byte [rbp - 0x71], dil
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rbp - 0x29], rax
test rax, rax
je 0x1401fdcb6
xor edx, edx
mov r8d, 0x1400000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbp - 0x29]
mov r8, r14
mov ecx, dword [rbx + 0x48]
movzx edx, sil
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x1400000
call fcn.1401c1720
cmp eax, 0xffffffff
je 0x1401fdcac
mov r9, qword [rbp - 0x29]
mov ebx, dword [rbp - 0x4d]
cmp ebx, dword [r9]
jne 0x1401fdc24
cmp byte [0x1411dd026], dil
jne 0x1401fdcac
mov edi, dword [rbp - 0x51]
mov r15d, dword [rbp - 0x55]
mov r14d, dword [rbp - 0x59]
mov esi, dword [rbp - 0x5d]
movzx r11d, byte [0x1411dd028]
nop dword [rax]
mov eax, r12d
add rax, 0x18
cmp rax, 0x1400000
jb 0x1401fd7b0
mov rcx, qword [rbp - 0x21]
mov rax, r13
cqo
mov r8d, dword [rcx + 0x28]
imul r8d, dword [rcx + 0x48]
mov rcx, r9
idiv r8
mov r8d, 0x1400000
mov r12, rdx
mov r13, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rbp - 0x19]
xor eax, eax
mov r9, qword [rbp - 0x29]
add r8, r13
movzx edx, byte [rbp - 0x61]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x21]
mov dword [rsp + 0x20], 0x1400000
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x1401fdca8
movzx r11d, byte [0x1411dd028]
mov r13, qword [rbp - 0x49]
mov r9, qword [rbp - 0x29]
mov ecx, r12d
lea rax, [rcx + 0x18]
cmp rax, 0x1400000
jae 0x1401fdbfb
cmp ebx, dword [rcx + r9]
jne 0x1401fd803
lea rax, [rcx + 0x2c]
cmp rax, 0x1400000
jae 0x1401fd7f2
mov rax, qword [rbp - 9]
lea ecx, [r12 + 0x20]
cmp rax, qword [rcx + r9]
jne 0x1401fd7f2
mov eax, dword [rbp - 1]
cmp eax, dword [rcx + r9 + 8]
je 0x1401fdc15
add r12d, 0xc
add r13, 0xc
mov qword [rbp - 0x49], r13
jmp 0x1401fdbee
lea eax, [r12 + 0x14]
mov edx, eax
cmp ebx, dword [rax + r9]
jne 0x1401fd84a
add rax, 0x2c
cmp rax, 0x1400000
jae 0x1401fd839
mov rax, qword [rbp - 9]
lea ecx, [r12 + 0x34]
cmp rax, qword [rcx + r9]
jne 0x1401fd839
mov eax, dword [rbp - 1]
cmp eax, dword [rcx + r9 + 8]
je 0x1401fdc15
add r12d, 0x20
add r13, 0x20
mov qword [rbp - 0x49], r13
jmp 0x1401fdbee
cmp edi, dword [rcx + r9]
jne 0x1401fd8ac
add r12d, 4
lea eax, [r12 + 2]
cmp eax, 0x1400000
jae 0x1401fd88f
test r11b, r11b
jne 0x1401fd882
movzx eax, byte [r12 + r9 + 1]
mov byte [rbp - 0x5d], al
movzx eax, byte [r12 + r9]
mov byte [rbp - 0x5c], al
movzx eax, word [rbp - 0x5d]
movzx edx, ax
mov dword [rbp - 0x65], edx
jmp 0x1401fd892
movzx eax, word [r12 + r9]
movzx edx, ax
mov dword [rbp - 0x65], edx
jmp 0x1401fd892
mov edx, dword [rbp - 0x65]
add r12d, 2
mov byte [rbp - 0x71], 1
add r12d, edx
lea ecx, [rdx + 6]
add r13, rcx
mov qword [rbp - 0x49], r13
jmp 0x1401fdbee
cmp r15d, dword [rcx + r9]
jne 0x1401fd900
add r12d, 4
add r13, 4
mov qword [rbp - 0x49], r13
