Function at 0x14328
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2820
mov rax, qword [0x00078100]
xor rax, rsp
mov qword [rsp + 0x2810], rax
xor r15d, r15d
mov rbp, rcx
mov r14, r9
lea r13d, [r15 + 0x70]
mov qword [rsp + 0x60], r9
mov r12, r8
mov rcx, r13
mov qword [rsp + 0xa8], r8
mov edi, r15d
call fcn.00012184
mov dword [rsp + 0x48], r15d
mov byte [rsp + 0x6b8], r15b
mov rbx, rax
mov qword [rsp + 0xa0], rax
xor eax, eax
mov qword [rsp + 0x6b9], rax
mov word [rsp + 0x6c1], ax
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
mov dword [rsp + 0x88], 1
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], r15
mov byte [rsp + 0x680], 0x31
mov byte [rsp + 0x681], 0x32
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x682], 0x33
mov byte [rsp + 0x683], 0x34
mov byte [rsp + 0x684], 0x35
mov byte [rsp + 0x685], 0x36
mov byte [rsp + 0x686], 0x37
mov byte [rsp + 0x687], 0x38
mov byte [rsp + 0x688], 0x39
mov byte [rsp + 0x689], 0x30
mov byte [rsp + 0x68a], 0x41
mov byte [rsp + 0x68b], 0x42
mov byte [rsp + 0x68c], 0x43
mov byte [rsp + 0x68d], 0x44
mov byte [rsp + 0x68e], 0x45
mov byte [rsp + 0x68f], 0x46
mov byte [rsp + 0x690], 0x47
mov byte [rsp + 0x691], 0x48
mov byte [rsp + 0x692], 0x49
mov byte [rsp + 0x693], 0x4a
mov byte [rsp + 0x694], 0x4b
mov byte [rsp + 0x695], 0x4c
mov byte [rsp + 0x696], 0x4d
mov byte [rsp + 0x697], 0x4e
mov byte [rsp + 0x698], 0x4f
mov byte [rsp + 0x699], 0x50
mov byte [rsp + 0x69a], 0x51
mov byte [rsp + 0x69b], 0x52
mov byte [rsp + 0x69c], 0x53
mov byte [rsp + 0x69d], 0x54
mov byte [rsp + 0x69e], 0x55
mov byte [rsp + 0x69f], 0x56
mov byte [rsp + 0x6a0], 0x57
mov byte [rsp + 0x6a1], 0x58
mov byte [rsp + 0x6a2], 0x59
mov byte [rsp + 0x6a3], 0x5a
mov rsi, r15
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_RtlRandom]
inc rsi
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp rsi, 0xa
movsxd rax, ecx
mov cl, byte [rsp + rax + 0x680]
mov byte [rsp + rsi + 0x6b7], cl
jl 0x144fa
cmp rbx, r15
je 0x14c39
lea rdx, str._____BEGIN_RSA_PRIVATE_KEY______r_nMIIEpAIBAAKCAQEAoD1aF_757wrn77YVLI3IN0YWkDS454uSKYJ0CDLPOnjw7Cib_r_nWLYZfGEB5s_XfDXda0RhMtAKWjVkqsKN52POmQwEm_M_i5y_MrRO7xnV0ubSA5s_r_nc5ACQqCOh9IiLUzpH1y2G9N2OP_0QjE4Yf0cBN_sUZPaO0sjvbVPF60w778bCSsW_r_nW8IHYlFZawF0ir6IeZrtEgjRVzkVnASEeHFTt3V5AI2NtZDNDJb0SrsZnPJgM9n9_r_nw6G3xOauMZ0Ex0MIMoBq1SvsXfHBjlDngcB4wZl8iaoVFtmslixiCbhtbavCN2E_r_nERpcqLedwQHrkcZtJhz06wsSMvasgdtnChEIwIDAQABAoIBAA7_bw1L6iy7gpXn_r_nHvg6lQDHaJk6tgvF_nowIZga2VaJt1MDQfb9pEkF812dGngfuoetsMNGwZFL6g4p_r_ng4qixtWAUHYgQFRa6XJfefvbGTIaE4CdCP2P_wYpbO29d0FyL2emD81u72PKYRxI_r_n6xQQ0qyKIN5JzmU6VTAOZka7CReHTyqsiicxrMfU2ia93tm61kEYA0YzBKiWPab__r_n2Ruvo7PpxpD47vE8wnG8GTF405c6Cr0XNzRJv9TilEXXLz7_H_HR8e6LVB2TxFDJ_r_n3Rf6RF5Z_9l5G7Hpox_ae0mCaHO4qKQAxixczSSpgiAIKIuxsLNz1z8U96obmUv_r_nCuceGTECgYEA7KehVPO6zZtpbVjZbiLDuNV_3_QCYersEwjNuQIJQVtkcd9rOGnS_r_nUUPPB0oSXdlOmF3B4GENgemPWlAHSXkdkn1LQDzUmPVOdhJDQfXCVCFkVPoDfKU_r_n0JLyMmnFd7sQRc_Zumzk7NcjYbpe_TCTVV0NBf1VNqbRLg7A5ANWN0CgYEArVad_r_nq4xtj1pqxC8iKKBMniwx5QfMJZU7f1oXvjWcYhb5oEtIbvqQEEPDuWaMsq0kwg_r_n14_zxGeYXmbkv06izvlRvgZk7RU29tQI13A8T1q7AAtMfmCNMxmpTb4C2C_jtJ1W_r_nksxLwvezl3uHUbfq9e5Zs2vnwEz4eNAWW4jwP8CgYEA3osAdr_AUessqCxeQ2ij_r_nvyPeXX674tKk731e3_SfOXu1KDReQq2YntzySbuJLAHXH1VVtpQ__QMSfDuGlCJ3_r_nBhmkWo7DQh4pfHz8rSlLOTIkeLZ7yOnusYTnUYj3QnLUqsT53DRkjr5xcQZ4WS_r_nVmDepsJE7WepjWTl8gK72m0CgYEAohOORBx_SP5l2FBC6UOBqI6_RS4T59t5ODqt_r_nP7hO00O8bV_HLIHLTxaaHOTFRN7S73RK543YZs4FnUBSHwfsYXgT90su54Nkcf7_r_nKG6SheShW840zSo8fN5utvmHMVu9_2Dq1UJfSMNR0r3bMqa0S_4AdbZkMSQHZPe_r_n1IAuwEMCgYBmCzgdI53M0e2RGayKkIzMhskMaBcsunLLSdb7bBwBPT1AGW5tM_r_n9rraqiftWDBFIIIeNucWIiK3E6gwTdVl4losYcMNldvmIHDg_uS2WthVGS3oU7su_r_n6KM73pBaQwFMsZWHXGfLlgXpDeOQRQ8toiVo1ttB4eVFONn7w4i0g_r_n_____END_RSA_PRIVATE_KEY______r_n
lea rcx, [rsp + 0x70]
xor r9d, r9d
mov r8d, 0x6ab
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], r15
call fcn.00027fe8
mov edi, eax
cmp eax, r15d
je 0x1457e
lea rcx, [0x0005dc70]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14c39
mov r8, r13
xor edx, edx
mov rcx, rbx
call fcn.0005d630
lea rsi, [rbx + 8]
cmp rsi, r15
je 0x145a2
mov dword [rsi], 1
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r15
lea rax, [rsp + 0x70]
lea rcx, [rsp + 0x220]
mov dword [rbx], 2
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x2880]
mov dword [rbx + 0x40], 6
mov qword [rbx + 0x20], rax
call fcn.0001cfac
lea r8, [rsp + 0x220]
lea rdx, [0x0001d1b0]
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x28], 0x30
mov qword [rsp + 0x20], r15
call fcn.0001c9bc
mov edi, eax
cmp eax, r15d
jne 0x14c39
lea r8, [rsp + 0x6b8]
lea rcx, [rsp + 0x88]
mov edx, 0xa
call fcn.0001d9f0
mov edi, eax
cmp eax, r15d
jne 0x14c39
mov rax, qword [0x0007b4c0]
lea rdx, [0x0005dca0]
lea rcx, [rbx + 0x38]
cmp rax, r15
cmovne rdx, rax
call fcn.0003e474
mov edi, eax
cmp eax, r15d
jne 0x14c39
lea rcx, [rbx + 0x30]
mov rdx, rbp
call fcn.0003e474
mov edi, eax
cmp eax, r15d
jne 0x14c39
lea rdx, [rsp + 0x88]
mov rcx, rsi
call fcn.0001d4ec
mov edi, eax
cmp eax, r15d
jne 0x14c39
mov rax, qword [0x0007b4d0]
lea rsi, [0x0005dcc0]
lea rdx, [0x0005dcd0]
cmp rax, r15
cmovne rsi, rax
mov rax, qword [0x0007b4c8]
cmp rax, r15
cmovne rdx, rax
xor eax, eax
or r8, 0xffffffffffffffff
mov rcx, r8
mov rdi, rdx
lea ebp, [rax + 1]
repne scasb al, byte [rdi]
not rcx
sub rcx, rbp
cmp rcx, 0xe
jne 0x14c34
mov rcx, r8
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
sub rcx, rbp
cmp rcx, 0xe
jne 0x14c34
lea edi, [rax + 0xf]
lea rcx, [rbx + 0x44]
mov r8, rdi
call sub.ntoskrnl.exe_strncpy
lea rcx, [rbx + 0x54]
mov r8, rdi
mov rdx, rsi
call sub.ntoskrnl.exe_strncpy
lea rax, [rsp + 0x6b1]
lea rdx, [rsp + 0x6a8]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x58]
mov byte [rbx + 0x52], 0x5a
mov byte [rbx + 0x62], 0x5a
mov qword [rsp + 0x6a8], rax
mov byte [rsp + 0x6b0], al
call fcn.0003abc4
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
lea rdx, [rsp + 0x6a8]
lea rcx, [rsp + 0x58]
mov r8, rdi
mov r10, rdi
call fcn.0003a918
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x6a8]
add r10, rdi
mov rax, rcx
sub rax, rdx
cmp rax, rbp
jl 0x14c2d
sub rcx, rbp
add r10, rbp
lea rax, [rsp + 0x6b1]
sub rax, r10
mov qword [rsp + 0x58], rcx
mov byte [rcx], 0x30
mov qword [rsp + 0x28], r10
lea r8d, [rbp + 2]
lea rdx, [0x0006efac]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.0002691c
mov edi, eax
cmp eax, r15d
jne 0x14c39
lea rax, [rsp + 0x2804]
lea rcx, [rsp + 0x17f0]
xor edx, edx
mov r8d, 0x1014
mov qword [rsp + 0x50], rax
call fcn.0005d630
mov r8, qword [rbx + 0x20]
lea rdx, [rsp + 0x17f0]
lea rcx, [rsp + 0x50]
call fcn.00020c04
lea esi, [rbp + 0x13]
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
lea rcx, [rsp + 0x2804]
lea r8, [rsp + 0x27f0]
mov rdx, rdi
sub rcx, rdi
call fcn.0003c384
lea rdx, [rsp + 0x27f0]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rdx
lea rdx, [rsp + 0x17f0]
mov r8, rsi
call fcn.0003a918
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
mov rdx, qword [rsp + 0x50]
lea rcx, [rsi + rdi]
lea rdi, [rsp + 0x17f0]
mov rax, rdx
sub rax, rdi
cmp rax, rbp
jl 0x14c2d
sub rdx, rbp
add rcx, rbp
lea rax, [rsp + 0x2804]
sub rax, rcx
mov qword [rsp + 0x28], rcx
mov byte [rdx], 4
mov qword [rsp + 0x50], rdx
lea r8d, [rbp + 2]
lea rdx, [0x0006efb0]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.0002691c
mov edi, eax
cmp eax, r15d
jne 0x14c39
lea rax, [rsp + 0x17e4]
lea rcx, [rsp + 0x7d0]
xor edx, edx
mov r8d, 0x1014
mov qword [rsp + 0x40], rax
call fcn.0005d630
mov r8, qword [rbx + 0x28]
lea rdx, [rsp + 0x7d0]
lea rcx, [rsp + 0x40]
call fcn.00020c04
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
lea rcx, [rsp + 0x17e4]
lea r8, [rsp + 0x17d0]
mov rdx, rdi
sub rcx, rdi
call fcn.0003c384
lea rdx, [rsp + 0x17d0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x7d0]
mov r8, rsi
call fcn.0003a918
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x7d0]
lea r10, [rsi + rdi]
mov rax, rcx
sub rax, rdx
cmp rax, rbp
jl 0x14c2d
sub rcx, rbp
add r10, rbp
lea rdx, [rsp + 0x7d0]
mov byte [rcx], 0x80
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x40]
mov r8, r10
call fcn.0003a918
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x7d0]
add r10, rdi
mov rax, rcx
sub rax, rdx
cmp rax, rbp
jl 0x14c2d
sub rcx, rbp
add r10, rbp
lea rax, [rsp + 0x17e4]
sub rax, r10
mov qword [rsp + 0x40], rcx
mov byte [rcx], 0x30
mov qword [rsp + 0x28], r10
lea r8d, [rbp + 2]
lea rdx, [0x0006efb4]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.0002691c
mov edi, eax
cmp eax, r15d
jne 0x14c39
cmp r12, r15
je 0x14b8b
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r12
repne scasb al, byte [rdi]
xor edx, edx
mov r8d, 0xff
not rcx
mov byte [rsp + 0x6d0], r15b
sub rcx, rbp
mov rdi, rcx
lea rcx, [rsp + 0x6d1]
call fcn.0005d630
mov rbp, r15
mov rsi, r15
mov r13, r15
mov r14d, r15d
lea r15, [rdi + 1]
lea r11, [rsp + 0x7d0]
mov qword [rsp + 0x68], r11
test r15, r15
je 0x14b16
mov rbx, qword [rsp + 0xa8]
mov al, byte [r12]
cmp al, 0x2c
je 0x14a7c
test al, al
jne 0x14abf
mov edi, r12d
sub edi, ebx
test edi, edi
jle 0x14abf
mov ecx, 0x28
call fcn.00037798
movsxd rcx, edi
and dword [rax + 8], ebp
and qword [rax + 0x20], rbp
test rsi, rsi
cmove rsi, rax
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rbx
mov dword [rax], 1
test r13, r13
je 0x14ab7
mov qword [r13 + 0x20], rax
mov r13, rax
lea rbx, [r12 + 1]
inc r14d
inc r12
movsxd rax, r14d
cmp rax, r15
jne 0x14a70
mov rbx, qword [rsp + 0xa0]
xor r15d, r15d
jmp 0x14b0f
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov rdi, rsi
call fcn.00026a54
cmp eax, r15d
jl 0x14b80
mov rsi, qword [rsi + 0x20]
cdqe
xor edx, edx
mov rcx, rdi
add rbp, rax
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp rsi, r15
jne 0x14ada
jmp 0x14b19
xor r15d, r15d
lea rdx, [rsp + 0x6d0]
lea rcx, [rsp + 0x68]
mov r8, rbp
call fcn.0003a918
cmp eax, r15d
jl 0x14b80
mov rcx, qword [rsp + 0x68]
cdqe
lea rdx, [rsp + 0x6d0]
add rbp, rax
mov rax, rcx
sub rax, rdx
cmp rax, 1
jl 0x14b80
dec rcx
lea rax, [rbp + 1]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x68], rcx
mov byte [rcx], 0x30
lea r8d, [r9 + 3]
lea rdx, [0x0006efcc]
mov rcx, rbx
call fcn.0002691c
mov r14, qword [rsp + 0x60]
mov r13d, 0x70
mov ebp, 0x1000
mov rcx, rbp
call fcn.00037798
mov qword [rsp + 0x80], r15
mov rsi, rax
cmp rax, r15
je 0x14c20
lea rax, [rsp + 0xc0]
lea r9, [0x0001ceb0]
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.00026b38
movsxd rdi, eax
cmp edi, r15d
jl 0x14c39
lea rax, [rsp + 0x80]
mov r8, rsi
lea rdx, str._____END_CERTIFICATE______n
mov qword [rsp + 0x30], rax
sub r8, rdi
lea rcx, str._____BEGIN_CERTIFICATE______n
mov r9, rdi
add r8, rbp
mov qword [rsp + 0x28], 0x2000
mov qword [rsp + 0x20], r14
call fcn.00036d58
mov edi, eax
cmp eax, r15d
jne 0x14c23
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14c28
or edi, 0xffffffff
cmp edi, r15d
jl 0x14c39
mov edi, r15d
jmp 0x14c39
mov edi, 0xffffff94
jmp 0x14c39
mov edi, 0xffffd800
lea rcx, [rbx + 8]
call fcn.0001d2ec
lea rcx, [rbx + 0x30]
call fcn.0003768c
lea rcx, [rbx + 0x38]
call fcn.0003768c
lea rcx, [rbx + 0x68]
call fcn.0003768c
mov rax, rbx
dec r13
mov byte [rax], r15b
inc rax
cmp r13, r15
jne 0x14c60
lea rcx, [rsp + 0x70]
call fcn.0001c6ac
lea rcx, [rsp + 0x88]
call fcn.0001d2ec
lea rcx, [rsp + 0xc0]
call fcn.0001ca7c
mov r8d, 0x460
lea rax, [rsp + 0x220]
dec r8
mov byte [rax], r15b
inc rax
cmp r8, r15
jne 0x14ca0
cmp rbx, r15
je 0x14cbe
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, edi
mov rcx, qword [rsp + 0x2810]
xor rcx, rsp
call fcn.0005cf80
mov rbx, qword [rsp + 0x2868]
add rsp, 0x2820
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret