Function at 0x1402039b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0xe8], rax
cmp byte [0x1411dd031], 0
mov r12, r9
mov rax, qword [rbp + 0x168]
movzx r15d, r8b
mov qword [rbp - 0x58], rax
mov rdi, rcx
mov qword [rbp - 0x68], r9
mov byte [rsp + 0x54], r8b
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x78], rcx
jne 0x1402045bb
cmp byte [0x1411dd033], 0
jne 0x1402045bb
cmp byte [0x1411dd032], 0
jne 0x1402045bb
cmp byte [0x1411dd043], 0
jne 0x1402045bb
cmp byte [0x1411dd044], 0
jne 0x1402045bb
cmp byte [0x1411dd035], 0
jne 0x1402045bb
cmp byte [0x1411dd040], 0
jne 0x1402045bb
cmp byte [0x1411dd041], 0
jne 0x1402045bb
cmp byte [0x1411dd03f], 0
jne 0x1402045bb
xor r14b, r14b
mov dword [rsp + 0x7c], 0x4034b50
xor ebx, ebx
mov byte [rsp + 0x40], r14b
mov dword [rsp + 0x60], ebx
mov r13b, 0x2e
mov dword [rsp + 0x74], ebx
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x5c], 0x2014b50
mov dword [rbp - 0x80], 0x6054b50
mov dword [rsp + 0x58], 0x64726f77
mov word [rsp + 0x44], 0x6c78
mov word [rbp - 0x7c], 0x7070
mov dword [rsp + 0x4c], 0x74706143
mov dword [rbp - 0x30], 0x74706143
mov dword [rbp - 0x2c], 0x4f657275
mov word [rbp - 0x28], 0x656e
mov dword [rbp + 0xd8], 0x63697551
mov dword [rbp + 0xdc], 0x6f6f4c6b
mov dword [rbp - 0x48], 0x4154454d
mov dword [rbp - 0x44], 0x464e492d
mov dword [rsp + 0x48], 0x65646e49
mov dword [rbp + 0x58], 0x65646e49
mov dword [rbp + 0x5c], 0x61432f78
mov dword [rbp + 0x60], 0x6c75636c
mov dword [rbp + 0x64], 0x6f697461
mov dword [rbp + 0x68], 0x676e456e
mov word [rbp + 0x6c], 0x6e69
mov dword [rbp - 0x40], 0x6e65706f
mov dword [rbp - 0x3c], 0x75636f64
mov dword [rbp - 0x38], 0x746e656d
mov dword [rbp + 0x28], 0x6e65706f
mov dword [rbp + 0x2c], 0x75636f64
mov dword [rbp + 0x30], 0x746e656d
mov dword [rbp + 0x34], 0x7865742e
mov dword [rbp + 0x40], 0x6e65706f
mov dword [rbp + 0x44], 0x75636f64
mov dword [rbp + 0x48], 0x746e656d
mov dword [rbp + 0x4c], 0x7361622e
mov dword [rbp - 0x20], 0x6e65706f
mov dword [rbp - 0x1c], 0x75636f64
mov dword [rbp - 0x18], 0x746e656d
mov dword [rbp - 0x14], 0x7865742e
mov dword [rbp - 0x10], 0x616d2d74
mov dword [rbp - 0xc], 0x72657473
mov dword [rbp - 8], 0x6e65706f
mov dword [rbp - 4], 0x75636f64
mov dword [rbp], 0x746e656d
mov dword [rbp + 4], 0x7270732e
mov dword [rbp + 8], 0x73646165
mov dword [rbp + 0xc], 0x74656568
mov dword [rbp + 0x10], 0x6e65706f
mov dword [rbp + 0x14], 0x75636f64
mov dword [rbp + 0x18], 0x746e656d
mov dword [rbp + 0x1c], 0x7270732e
mov dword [rbp + 0x20], 0x73646165
mov dword [rbp + 0x24], 0x74656568
mov dword [rbp + 0x90], 0x6e65706f
mov dword [rbp + 0x94], 0x75636f64
mov dword [rbp + 0x98], 0x746e656d
mov dword [rbp + 0x9c], 0x7865742e
mov dword [rbp + 0xa0], 0x65742d74
mov dword [rbp + 0xa4], 0x616c706d
mov word [rbp + 0xa8], 0x6574