lea eax, [r12 + 0x14]
mov ecx, eax
add rax, 4
cmp rax, 0x1400000
jae 0x1401fdbfb
cmp ebx, dword [r12 + r9]
je 0x1401fdbee
cmp ebx, dword [rcx + r9]
je 0x1401fdbee
mov rax, qword [rbp - 0x31]
mov dil, 1
mov byte [rax], dil
mov rax, qword [rbp - 0x11]
mov qword [rax + 0x10], r13
jmp 0x1401fdcac
movzx r10d, word [rbp - 0x41]
mov al, 1
cmp r10w, word [rcx + r9]
jne 0x1401fdb70
cmp al, byte [rcx + r9 + 2]
jne 0x1401fdb70
add r12d, 4
lea eax, [r12 + 2]
cmp eax, 0x1400000
jae 0x1401fd95c
test r11b, r11b
jne 0x1401fd94f
movzx eax, byte [r12 + r9 + 1]
mov byte [rbp - 0x59], al
movzx eax, byte [r12 + r9]
mov byte [rbp - 0x58], al
movzx eax, word [rbp - 0x59]
movzx edx, ax
mov dword [rbp - 0x65], edx
jmp 0x1401fd95f
movzx eax, word [r12 + r9]
movzx edx, ax
mov dword [rbp - 0x65], edx
jmp 0x1401fd95f
mov edx, dword [rbp - 0x65]
add r12d, 2
lea ecx, [rdx + 6]
add r13, rcx
add r12d, edx
mov qword [rbp - 0x49], r13
lea rax, [r13 + 0x18]
cmp rax, 0x1400000
jl 0x1401fd98c
lea eax, [r12 + 0x18]
cmp eax, 0x1400000
jae 0x1401fdbd5
mov r8d, r12d
add r8, r9
test r11b, r11b
jne 0x1401fd9bb
movzx eax, byte [r8 + 3]
mov byte [rbp - 0x6d], al
movzx eax, byte [r8 + 2]
mov byte [rbp - 0x6c], al
movzx eax, byte [r8 + 1]
mov byte [rbp - 0x6b], al
movzx eax, byte [r8]
mov byte [rbp - 0x6a], al
mov eax, dword [rbp - 0x6d]
jmp 0x1401fd9be
mov eax, dword [r8]
lea r10d, [r12 + 0x14]
test eax, eax
jne 0x1401fd9fc
mov ecx, r10d
add rcx, r9
test r11b, r11b
jne 0x1401fd9f2
movzx eax, byte [rcx + 3]
mov byte [rbp - 0x69], al
movzx eax, byte [rcx + 2]
mov byte [rbp - 0x68], al
movzx eax, byte [rcx + 1]
mov byte [rbp - 0x67], al
movzx eax, byte [rcx]
mov byte [rbp - 0x66], al
mov eax, dword [rbp - 0x69]
jmp 0x1401fd9f4
mov eax, dword [rcx]
test eax, eax
je 0x1401fdbfb
lea rax, [r10 + 3]
mov ecx, r10d
cmp rax, 0x1400000
jae 0x1401fdbd5
movzx r10d, word [rbp - 0x41]
mov al, 1
cmp r10w, word [r8]
jne 0x1401fda26
cmp al, byte [r8 + 2]
je 0x1401fdbd5
cmp ebx, dword [r9 + rcx]
je 0x1401fdbd5
cmp r10w, word [r9 + rcx]
jne 0x1401fda42
cmp al, byte [r9 + rcx + 2]
je 0x1401fdbd5
sub r12d, edx
mov eax, edx
sub r13, rax
mov r8d, 2
cmp byte [0x1411dd026], 0
mov r10d, r12d
mov qword [rbp - 0x49], r13
jne 0x1401fdbd5
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx + 4]
add eax, r10d
cmp r12d, eax
jae 0x1401fdbd5
cmp r12d, 0x1400000
ja 0x1401fdbd5
lea eax, [r12 + 4]
cmp eax, 0x1400000
jae 0x1401fdaaa
cmp ebx, dword [r12 + r9]
jne 0x1401fdaaa
add r12d, 0xc
add r13, 0xc
mov qword [rbp - 0x49], r13
lea ecx, [r12 + 4]
cmp ecx, 0x1400000
jae 0x1401fdad0
cmp r14d, dword [r12 + r9]
je 0x1401fdac3
cmp esi, dword [r12 + r9]
jne 0x1401fdad0
lea eax, [rcx + 2]
mov r12d, ecx
cmp eax, 0x1400000
jb 0x1401fdb37
lea ecx, [r12 + 4]
