Function at 0x14001b970
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x328
cmp word [rdx + 0xe], 3
mov rsi, rcx
mov rbx, rdx
mov rdi, r8
je 0x14001b9b8
mov dword [r8], 2
xor ebp, ebp
mov eax, ebp
add rsp, 0x328
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rcx + 0x500]
lea r8, [rcx + 0x290]
mov edx, 1
mov qword [rsp + 0x38], rax
test byte [rcx + 0x4b8], 2
je 0x14001bb80
lea rax, [rsp + 0xb0]
mov r9, qword [rsp + 0x38]
lea r14, [rsp + 0x73]
movabs r12, 0xffffffffffff
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.140023830
mov r10d, 0x686d
mov rcx, r14
mov dword [rsp + 0x5c], 0x6366736e
mov word [rsp + 0x60], r10w
mov byte [rsp + 0x62], 0
mov eax, dword [rsp + 0x5f]
mov dword [rsp + 0x73], 0x6366736e
mov dword [rsp + 0x76], eax
movzx eax, byte [rsp + 0x73]
sub eax, 4
mov byte [rsp + 0x73], al
movzx eax, byte [rsp + 0x74]
sub eax, 4
mov byte [rsp + 0x74], al
movzx eax, byte [rsp + 0x75]
sub eax, 4
mov byte [rsp + 0x75], al
movzx eax, byte [rsp + 0x76]
sub eax, 4
mov byte [rsp + 0x76], al
movzx eax, byte [rsp + 0x77]
sub eax, 4
mov byte [rsp + 0x77], al
movzx eax, byte [rsp + 0x78]
sub eax, 4
mov byte [rsp + 0x78], al
call sub.msvcrt.dll_strlen
mov r15, qword [rbx + 8]
mov r10d, dword [rbx]
mov dword [rsp + 0xa4], 0
mov rdx, rax
movabs rax, 0x405000000000000
and r15, r12
shl r10, 5
or rax, r14
mov dword [rsp + 0xa0], edx
lea r13, [r15 + r10]
mov qword [rsp + 0xa8], rax
cmp r15, r13
je 0x14001bb50
mov rcx, rax
shl rax, 0x10
mov r11d, 0xd
mov ebp, edx
sar rax, 0x38
shr rcx, 0x30
sub r11d, eax
and ch, 0x10
cmovne ebp, r11d
mov eax, ebp
mov qword [rsp + 0x28], rax
je 0x14001bf80
lea r14, [rsp + 0xa0]
jmp 0x14001bb26
cmp dword [r15], ebp
jne 0x14001bb1d
mov rdx, qword [r15 + 8]
and rdx, r12
mov r8, qword [rsp + 0x28]
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14001bb90
add r15, 0x20
cmp r15, r13
je 0x14001bb50
test byte [r15 + 0xf], 0x10
je 0x14001bb00
movsx edx, byte [r15 + 0xd]
mov eax, 0xd
sub eax, edx
mov rdx, r15
cmp ebp, eax
je 0x14001bb0c
add r15, 0x20
cmp r15, r13
jne 0x14001bb26
nop dword [rax]
mov qword [0x14021a6d0], 0
lea rax, [0x14021a6d0]
mov qword [0x14021a6d8], 0
movabs rdx, 0xffffffffffff
and rdx, qword [rax + 8]
jmp 0x14001bba4
mov edx, dword [rcx + 0x2d8]
shr edx, 1
and edx, 1
jmp 0x14001b9dd
cmp r13, r15
je 0x14001bb50
lea rdx, [r15 + 0x10]
test byte [r15 + 0x1f], 0x10
je 0x14001c388
lea rcx, [rsp + 0xf8]
call fcn.1400443a0
cmp qword [rsp + 0xf8], 0
je 0x14001c0b8
lea rdx, [rsp + 0x52]
xor r8d, r8d
mov rcx, rbx
mov byte [rsp + 0x50], 0
mov dword [rsp + 0x52], 0x7971766b
mov byte [rsp + 0x56], 0
mov dword [rsp + 0x57], 0x66737066
mov byte [rsp + 0x5b], 0
movzx eax, byte [rsp + 0x52]
mov dword [rsp + 0x4c], 0x7971766b
sub eax, 0xa
mov dword [rsp + 0x44], 0x66737066
mov byte [rsp + 0x52], al
movzx eax, byte [rsp + 0x53]
mov byte [rsp + 0x48], 0
sub eax, 0xa
mov byte [rsp + 0x53], al
movzx eax, byte [rsp + 0x54]
sub eax, 0xa
mov byte [rsp + 0x54], al
movzx eax, byte [rsp + 0x55]
sub eax, 0xa
mov byte [rsp + 0x55], al
call fcn.140006fa0
mov rbp, rax
movzx eax, byte [rsp + 0x57]
lea rdx, [rsp + 0x57]
xor r8d, r8d
mov rcx, rbx
sub eax, 4
mov byte [rsp + 0x57], al
movzx eax, byte [rsp + 0x58]
sub eax, 4
mov byte [rsp + 0x58], al
movzx eax, byte [rsp + 0x59]
sub eax, 4
mov byte [rsp + 0x59], al
movzx eax, byte [rsp + 0x5a]
sub eax, 4
mov byte [rsp + 0x5a], al
call fcn.140006fa0
mov r12, rax
test rbp, rbp
je 0x14001c040
mov rcx, rbp
call fcn.140004980
mov dword [rsp + 0xb0], eax
mov rcx, qword [rsp + 0x30]
mov rdx, r12
call fcn.1400239b0
test al, al
je 0x14001c098
mov r8d, 0x7c6d
mov dword [rsp + 0x64], 0x6f7a697c
lea r14, [rsp + 0x7a]
movabs r15, 0xffffffffffff
mov word [rsp + 0x68], r8w
mov rcx, r14
mov byte [rsp + 0x6a], 0
mov eax, dword [rsp + 0x67]
mov dword [rsp + 0x7a], 0x6f7a697c
mov dword [rsp + 0x7d], eax
movzx eax, byte [rsp + 0x7a]
sub eax, 8
mov byte [rsp + 0x7a], al
movzx eax, byte [rsp + 0x7b]
sub eax, 8
mov byte [rsp + 0x7b], al
movzx eax, byte [rsp + 0x7c]
sub eax, 8
mov byte [rsp + 0x7c], al
movzx eax, byte [rsp + 0x7d]
sub eax, 8
mov byte [rsp + 0x7d], al
movzx eax, byte [rsp + 0x7e]
sub eax, 8
mov byte [rsp + 0x7e], al
movzx eax, byte [rsp + 0x7f]
sub eax, 8
mov byte [rsp + 0x7f], al
call sub.msvcrt.dll_strlen
mov r10d, dword [rbx]
and r15, qword [rbx + 8]
mov dword [rsp + 0xa4], 0
mov rdx, rax
movabs rax, 0x405000000000000
shl r10, 5
or rax, r14
mov dword [rsp + 0xa0], edx
lea rbp, [r15 + r10]
mov qword [rsp + 0xa8], rax
cmp rbp, r15
je 0x14001c0c8
mov rcx, rax
shl rax, 0x10
mov r11d, 0xd
mov r12d, edx
sar rax, 0x38
shr rcx, 0x30
sub r11d, eax
and ch, 0x10
cmovne r12d, r11d
mov r13d, r12d
jne 0x14001bfe0
movabs rax, 0xffffffffffff
and r14, rax
jmp 0x14001bde4
cmp dword [r15], r12d
jne 0x14001bdd7
movabs rdx, 0xffffffffffff
and rdx, qword [r15 + 8]
cmp r14, rdx
je 0x14001be04
mov r8, r13
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14001be04
add r15, 0x20
cmp rbp, r15
je 0x14001c0c8
test byte [r15 + 0xf], 0x10
je 0x14001bdb0
movsx edx, byte [r15 + 0xd]
mov eax, 0xd
sub eax, edx
cmp eax, r12d
jne 0x14001bdd7
mov rdx, r15
cmp r14, rdx
jne 0x14001bdc8
cmp rbp, r15
je 0x14001c0c8
lea rdx, [r15 + 0x10]
test byte [r15 + 0x1f], 0x10
je 0x14001c397
mov rcx, qword [rsp + 0x30]
call fcn.140023b70
test al, al
je 0x14001c0a8
mov ecx, 0x776b
mov byte [rsp + 0x72], 0
lea rdx, [rsp + 0x81]
xor r8d, r8d
mov word [rsp + 0x70], cx
mov rcx, rbx
mov dword [rsp + 0x6c], 0x6a6c686b
mov eax, dword [rsp + 0x6f]
mov dword [rsp + 0x81], 0x6a6c686b
mov dword [rsp + 0x84], eax
movzx eax, byte [rsp + 0x81]
sub eax, 3
mov byte [rsp + 0x81], al
movzx eax, byte [rsp + 0x82]
sub eax, 3
mov byte [rsp + 0x82], al
movzx eax, byte [rsp + 0x83]
sub eax, 3
mov byte [rsp + 0x83], al
movzx eax, byte [rsp + 0x84]
sub eax, 3
mov byte [rsp + 0x84], al
movzx eax, byte [rsp + 0x85]
sub eax, 3
mov byte [rsp + 0x85], al
movzx eax, byte [rsp + 0x86]
sub eax, 3
mov byte [rsp + 0x86], al
call fcn.140007d70
mov qword [rsp + 0x128], rax
mov eax, dword [rsp + 0xb0]
test eax, eax
je 0x14001bf0c
mov edx, eax
and edx, 0xff000000
cmp edx, 0x63000000
je 0x14001c0f8
cmp eax, 0xffffff
ja 0x14001c0f8
mov dword [rdi], 6
xor ebp, ebp
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x14001bf26
call fcn.14020b2c0
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x14001bf38
call fcn.14020b2c0
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14001bf4a
call fcn.14020b2c0
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14001bf5c
call fcn.14020b2c0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14001b99c
call fcn.14020b2d0
jmp 0x14001b99c
and r14, r12
jmp 0x14001bfbf
cmp ebp, dword [r15]
jne 0x14001bfb2
mov rdx, qword [r15 + 8]
and rdx, r12
cmp r14, rdx
je 0x14001bb90
mov r8, qword [rsp + 0x28]
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14001bb90
add r15, 0x20
cmp r15, r13
je 0x14001bb50
test byte [r15 + 0xf], 0x10
je 0x14001bf88
movsx edx, byte [r15 + 0xd]
mov eax, 0xd
sub eax, edx
cmp ebp, eax
jne 0x14001bfb2
mov rdx, r15
jmp 0x14001bf94
lea r14, [rsp + 0xa0]
jmp 0x14001c023
cmp dword [r15], r12d
jne 0x14001c016
movabs rdx, 0xffffffffffff
and rdx, qword [r15 + 8]
mov r8, r13
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x14001be04
add r15, 0x20
cmp rbp, r15
je 0x14001c0c8
test byte [r15 + 0xf], 0x10
je 0x14001bff0
movsx edx, byte [r15 + 0xd]
mov eax, 0xd
sub eax, edx
mov rdx, r15
cmp r12d, eax
je 0x14001c003
jmp 0x14001c016
mov r9d, dword [rsi + 0x298]
test r9d, r9d
je 0x14001bc92
mov byte [rsp + 0xa0], 0
test rax, rax
je 0x14001c390
lea rcx, [rsp + 0xa0]
mov r9d, 2
mov r8, rax
mov edx, 1
call fcn.140043500
movzx edx, byte [rsp + 0xa0]
lea rcx, [rsi + 0x298]
call fcn.140004ea0
jmp 0x14001bc8b
mov dword [rdi], 4
jmp 0x14001bf12
mov dword [rdi], 5
jmp 0x14001bf12
mov dword [rdi], 3
jmp 0x14001bf12
mov qword [0x14021a6d0], 0
lea rax, [0x14021a6d0]
mov qword [0x14021a6d8], 0
movabs rdx, 0xffffffffffff
and rdx, qword [rax + 8]
jmp 0x14001be1c
mov rcx, qword [rsi + 0x10]
mov r14, qword [rsp + 0x30]
mov rdx, rsi
lea r12, [rsp + 0xa0]
mov byte [rsp + 0xa0], 1
