Function at 0x140004960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1400f7020]
xor rax, rsp
mov qword [rbp + 0x1f0], rax
movzx ebx, r9b
mov rdi, r8
mov r13, rdx
mov esi, ecx
mov dword [rsp + 0x30], ecx
lea rdx, [0x1400eb024]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rdi
mov r8, qword [rdi + 0x18]
cmp r8, 0x10
jb 0x1400049c4
mov rdx, qword [rdi]
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400049d1
mov rcx, qword [rax]
xor r15d, r15d
cmp rdx, rcx
je 0x140004a0b
mov qword [rdi + 0x10], r15
mov rcx, rdi
cmp r8, 0x10
jb 0x1400049e9
mov rcx, qword [rdi]
mov byte [rcx], r15b
cmp rdi, rax
je 0x140004a0b
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400049fe
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rdi
call fcn.1400190d0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140004a4c
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053b1
call fcn.14001e44c
lea rcx, [rbp + 0x80]
test bl, bl
je 0x140004bd6
lea rdx, [0x1400eb02c]
call fcn.1400bd560
nop
mov rdx, rax
mov rcx, rdi
call fcn.140019b20
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140004ab5
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053b7
call fcn.14001e44c
mov qword [rsp + 0x38], r15
lea rdx, [rsp + 0x38]
mov ecx, esi
call fcn.1400d33c0
test eax, eax
je 0x140004bc9
cmp qword [rsp + 0x38], 0
je 0x140004bc9
lea rdx, [0x1400eb038]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rax
mov rcx, rdi
call fcn.140019b20
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140004b3b
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053bd
call fcn.14001e44c
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 8
mov r8, r13
lea edx, [r9 + 0xb]
mov rcx, qword [rsp + 0x38]
call fcn.140016960
cmp qword [r13], 0
je 0x140004bce
lea rdx, [0x1400eb048]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rax
mov rcx, rdi
call fcn.140019b20
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140004bc9
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053c3
call fcn.14001e44c
cmp qword [r13], 0
setne al
jmp 0x140005381
lea rdx, [0x1400eb054]
call fcn.1400bd560
nop
mov rdx, rax
mov rcx, rdi
call fcn.140019b20
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140004c30
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004c2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053c9
call fcn.14001e44c
xor bl, bl
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x50], 0x130
call fcn.1400c5140
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14000537e
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14000a7c0
cmp eax, 1
jne 0x140005374
lea r12, [0x1400ead70]
mov qword [rbp + 0xa0], r15
mov rsi, r15
mov qword [rbp + 0xb0], r15
mov r14d, 0xf
mov qword [rbp + 0xb8], r14
mov byte [rbp + 0xa0], 0
lea r8d, [r14 + 8]
lea rcx, [rbp + 0xc0]
call fcn.1400c8e20
mov rbx, r15
movzx edx, byte [r12 + rbx*2 + 1]
sub dl, 0x80
movzx eax, byte [r12 + rbx*2]
shl al, 4
or dl, al
lea rcx, [rbp + 0xc0]
call fcn.1400c8f50
test rbx, rbx
je 0x140004d31
mov rcx, r14
sub rcx, rsi
cmp rcx, 1
jb 0x140004d0b
lea rcx, [rsi + 1]
mov qword [rbp + 0xb0], rcx
lea rcx, [rbp + 0xa0]
cmp r14, 0x10
cmovae rcx, qword [rbp + 0xa0]
movzx eax, al
mov byte [rcx + rsi], al
mov byte [rcx + rsi + 1], 0
jmp 0x140004d23
mov byte [rsp + 0x20], al
mov edx, 1
mov r9d, edx
lea rcx, [rbp + 0xa0]
call fcn.14001af40
mov rsi, qword [rbp + 0xb0]
mov r14, qword [rbp + 0xb8]
inc rbx
cmp rbx, 0xd
jl 0x140004cb0
mov qword [rbp + 0x80], r15
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r15
lea r12, [rbp + 0xa0]
mov rbx, qword [rbp + 0xa0]
cmp r14, 0x10
cmovae r12, rbx
cmp rsi, 0x10
jae 0x140004d83
movups xmm0, xmmword [r12]
movups xmmword [rbp + 0x80], xmm0
mov r15d, 0xf
jmp 0x140004dfb
mov r15, rsi
or r15, 0xf
movabs rax, 0x7fffffffffffffff
cmp r15, rax
cmova r15, rax
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140004dd7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400053d5
mov rcx, rax
call fcn.14001e454
mov rcx, rax
test rax, rax
je 0x1400053cf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004de5
test rcx, rcx
je 0x140004de3
call fcn.14001e454
jmp 0x140004de5
xor eax, eax
mov qword [rbp + 0x80], rax
lea r8, [rsi + 1]
mov rdx, r12
mov rcx, rax
call fcn.1400205b0
mov qword [rbp + 0x98], r15
mov qword [rbp + 0x90], rsi
cmp r14, 0x10
jb 0x140004e47
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140004e38
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053db
mov rcx, rbx
call fcn.14001e44c
mov r15, qword [rbp + 0x98]
lea rax, [rbp + 0x80]
mov r8, qword [rbp + 0x80]
cmp r15, 0x10
cmovae rax, r8
lea rdx, [rsp + 0x7c]
sub rdx, rax
movzx ebx, byte [rax]
movzx ecx, byte [rax + rdx]
sub ebx, ecx
jne 0x140004e77
inc rax
test ecx, ecx
jne 0x140004e65
cmp r15, 0x10
jb 0x140004eae
lea rdx, [r15 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140004ea6
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053db
mov rcx, r8
call fcn.14001e44c
test ebx, ebx
jne 0x14000525f
lea rdx, [0x1400eb05c]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rdi
mov r8, qword [rdi + 0x18]
cmp r8, 0x10
jb 0x140004eda
mov rdx, qword [rdi]