cmp ecx, 0x1400000
jae 0x1401fdb2c
cmp edi, dword [r12 + r9]
jne 0x1401fdb2c
lea eax, [rcx + 2]
mov r12d, ecx
cmp eax, 0x1400000
jae 0x1401fdb2c
test r11b, r11b
jne 0x1401fdb0c
movzx eax, byte [rcx + r9 + 1]
mov byte [rbp - 0x55], al
movzx eax, byte [rcx + r9]
mov byte [rbp - 0x54], al
movzx eax, word [rbp - 0x55]
jmp 0x1401fdb11
movzx eax, word [rcx + r9]
movzx edx, ax
add r12d, 2
add r12d, edx
mov dword [rbp - 0x65], edx
mov byte [rbp - 0x71], 1
lea ecx, [rdx + 6]
add r13, rcx
mov qword [rbp - 0x49], r13
inc r8d
inc r12d
jmp 0x1401fda70
test r11b, r11b
jne 0x1401fdb53
movzx eax, byte [rcx + r9 + 1]
mov byte [rbp - 0x51], al
movzx eax, byte [rcx + r9]
mov byte [rbp - 0x50], al
movzx eax, word [rbp - 0x51]
jmp 0x1401fdb58
movzx eax, word [rcx + r9]
movzx eax, ax
add r12d, 2
add r12d, eax
mov dword [rbp - 0x65], eax
lea ecx, [rax + 6]
mov eax, r8d
add r13, rax
jmp 0x1401fdbce
cmp r10w, word [rdx + r9]
jne 0x1401fdbfb
cmp al, byte [rdx + r9 + 2]
jne 0x1401fdbfb
add r12d, 0x18
lea eax, [r12 + 2]
cmp eax, 0x1400000
jae 0x1401fdbc1
test r11b, r11b
jne 0x1401fdbb4
movzx eax, byte [r12 + r9 + 1]
mov byte [rbp - 0x4d], al
movzx eax, byte [r12 + r9]
mov byte [rbp - 0x4c], al
movzx eax, word [rbp - 0x4d]
movzx edx, ax
mov dword [rbp - 0x65], edx
jmp 0x1401fdbc4
movzx eax, word [r12 + r9]
movzx edx, ax
mov dword [rbp - 0x65], edx
jmp 0x1401fdbc4
mov edx, dword [rbp - 0x65]
add r12d, 2
lea ecx, [rdx + 0x1a]
add r12d, edx
add r13, rcx
mov qword [rbp - 0x49], r13
cmp byte [rbp - 0x71], 0
je 0x1401fdbee
mov rax, qword [rbp - 0x31]
mov byte [rbp - 0x70], 1
mov byte [rax], 1
movzx r11d, byte [0x1411dd028]
cmp byte [0x1411dd026], 0
je 0x1401fd730
movzx edi, byte [rbp - 0x70]
test dil, dil
je 0x1401fdcac
mov rax, qword [rbp - 0x11]
mov qword [rax + 0x10], r13
jmp 0x1401fdcac
mov rax, qword [rbp - 0x31]
xor dil, dil
mov byte [rax], 0
jmp 0x1401fdcac
mov eax, dword [rbp - 0x69]
cmp eax, dword [r9]
jne 0x1401fdcac
mov ecx, dword [rbp - 0x6d]
cmp ecx, dword [r9 + 0xc]
je 0x1401fdc48
mov ecx, dword [rbp - 0x3d]
cmp ecx, dword [r9 + 0xc]
je 0x1401fdc48
cmp ecx, dword [r9 + 0x4c]
jne 0x1401fdcac
movzx r8d, byte [0x1411dd026]
mov dil, 1
mov ecx, dword [rbp - 0x39]
test r8b, r8b
jne 0x1401fdc9e
mov edx, r12d
cmp ecx, dword [rdx + r9]
jne 0x1401fdc86
lea edx, [r12 + 4]
mov r13d, edx
add rdx, 4
cmp rdx, 0x1400000
jae 0x1401fdc9e
cmp eax, dword [r9 + r13]
jne 0x1401fdc9e
mov edx, 4
jmp 0x1401fdc8b
mov edx, 1
add r12d, edx
mov edx, r12d
add rdx, 4
cmp rdx, 0x1400000
jb 0x1401fdc56
mov rax, qword [rbp - 0x11]
mov qword [rax + 0x10], r13
jmp 0x1401fdcac
movzx edi, byte [rbp - 0x70]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, dil
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret