Function at 0x14006dae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1400f7060]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov dword [rbp - 9], 0x203e2d20
mov byte [rbp - 5], 0
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x51], xmm0
mov dword [rbp - 0x41], 0x506c6c44
mov dword [rbp - 0x3d], 0x65746f72
mov dword [rbp - 0x39], 0x6e457463
mov word [rbp - 0x35], 0x64
lea r8, [rbp - 9]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x31]
call fcn.14005ee20
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp + 0x27]
call fcn.14005fd10
mov dword [rbp - 9], 0x202d3c20
mov byte [rbp - 5], 0
movdqa xmm0, xmmword [str._DLLPROTECT__::_PerformSecurityCLoadLibraryExA_HLoadLibraryExW_HWinVerifyTrust_Hget_module_path_GenericLoadLibraVerifyEmbeddedSiLoadLibraryA_HooLoadLibraryW_HooreadBlacklistJsoDumpDllProtEventK]
movdqu xmmword [rbp - 0x51], xmm0
mov dword [rbp - 0x41], 0x506c6c44
mov dword [rbp - 0x3d], 0x65746f72
mov dword [rbp - 0x39], 0x6e457463
mov word [rbp - 0x35], 0x64
lea r8, [rbp - 9]
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x31]
call fcn.14005ee20
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14005fd10
mov rbx, qword [0x1400fbc38]
xor edi, edi
mov qword [rbp - 0x51], rdi
lea rax, [rbp - 1]
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rbx
mov qword [rbp - 0x39], rdi
mov rax, qword [rbx]
cmp dword [rax], edi
je 0x14006dc0e
mov qword [rbp - 9], rdi
lea rcx, [rbp - 9]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbp - 9]
mov qword [rbp - 0x51], rax
lea r8, [0x1400e01eb]
mov qword [rsp + 0x28], r8
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r9, str._s_s
xor edx, edx
mov rcx, rbx
call fcn.14007c440
nop
lea rcx, [0x1400fba90]
call fcn.14003581c
test eax, eax
jne 0x14006ddf8
mov byte [0x1400fba40], 1
cmp dword [0x1400fbae0], eax
je 0x14006dc4d
lea rdx, [0x1400fba90]
lea rcx, [0x1400fba48]
call fcn.1400c5b08
cmp dword [0x1400fbae0], 0
jne 0x14006dc31
lea rcx, [0x1400fba90]
call fcn.140035840
mov rbx, qword [0x1400fbd78]
test rbx, rbx
je 0x14006dc9f
lea rcx, [rbx + 0xc0]
call fcn.14006ba40
lea rcx, [rbx + 0x78]
call fcn.1400c5a94
lea rcx, [rbx + 0x28]
call fcn.1400357d0
mov rcx, rbx
call fcn.14006bde0
mov edx, 0xe8
mov rcx, rbx
call fcn.14005be00
mov qword [0x1400fbd78], rdi
mov ebx, 1
mov rcx, qword [0x1400fbd70]
test rcx, rcx
je 0x14006dcbe
mov rax, qword [rcx]
mov edx, ebx
call qword [rax]
mov qword [0x1400fbd70], rdi
call fcn.1400961e0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140096860
lea rdx, [0x1400752c0]
lea rcx, [0x1400fb908]
call fcn.140095f20
test eax, eax
jne 0x14006ddc5
lea rdx, [0x1400750f0]
lea rcx, [0x1400fbae8]
call fcn.140095f20
test eax, eax
jne 0x14006ddc5
lea rdx, [0x140074c60]
lea rcx, [0x1400fbc50]
call fcn.140095f20
test eax, eax
jne 0x14006ddc5
lea rdx, [0x140074e90]
lea rcx, [0x1400fbcd8]
call fcn.140095f20
test eax, eax
jne 0x14006ddc5
lea rdx, [0x140079380]
lea rcx, sub.WINTRUST.dll_WinVerifyTrust
call fcn.140095f20
test eax, eax
jne 0x14006ddc5
cmp byte [0x1400fbd19], al
je 0x14006dd73
lea rdx, [0x140075610]
lea rcx, [0x1400fb8d0]
call fcn.140095f20
test eax, eax
jne 0x14006ddc5
call fcn.1400962c0
mov rcx, qword [0x1400fb8f0]
test rcx, rcx
je 0x14006dd91
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400fb8f0], rdi
mov rcx, qword [0x1400fb8e8]
test rcx, rcx
je 0x14006ddaa
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400fb8e8], rdi
mov rcx, qword [0x1400fb8e0]
test rcx, rcx
je 0x14006ddcc
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1400fb8e0], rdi
jmp 0x14006ddcc
call fcn.140096090
mov ebx, edi
lea rcx, [rbp - 0x51]
call fcn.14006ca40
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14005bde0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, eax
call fcn.140035390
int3