Function at 0x1401d9dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1411d99d8]
xor rax, rsp
mov qword [rbp], rax
cmp byte [0x1411dd031], 0
mov r12, r9
mov rax, qword [rbp + 0x80]
movzx r15d, r8b
mov qword [rbp - 0x58], rax
mov rdi, rcx
mov qword [rbp - 0x68], r9
mov byte [rsp + 0x54], r8b
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x78], rcx
jne 0x1401da6a4
cmp byte [0x1411dd033], 0
jne 0x1401da6a4
cmp byte [0x1411dd032], 0
jne 0x1401da6a4
cmp byte [0x1411dd035], 0
jne 0x1401da6a4
cmp byte [0x1411dd040], 0
jne 0x1401da6a4
cmp byte [0x1411dd041], 0
jne 0x1401da6a4
cmp byte [0x1411dd03f], 0
jne 0x1401da6a4
cmp byte [0x1411dd044], 0
jne 0x1401da6a4
cmp byte [0x1411dd045], 0
jne 0x1401da6a4
xor ebx, ebx
mov dword [rsp + 0x60], 0x4034b50
xor r14b, r14b
mov dword [rsp + 0x5c], 0x2014b50
cmp byte [0x1411dd026], bl
mov r13b, 0x2e
mov byte [rsp + 0x40], r14b
mov dword [rsp + 0x48], 0x6054b50
mov dword [rsp + 0x78], 0x64726f77
mov word [rsp + 0x44], 0x6c78
mov word [rsp + 0x7c], 0x7070
mov dword [rsp + 0x4c], 0x74706143
mov dword [rbp - 0x38], 0x74706143
mov dword [rbp - 0x34], 0x4f657275
mov word [rbp - 0x30], 0x656e
mov dword [rbp - 0x10], 0x63697551
mov dword [rbp - 0xc], 0x6f6f4c6b
mov dword [rsp + 0x58], 0x2f53504f
mov dword [rsp + 0x50], 0x65646e49
mov dword [rbp - 0x28], 0x65646e49
mov dword [rbp - 0x24], 0x61432f78
mov dword [rbp - 0x20], 0x6c75636c
mov dword [rbp - 0x1c], 0x6f697461
mov dword [rbp - 0x18], 0x676e456e
mov word [rbp - 0x14], 0x6e69
mov dword [rbp - 0x48], 0x6e65706f
mov dword [rbp - 0x44], 0x75636f64
mov dword [rbp - 0x40], 0x746e656d
mov dword [rsp + 0x6c], ebx
mov dword [rbp - 0x80], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x64], ebx
jne 0x1401da6a4
mov edx, dword [rcx + 0x28]
imul edx, dword [rcx + 0x48]
lea ecx, [rbx + 1]
mov qword [rsp + 0x118], rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r8d, dword [rdi + 0x28]
xor edx, edx
imul r8d, dword [rdi + 0x48]
mov rcx, rax
mov rsi, rax
mov qword [rbp - 0x70], rax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rdi + 0x28]
xor edx, edx
mov ecx, dword [rdi + 0x48]
mov r9, rsi
mov dword [rsp + 0x30], edx
mov r8, r12
mov qword [rsp + 0x28], rdx
movzx edx, r15b
imul eax, ecx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x20], eax
call fcn.1401c1720
test eax, eax
je 0x1401da56f
mov ebx, dword [rsp + 0x60]
cmp ebx, dword [rsi]
jne 0x1401da56a
mov rax, qword [rbp - 0x48]
mov qword [0x1411dd043], 0
mov word [0x1411dd03f], 0
mov byte [0x1411dd041], r14b
mov dword [0x1411dd031], 0
mov byte [0x1411dd035], r14b
mov word [0x1411dd04b], 0
mov byte [0x1411dd04d], r14b
cmp rax, qword [rsi + 0x3c]
jne 0x1401da031
mov eax, dword [rbp - 0x40]
cmp eax, dword [rsi + 0x44]
jne 0x1401da031
cmp r13b, byte [rsi + 0x48]
jne 0x1401da031
mov byte [0x1411dd045], 1
jmp 0x1401da56a
mov edx, 0x400000
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1401da69c
xor edx, edx
mov r8d, 0x400000
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rsp + 0x70]
xor eax, eax
mov ecx, dword [rdi + 0x48]
mov r8, r12
mov dword [rsp + 0x30], eax
movzx edx, r15b
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400000
call fcn.1401c1720
test eax, eax
je 0x1401da56a
cmp byte [0x1411dd026], r14b
jne 0x1401da56a
mov r10d, dword [rdi + 0x48]
mov r9d, dword [rdi + 0x28]
mov edi, dword [rsp + 0x58]
mov r13d, dword [rsp + 0x5c]
mov esi, dword [rsp + 0x48]
movzx r14d, word [rsp + 0x44]
mov r15d, dword [rsp + 0x4c]
mov r12d, dword [rsp + 0x50]
