Function at 0x180002940
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18001c030]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r13, rdx
xor r14d, r14d
mov dword [0x18001c6c4], r14d
mov dword [rsp + 0x20], r14d
mov ecx, 0x64000
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
mov byte [rsp + 0x30], 0x49
mov byte [rsp + 0x31], 0x50
mov byte [rsp + 0x32], 0x48
mov byte [rsp + 0x33], 0x4c
mov byte [rsp + 0x34], 0x50
mov byte [rsp + 0x35], 0x41
mov byte [rsp + 0x36], 0x50
mov byte [rsp + 0x37], 0x49
mov byte [rsp + 0x38], r14b
mov byte [rsp + 0x40], 0x47
mov byte [rsp + 0x41], 0x65
mov byte [rsp + 0x42], 0x74
mov byte [rsp + 0x43], 0x54
mov byte [rsp + 0x44], 0x63
mov byte [rsp + 0x45], 0x70
mov byte [rsp + 0x46], 0x54
mov byte [rsp + 0x47], 0x61
mov byte [rsp + 0x48], 0x62
mov byte [rsp + 0x49], 0x6c
mov byte [rsp + 0x4a], 0x65
mov byte [rsp + 0x4b], r14b
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov dword [rsp + 0x20], 0x64000
lea r8d, [r14 + 1]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call rbx
cmp eax, 0x7a
jne 0x180002a52
mov rcx, rdi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov ecx, dword [rsp + 0x20]
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdi, rax
test rax, rax
je 0x180002b9c
mov r8d, 1
lea rdx, [rsp + 0x20]
mov rcx, rdi
call rbx
test eax, eax
jne 0x180002b91
mov esi, r14d
lea r15, [0x18001c6d0]
cmp esi, dword [rdi]
jge 0x180002b82
movsxd rax, esi
lea rbx, [rax + rax*4]
movzx ecx, word [rdi + rbx*4 + 0x14]
call qword [r13 + 0x38]
movzx r12d, ax
movzx ecx, ax
cmp ecx, 0x328
je 0x180002abf
cmp ecx, 0xc38
je 0x180002abf
cmp ecx, 0x1f90
je 0x180002abf
cmp ecx, 0x1f91
je 0x180002abf
cmp ecx, 0x438
jne 0x180002b7b
cmp dword [0x18001c6c4], 0xa
jge 0x180002b82
mov ecx, dword [rdi + rbx*4 + 0x10]
call qword [r13 + 0x20]
lea rdx, [rsp + 0x50]
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx], cl
inc rax
inc rdx
test cl, cl
jne 0x180002ae0
mov r9d, r14d
cmp r9d, dword [0x18001c6c4]
jge 0x180002b2c
movsxd rax, r9d
shl rax, 7
add rax, r15
lea r8, [rsp + 0x50]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180002b23
inc rax
test ecx, ecx
jne 0x180002b10
test edx, edx
je 0x180002b7b
inc r9d
jmp 0x180002af2
test r14d, r14d
jne 0x180002b7b
lea rdx, [rsp + 0x50]
movsxd rcx, dword [0x18001c6c4]
shl rcx, 7
add rcx, r15
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
inc rcx
test al, al
jne 0x180002b50
movsxd rcx, dword [0x18001c6c4]
lea rdx, [0x18001c688]
mov word [rdx + rcx*2], r12w
lea eax, [rcx + 1]
mov dword [0x18001c6c4], eax
inc esi
jmp 0x180002a74
mov rcx, rdi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, 1
jmp 0x180002b9c
mov rcx, rdi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
nop
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180014460
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret