Function at 0x1402157c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push r12
push r13
push r15
lea rbp, [rsp - 0x58]
sub rsp, 0x158
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp + 0x38], rax
cmp byte [0x1411dd031], 0
mov r13, r9
mov rax, qword [rbp + 0xb0]
movzx r12d, r8b
mov qword [rbp - 0x48], rax
mov rsi, rcx
mov qword [rbp - 0x50], r9
mov byte [rsp + 0x54], r8b
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x68], rcx
jne 0x140216167
cmp byte [0x1411dd033], 0
jne 0x140216167
cmp byte [0x1411dd032], 0
jne 0x140216167
cmp byte [0x1411dd035], 0
jne 0x140216167
cmp byte [0x1411dd043], 0
jne 0x140216167
cmp byte [0x1411dd044], 0
jne 0x140216167
cmp byte [0x1411dd045], 0
jne 0x140216167
xor ebx, ebx
mov dword [rsp + 0x60], 0x4034b50
xor r15b, r15b
mov dword [rbp - 0x80], 0x2014b50
xor al, al
mov byte [rsp + 0x40], r15b
cmp byte [0x1411dd026], al
mov byte [rsp + 0x41], al
mov dword [rsp + 0x5c], 0x6054b50
mov dword [rsp + 0x78], 0x64726f77
mov word [rsp + 0x44], 0x6c78
mov word [rbp - 0x70], 0x7070
mov dword [rsp + 0x48], 0x74706143
mov dword [rbp - 0x28], 0x74706143
mov dword [rbp - 0x24], 0x4f657275
mov word [rbp - 0x20], 0x656e
mov dword [rbp + 0x28], 0x63697551
mov dword [rbp + 0x2c], 0x6f6f4c6b
mov dword [rsp + 0x4c], 0x2f53504f
mov dword [rbp - 0x38], 0x6e65706f
mov dword [rbp - 0x34], 0x75636f64
mov dword [rbp - 0x30], 0x746e656d
mov dword [rsp + 0x58], 0x65646e49
mov dword [rbp - 0x18], 0x65646e49
mov dword [rbp - 0x14], 0x61542f78
mov dword [rbp - 0x10], 0x73656c62
mov dword [rsp + 0x50], 0x65646e49
mov dword [rbp - 8], 0x65646e49
mov dword [rbp - 4], 0x614d2f78
mov dword [rbp], 0x72657473
mov dword [rbp + 4], 0x64696c53
mov dword [rsp + 0x7c], 0x65646e49
mov dword [rbp + 0x10], 0x65646e49
mov dword [rbp + 0x14], 0x61432f78
mov dword [rbp + 0x18], 0x6c75636c
mov dword [rbp + 0x1c], 0x6f697461
mov dword [rbp + 0x20], 0x676e456e
mov word [rbp + 0x24], 0x6e69
mov dword [rsp + 0x6c], ebx
mov dword [rbp - 0x78], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x64], ebx
jne 0x140216167
mov edx, dword [rcx + 0x28]
imul edx, dword [rcx + 0x48]
lea ecx, [rbx + 1]
mov qword [r11 - 0x38], rdi
mov qword [r11 - 0x40], r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8d, dword [rsi + 0x28]
xor edx, edx
imul r8d, dword [rsi + 0x48]
mov rcx, rax
mov r14, rax
mov qword [rbp - 0x60], rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rsi + 0x48]
mov r9, r14
mov eax, ecx
mov dword [rsp + 0x30], ebx
imul eax, dword [rsi + 0x28]
mov r8, r13
mov qword [rsp + 0x28], rbx
movzx edx, r12b
mov edi, ebx
mov dword [rsp + 0x20], eax
call fcn.1401c1720
test eax, eax
je 0x14021601e
mov ebx, dword [rsp + 0x60]
cmp ebx, dword [r14]
jne 0x14021601e
mov rax, qword [rbp - 0x38]
mov qword [0x1411dd043], rdi
mov word [0x1411dd03f], di
mov byte [0x1411dd041], dil
mov dword [0x1411dd031], edi
mov byte [0x1411dd035], dil
mov word [0x1411dd04b], di
mov byte [0x1411dd04d], dil
cmp rax, qword [r14 + 0x3c]
jne 0x140215a3c
mov eax, dword [rbp - 0x30]
cmp eax, dword [r14 + 0x44]
jne 0x140215a3c
mov al, 0x2e
cmp al, byte [r14 + 0x48]
jne 0x140215a3c
mov byte [0x1411dd045], 1
jmp 0x14021601e
mov edx, 0x400000
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x70], rax
mov rdi, rax
test rax, rax
je 0x14021601e
xor edx, edx
mov r8d, 0x400000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rsi + 0x48]
xor eax, eax
mov dword [rsp + 0x30], eax
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8, r13
movzx edx, r12b
mov dword [rsp + 0x20], 0x400000
call fcn.1401c1720
test eax, eax
je 0x14021601e
cmp byte [0x1411dd026], r15b
jne 0x14021601e
mov r10d, dword [rsi + 0x48]
mov r11d, dword [rsi + 0x28]
mov esi, dword [rsp + 0x5c]
movzx r14d, word [rsp + 0x44]
mov r15d, dword [rsp + 0x48]
mov edi, dword [rsp + 0x4c]
mov r12d, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x50]
mov r8d, dword [rbp - 0x78]
mov ecx, r10d
imul ecx, r11d
cmp r8d, ecx
jbe 0x140215aef
xor edx, edx
mov eax, r8d
div ecx
inc eax
imul eax, r10d
imul eax, r11d
jmp 0x140215af1
mov eax, ecx
mov r8d, 0x400000
mov edx, 0
sub r8d, dword [rsp + 0x68]
cmp dword [rsp + 0x68], 0x400000
cmovae r8d, edx
cmp r8d, eax
jae 0x140215b95
mov eax, dword [rsp + 0x6c]
div ecx
mov r8d, edx
mov dword [rbp - 0x78], eax
mov dword [rsp + 0x68], edx
mov eax, r8d
xor edx, edx
div ecx
mov rcx, qword [rsp + 0x70]
xor edx, edx
imul eax, r10d
imul eax, r11d
mov dword [rsp + 0x64], eax
mov eax, 0x400000
sub eax, r8d
mov r8d, 0x400000
mov dword [rsp + 0x48], eax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbp - 0x78]
xor eax, eax
add r8, qword [rbp - 0x50]
mov r9, qword [rsp + 0x70]
movzx edx, byte [rsp + 0x54]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x68]
mov dword [rsp + 0x20], 0x400000
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x140215f5d
mov r8d, dword [rsp + 0x48]
mov rax, qword [rbp - 0x68]
xor edx, edx
mov r11d, dword [rax + 0x28]
mov ecx, r11d
mov r10d, dword [rax + 0x48]
mov eax, dword [rsp + 0x6c]
imul ecx, r10d
div ecx
mov dword [rsp + 0x4c], ecx
lea eax, [rdx + 4]
cmp eax, r8d
jae 0x140215f5d
mov r9d, dword [rsp + 0x64]
mov rcx, qword [rsp + 0x70]
mov eax, edx
add rax, r9
add rcx, rax
cmp ebx, dword [rcx]
jne 0x140215e78
lea eax, [rdx + 0x1e]
cmp eax, r8d
jae 0x140215f5d
mov r11, qword [rsp + 0x70]
add edx, 0x12
mov eax, edx
add edx, 8
add rax, r9
cmp byte [0x1411dd028], 0
lea r10d, [rdx + 2]
mov ecx, dword [rax + r11]
mov dword [rsp + 0x64], ecx
je 0x140215c7a
mov eax, ecx
mov byte [rsp + 0x53], cl
shr eax, 0x18
mov byte [rsp + 0x50], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x51], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x52], al
lea rax, [r11 + rdx]
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x59], al
shr cx, 8
mov byte [rsp + 0x58], cl
mov eax, r10d