mov dword [rbp + 0x70], 0x6e65706f
mov dword [rbp + 0x74], 0x75636f64
mov dword [rbp + 0x78], 0x746e656d
mov dword [rbp + 0x7c], 0x6572702e
mov dword [rbp + 0x80], 0x746e6573
mov dword [rbp + 0x84], 0x6f697461
mov byte [rbp + 0x88], 0x6e
mov dword [rbp + 0xb0], 0x6e65706f
mov dword [rbp + 0xb4], 0x75636f64
mov dword [rbp + 0xb8], 0x746e656d
mov dword [rbp + 0xbc], 0x6572702e
mov dword [rbp + 0xc0], 0x746e6573
mov dword [rbp + 0xc4], 0x6f697461
mov dword [rbp + 0xc8], 0x65742d6e
mov dword [rbp + 0xcc], 0x616c706d
mov word [rbp + 0xd0], 0x6574
cmp byte [0x1411dd026], bl
jne 0x1402045bb
mov edx, dword [rcx + 0x28]
imul edx, dword [rcx + 0x48]
lea ecx, [rbx + 1]
mov qword [rsp + 0x1f8], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8d, dword [rdi + 0x28]
xor edx, edx
imul r8d, dword [rdi + 0x48]
mov rcx, rax
mov rsi, rax
mov qword [rbp - 0x70], rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rdi + 0x48]
xor edx, edx
mov dword [rsp + 0x30], edx
mov eax, ecx
imul eax, dword [rdi + 0x28]
mov r9, rsi
mov qword [rsp + 0x28], rdx
mov r8, r12
movzx edx, r15b
mov dword [rsp + 0x20], eax
call fcn.1401c1720
test eax, eax
je 0x140204469
mov eax, dword [rsp + 0x7c]
cmp eax, dword [rsi]
jne 0x140204469
mov rax, qword [rbp - 0x40]
mov qword [0x1411dd043], rbx
mov word [0x1411dd03f], bx
mov byte [0x1411dd041], bl
mov dword [0x1411dd031], ebx
mov byte [0x1411dd035], bl
mov word [0x1411dd04b], bx
mov byte [0x1411dd04d], bl
cmp rax, qword [rsi + 0x3c]
jne 0x140204469
mov eax, dword [rbp - 0x38]
cmp eax, dword [rsi + 0x44]
jne 0x140204469
cmp r13b, byte [rsi + 0x48]
jne 0x140204469
mov edx, 0x400000
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1402045b3
xor edx, edx
mov r8d, 0x400000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov ecx, dword [rdi + 0x48]
mov r9, rbx
mov dword [rsp + 0x30], eax
mov r8, r12
mov qword [rsp + 0x28], rax
movzx edx, r15b
mov dword [rsp + 0x20], 0x400000
call fcn.1401c1720
test eax, eax
je 0x140204469
mov rax, qword [rbp + 0x28]
mov r11, rbx
add rbx, 0x3c
cmp rax, qword [rbx]
jne 0x140203e26
mov rax, qword [rbp + 0x30]
cmp rax, qword [rbx + 8]
jne 0x140203e26
mov al, 0x74
cmp al, byte [rbx + 0x10]
jne 0x140203e26
mov word [0x1411dd045], 0x101
jmp 0x140203f4d
mov rax, qword [rbp + 0x40]
cmp rax, qword [rbx]
jne 0x140203e53
mov rax, qword [rbp + 0x48]
cmp rax, qword [rbx + 8]
jne 0x140203e53
mov al, 0x65
cmp al, byte [rbx + 0x10]
jne 0x140203e53
mov byte [0x1411dd045], 1
mov byte [0x1411dd049], 1
jmp 0x140203f4d
mov rax, qword [rbp - 0x20]
cmp rax, qword [rbx]
jne 0x140203e83
mov rax, qword [rbp - 0x18]
cmp rax, qword [rbx + 8]
jne 0x140203e83
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbx + 0x10]
jne 0x140203e83
mov byte [0x1411dd045], 1
mov byte [0x1411dd04b], 1
jmp 0x140203f4d
mov rax, qword [rbp - 8]
cmp rax, qword [rbx]
