Function at 0x140001180
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x360]
sub rsp, 0x460
mov rax, qword [0x1400a7020]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov r14, rdx
movsxd r12, ecx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
xor r13d, r13d
mov qword [rsp + 0x38], r13
lea r15, [r13 - 1]
mov rbx, qword [rsp + 0x30]
cmp r12, 1
jle 0x1400012ab
mov edi, 1
nop word [rax + rax]
mov rdx, qword [r14 + rdi*8]
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140001210
lea rcx, [rbp - 0x80]
call fcn.140019460
nop
cmp rbx, qword [rsp + 0x38]
je 0x14000124e
movups xmm0, xmmword [rbp - 0x80]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x70]
movups xmmword [rbx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 0x80], 0
add rbx, 0x20
mov qword [rsp + 0x30], rbx
jmp 0x140001268
lea r8, [rbp - 0x80]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.14001a2e0
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14000129f
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000129a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d75
call fcn.14001cc6c
inc rdi
cmp rdi, r12
jl 0x1400011f0
cmp r12d, 2
jl 0x14000190d
mov rax, qword [r14 + 8]
cmp byte [rax], 0x2d
jne 0x140001d60
mov dword [rbp - 0x1c], 0x6d6574
mov dword [rbp - 0x20], 0x7379732d
mov word [rbp - 0xb], 0x6e
mov dword [rbp - 0x10], 0x6b6f742d
mov byte [rbp - 0xc], 0x65
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 0xf
lea rax, [rbp - 0x20]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140001300
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.140019460
mov rsi, qword [rsp + 0x28]
mov rdi, rsi
mov r13, qword [rbp - 0x28]
mov r14, qword [rbp - 0x40]
cmp rsi, rbx
je 0x140001364
mov r12, qword [rbp - 0x30]
lea rdx, [rbp - 0x40]
cmp r13, 0x10
cmovae rdx, r14
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140001349
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, r12
jne 0x14000135b
call fcn.14001f240
test eax, eax
je 0x140001364
add rdi, 0x20
cmp rdi, rbx
jne 0x140001330
cmp r13, 0x10
jb 0x14000139b
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140001393
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dd3
mov rcx, r14
call fcn.14001cc6c
cmp rdi, rbx
je 0x140001833
mov qword [rbp - 0x60], 0
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
lea rax, [rbp - 0x10]
mov r8, r15
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400013d0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.140019460
nop
mov rdi, rsi
mov r13, qword [rbp - 0x48]
mov r14, qword [rbp - 0x60]
cmp rsi, rbx
je 0x140001444
mov r12, qword [rbp - 0x50]
nop dword [rax]
lea rdx, [rbp - 0x60]
cmp r13, 0x10
cmovae rdx, r14
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140001419
mov rcx, qword [rdi]
mov r8, qword [rdi + 0x10]
cmp r8, r12
jne 0x14000142b
call fcn.14001f240
test eax, eax
je 0x140001436
add rdi, 0x20
cmp rdi, rbx
je 0x140001444
jmp 0x140001400
cmp rdi, rbx
je 0x140001444
add rdi, 0x20
cmp rdi, rbx
jne 0x14000146b
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400ae9d8], eax
jg 0x140001d7b
lea rdi, [0x1400ae9e0]
cmp r13, 0x10
jb 0x1400014a2
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000149a
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001dd3
mov rcx, r14
call fcn.14001cc6c
cmp qword [rdi + 0x10], 0
je 0x140001833
lea rcx, [rsp + 0x40]
call fcn.140017ec0
nop
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
je 0x14000180b
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x140001dd9
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov word [rbp], 0x7325
mov word [rbp + 3], 0x73
mov byte [rbp + 2], 0x25
mov r9d, 3
lea r8d, [r9 + 0x1a]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.1400199d0
mov rbx, rax
mov r9d, 3
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.1400199d0
nop
mov r9, qword [rbx]
mov r8, qword [rax]
lea rdx, [rbp]
lea rcx, [rsp + 0x48]
call fcn.14001a2b0
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001561
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001580
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [rdi + 0x18], 0x10
jb 0x14000158a
mov rdi, qword [rdi]
test rdi, rdi
je 0x140001de4
mov rdx, rdi
mov rcx, qword [rsp + 0x48]
call fcn.140027e48
test eax, eax
jne 0x1400017eb
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x240]
call fcn.14001ef80
lea rdx, [rbp + 0x240]
call fcn.140083860
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x130]
call fcn.14001ef80
lea rcx, [rbp + 0x240]
call fcn.1400166c0
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0x130]
call fcn.14002614c
call fcn.14001b940
mov rcx, rax
test rax, rax
je 0x140001def
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call fcn.14001b1d0
test al, al
jne 0x14000165e
lea rcx, [rbp + 0x130]
mov rax, r15
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140001640
mov r8d, eax
lea rdx, [rbp + 0x130]
lea rcx, [rsp + 0x20]
call fcn.14001b4a0
nop
mov rbx, qword [rsp + 0x20]
mov edi, dword [rbx - 0x10]
lea eax, [rdi - 4]
xor r13d, r13d
mov r14d, r13d
test eax, eax
cmovns r14d, eax
cmp r14d, 0x7ffffffb
jg 0x140001dfa
lea eax, [r14 + 4]
mov esi, edi
sub esi, r14d
cmp eax, edi
jle 0x140001698
mov r12d, esi
test esi, esi
jle 0x140001706
jmp 0x14000169e
mov r12d, 4
sub edi, r12d
sub esi, r12d
inc esi
cmp dword [rbx - 8], 1
jle 0x1400016be
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.14001b310
mov rbx, qword [rsp + 0x20]
movsxd r8, esi
movsxd rcx, r14d
mov edx, r12d
add rdx, rcx
add rdx, rbx
add rcx, rbx
test esi, esi
je 0x1400016eb
test rcx, rcx
je 0x140001e05
test rdx, rdx
je 0x140001e05
call fcn.14001e8d0
test edi, edi
js 0x140001d6a
cmp edi, dword [rbx - 0xc]
jg 0x140001d6a
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov byte [rax + rbx], r13b
cmp dword [rbx - 8], 1
jle 0x14000171e
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x20]
call fcn.14001b310
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x60], rbx
lea rax, [0x140079d20]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov dword [rbp + 0x10], 0x6c6c642e
mov word [rbp + 0xc], 0x6970
mov word [rbp + 9], 0x7664
mov byte [rbp + 0x14], r13b
mov word [rbp + 0xe], 0x3233
mov byte [rbp + 8], 0x41
mov byte [rbp + 0xb], 0x61
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x1400017d0
mov dword [rbp + 0x2c], 0x68637461
mov word [rbp + 0x1d], 0x6553
mov dword [rbp + 0x20], 0x65636976
mov dword [rbp + 0x26], 0x69446c72
mov dword [rbp + 0x30], 0x417265
mov word [rbp + 0x24], 0x7443
mov dword [rbp + 0x18], 0x72617453
mov word [rbp + 0x2a], 0x7073
mov byte [rbp + 0x1f], 0x72
mov byte [rbp + 0x1c], 0x74
lea rdx, [rbp + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400017c6
lea rcx, [rsp + 0x60]
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400017eb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000180b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140001829
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
xor r13d, r13d
test rsi, rsi
je 0x1400018db
mov rdi, rsi
cmp rsi, rbx
je 0x1400018a2
nop word [rax + rax]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000188a
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140001885
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001e20
mov rcx, r8
call fcn.14001cc6c
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
add rdi, 0x20
cmp rdi, rbx
jne 0x140001850
mov rdx, qword [rsp + 0x38]
sub rdx, rsi
and rdx, 0xffffffffffffffe0
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400018d3
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e20
mov rcx, rsi
call fcn.14001cc6c
xor eax, eax
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.14001c9b0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov dword [rbp - 0x6d], 0x46207472
mov dword [rbp - 0x77], 0x69767265
mov dword [rbp - 0x7b], 0x53207377
mov dword [rbp - 0x67], 0x6572756c
mov word [rbp - 0x7d], 0x6f64
mov dword [rbp - 0x73], 0x53206563
mov word [rbp - 0x6f], 0x6174
mov word [rbp - 0x69], 0x6961
mov word [rbp - 0x80], 0x6957
mov byte [rbp - 0x63], 0
mov byte [rbp - 0x7e], 0x6e
mov byte [rbp + 0x116], 0x20
mov word [rbp + 0xa0], 0x6c6c
mov dword [rbp + 0x118], 0x54524154
mov word [rbp + 0x11c], 0x6320
mov byte [rbp + 0x11e], 0x6f
mov word [rbp + 0x83], 0x2073
mov byte [rbp + 0x6c], 0x72
mov word [rbp + 0xf3], 0x6369
mov byte [rbp + 0xe5], 0x2c
mov word [rbp + 0xfe], 0x7473
mov dword [rbp + 0x85], 0x76726553
mov dword [rbp + 0xbd], 0x20646e61
mov byte [rbp + 0x10b], 0x20
mov byte [rbp + 0xa2], 0x65
mov word [rbp + 0x64], 0x2064
mov dword [rbp + 0x7e], 0x6f646e69
mov byte [rbp + 0x100], 0x72
mov dword [rbp + 0x46], 0x61747320
mov dword [rbp + 0x89], 0x20656369
mov word [rbp + 0x11f], 0x6d6d
mov word [rbp + 0xb1], 0x6c6c
mov byte [rbp + 0x6f], 0x20
mov byte [rbp + 0x91], 0x20
mov dword [rbp + 0xab], 0x736e6920
mov byte [rbp + 0xdd], 0x45
mov word [rbp + 0xd7], 0x6553
mov byte [rbp + 0xa7], 0x73
mov byte [rbp + 0x8f], 0x73
mov dword [rbp + 0x72], 0x67677562
mov word [rbp + 0xee], 0x5320
mov byte [rbp + 0xda], 0x76
mov byte [rbp + 0x4c], 0x20
mov dword [rbp + 0x52], 0x66206563
mov byte [rbp + 0xd5], 0x65
mov dword [rbp + 0x10c], 0x7420726f
mov dword [rbp + 0x111], 0x454e2065
mov dword [rbp + 0x9a], 0x736e6920
mov byte [rbp + 0x99], 0x65
mov byte [rbp + 0xca], 0x74
mov byte [rbp + 0xf8], 0x41
mov dword [rbp + 0xce], 0x68746977
mov word [rbp + 0xfb], 0x6e69
mov word [rbp + 0x44], 0x746f
mov byte [rbp + 0x107], 0x74
mov word [rbp + 0xd3], 0x6874
mov dword [rbp + 0x59], 0x65687420
mov word [rbp + 0x93], 0x7269
mov byte [rbp + 0xc8], 0x61
mov dword [rbp + 0x121], 0x2e646e61
mov word [rbp + 0x96], 0x2074
mov word [rbp + 0xe8], 0x6e69
mov dword [rbp + 0x5d], 0x6d6f6320
mov dword [rbp + 0x101], 0x76697461
mov word [rbp + 0x6d], 0x6120
mov word [rbp + 0x50], 0x6976
mov word [rbp + 0x108], 0x6f6f
mov word [rbp + 0xa5], 0x7528
mov word [rbp + 0xeb], 0x776f
mov word [rbp + 0xf6], 0x2073
mov byte [rbp + 0x110], 0x68
mov byte [rbp + 0xc4], 0x6e
mov dword [rbp + 0x76], 0x202e7265
mov word [rbp + 0xde], 0x7078
mov word [rbp + 0xf0], 0x7265
mov word [rbp + 0xba], 0x2965
mov word [rbp + 0xb7], 0x652e
mov dword [rbp + 0x40], 0x6e6e6143
mov word [rbp + 0xa3], 0x2064
mov dword [rbp + 0x67], 0x20656e69
mov word [rbp + 0xdb], 0x7265
mov dword [rbp + 0x7a], 0x57204120
mov byte [rbp + 0x95], 0x73
mov word [rbp + 0xe6], 0x5720
mov dword [rbp + 0xe0], 0x65726f6c
mov word [rbp + 0xb4], 0x6974
mov word [rbp + 0x61], 0x616d
mov byte [rbp + 0xb6], 0x6c
mov byte [rbp + 0x92], 0x66
mov byte [rbp + 0x10a], 0x6c
mov byte [rbp + 0xc1], 0x74
mov word [rbp + 0xcb], 0x6465
mov byte [rbp + 0xea], 0x64
mov byte [rbp + 0x117], 0x53
mov word [rbp + 0xaf], 0x6174
mov word [rbp + 0xc5], 0x7320
mov word [rbp + 0x8d], 0x756d
mov byte [rbp + 0xd6], 0x20
mov byte [rbp + 0x115], 0x54
mov word [rbp + 0xa8], 0x6e69
mov word [rbp + 0x105], 0x2065
mov word [rbp + 0x56], 0x6f72
mov byte [rbp + 0xb9], 0x78
mov byte [rbp + 0xd9], 0x72
mov byte [rbp + 0x63], 0x6e
mov word [rbp + 0x4a], 0x7472
mov byte [rbp + 0xbc], 0x20
mov word [rbp + 0x4d], 0x6573
mov byte [rbp + 0xcd], 0x20
mov byte [rbp + 0x90], 0x74
mov byte [rbp + 0x125], 0
mov byte [rbp + 0xc9], 0x72
mov byte [rbp + 0x98], 0x62
mov byte [rbp + 0xf2], 0x76
mov byte [rbp + 0xed], 0x73
mov byte [rbp + 0xf5], 0x65
mov word [rbp + 0x70], 0x6564
mov word [rbp + 0xf9], 0x6d64
mov word [rbp + 0xc2], 0x6568
mov byte [rbp + 0x58], 0x6d
mov byte [rbp + 0xfd], 0x69
mov word [rbp + 0x9e], 0x6174
mov byte [rbp + 0x66], 0x6c
mov byte [rbp + 0x4f], 0x72
mov byte [rbp + 0xe4], 0x72
mov byte [rbp + 0x6b], 0x6f
mov byte [rbp + 0xb3], 0x75
mov byte [rbp + 0xc7], 0x74
mov byte [rbp + 0xaa], 0x67
mov byte [rbp + 0x82], 0x77
mov byte [rbp + 0xd2], 0x20
mov word [rbp - 0x1a], 0x642e
mov word [rbp - 0x1d], 0x3372
mov word [rbp - 0x20], 0x7355
mov word [rbp - 0x17], 0x6c
mov byte [rbp - 0x1e], 0x65
mov byte [rbp - 0x1b], 0x32
mov byte [rbp - 0x18], 0x6c
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x140001d60
mov dword [rbp - 0xb], 0x6f426567
mov dword [rbp - 0x10], 0x7373654d
mov byte [rbp - 0xc], 0x61
mov word [rbp - 7], 0x4178
mov byte [rbp - 5], 0
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001d57
mov r9d, 0x10
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x40]
xor ecx, ecx
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x28]
jmp 0x140001836
mov ecx, 0x80070057
call fcn.14001b6d0
nop
call fcn.140021c7c
nop
lea rcx, [0x1400ae9d8]
call fcn.14001ce64
cmp dword [0x1400ae9d8], 0xffffffff
jne 0x140001464
mov qword [0x1400ae9e0], 0
mov qword [0x1400ae9f8], 0xf
mov qword [0x1400ae9f0], 0
lea rcx, [0x140086e90]
call fcn.14001d1ac
nop
lea rcx, [0x1400ae9d8]
call fcn.14001ce04
jmp 0x140001464
call fcn.140021c7c
nop
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80004005
call fcn.14001b6d0
int3
mov ecx, 0x80004005
call fcn.14001b6d0
nop
mov ecx, 0x80070216
call fcn.14001b6d0
int3
call fcn.140021dc0
mov dword [rax], 0x16
call fcn.140021c5c
mov ecx, 0x80070057
call fcn.14001b6d0
nop
call fcn.140021c7c
int3