Function at 0x281b71930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
mov edx, 0x7865
movabs rax, 0x7265726f6c707865
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov r14, rcx
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ecx, 0x7865
movabs rax, 0x6e6f676f6c6e6977
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x70], rax
movabs rax, 0x78652e737361736c
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
movabs rax, 0x7365636976726573
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xb0], rax
movabs rax, 0x2e74736f68637673
mov qword [rsp + 0xc0], rax
mov eax, 0x7865
mov word [rsp + 0xc8], ax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
movabs rax, 0x2e76736c6f6f7073
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x48], 0x6578652e
mov qword [rsp + 0x38], 0xc
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x68], 0x6578652e
mov qword [rsp + 0x58], 0xc
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x88], 0x65
mov qword [rsp + 0x78], 9
mov byte [rsp + 0x89], 0
mov dword [rsp + 0xa8], 0x6578652e
mov qword [rsp + 0x98], 0xc
mov byte [rsp + 0xac], 0
mov byte [rsp + 0xca], 0x65
mov qword [rsp + 0xb8], 0xb
mov byte [rsp + 0xcb], 0
mov word [rsp + 0xe8], dx
mov byte [rsp + 0xea], 0x65
mov qword [rsp + 0xd8], 0xb
mov byte [rsp + 0xeb], 0
mov qword [rsp + 0xf0], rax
movabs rax, 0x2e74696e696e6977
mov word [rsp + 0x108], cx
mov ecx, 0xe0
mov qword [rsp + 0x100], rax
mov byte [rsp + 0x10a], 0x65
mov qword [rsp + 0xf8], 0xb
mov byte [rsp + 0x10b], 0
call fcn.281c38ef0
lea rdi, [rsp + 0x30]
mov r13, rax
mov rbx, rax
mov rsi, rdi
nop word cs:[rax + rax]
lea rax, [rbx + 0x10]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rbx
mov qword [rbx], rax
add r8, rdx
call fcn.281b713d0
add rsi, 0x20
lea rax, [rsp + 0x110]
add rbx, 0x20
cmp rsi, rax
jne 0x281b71b20
lea r12, [rsp + 0xf0]
jmp 0x281b71b63
mov r12, rax
mov rcx, qword [r12]
lea rax, [r12 + 0x10]
cmp rcx, rax
je 0x281b71b7f
mov rax, qword [r12 + 0x10]
lea rdx, [rax + 1]
call fcn.281c38eb0
lea rax, [r12 - 0x20]
cmp r12, rdi
jne 0x281b71b60
lea r15, [r14 + 0x2c]
mov qword [rsp + 0x30], rbp
mov rcx, r15
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x28], rax
mov rsi, rax
cmp rax, 0xf
ja 0x281b71c98
cmp rax, 1
jne 0x281b71c80
movzx edx, byte [r14 + 0x2c]
mov byte [rsp + 0x40], dl
mov rdx, rbp
mov qword [rsp + 0x38], rax
mov byte [rdx + rax], 0
cmp r13, rbx
je 0x281b71cd4
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, r13
jmp 0x281b71bf5
add rsi, 0x20
cmp rbx, rsi
je 0x281b71c90
cmp rdi, qword [rsi + 8]
jne 0x281b71be8
test rdi, rdi
je 0x281b71c12
mov rdx, qword [rsi]
mov r8, rdi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x281b71be8
mov r12d, 1
cmp r14, rbp
je 0x281b71c2e
mov rax, qword [rsp + 0x40]
mov rcx, r14
lea rdx, [rax + 1]
call fcn.281c38eb0
mov rsi, r13
nop dword [rax]
mov rcx, qword [rsi]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x281b71c51
mov rax, qword [rsi + 0x10]
lea rdx, [rax + 1]
call fcn.281c38eb0
add rsi, 0x20
cmp rbx, rsi
jne 0x281b71c38
mov edx, 0xe0
mov rcx, r13
call fcn.281c38eb0
mov eax, r12d
add rsp, 0x118
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
jne 0x281b71cf4
mov rdx, rbp
jmp 0x281b71bc2
xor r12d, r12d
jmp 0x281b71c18
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, r12
call fcn.281c1b2a0
mov qword [rsp + 0x30], rax
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x281b71bc2
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x281b71cec
mov rax, qword [rsp + 0x40]
lea rdx, [rax + 1]
call fcn.281c38eb0
xor r12d, r12d
jmp 0x281b71c5a
mov rcx, rbp
jmp 0x281b71cba