jne 0x140203eb3
mov rax, qword [rbp]
cmp rax, qword [rbx + 8]
jne 0x140203eb3
mov rax, qword [rbp + 8]
cmp rax, qword [rbx + 0x10]
jne 0x140203eb3
mov byte [0x1411dd045], 1
mov byte [0x1411dd048], 1
jmp 0x140203f4d
mov rax, qword [rbp + 0x10]
cmp rax, qword [rbx]
jne 0x140203ee0
mov rax, qword [rbp + 0x18]
cmp rax, qword [rbx + 8]
jne 0x140203ee0
mov rax, qword [rbp + 0x20]
cmp rax, qword [rbx + 0x10]
jne 0x140203ee0
mov byte [0x1411dd045], 1
mov byte [0x1411dd04a], 1
jmp 0x140203f4d
mov r8d, 0x1a
lea rcx, [rbp + 0x90]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140203f02
mov byte [0x1411dd047], 1
jmp 0x140203f41
mov r8d, 0x19
lea rcx, [rbp + 0x70]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140203f21
mov byte [0x1411dd04c], 1
jmp 0x140203f41
mov r8d, 0x22
lea rcx, [rbp + 0xb0]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140203f48
mov byte [0x1411dd04d], 1
mov byte [0x1411dd045], 1
mov r11, qword [rsp + 0x68]
cmp byte [0x1411dd026], r14b
jne 0x140204464
mov r10d, dword [rdi + 0x48]
mov r9d, dword [rdi + 0x28]
mov r12d, dword [rsp + 0x5c]
mov r13d, dword [rsp + 0x58]
movzx esi, word [rsp + 0x44]
mov r14d, dword [rsp + 0x4c]
mov rbx, qword [rbp - 0x48]
mov r15d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x74]
mov ecx, r10d
imul ecx, r9d
cmp r8d, ecx
jbe 0x140203fa3
xor edx, edx
mov eax, r8d
div ecx
inc eax
imul eax, r10d
imul eax, r9d
jmp 0x140203fa5
mov eax, ecx
mov r8d, 0x400000
mov edx, 0
sub r8d, dword [rsp + 0x70]
cmp dword [rsp + 0x70], 0x400000
cmovae r8d, edx
cmp r8d, eax
jae 0x140204045
mov eax, dword [rsp + 0x60]
div ecx
mov r8d, edx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x70], edx
mov eax, r8d
xor edx, edx
div ecx
xor edx, edx
mov rcx, r11
imul eax, r10d
imul eax, r9d
mov dword [rsp + 0x50], eax
mov eax, 0x400000
sub eax, r8d
mov r8d, 0x400000
mov dword [rsp + 0x48], eax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x4c]
xor eax, eax
add r8, qword [rbp - 0x68]
mov r9, qword [rsp + 0x68]
movzx edx, byte [rsp + 0x54]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x78]
mov dword [rsp + 0x20], 0x400000
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x1402043c1
mov r8d, dword [rsp + 0x48]
mov rax, qword [rbp - 0x78]
xor edx, edx
mov ecx, dword [rax + 0x28]
mov r10d, dword [rax + 0x48]
mov eax, dword [rsp + 0x60]
imul ecx, r10d
div ecx
mov dword [rsp + 0x48], ecx
lea eax, [rdx + 4]
cmp eax, r8d
jae 0x1402043c1
mov ecx, dword [rsp + 0x50]
mov r11, qword [rsp + 0x68]
mov r9d, ecx
mov eax, edx
add rax, rcx
add rax, r11
mov qword [rbp - 0x48], rax
mov rdi, qword [rbp - 0x48]
mov eax, dword [rsp + 0x7c]
cmp eax, dword [rdi]
mov edi, dword [rbp - 0x80]
jne 0x1402042db
lea eax, [rdx + 0x1e]
cmp eax, r8d
jae 0x1402043c1
lea eax, [rcx + 6]
add eax, edx
cmp byte [rax + r11], 8
je 0x140204567
add edx, 0x12
