Function at 0x140002210
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
movabs rax, 0x3a7330373e2d3600
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f8
mov qword [rsp + 0x2e6], rax
lea rax, [rsp + 0x2e7]
mov qword [rsp + 0x38], rax
xchg rcx, rax
and qword [rsp + 0x60], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0x70], 0
mov word [rsp + 0x2ee], 0xc33
mov byte [rsp + 0x2f0], 0x61
call fcn.140006250
mov byte [rsp + 0x2e6], 1
mov rcx, qword [rsp + 0x38]
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
test rax, rax
jne 0x14000228f
xor eax, eax
jmp 0x1400029e0
xchg rbp, rax
mov rcx, qword [rsp + 0x38]
movabs rax, 0xe2e8fcedc6e2db00
mov word [rsp + 0x2fe], 0xdedf
mov qword [rsp + 0x2e6], rax
movabs rax, 0xd7c3ccd2f0f8f3d5
mov qword [rsp + 0x2ee], rax
movabs rax, 0xcec9c6daf7c8cacd
mov qword [rsp + 0x2f6], rax
mov byte [rsp + 0x300], 0xae
call fcn.140006ca0
mov byte [rsp + 0x2e6], 1
mov rdx, qword [rsp + 0x38]
mov rcx, rbp
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rsi
xchg r14, rax
test r14, r14
je 0x140002288
lea rdx, [0x14000d0c0]
mov rcx, rbp
call rsi
xchg r12, rax
test r12, r12
je 0x140002288
lea rdx, str.RtlLeaveCriticalSection
mov rcx, rbp
call rsi
xchg r13, rax
test r13, r13
je 0x140002288
lea rdx, str.RtlInitUnicodeString
mov rcx, rbp
call rsi
xchg r15, rax
test r15, r15
je 0x140002288
lea rbp, [rsp + 0xa9]
mov byte [rsp + 0xa1], 0x96
movabs rax, 0xfee2dfe0e8fcc400
mov qword [rsp + 0x95], rax
lea rax, [rsp + 0x96]
mov qword [rsp + 0x48], rax
xchg rcx, rax
mov dword [rsp + 0x9d], 0xe6e7f6f1
call fcn.1400070c0
mov rcx, rbp
mov byte [rsp + 0x95], 1
movabs rax, 0x673f373f222a2500
mov qword [rsp + 0xa8], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xb0], 0x34337867
mov word [rsp + 0xb4], 0x5a35
call fcn.140005800
mov rcx, rbp
mov byte [rsp + 0xa8], 1
lea rbp, [rsp + 0xdd]
call rdi
mov rdx, qword [rsp + 0x48]
xchg rcx, rax
call rsi
mov rcx, qword [rsp + 0x38]
mov byte [rsp + 0x2fa], 0x24
mov dword [rsp + 0x2f6], 0x476b5253
xchg rbx, rax
movabs rax, 0x6564605767775600
mov qword [rsp + 0x2e6], rax
movabs rax, 0x7a7d726e4b6e777d
mov qword [rsp + 0x2ee], rax
call fcn.140004150
mov rcx, rbp
mov byte [rsp + 0x2e6], 1
movabs rax, 0xeab4b2b8a7b1b800
mov qword [rsp + 0xdc], rax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0xe4], 0xb1b8f5e8
mov word [rsp + 0xe8], 0xdfb2
call fcn.140008980
mov rcx, rbp
mov byte [rsp + 0xdc], 1
call rdi
mov rdx, qword [rsp + 0x38]
xchg rcx, rax
call rsi
call rax
xor edx, edx
mov ecx, 0x438
xchg r8d, eax
call rbx
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x140002288
and qword [rsp + 0x20], 0
xor edx, edx
xchg rcx, rax
push 0x30
pop r9
mov r8, qword [rsp + 0x58]
call r14
mov rcx, qword [rsp + 0x38]
movabs rax, 0x627e5b6e686d5500
mov qword [rsp + 0x2e6], rax
movabs rax, 0x7a79765f62636a6d
mov qword [rsp + 0x2ee], rax
mov word [rsp + 0x2f6], 0x6e64
mov byte [rsp + 0x2f8], 0x18
call fcn.140005e30
mov rcx, rbp
mov byte [rsp + 0x2e6], 1
movabs rax, 0xfca2a8a2b9afa200
mov qword [rsp + 0xdc], rax
mov dword [rsp + 0xe4], 0xbfb6ffe2
mov word [rsp + 0xe8], 0xd5b8
call fcn.1400095a0
mov byte [rsp + 0xdc], 1
mov rcx, rbp
call rdi
mov rdx, qword [rsp + 0x38]
xchg rcx, rax
call rsi
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0xb0]
push 8
pop r9
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x60]
call rax
test eax, eax
je 0x140002288
mov rcx, qword [rsp + 0x38]
mov byte [rsp + 0x2f8], 0x92
movabs rax, 0xe8f4d5e0e2e7d300
mov qword [rsp + 0x2e6], rax
movabs rax, 0xe0e3e8c1f8f9eceb
mov qword [rsp + 0x2ee], rax
mov word [rsp + 0x2f6], 0xe8e2
call fcn.1400076f0
mov rcx, rbp
mov byte [rsp + 0x2e6], 1
movabs rax, 0x79252d2934202f00
mov qword [rsp + 0xdc], rax
mov dword [rsp + 0xe4], 0x22296279
mov word [rsp + 0xe8], 0x5023
call fcn.1400053e0
mov byte [rsp + 0xdc], 1
mov rcx, rbp
call rdi
mov rdx, qword [rsp + 0x38]
xchg rcx, rax
call rsi
mov rbx, qword [rsp + 0x60]
and qword [rsp + 0x20], 0
push 8
pop r9
lea rdx, [rbx + 0x18]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x68]