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x45], al
shr cx, 8
mov byte [rsp + 0x44], cl
movzx eax, word [rsp + 0x44]
movzx ecx, word [rsp + 0x58]
mov word [rsp + 0x4c], ax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x64], eax
mov word [rsp + 0x48], cx
jmp 0x140215c99
mov eax, r10d
add rax, r11
mov ecx, edx
add rcx, r11
movzx eax, word [rax + r9]
mov word [rsp + 0x4c], ax
movzx eax, word [rcx + r9]
mov word [rsp + 0x48], ax
add r10d, 2
mov qword [rbp - 0x38], r8
mov edx, r10d
mov qword [rbp - 0x58], rdx
lea rax, [r10 + 4]
cmp rax, r8
jae 0x140215f5d
mov eax, dword [rsp + 0x78]
lea rcx, [r10 + r9]
add rcx, r11
mov qword [rbp - 0x78], rcx
cmp eax, dword [rcx]
je 0x140216116
lea rax, [r10 + 2]
cmp rax, r8
jae 0x140215f5d
cmp r14w, word [rcx]
je 0x1402160f7
lea rax, [r10 + 3]
cmp rax, r8
jae 0x140215f5d
movzx eax, word [rbp - 0x70]
cmp ax, word [rcx]
jne 0x140215d04
mov al, 0x74
cmp al, byte [rcx + 2]
je 0x14021606b
cmp r15d, dword [rcx]
jne 0x140215d2d
lea rax, [r10 + 0xa]
cmp rax, r8
jae 0x140215f5d
mov rax, qword [rbp - 0x28]
cmp rax, qword [rcx]
jne 0x140215d2d
movzx eax, word [rbp - 0x20]
cmp ax, word [rcx + 8]
je 0x14021607a
cmp r12d, dword [rcx]
jne 0x140215d71
lea rax, [r10 + 0xc]
cmp rax, r8
jae 0x140215f5d
mov rax, qword [rbp - 0x18]
cmp rax, qword [rcx]
jne 0x140215d71
mov eax, dword [rbp - 0x10]
cmp eax, dword [rcx + 8]
jne 0x140215d71
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd040], 1
cmp r13d, dword [rcx]
jne 0x140215dbe
lea rax, [r10 + 0x11]
cmp rax, r8
jae 0x140215f5d
mov rax, qword [rbp - 8]
cmp rax, qword [rcx]
jne 0x140215dbe
mov rax, qword [rbp]
cmp rax, qword [rcx + 8]
jne 0x140215dbe
mov al, 0x65
cmp al, byte [rcx + 0x10]
jne 0x140215dbe
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd041], 1
mov eax, dword [rsp + 0x7c]
cmp eax, dword [rcx]
jne 0x140215e0d
lea rax, [r10 + 0x16]
cmp rax, r8
jae 0x140215f5d
mov rdx, rcx
mov r8d, 0x16
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memcmp
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x38]
test eax, eax
jne 0x140215e0d
mov dword [0x1411dd031], eax
mov word [0x1411dd037], ax
mov byte [0x1411dd035], al
mov byte [rsp + 0x41], 1
lea rax, [rdx + 9]
cmp rax, r8
jae 0x140215f5d
mov rax, qword [rbp + 0x28]
cmp rax, qword [rcx]
jne 0x140215e2e
mov al, 0x6b
cmp al, byte [rcx + 8]
je 0x140216099
cmp edi, dword [rcx]
je 0x1402160c8
mov rax, qword [rbp - 0x68]
xor edx, edx
mov r9d, dword [rsp + 0x68]
movzx r8d, word [rsp + 0x4c]
add r8d, dword [rsp + 0x64]
mov r11d, dword [rax + 0x28]
mov r10d, dword [rax + 0x48]
movzx ecx, word [rsp + 0x48]
add ecx, 0x1e
add r8d, ecx
mov ecx, r11d
add r9d, r8d
imul ecx, r10d
mov eax, r9d
mov dword [rsp + 0x68], r9d
div ecx
jmp 0x140215f3f
mov eax, dword [rbp - 0x80]
cmp eax, dword [rcx]
jne 0x140215f5d
lea eax, [rdx + 0x2e]
cmp eax, r8d
jae 0x140215f5d
mov rcx, qword [rsp + 0x70]
mov dword [rbp - 0x78], edx
add edx, 0x1c