mov r9, r12
mov rax, qword [rcx]
mov r8, r14
call qword [rax + 0x38]
movzx ebp, byte [rsp + 0xa0]
test bpl, bpl
je 0x14001bf0c
mov rax, qword [0x14021c668]
mov edx, 0x75
cmp dword [rsi + 0x2a0], 2
mov qword [rsp + 0x90], rax
mov eax, 0x75
mov word [rsp + 0x98], ax
movabs rax, 0x806e756c71727280
mov qword [rsp + 0xa0], rax
mov word [rsp + 0xa8], dx
je 0x14001c253
mov eax, dword [rsp + 0xb0]
and eax, 0xff000000
cmp eax, 0x72000000
jne 0x14001c253
movzx eax, byte [rsp + 0xa0]
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
sub eax, 0xd
mov byte [rsp + 0xa0], al
movzx eax, byte [rsp + 0xa1]
sub eax, 0xd
mov byte [rsp + 0xa1], al
movzx eax, byte [rsp + 0xa2]
sub eax, 0xd
mov byte [rsp + 0xa2], al
movzx eax, byte [rsp + 0xa3]
sub eax, 0xd
mov byte [rsp + 0xa3], al
movzx eax, byte [rsp + 0xa4]
sub eax, 0xd
mov byte [rsp + 0xa4], al
movzx eax, byte [rsp + 0xa5]
sub eax, 0xd
mov byte [rsp + 0xa5], al
movzx eax, byte [rsp + 0xa6]
sub eax, 0xd
mov byte [rsp + 0xa6], al
movzx eax, byte [rsp + 0xa7]
sub eax, 0xd
mov byte [rsp + 0xa7], al
movzx eax, byte [rsp + 0xa8]
sub eax, 0xd
mov byte [rsp + 0xa8], al
call fcn.140006fa0
mov rdx, rax
mov rcx, r14
call fcn.140023ab0
test al, al
je 0x14001c3bc
movabs rax, 0x7b676d61696b75
lea rdx, [rsp + 0x88]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x88], rax
movzx eax, byte [rsp + 0x88]
sub eax, 2
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x89]
sub eax, 2
mov byte [rsp + 0x89], al
movzx eax, byte [rsp + 0x8a]
sub eax, 2
mov byte [rsp + 0x8a], al
movzx eax, byte [rsp + 0x8b]
sub eax, 2
mov byte [rsp + 0x8b], al
movzx eax, byte [rsp + 0x8c]
sub eax, 2
mov byte [rsp + 0x8c], al
movzx eax, byte [rsp + 0x8d]
sub eax, 2
mov byte [rsp + 0x8d], al
movzx eax, byte [rsp + 0x8e]
sub eax, 2
mov byte [rsp + 0x8e], al
call fcn.140006fa0
mov rdi, qword [rsp + 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.140023c60
mov rdx, qword [rsp + 0x38]
lea rcx, [rsi + 0x50]
call fcn.140044410
lea rbx, [rsi + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.140023900
mov edx, eax
mov rax, qword [rsi + 0x520]
test dl, dl
je 0x14001c39f
test rax, rax
je 0x14001bf12
test dword [rsi + 0x3a8], 0xfffffffb
je 0x14001bf12
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x14001bf12
mov dword [rsi + 0x3a8], 4
call fcn.140069a70
test eax, eax
jne 0x14001bf12
mov rcx, qword [rsi + 0x538]
lea rdx, [0x14001eb40]
call fcn.1400698d0
jmp 0x14001bf12
mov rax, rdx
jmp 0x14001bb6d
xor edx, edx
jmp 0x14001c084
mov rax, rdx
jmp 0x14001c0e5
add rax, 1
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
mov qword [rsi + 0x520], rax
call fcn.1400240e0
jmp 0x14001bf14
mov dword [rdi], 7
jmp 0x14001bf12