call rax
test eax, eax
je 0x140002288
movabs rax, 0x666f69a88a98bb00
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x2f6], 0x777f637f
mov qword [rsp + 0x2e6], rax
movabs rax, 0x696c7a6e4276736c
mov qword [rsp + 0x2ee], rax
mov word [rsp + 0x2fa], 0x1058
call fcn.140008f90
mov rcx, qword [rsp + 0x48]
movabs rax, 0xf6a8a6acb3a5d400
mov byte [rsp + 0x2e6], 1
mov qword [rsp + 0x95], rax
mov dword [rsp + 0x9d], 0xa5ace9f4
mov word [rsp + 0xa1], 0xcba6
call fcn.140009bd0
mov rcx, qword [rsp + 0x48]
mov byte [rsp + 0x95], 1
call rdi
mov rdx, qword [rsp + 0x38]
xchg rcx, rax
call rsi
mov rcx, qword [rsp + 0x50]
mov edx, 0x104
call rax
test eax, eax
je 0x140002288
lea r8, [rsp + 0x2e8]
movabs rax, 0x4d0044005e0066
mov byte [rsp + 0x2e6], 0
mov qword [rsp + 0x2e8], rax
mov rcx, r8
movabs rax, 0x24003200500052
mov qword [rsp + 0x2f0], rax
movabs rax, 0x3d0021006d0030
mov qword [rsp + 0x2f8], rax
mov qword [rsp + 0x38], r8
mov dword [rsp + 0x300], 0x470023
call fcn.14000ae50
mov r8, qword [rsp + 0x38]
mov edx, 0x105
mov rcx, qword [rsp + 0x50]
mov byte [rsp + 0x2e6], 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov rcx, qword [rsp + 0x50]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rsi, [rax + 1]
lea rcx, [rsi + rsi]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
xchg rbx, rax
test rbx, rbx
je 0x140002288
lea rax, [rsp + 0xdc]
mov rdx, rsi
mov rcx, rbx
mov qword [rsp + 0x48], rax
xchg r8, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
call r12
mov rax, qword [rsp + 0x60]
mov rdx, rbx
movabs r12, 0xd4c8e9dcd6d3e700
mov rcx, qword [rax + 0x20]
add rcx, 0x60
call r15
mov rax, qword [rsp + 0x60]
mov rdx, rbx
mov rcx, qword [rax + 0x20]
add rcx, 0x70
call r15
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x18]
mov rbp, qword [rax + 0x10]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x78], rax
lea r14, [rsp + 0x96]
movabs rax, 0xacafa48dcccdd8df
mov qword [rsp + 0x95], r12
mov rcx, r14
mov qword [rsp + 0x9d], rax
mov word [rsp + 0xa5], 0xbcb6
mov byte [rsp + 0xa7], 0xc6
call fcn.140009ff0
mov byte [rsp + 0x95], 1
movabs rax, 0x4d111915081c1300
mov qword [rsp + 0x87], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
xchg rcx, rax
mov dword [rsp + 0x8f], 0xeee5ae4d
mov word [rsp + 0x93], 0x84ef
call fcn.140003910
mov rcx, qword [rsp + 0x38]
mov byte [rsp + 0x87], 1
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rdi
mov rdx, r14
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
xchg rcx, rax
call rsi
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x78]
push 8
pop r9
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x70]
call rax
test eax, eax
je 0x140002288
movabs rax, 0x5947645753546200
mov rcx, r14
mov word [rsp + 0xa5], 0x394d
mov qword [rsp + 0x95], rax
movabs rax, 0x51505976494a5d54
mov qword [rsp + 0x9d], rax
mov byte [rsp + 0xa7], 0x41
call fcn.140004ba0
mov rcx, qword [rsp + 0x38]
movabs rax, 0xcb9b939b86969900
mov byte [rsp + 0x95], 1
mov qword [rsp + 0x87], rax
mov dword [rsp + 0x8f], 0x909fd4cb
mov word [rsp + 0x93], 0xfe91
call fcn.140007d20
mov rcx, qword [rsp + 0x38]
mov byte [rsp + 0x87], 1
call rdi
mov rdx, r14
xchg rcx, rax
call rsi
mov rdx, qword [rsp + 0x70]
lea rsi, [rsp + 0x2e6]
mov rcx, qword [rsp + 0x40]
mov r8, rsi
movzx r9d, word [rdx + 0x4a]
mov rdx, qword [rdx + 0x50]
and qword [rsp + 0x20], 0
call rax
test eax, eax
je 0x140002288
mov rax, qword [rsp + 0x70]
mov rcx, qword [0x14000da10]
mov rdx, rsi
movzx eax, word [rax + 0x48]
shr rax, 1
and word [rsp + rax*2 + 0x2e6], 0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, qword [rsp + 0x70]
test eax, eax
jne 0x1400029a2
add rcx, 0x48
mov rdx, rbx
call r15
mov rax, qword [rsp + 0x70]
mov rdx, rbx
lea rcx, [rax + 0x58]
call r15
jmp 0x1400029b3
mov rax, qword [rcx]
mov qword [rsp + 0x78], rax
cmp rax, rbp
jne 0x1400027d8
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 0x38]
call r13
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
setne al
movzx eax, al
add rsp, 0x4f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret