Function at 0x140026900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
sub rsp, 0x50
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edx, 0x188
mov ecx, 1
call qword [fcn.14006da94]
mov r15, rax
test rax, rax
jne 0x140026941
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop r15
ret
mov dword [rax], 0xbab1e
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
lea rbp, [r15 + 0xe8]
mov qword [rsp + 0x70], rsi
mov rcx, rbp
lea rsi, [r15 + 0xb8]
mov qword [rsp + 0x48], r12
xor r12d, r12d
mov qword [rsp + 0x40], r14
lea r14, [rax + 0x80]
mov qword [rsi], r12
lea rax, [0x140046820]
mov qword [r14], r12
mov qword [r14 + 8], rax
lea rax, [0x140046850]
mov qword [r14 + 0x10], rax
lea rax, [0x1400488c0]
mov qword [r14 + 0x18], rax
lea rax, [0x1400267e0]
mov qword [rsi + 8], rax
lea rax, [0x1400267f0]
mov qword [rsi + 0x10], rax
lea rax, [0x1400268f0]
mov qword [rsi + 0x18], rax
mov qword [r14 + 0x28], r12
mov dword [r14 + 0x20], 7
mov qword [rsi + 0x28], r12
mov dword [rsi + 0x20], 1
call fcn.140039ca0
test eax, eax
jne 0x140026a88
mov qword [r15 + 0x38], r12
mov ebx, r12d
mov qword [r15 + 0x30], r12
mov qword [r15 + 0x20], r12
mov qword [r15 + 0x28], r12
mov qword [r15 + 0x58], r12
mov qword [r15 + 0x50], r12
mov qword [r15 + 0x40], r12
mov qword [r15 + 0x48], r12
mov byte [r15 + 0x180], 1
mov dword [r15 + 0x140], 0xffffffff
mov dword [r15 + 0x170], 0x64
mov byte [r15 + 0x183], r12b
call fcn.140024690
test rax, rax
je 0x140026a74
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x65764565
mov rcx, rax
mov word [rsp + 0x2c], 0x746e
mov byte [rsp + 0x2e], bl
mov dword [rsp + 0x24], 0x74616572
mov dword [rsp + 0x20], 0x43415357
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140026a74
call rax
mov rbx, rax
mov qword [r15 + 0x178], rbx
test rbx, rbx
je 0x140026a88
mov rax, r15
jmp 0x140026d6d
mov qword [rsp + 0x78], rdi
mov rdi, qword [rsi]
test rdi, rdi
je 0x140026b05
movsxd rax, dword [rsi + 0x20]
test eax, eax
jle 0x140026aca
mov r8, rax
mov edx, r12d
mov rax, rdi
mov rcx, r12
nop dword [rax]
lea ebx, [rdx + 1]
cmp qword [rax], r12
jne 0x140026bbe
inc rcx
add rax, 0x20
mov edx, ebx
cmp rcx, r8
jl 0x140026ab0
mov rcx, qword [rsi]
test rcx, rcx
je 0x140026b05
mov ebx, r12d
cmp dword [rsi + 0x20], r12d
jle 0x140026afc
nop dword [rax + rax]
movsxd rcx, ebx
mov rdx, rsi
shl rcx, 5
add rcx, qword [rsi]
call fcn.140045fa0
inc ebx
cmp ebx, dword [rsi + 0x20]
jl 0x140026ae0
mov rcx, qword [rsi]
call qword [fcn.14006baa8]
mov qword [rsi], r12
mov rdi, qword [rsp + 0x78]
mov qword [rsi + 0x28], r12
mov dword [rsi + 0x20], r12d
mov rcx, qword [r14]
test rcx, rcx
je 0x140026b49
mov ebx, r12d
cmp dword [r14 + 0x20], r12d
jle 0x140026b40
movsxd rcx, ebx
mov rdx, r14
shl rcx, 5
add rcx, qword [r14]
call fcn.140045fa0
inc ebx
cmp ebx, dword [r14 + 0x20]
jl 0x140026b23
mov rcx, qword [r14]
call qword [fcn.14006baa8]
mov qword [r14], r12
mov qword [r14 + 0x28], r12
mov dword [r14 + 0x20], r12d
test rbp, rbp
je 0x140026b5e
mov rcx, rbp
call fcn.1400466e0
lea rbx, [r15 + 0x20]
test rbx, rbx
je 0x140026cb8
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140026cb8
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
mov rax, rdx
test rcx, rcx
je 0x140026cac
test rdx, rdx
je 0x140026cac
lea rdx, [rcx + 0x10]
cmp rcx, qword [rbx]
jne 0x140026c5c
mov rax, qword [rdx]
mov qword [rbx], rax
test rax, rax
jne 0x140026c53
mov qword [rbx + 8], r12
jmp 0x140026c82
movsxd rax, edx
shl rax, 5
mov rdi, qword [rax + rdi]
test rdi, rdi
je 0x140026aca
mov rax, qword [rdi]
test rax, rax
je 0x140026aca
nop
mov rcx, qword [rax + 0x18]
call fcn.1400466e0
mov r9, qword [rsi]
test r9, r9
je 0x140026b05
mov rdi, qword [rdi + 0x10]
test rdi, rdi
jne 0x140026c46
movsxd rax, dword [rsi + 0x20]
mov edx, ebx
cmp ebx, eax
jge 0x140026c2e
mov r8, rax
movsxd rcx, ebx
mov rax, rcx
shl rax, 5
add rax, r9
lea ebx, [rdx + 1]
cmp qword [rax], r12
jne 0x140026c36
inc rcx
add rax, 0x20
mov edx, ebx
cmp rcx, r8
jl 0x140026c18
mov rcx, r9
jmp 0x140026ad2
movsxd rax, edx
shl rax, 5
mov rdi, qword [rax + r9]
test rdi, rdi
je 0x140026c2e
mov rax, qword [rdi]
test rax, rax
jne 0x140026be0
jmp 0x140026aca
mov rax, qword [rdx]
mov qword [rax + 8], r12
jmp 0x140026c82
mov r8, qword [rcx + 8]
test r8, r8
je 0x140026c6c
mov rax, qword [rdx]
mov qword [r8 + 0x10], rax
mov r8, qword [rdx]
mov rax, qword [rcx + 8]
test r8, r8
jne 0x140026c7e
mov qword [rbx + 8], rax
jmp 0x140026c82
mov qword [r8 + 8], rax
mov r9, qword [rcx]
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rdx], r12
dec qword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
test r8, r8
je 0x140026cac
mov rdx, r9
xor ecx, ecx
call r8
mov rax, qword [rbx + 0x18]
mov rdx, rax
test rax, rax
jne 0x140026b80
lea rbx, [r15 + 0x40]
test rbx, rbx
je 0x140026d62
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140026d62
mov rcx, qword [rbx + 8]
mov rax, rdx
test rcx, rcx
je 0x140026d56
test rdx, rdx
je 0x140026d56
lea rdx, [rcx + 0x10]
cmp rcx, qword [rbx]
jne 0x140026d06
mov rax, qword [rdx]
mov qword [rbx], rax
test rax, rax
jne 0x140026cfd
mov qword [rbx + 8], r12
jmp 0x140026d2c
mov rax, qword [rdx]
mov qword [rax + 8], r12
jmp 0x140026d2c
mov r8, qword [rcx + 8]
test r8, r8
je 0x140026d16
mov rax, qword [rdx]
mov qword [r8 + 0x10], rax
mov r8, qword [rdx]
mov rax, qword [rcx + 8]
test r8, r8
jne 0x140026d28
mov qword [rbx + 8], rax
jmp 0x140026d2c
mov qword [r8 + 8], rax
mov r9, qword [rcx]
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rdx], r12
dec qword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
mov rax, qword [rbx + 0x18]
test r8, r8
je 0x140026d56
mov rdx, r9
xor ecx, ecx
call r8
mov rax, qword [rbx + 0x18]
mov rdx, rax
test rax, rax
jne 0x140026cd2
mov rcx, r15
call qword [fcn.14006baa8]
xor eax, eax
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140060fb0
add rsp, 0x50
pop r15
ret