mov r8d, dword [rbp - 0x80]
mov ecx, r10d
imul ecx, r9d
cmp r8d, ecx
jbe 0x1401da0e3
xor edx, edx
mov eax, r8d
div ecx
inc eax
imul eax, r10d
imul eax, r9d
jmp 0x1401da0e5
mov eax, ecx
mov r8d, 0x400000
mov edx, 0
sub r8d, dword [rsp + 0x68]
cmp dword [rsp + 0x68], 0x400000
cmovae r8d, edx
cmp r8d, eax
jae 0x1401da189
mov eax, dword [rsp + 0x6c]
div ecx
mov r8d, edx
mov dword [rbp - 0x80], eax
mov dword [rsp + 0x68], edx
mov eax, r8d
xor edx, edx
div ecx
mov rcx, qword [rsp + 0x70]
xor edx, edx
imul eax, r10d
imul eax, r9d
mov dword [rsp + 0x64], eax
mov eax, 0x400000
sub eax, r8d
mov r8d, 0x400000
mov dword [rsp + 0x48], eax
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rbp - 0x80]
xor eax, eax
add r8, qword [rbp - 0x68]
mov r9, qword [rsp + 0x70]
movzx edx, byte [rsp + 0x54]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x78]
mov dword [rsp + 0x20], 0x400000
mov ecx, dword [rax + 0x48]
call fcn.1401c1720
test eax, eax
je 0x1401da4c2
mov r8d, dword [rsp + 0x48]
mov rax, qword [rbp - 0x78]
xor edx, edx
mov ecx, dword [rax + 0x28]
mov r10d, dword [rax + 0x48]
mov eax, dword [rsp + 0x6c]
imul ecx, r10d
div ecx
mov dword [rsp + 0x4c], ecx
lea eax, [rdx + 4]
cmp eax, r8d
jae 0x1401da4c2
mov r9d, dword [rsp + 0x64]
mov r11, qword [rsp + 0x70]
mov ecx, edx
add rcx, r9
cmp ebx, dword [rcx + r11]
jne 0x1401da3e1
lea eax, [rdx + 0x1e]
cmp eax, r8d
jae 0x1401da4c2
add edx, 0x12
mov eax, edx
add edx, 8
add rax, r9
cmp byte [0x1411dd028], 0
lea r10d, [rdx + 2]
mov ecx, dword [rax + r11]
mov dword [rsp + 0x64], ecx
je 0x1401da264
mov eax, ecx
mov byte [rsp + 0x53], cl
shr eax, 0x18
mov byte [rsp + 0x50], al
mov eax, ecx
shr eax, 0x10
mov byte [rsp + 0x51], al
mov eax, ecx
shr eax, 8
mov byte [rsp + 0x52], al
lea rax, [r11 + rdx]
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x59], al
shr cx, 8
mov byte [rsp + 0x58], cl
mov eax, r10d
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x45], al
shr cx, 8
mov byte [rsp + 0x44], cl
movzx eax, word [rsp + 0x44]
movzx ecx, word [rsp + 0x58]
mov word [rsp + 0x4c], ax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x64], eax
mov word [rsp + 0x48], cx
jmp 0x1401da283
mov eax, r10d
add rax, r11
mov ecx, edx
add rcx, r11
movzx eax, word [rax + r9]
mov word [rsp + 0x4c], ax
movzx eax, word [rcx + r9]
mov word [rsp + 0x48], ax
add r10d, 2
mov qword [rbp - 0x48], r8
mov edx, r10d
mov qword [rbp - 0x60], rdx
lea rax, [r10 + 4]
cmp rax, r8
jae 0x1401da4c2
mov eax, dword [rsp + 0x78]
lea rcx, [r10 + r9]
add rcx, r11
mov qword [rbp - 0x80], rcx
cmp eax, dword [rcx]
je 0x1401da64b
lea rax, [r10 + 2]
cmp rax, r8
jae 0x1401da4c2
cmp r14w, word [rcx]
je 0x1401da62c
lea rax, [r10 + 3]
cmp rax, r8
jae 0x1401da4c2
movzx eax, word [rsp + 0x7c]
cmp ax, word [rcx]
jne 0x1401da2ef
mov al, 0x74
cmp al, byte [rcx + 2]
je 0x1401da5b6
cmp r15d, dword [rcx]
jne 0x1401da318
lea rax, [r10 + 0xa]
cmp rax, r8
jae 0x1401da4c2
mov rax, qword [rbp - 0x38]
cmp rax, qword [rcx]
jne 0x1401da318
movzx eax, word [rbp - 0x30]
cmp ax, word [rcx + 8]
je 0x1401da5c2
cmp r12d, dword [rcx]
jne 0x1401da350
lea rax, [r10 + 0x16]
cmp rax, r8
jae 0x1401da4c2
mov rdx, rcx
mov r8d, 0x16
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401da5e1
mov rcx, qword [rbp - 0x80]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x48]
lea rax, [rdx + 9]
cmp rax, r8
jae 0x1401da4c2
mov rax, qword [rbp - 0x10]
cmp rax, qword [rcx]
jne 0x1401da397
mov al, 0x6b
cmp al, byte [rcx + 8]