mov eax, edx
add edx, 2
add rax, r9
cmp byte [0x1411dd028], 0
movzx ecx, word [rax + rcx]
mov word [rsp + 0x48], cx
je 0x140215eea
movzx eax, cx
mov byte [rsp + 0x61], cl
shr ax, 8
mov byte [rsp + 0x60], al
mov eax, edx
add rax, qword [rsp + 0x70]
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x5d], al
movzx eax, word [rsp + 0x60]
shr cx, 8
mov byte [rsp + 0x5c], cl
movzx ecx, word [rsp + 0x5c]
jmp 0x140215efb
mov eax, edx
add rax, qword [rsp + 0x70]
movzx ecx, word [rax + r9]
movzx eax, word [rsp + 0x48]
movzx edx, cx
mov ecx, dword [rbp - 0x78]
movzx eax, ax
add ecx, 0x2e
add edx, eax
add ecx, edx
lea eax, [rcx + 4]
cmp eax, r8d
jae 0x140215f5d
mov eax, ecx
add rax, r9
add rax, qword [rsp + 0x70]
cmp esi, dword [rax]
je 0x140216135
mov eax, dword [rsp + 0x68]
lea r8d, [rdx + 0x2e]
add eax, r8d
mov byte [rsp + 0x40], 1
xor edx, edx
mov dword [rsp + 0x68], eax
div dword [rsp + 0x4c]
add dword [rsp + 0x6c], r8d
imul eax, r11d
imul eax, r10d
cmp byte [0x1411dd026], 0
mov dword [rsp + 0x64], eax
je 0x140215ad0
movzx r15d, byte [rsp + 0x40]
test r15b, r15b
je 0x140216015
mov ecx, dword [rsp + 0x6c]
cmp byte [rsp + 0x41], 0
je 0x140215f9c
cmp byte [0x1411dd041], 0
jne 0x140215f9c
movzx eax, byte [0x1411dd03f]
mov edx, 1
cmp byte [0x1411dd040], 0
cmove eax, edx
mov byte [0x1411dd03f], al
cmp byte [0x1411dd031], 0
jne 0x140216146
cmp byte [0x1411dd033], 0
jne 0x140216146
cmp byte [0x1411dd032], 0
jne 0x140216146
cmp byte [0x1411dd034], 0
jne 0x140216146
cmp byte [0x1411dd035], 0
jne 0x140216146
cmp byte [0x1411dd045], 0
jne 0x140216146
cmp byte [0x1411dd044], 0
jne 0x140216146
cmp byte [0x1411dd043], 0
jne 0x140216146
mov rax, qword [rbp - 0x48]
mov byte [rax], 1
mov eax, ecx
mov rcx, qword [rbp - 0x40]
mov qword [rcx + 0x10], rax
mov r14, qword [rbp - 0x60]
mov rdi, qword [rsp + 0x70]
test r14, r14
je 0x14021602c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rdi, rdi
je 0x14021603a
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r15b
mov rdi, qword [rsp + 0x150]
mov r14, qword [rsp + 0x148]
mov rcx, qword [rbp + 0x38]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x158
pop r15
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov dword [0x1411dd031], 0x100
jmp 0x140216101
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 1
jmp 0x140215f5d
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 1
jmp 0x140215f5d
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 0x100
jmp 0x140215f5d
mov dword [0x1411dd031], 0x10000
mov word [0x1411dd037], 0x100
mov byte [0x1411dd035], 0
jmp 0x140215f5d
mov dword [0x1411dd032], 0
mov byte [0x1411dd031], 1
mov word [0x1411dd037], 0x100
jmp 0x140215f5d
mov ecx, dword [rsp + 0x6c]
mov r15b, 1
add ecx, 0x44
add ecx, edx
jmp 0x140215f70
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140216155
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x14021603e
xor al, al
jmp 0x14021604e