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140004ee7
mov rcx, qword [rax]
xor ebx, ebx
cmp rdx, rcx
je 0x140004f1f
mov qword [rdi + 0x10], rbx
mov rcx, rdi
cmp r8, 0x10
jb 0x140004efe
mov rcx, qword [rdi]
mov byte [rcx], bl
cmp rdi, rax
je 0x140004f1f
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140004f12
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rdi
call fcn.1400190d0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140004f60
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004f5b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053e1
call fcn.14001e44c
mov r8d, dword [rsp + 0x58]
call fcn.1400168a0
mov r12, rax
test rax, rax
je 0x14000525f
lea rdx, [0x1400eb068]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rdi
mov r8, qword [rdi + 0x18]
cmp r8, 0x10
jb 0x140004f9a
mov rdx, qword [rdi]
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140004fa7
mov rcx, qword [rax]
cmp rdx, rcx
je 0x140004fde
mov qword [rdi + 0x10], rbx
mov rcx, rdi
cmp r8, 0x10
jb 0x140004fbc
mov rcx, qword [rdi]
mov byte [rcx], 0
cmp rdi, rax
je 0x140004fde
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140004fd1
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rdi
call fcn.1400190d0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x14000501f
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000501a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053e7
call fcn.14001e44c
mov r8, r13
mov edx, 0xa
mov rcx, r12
call fcn.1400c5630
test eax, eax
je 0x140005241
lea rdx, [0x1400eb078]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rdi
mov r8, qword [rdi + 0x18]
cmp r8, 0x10
jb 0x14000505b
mov rdx, qword [rdi]
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140005068
mov rcx, qword [rax]
cmp rdx, rcx
je 0x14000509f
mov qword [rdi + 0x10], rbx
mov rcx, rdi
cmp r8, 0x10
jb 0x14000507d
mov rcx, qword [rdi]
mov byte [rcx], 0
cmp rdi, rax
je 0x14000509f
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140005092
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rdi
call fcn.1400190d0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x1400050e0
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ed
call fcn.14001e44c
mov r14d, dword [rsp + 0x40]
mov r15, qword [r13]
mov esi, ebx
call fcn.1400d3240
mov rbx, rax
test rax, rax
je 0x14000517e
mov dword [rbp + 0xa4], 0x6e656b6f
mov dword [rbp + 0xaf], 0x6e6f6974
mov word [rbp + 0xaa], 0x6f66
mov dword [rbp + 0xa0], 0x54746547
mov byte [rbp + 0xb3], 0
mov word [rbp + 0xad], 0x616d
mov word [rbp + 0xa8], 0x6e49
mov byte [rbp + 0xac], 0x72
lea rdx, [rbp + 0xa0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005176
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, r14d
lea r8, [rsp + 0x44]
mov edx, 0xc
mov rcx, r15
call rax
mov esi, eax
mov rcx, rbx
call fcn.1400c4d80
test esi, esi
je 0x140005241
lea rdx, [0x1400eb088]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rdi
mov r8, qword [rdi + 0x18]
cmp r8, 0x10
jb 0x1400051aa
mov rdx, qword [rdi]
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400051b7
mov rcx, qword [rax]
cmp rdx, rcx
je 0x1400051f2
mov qword [rdi + 0x10], 0
mov rcx, rdi
cmp r8, 0x10
jb 0x1400051d0
mov rcx, qword [rdi]
mov byte [rcx], 0
cmp rdi, rax
je 0x1400051f2
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400051e5
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rdi
call fcn.1400190d0
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140005233
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000522e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053f3
call fcn.14001e44c
mov eax, dword [rsp + 0x30]
cmp eax, dword [rsp + 0x44]
je 0x140005309
mov rcx, qword [r13]
test rcx, rcx
je 0x140005257
call fcn.14000a880
mov qword [r13], 0
mov rcx, r12
call fcn.14000a880
mov word [rbp + 0x1eb], 0x7478
mov dword [rbp + 0x1e1], 0x65636f72
mov dword [rbp + 0x1e6], 0x4e323373
mov byte [rbp + 0x1e0], 0x50
mov byte [rbp + 0x1e5], 0x73
mov byte [rbp + 0x1ea], 0x65
mov byte [rbp + 0x1ed], 0
mov word [rbp + 0x1d1], 0x7265
mov dword [rbp + 0x1d9], 0x6c6c64
mov dword [rbp + 0x1d4], 0x32336c65
mov byte [rbp + 0x1d3], 0x6e
mov byte [rbp + 0x1d0], 0x4b
mov byte [rbp + 0x1d8], 0x2e
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rbp + 0x1e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140005372
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
call rax
cmp eax, 1
jne 0x140005372
xor r15d, r15d
jmp 0x140004c71
lea rdx, [0x1400eb0a0]
lea rcx, [rbp + 0x80]
call fcn.1400bd560
nop
mov rdx, rax
mov rcx, rdi
call fcn.140019b20
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140005366
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ab
call fcn.14001e44c
mov bl, 1
mov rcx, r12
call fcn.14000a880
jmp 0x140005374
xor bl, bl
mov rcx, qword [rsp + 0x38]
call fcn.14000a880
movzx eax, bl
mov rcx, qword [rbp + 0x1f0]
xor rcx, rsp
call fcn.14001e190
mov rbx, qword [rsp + 0x358]
add rsp, 0x300
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
nop
call fcn.140024b1c
nop
call fcn.140019070
nop
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
int3
call fcn.140024b1c
int3