Function at 0x14000eb20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x1400cc020]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r12d, r12d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x20]
call fcn.140063480
mov dword [rsp + 0x40], 0x6c694665
mov word [rsp + 0x44], 0x4e65
mov dword [rsp + 0x38], 0x4d746547
mov dword [rsp + 0x3c], 0x6c75646f
mov dword [rsp + 0x47], 0x41656d
mov byte [rsp + 0x46], 0x61
mov word [rsp + 0x59], 0x7265
mov dword [rsp + 0x61], 0x6c6c64
mov dword [rsp + 0x5c], 0x32336c65
mov byte [rsp + 0x5b], 0x6e
mov byte [rsp + 0x58], 0x4b
mov byte [rsp + 0x60], 0x2e
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ebef
mov r8d, 0x104
lea rdx, [rbp - 0x20]
xor ecx, ecx
call rax
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xf0]
call fcn.140063480
lea rdi, [rbp - 0x20]
call fcn.1400a3820
mov rbx, rax
test rax, rax
je 0x14000ec71
mov dword [rsp + 0x5b], 0x6e694668
mov word [rsp + 0x59], 0x7461
mov word [rsp + 0x67], 0x4165
mov byte [rsp + 0x69], r12b
mov dword [rsp + 0x60], 0x656c6946
mov word [rsp + 0x64], 0x614e
mov byte [rsp + 0x58], 0x50
mov byte [rsp + 0x66], 0x6d
mov byte [rsp + 0x5f], 0x64
lea rdx, [rsp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ec69
lea rcx, [rbp - 0x20]
call rax
mov rdi, rax
mov rcx, rbx
call fcn.140098790
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp + 0xf0]
call fcn.14006bcf8
call fcn.1400a3820
mov rbx, rax
test rax, rax
je 0x14000ecf2
mov dword [rsp + 0x38], 0x68746150
mov word [rsp + 0x3c], 0x6552
mov word [rsp + 0x46], 0x736e
mov dword [rsp + 0x41], 0x74784565
mov dword [rsp + 0x48], 0x416e6f69
mov word [rsp + 0x3f], 0x766f
mov byte [rsp + 0x4c], r12b
mov byte [rsp + 0x45], 0x65
mov byte [rsp + 0x3e], 0x6d
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000ecea
lea rcx, [rbp + 0xf0]
call rax
mov rcx, rbx
call fcn.140098790
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x68]
call fcn.14001cff0
mov r8, rax
lea rdi, [0x1400ccb60]
mov rdx, qword [0x1400ccb78]
mov rax, rdi
cmp rdx, 0x10
cmovae rax, qword [0x1400ccb60]
mov rcx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14000ed2f
mov rcx, qword [r8]
cmp rax, rcx
je 0x14000ed6c
mov qword [0x1400ccb70], r12
mov rax, rdi
cmp rdx, 0x10
cmovae rax, qword [0x1400ccb60]
mov byte [rax], 0
cmp rdi, r8
je 0x14000ed6c
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14000ed5f
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, rdi
call fcn.14001adc0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14000eda7
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eda2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f4eb
call fcn.14006126c
lea r9, [0x1400ccb80]
mov r8, qword [0x1400ccb98]
mov rcx, r9
mov rdx, qword [0x1400ccb80]
cmp r8, 0x10
cmovae rcx, rdx
mov rax, rdi
cmp qword [0x1400ccb78], 0x10
cmovae rax, qword [0x1400ccb60]
cmp rcx, rax
je 0x14000ee1f
mov qword [0x1400ccb90], r12
cmp r8, 0x10
jb 0x14000edf1
mov byte [rdx], 0
jmp 0x14000edfd
mov byte [0x1400ccb80], 0
cmp r9, rdi
je 0x14000ee1f
mov rdx, rdi
cmp qword [0x1400ccb78], 0x10
cmovae rdx, qword [0x1400ccb60]
mov r8, qword [0x1400ccb70]
mov rcx, r9
call fcn.14001adc0
lea r9, [0x1400ccba0]
mov r8, qword [0x1400ccbb8]
mov rcx, r9
mov rdx, qword [0x1400ccba0]
cmp r8, 0x10
cmovae rcx, rdx
mov rax, rdi
cmp qword [0x1400ccb78], 0x10
cmovae rax, qword [0x1400ccb60]
cmp rcx, rax
je 0x14000ee97
mov qword [0x1400ccbb0], r12
cmp r8, 0x10
jb 0x14000ee69
mov byte [rdx], 0
jmp 0x14000ee75
mov byte [0x1400ccba0], 0
cmp r9, rdi
je 0x14000ee97
mov rdx, rdi
cmp qword [0x1400ccb78], 0x10
cmovae rdx, qword [0x1400ccb60]
mov r8, qword [0x1400ccb70]
mov rcx, r9
call fcn.14001adc0
lea rdx, [0x1400ba670]
lea rcx, [rbp - 0x68]
call fcn.14009c7c0
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14001aa50
mov dword [rsp + 0x30], 1
lea rcx, [0x1400ba5e4]
call fcn.140067b40
mov rsi, rax
mov rax, qword [rbp - 0x78]
mov r8, qword [rbp - 0x70]
mov rcx, r8
sub rcx, rax
cmp rsi, rcx
ja 0x14000ef11
lea rcx, [rsi + rax]
mov qword [rbp - 0x78], rcx
lea rbx, [rsp + 0x78]
cmp r8, 0x10
cmovae rbx, qword [rsp + 0x78]
add rbx, rax
mov r8, rsi
lea rdx, [0x1400ba5e4]
mov rcx, rbx
call fcn.140062140
mov byte [rsi + rbx], 0
jmp 0x14000ef2b
mov qword [rsp + 0x20], rsi
lea r9, [0x1400ba5e4]
mov rdx, rsi
lea rcx, [rsp + 0x78]
call fcn.14001a170
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x14000ef66
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f4f1
call fcn.14006126c
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov rsi, qword [rbp - 0x78]
lea r14, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae r14, qword [rsp + 0x78]
movabs r13, 0x7fffffffffffffff
cmp rsi, 0x10
jae 0x14000efcc
mov r8d, 0x10
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140062140
mov qword [rsp + 0x50], 0xf
mov ebx, 0xf
jmp 0x14000f03e
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000f016
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000f4f7
mov rcx, rax
call fcn.140061274
mov rcx, rax
test rax, rax
je 0x14000f4fd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000f025
test rcx, rcx
je 0x14000f022
call fcn.140061274
jmp 0x14000f025
mov rax, r12
mov qword [rsp + 0x38], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140062140
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x30], 3
mov r9, rdi
cmp qword [0x1400ccb78], 0x10
cmovae r9, qword [0x1400ccb60]
mov r14, qword [0x1400ccb70]
mov rax, rbx
sub rax, rsi
cmp r14, rax
ja 0x14000f0a1
lea rax, [r14 + rsi]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rbx, 0x10
cmovae rax, qword [rsp + 0x38]
lea rbx, [rax + rsi]
mov r8, r14
mov rdx, r9
mov rcx, rbx
call fcn.140062140
mov byte [r14 + rbx], 0
jmp 0x14000f0b3
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.14001a170
lea r11, [0x1400ccbc0]
mov r9, qword [0x1400ccbd8]
mov rcx, r11
mov r10, qword [0x1400ccbc0]
cmp r9, 0x10
cmovae rcx, r10
lea rax, [rsp + 0x38]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
cmovae rax, r8
cmp rcx, rax
je 0x14000f12c
mov qword [0x1400ccbd0], r12
mov rax, r11
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], 0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov rcx, r11
call fcn.14001adc0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x38]
mov dword [rsp + 0x30], 1
cmp rdx, 0x10
jb 0x14000f16a
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x14000f162
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f503
mov rcx, r8
call fcn.14006126c
lea rdx, [0x1400ba6c0]
lea rcx, [rbp - 0x48]
call fcn.14009c7c0
mov r15, rax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
mov rsi, qword [rbp - 0x78]
lea r14, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae r14, qword [rsp + 0x78]
cmp rsi, 0x10
jae 0x14000f1c9
mov r8d, 0x10
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140062140
mov qword [rsp + 0x70], 0xf
mov ebx, 0xf
jmp 0x14000f23b
mov rbx, rsi
or rbx, 0xf
cmp rbx, r13
cmova rbx, r13
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000f213
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000f509
mov rcx, rax
call fcn.140061274
mov rcx, rax
test rax, rax
je 0x14000f50f
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000f222
test rcx, rcx
je 0x14000f21f
call fcn.140061274
jmp 0x14000f222
mov rax, r12
mov qword [rsp + 0x58], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.140062140
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x30], 5
cmp qword [0x1400ccb78], 0x10
cmovae rdi, qword [0x1400ccb60]
mov r14, qword [0x1400ccb70]
mov rax, rbx
sub rax, rsi
cmp r14, rax
ja 0x14000f29b
lea rax, [r14 + rsi]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rbx, 0x10
cmovae rax, qword [rsp + 0x58]
lea rbx, [rax + rsi]
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140062140
mov byte [r14 + rbx], 0
jmp 0x14000f2b1
mov qword [rsp + 0x20], r14
mov r9, rdi
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.14001a170
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.14001aa50
mov dword [rsp + 0x30], 0xd
mov r9, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14000f2d5
mov r9, qword [r15]
mov rdi, qword [r15 + 0x10]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14000f31d
lea rax, [rcx + rdi]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x38]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call fcn.140062140
mov byte [rdi + rbx], 0
jmp 0x14000f32f
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14001a170
lea r11, [0x1400ccbe0]
mov r9, qword [0x1400ccbf8]
mov rcx, r11
mov r10, qword [0x1400ccbe0]
cmp r9, 0x10
cmovae rcx, r10
lea rax, [rsp + 0x38]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
cmovae rax, r8
cmp rcx, rax
je 0x14000f3a8
mov qword [0x1400ccbf0], r12
mov rax, r11
cmp r9, 0x10
cmovae rax, r10
mov byte [rax], 0
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
mov rcx, r11
call fcn.14001adc0
mov rdx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14000f3de
inc rdx
mov rax, r8
cmp rdx, 0x1000
jb 0x14000f3d6
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f50f
mov rcx, r8
call fcn.14006126c
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000f42e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f429
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f515
call fcn.14006126c
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x14000f47d
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f477
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f51b
call fcn.14006126c
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14000f4b5
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f4b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000f4e5
call fcn.14006126c
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140060fb0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140067948
int3
call fcn.140067948
nop
call fcn.140067948
nop
call fcn.14001ad60
int3
call fcn.140067948
nop
call fcn.140067948
nop
call fcn.14001ad60
int3
call fcn.140067948
nop
call fcn.140067948
nop
call fcn.140067948
int3