Function at 0x1400032c8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
xor ebx, ebx
mov dword [rbp + 0xa0], ebx
call fcn.14000314c
lea r8, [rbp + 0xa0]
mov rcx, rax
lea rdx, [0x140003ab0]
call fcn.140003084
mov rdi, rax
test rax, rax
je 0x1400033d5
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x110
call fcn.140003900
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
mov eax, dword [rsp + 0x7c]
mov ecx, 0x47ba
cmp eax, ecx
ja 0x140003484
je 0x140003386
cmp eax, 0x1db1
je 0x140003435
cmp eax, 0x2580
je 0x1400033f4
cmp eax, 0x3839
je 0x1400033ea
cmp eax, 0x3ad7
je 0x1400033ea
cmp eax, 0x3fab
je 0x1400033ea
cmp eax, 0x42ee
je 0x140003386
cmp eax, 0x4563
jne 0x1400033d2
mov dword [rsp + 0x3c], 0x6530ec83
lea r8, [rsp + 0x30]
mov byte [rsp + 0x42], 0x34
mov r9d, 0x13
mov word [rsp + 0x40], 0x8b48
mov dword [rsp + 0x38], 0x48571824
mov dword [rsp + 0x34], 0x74894808
mov byte [rsp + 0x20], bl
mov dword [rsp + 0x30], 0x245c8948
mov edx, dword [rbp + 0xa0]
mov rcx, rdi
call fcn.14000324c
mov rbx, rax
mov rax, rbx
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov dword [rsp + 0x3c], 0x6520ec83
jmp 0x14000338e
mov dword [rsp + 0x34], 0x6c894808
lea r8, [rsp + 0x30]
mov dword [rsp + 0x38], 0x89481024
mov r9d, 0x1b
mov dword [rsp + 0x3c], 0x57182474
mov dword [rsp + 0x40], 0x20ec8348
mov dword [rsp + 0x44], 0x8bd98b48
mov word [rsp + 0x48], 0x48f2
mov byte [rsp + 0x4a], 0x8d
jmp 0x1400033b5
mov dword [rsp + 0x34], 0x6c894808
lea r8, [rsp + 0x30]
mov dword [rsp + 0x38], 0x89481824
mov r9d, 0x22
mov dword [rsp + 0x3c], 0x57202474
mov dword [rsp + 0x40], 0x55415441
mov dword [rsp + 0x44], 0x57415641
mov dword [rsp + 0x48], 0x30ec8348
mov dword [rsp + 0x4c], 0x44f98b48
mov word [rsp + 0x50], 0xf28b
jmp 0x1400033b5
sub eax, 0x47bb
je 0x140003386
sub eax, 0x2a6
je 0x140003551
sub eax, 1
je 0x140003551
sub eax, 1
je 0x140003551
sub eax, 1
je 0x1400034bc
cmp eax, 0xb8c
jne 0x1400033d2
mov dword [rsp + 0x30], 0x48c48b48
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], 0x483f3f89
mov r9d, 0x40
mov dword [rsp + 0x38], 0x483f3f89
mov dword [rsp + 0x3c], 0x573f3f89
mov dword [rsp + 0x40], 0x3f3f3f48
mov dword [rsp + 0x44], 0x3f3f3f65
mov dword [rsp + 0x48], 0x3f3f3f3f
mov dword [rsp + 0x4c], 0x3f3f483f
mov dword [rsp + 0x50], 0xc6da8b3f
mov dword [rsp + 0x54], 0x483f3f40
mov dword [rsp + 0x58], 0x166f98b
mov dword [rsp + 0x5c], 0x3f3f3f3f
mov dword [rsp + 0x60], 0x483fb23f
mov dword [rsp + 0x64], 0x3f3f3f3f
mov dword [rsp + 0x68], 0x3fe83f3f
mov dword [rsp + 0x6c], 0x833f3f3f
mov byte [rsp + 0x20], 1
jmp 0x1400033c1
mov dword [rsp + 0x30], 0x48c48b48
lea r8, [rsp + 0x30]
mov dword [rsp + 0x34], 0x483f3f89
mov r9d, 0x2a
mov dword [rsp + 0x38], 0x483f3f89
mov dword [rsp + 0x3c], 0x573f3f89
mov dword [rsp + 0x40], 0x3f3f3f48
mov dword [rsp + 0x44], 0x3f3f3f65
mov dword [rsp + 0x48], 0x3f3f3f3f
mov dword [rsp + 0x4c], 0x3f3f483f
mov dword [rsp + 0x50], 0xc6da8b3f
mov dword [rsp + 0x54], 0x483f3f40
mov word [rsp + 0x58], 0xf98b
mov byte [rsp + 0x20], 1
jmp 0x1400033c1