jne 0x1401da397
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 1
cmp edi, dword [rcx]
je 0x1401da5fd
mov rax, qword [rbp - 0x78]
xor edx, edx
mov r11d, dword [rsp + 0x68]
movzx r8d, word [rsp + 0x4c]
add r8d, dword [rsp + 0x64]
mov r9d, dword [rax + 0x28]
mov r10d, dword [rax + 0x48]
movzx ecx, word [rsp + 0x48]
add ecx, 0x1e
add r8d, ecx
mov ecx, r9d
add r11d, r8d
imul ecx, r10d
mov eax, r11d
mov dword [rsp + 0x68], r11d
div ecx
jmp 0x1401da4a4
cmp r13d, dword [rcx + r11]
jne 0x1401da4c2
lea eax, [rdx + 0x2e]
cmp eax, r8d
jae 0x1401da4c2
mov dword [rbp - 0x80], edx
add edx, 0x1c
mov eax, edx
add edx, 2
add rax, r9
cmp byte [0x1411dd028], 0
movzx ecx, word [rax + r11]
mov word [rsp + 0x48], cx
je 0x1401da44c
movzx eax, cx
mov byte [rsp + 0x61], cl
shr ax, 8
mov byte [rsp + 0x60], al
mov eax, edx
add rax, r11
movzx eax, word [rax + r9]
movzx ecx, ax
mov byte [rsp + 0x5d], al
movzx eax, word [rsp + 0x60]
shr cx, 8
mov byte [rsp + 0x5c], cl
movzx ecx, word [rsp + 0x5c]
jmp 0x1401da45b
mov eax, edx
add rax, r11
movzx ecx, word [rax + r9]
movzx eax, word [rsp + 0x48]
movzx edx, cx
mov ecx, dword [rbp - 0x80]
movzx eax, ax
add ecx, 0x2e
add edx, eax
add ecx, edx
lea eax, [rcx + 4]
cmp eax, r8d
jae 0x1401da4c2
mov eax, ecx
add rax, r9
cmp esi, dword [rax + r11]
je 0x1401da66a
mov eax, dword [rsp + 0x68]
lea r8d, [rdx + 0x2e]
mov rcx, qword [rbp - 0x78]
add eax, r8d
xor edx, edx
mov dword [rsp + 0x68], eax
div dword [rsp + 0x4c]
mov r9d, dword [rcx + 0x28]
mov byte [rsp + 0x40], 1
add dword [rsp + 0x6c], r8d
imul eax, r9d
imul eax, r10d
cmp byte [0x1411dd026], 0
mov dword [rsp + 0x64], eax
je 0x1401da0c4
movzx r14d, byte [rsp + 0x40]
test r14b, r14b
je 0x1401da566
mov eax, dword [rsp + 0x6c]
cmp byte [0x1411dd031], 0
jne 0x1401da67b
cmp byte [0x1411dd033], 0
jne 0x1401da67b
cmp byte [0x1411dd032], 0
jne 0x1401da67b
cmp byte [0x1411dd034], 0
jne 0x1401da67b
cmp byte [0x1411dd035], 0
jne 0x1401da67b
cmp byte [0x1411dd045], 0
jne 0x1401da67b
cmp byte [0x1411dd044], 0
jne 0x1401da67b
cmp byte [0x1411dd03f], 0
jne 0x1401da67b
cmp byte [0x1411dd040], 0
jne 0x1401da67b
cmp byte [0x1411dd041], 0
jne 0x1401da67b
mov rcx, qword [rbp - 0x58]
mov byte [rcx], 1
mov rcx, qword [rbp - 0x50]
mov qword [rcx + 0x10], rax
mov rsi, qword [rbp - 0x70]
mov rbx, qword [rsp + 0x70]
test rsi, rsi
je 0x1401da57d
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
je 0x1401da58b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movzx eax, r14b
mov rsi, qword [rsp + 0x118]
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1402b25d0
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
mov dword [0x1411dd031], 0x100
jmp 0x1401da636
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 1
jmp 0x1401da4c2
mov byte [0x1411dd034], 0
mov word [0x1411dd03f], 0x101
mov byte [0x1411dd041], 1
jmp 0x1401da4c2
mov dword [0x1411dd031], 0
mov word [0x1411dd037], 0
mov byte [0x1411dd035], 0
mov byte [0x1411dd03f], 0
mov word [0x1411dd043], 0x100
jmp 0x1401da4c2
mov dword [0x1411dd031], 0x10000
mov word [0x1411dd037], 0x100
mov byte [0x1411dd035], 0
jmp 0x1401da4c2
mov dword [0x1411dd032], 0
mov byte [0x1411dd031], 1
mov word [0x1411dd037], 0x100
jmp 0x1401da4c2
mov eax, dword [rsp + 0x6c]
mov r14b, 1
add eax, 0x44
add eax, edx
jmp 0x1401da4d5
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1401da68a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x1401da58f
mov rbx, rax
jmp 0x1401da56f
xor al, al
jmp 0x1401da597