mov eax, edx
add edx, 8
add rax, rcx
cmp byte [0x1411dd028], 0
lea r10d, [rdx + 2]
mov ecx, dword [rax + r11]
mov dword [rsp + 0x50], ecx
je 0x140204142
mov eax, ecx
mov byte [rsp + 0x77], cl
shr eax, 0x18
mov byte [rsp + 0x74], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x75], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x76], al
lea rax, [r11 + rdx]
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x79], al
shr cx, 8
mov byte [rsp + 0x78], cl
mov eax, r10d
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x45], al
shr cx, 8
mov byte [rsp + 0x44], cl
movzx eax, word [rsp + 0x44]
movzx ecx, word [rsp + 0x78]
mov word [rsp + 0x48], ax
mov eax, dword [rsp + 0x74]
mov dword [rsp + 0x50], eax
mov word [rsp + 0x4c], cx
jmp 0x140204161
mov eax, r10d
add rax, r11
mov ecx, edx
add rcx, r11
movzx eax, word [rax + r9]
mov word [rsp + 0x48], ax
movzx eax, word [rcx + r9]
mov word [rsp + 0x4c], ax
add r10d, 2
mov qword [rbp - 0x40], r8
mov edx, r10d
mov qword [rbp - 0x60], rdx
lea rax, [r10 + 4]
cmp rax, r8
jae 0x1402043c1
lea rcx, [r10 + r9]
add rcx, r11
mov qword [rbp - 0x48], rcx
cmp r13d, dword [rcx]
je 0x140204548
lea rax, [r10 + 2]
cmp rax, r8
jae 0x1402043c1
cmp si, word [rcx]
je 0x140204529
lea rax, [r10 + 3]
cmp rax, r8
jae 0x1402043c1
movzx eax, word [rbp - 0x7c]
cmp ax, word [rcx]
jne 0x1402041c8
mov al, 0x74
cmp al, byte [rcx + 2]
je 0x1402044b3
cmp r14d, dword [rcx]
jne 0x1402041f1
lea rax, [r10 + 0xa]
cmp rax, r8
jae 0x1402043c1
mov rax, qword [rbp - 0x30]
cmp rax, qword [rcx]
jne 0x1402041f1
movzx eax, word [rbp - 0x28]
cmp ax, word [rcx + 8]
je 0x1402044bf
lea rax, [r10 + 0x22]
cmp rax, r8
jae 0x1402043c1
cmp r15d, dword [rcx + 0x1e]
jne 0x14020423c
lea rax, [r10 + 0x16]
cmp rax, r8
jae 0x1402043c1
mov rdx, rcx
mov r8d, 0x16
lea rcx, [rbp + 0x58]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1402044de
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x40]
mov r11, qword [rsp + 0x68]
lea rax, [rdx + 0x27]
cmp rax, r8
jae 0x1402043c1
mov rax, qword [rbp + 0xd8]
cmp rax, qword [rcx + 0x1e]
jne 0x140204261
mov al, 0x6b
cmp al, byte [rcx + 0x26]
je 0x1402044fa
lea rax, [rdx + 0x26]
cmp rax, r8
jae 0x1402043c1
cmp rbx, qword [rcx + 0x1e]
jne 0x14020429e
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 0x100
movzx ecx, word [rsp + 0x4c]
xor edx, edx
mov eax, dword [rsp + 0x70]
add ecx, 0x1e
movzx r8d, word [rsp + 0x48]
add r8d, dword [rsp + 0x50]
add r8d, ecx
mov rcx, qword [rbp - 0x78]
add eax, r8d
mov dword [rsp + 0x70], eax
mov r10d, dword [rcx + 0x48]
mov r9d, dword [rcx + 0x28]
mov ecx, r9d
imul ecx, r10d
div ecx
jmp 0x1402043a3
mov rax, qword [rbp - 0x48]
cmp r12d, dword [rax]
jne 0x1402043c1
lea eax, [rdx + 0x2e]
cmp eax, r8d
jae 0x1402043c1
mov dword [rsp + 0x50], edx
add edx, 0x1c
mov eax, edx
add edx, 2
add rax, r9
cmp byte [0x1411dd028], 0
movzx ecx, word [rax + r11]
mov word [rsp + 0x4c], cx
je 0x14020434a
movzx eax, cx
mov byte [rsp + 0x5d], cl
shr ax, 8
mov byte [rsp + 0x5c], al
mov eax, edx
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x59], al
movzx eax, word [rsp + 0x5c]
shr cx, 8
mov byte [rsp + 0x58], cl
movzx ecx, word [rsp + 0x58]
jmp 0x140204359
mov eax, edx
add rax, r11
movzx ecx, word [rax + r9]
movzx eax, word [rsp + 0x4c]
movzx edx, cx
mov ecx, dword [rsp + 0x50]
movzx eax, ax
add ecx, 0x2e
add edx, eax
add ecx, edx
lea eax, [rcx + 4]
cmp eax, r8d
jae 0x1402043c1
mov eax, ecx
add rax, r9
cmp edi, dword [rax + r11]
je 0x140204581
mov eax, dword [rsp + 0x70]
lea r8d, [rdx + 0x2e]
mov rcx, qword [rbp - 0x78]
add eax, r8d
xor edx, edx
mov dword [rsp + 0x70], eax
div dword [rsp + 0x48]
mov r9d, dword [rcx + 0x28]
mov byte [rsp + 0x40], 1
add dword [rsp + 0x60], r8d
imul eax, r9d
imul eax, r10d
cmp byte [0x1411dd026], 0
mov dword [rsp + 0x50], eax
je 0x140203f84
movzx r14d, byte [rsp + 0x40]
test r14b, r14b
je 0x140204460
mov ecx, dword [rsp + 0x60]
xor dl, dl
cmp byte [0x1411dd031], 0
jne 0x140204592
cmp byte [0x1411dd033], 0
jne 0x140204592
cmp byte [0x1411dd032], 0
jne 0x140204592
cmp byte [0x1411dd034], 0
jne 0x140204592
cmp byte [0x1411dd035], 0
jne 0x140204592
cmp byte [0x1411dd043], 0
jne 0x140204592
cmp byte [0x1411dd03f], 0
jne 0x140204592
cmp byte [0x1411dd040], 0
jne 0x140204592
cmp byte [0x1411dd041], 0
jne 0x140204592
test dl, dl
jne 0x140204456
mov rax, qword [rbp - 0x58]
mov byte [rax], 1
mov eax, ecx
mov rcx, qword [rbp - 0x50]
mov qword [rcx + 0x10], rax
mov rsi, qword [rbp - 0x70]
mov rbx, qword [rsp + 0x68]
test rsi, rsi
je 0x140204477
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x140204485
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r14b
mov rsi, qword [rsp + 0x1f8]
mov rcx, qword [rbp + 0xe8]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov dword [0x1411dd031], 0x100
jmp 0x140204533
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 1
jmp 0x1402043c1
mov byte [0x1411dd034], 0
mov word [0x1411dd03f], 0x101
mov byte [0x1411dd041], 1
jmp 0x1402043c1
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 1
jmp 0x1402043c1
mov dword [0x1411dd031], 0x10000
mov word [0x1411dd037], 0x100
mov byte [0x1411dd035], 0
jmp 0x1402043c1
mov dword [0x1411dd032], 0
mov byte [0x1411dd031], 1
mov word [0x1411dd037], 0x100
jmp 0x1402043c1
mov eax, dword [rbp + 0x160]
mov dl, 1
mov ecx, dword [rsp + 0x60]
movzx r14d, dl
shl eax, 0xb
add ecx, eax
jmp 0x1402043d6
mov ecx, dword [rsp + 0x60]
mov r14b, 1
add ecx, 0x44
add ecx, edx
jmp 0x1402043d4
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1402045a1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x140204489
mov rbx, rax
jmp 0x140204469
xor al, al
jmp 0x140204491