Function at 0x140001bc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x248
mov dword [rsp + 0x290], ecx
mov rdi, rdx
mov rsi, r8
mov ebp, dword [rsp + 0x2b0]
mov r14d, dword [rsp + 0x2b8]
mov eax, dword [rsp + 0x2c8]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x2d0]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x64], eax
mov ebx, dword [rsp + 0x2e0]
mov byte [rsp + 0x48], bpl
mov byte [rsp + 0x50], r14b
mov byte [rsp + 0x7e], bl
cmp word [r8], 0x5a4d
jne 0x140002a12
movsxd r13, dword [r8 + 0x3c]
add r13, r8
cmp word [r13 + 4], 0x8664
jne 0x140002a2d
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, dword [r13 + 0x50]
mov edx, 0
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x248]
mov rcx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140002a34
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], 0
mov qword [rsp + 0x208], 0
mov rax, qword [0x1401c3f10]
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x1d0], rdx
mov rdx, qword [rax + 0x50]
mov qword [rsp + 0x1d8], rdx
mov rdx, qword [rax + 0x178]
mov qword [rsp + 0x1e0], rdx
mov qword [rsp + 0x1e8], rcx
mov edx, dword [rsp + 0x2e8]
mov dword [rsp + 0x1f8], edx
mov rdx, qword [rsp + 0x2f0]
mov qword [rsp + 0x200], rdx
movzx ebx, bl
mov dword [rsp + 0x208], ebx
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rsi
mov rdx, rcx
mov rcx, rdi
call qword [rax + 0x268]
test eax, eax
je 0x140001d4d
lea rax, [r13 + 0x18]
mov qword [rsp + 0x70], rax
movzx ebx, word [r13 + 0x14]
add rbx, rax
cmp word [r13 + 6], 0
je 0x140001de7
mov r12d, 0
mov r15, qword [0x1401c3f10]
jmp 0x140001d8a
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x250]
mov ebp, 0
jmp 0x140002a17
add r12d, 1
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp eax, r12d
je 0x140001de7
mov r9d, dword [rbx + 0x10]
test r9d, r9d
je 0x140001d78
mov eax, dword [rbx + 0x14]
mov edx, dword [rbx + 0xc]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9d, r9d
lea r8, [rsi + rax]
mov rcx, rdi
call qword [r15 + 0x268]
test eax, eax
jne 0x140001d78
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x250]
mov ebp, 0
jmp 0x140002a17
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x40
mov edx, 0
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x248]
mov r15, rax
test rax, rax
je 0x140001f9d
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0x1d0]
mov rdx, rax
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x268]
test eax, eax
je 0x140001fc8
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov r8d, 0x14f0
mov edx, 0
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x248]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000200b
mov qword [rsp + 0x20], 0
mov r9d, 0x4f0
lea r8, [0x1401be060]
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x268]
test eax, eax
je 0x14000204e
mov dword [rsp + 0x1cc], 0
mov rbx, qword [0x1401c3f10]
lea rsi, [rsp + 0x1cc]
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
mov r8d, dword [r13 + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x258]
mov qword [rsp + 0x20], rsi
mov r9d, 0x40
mov r8d, 0x4f0
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x258]
call qword [rbx + 0x1f8]
mov dword [rsp + 0x78], eax
test bpl, bpl
jne 0x14000211d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r15
mov r9, rsi
mov r8d, 0
mov edx, 0
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x1d0]
test rax, rax
je 0x1400020ab
cmp qword [rsp + 0x300], 0
je 0x140002103
mov rsi, qword [rsp + 0x300]
mov qword [rsi], rax
mov byte [rsp + 0x7f], 1
mov rsi, qword [0x1401c3f10]
mov r12, rsi
mov r14, rsi
mov qword [rsp + 0x48], r13
movzx r13d, byte [rsp + 0x7f]
jmp 0x1400024ea
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x250]
mov ebp, 0
jmp 0x140002a17
mov rbx, qword [0x1401c3f10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov ebp, 0
jmp 0x140002a17
mov rbx, qword [0x1401c3f10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov ebp, 0
jmp 0x140002a17
mov rbx, qword [0x1401c3f10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x250]
mov ebp, 0
jmp 0x140002a17
mov rbx, qword [0x1401c3f10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x250]
jmp 0x140002a17
mov rcx, rax
mov rax, qword [0x1401c3f10]
call qword [rax + 0xc0]
mov byte [rsp + 0x7f], 1
jmp 0x140001f80
mov qword [rsp + 0x98], r15
mov rax, qword [rsp + 0x68]
lea rdx, [rax + 9]
mov qword [rsp + 0x20], 0
mov r9d, 4
lea r8, [rsp + 0x98]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x268]
test eax, eax
je 0x14000218f
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov rbx, qword [0x1401c3f10]
mov rsi, rbx
mov rbp, rbx
jmp 0x140002238
mov rbx, qword [0x1401c3f10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x250]
mov ebp, 0
jmp 0x140002a17
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], rax
jne 0x140002270
call qword [rsi + 0x1f8]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x2f8]
jae 0x140002270
mov ecx, dword [rsp + 0x2c0]
call qword [rbp + 0x218]
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
je 0x140002238
mov qword [rsp + 0xa8], rax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0xc0], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0xc0]
lea rcx, [0x1400040fe]
call qword [rbx + 0x280]
jmp 0x1400021ec
mov rax, qword [rsp + 0xa0]
cmp qword [rsp + 0xa8], rax
je 0x1400024a5
mov rax, qword [0x1401c3f10]
mov r8, qword [rax + 0xf8]
mov byte [rsp + 0x21a], 0x5c
mov byte [rsp + 0x21b], 0x47
mov byte [rsp + 0x21c], 0x50
mov byte [rsp + 0x21d], 0x59
mov byte [rsp + 0x21e], 0x5a
mov byte [rsp + 0x21f], 0x19
mov byte [rsp + 0x220], 0x5c
mov byte [rsp + 0x221], 0x55
mov byte [rsp + 0x222], 0x56
mov byte [rsp + 0x223], 0x3b
lea rcx, [rsp + 0x21a]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4ec4ec4f
sar rax, 0x24
mov r9d, edx
sar r9d, 0x1f
sub eax, r9d
imul eax, eax, 0x34
mov r9d, edx
sub r9d, eax
lea eax, [r9 + 0x32]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 0xa
jne 0x1400022f1
lea rcx, [rsp + 0x21a]
call r8
mov qword [rsp + 0x88], rax
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
cmp r12, rbx
je 0x1400024ac
mov byte [rsp + 0x7f], 0
mov rbp, qword [0x1401c3f10]
jmp 0x1400023aa
cmp qword [rbx], 0
je 0x14000239d
mov dword [rsp + 0x94], 0
lea rdx, [rsp + 0x94]
mov rcx, qword [rbx]
mov rax, qword [0x1401c3f10]
call qword [rax + 0x290]
mov esi, eax
test eax, eax
je 0x14000239d
mov eax, dword [rsp + 0x290]
cmp dword [rsp + 0x94], eax
je 0x1400023c3
add rbx, 8
cmp r12, rbx
je 0x140002465
lea rdx, [rsp + 0xc0]
mov r8d, 0x104
mov rcx, qword [rbx]
call qword [rbp + 0x288]
jmp 0x14000235e
mov r9d, esi
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x68]
mov ecx, 3
mov rax, qword [0x1401c3f10]
call qword [rax + 0x2a8]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14000239d
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, esi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x2a0]
mov ecx, 0xa
mov rax, qword [0x1401c3f10]
call qword [rax + 0x218]
mov ecx, 0xa
mov rax, qword [0x1401c3f10]
call qword [rax + 0x218]
mov rcx, qword [rsp + 0x80]
mov rax, qword [0x1401c3f10]
call qword [rax + 0x2b0]
cmp byte [rsp + 0x50], 0
jne 0x140002460
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x7f], al
jmp 0x14000239d
mov byte [rsp + 0x7f], r14b
mov rax, qword [rsp + 0xa0]
cmp rax, qword [rsp + 0xa8]
je 0x14000247f
mov qword [rsp + 0xa8], rax
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140001f80
mov rdx, qword [rsp + 0xb0]
sub rdx, rcx
call fcn.1400bb620
jmp 0x140001f80
mov byte [rsp + 0x7f], 0
jmp 0x14000247f
mov byte [rsp + 0x7f], 0
jmp 0x14000247f
cmp rbx, 0x404040
sete bpl
mov edx, r13d
xor edx, 1
or ebp, edx
or bpl, al
jne 0x1400025d1
mov ecx, 0xa
mov rax, qword [0x1401c3f10]
call qword [rax + 0x218]
test rbx, rbx
jne 0x14000262e
mov dword [rsp + 0xa0], 0
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call qword [rsi + 0x278]
cmp dword [rsp + 0xa0], 0x103
jne 0x140002624
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x40
lea r8, [rsp + 0xc0]
mov rdx, r15
mov rcx, rdi
call qword [r12 + 0x270]
mov rbx, qword [rsp + 0xe0]
mov eax, 0
cmp dword [rsp + 0x2f8], 0
je 0x1400024b3
call qword [r14 + 0x1f8]
sub eax, dword [rsp + 0x78]
cmp eax, dword [rsp + 0x2f8]
setae al
jmp 0x1400024b3
mov rbx, qword [0x1401c3f10]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call qword [rbx + 0x250]
mov ebp, 0
jmp 0x140002a17
mov r13, qword [rsp + 0x48]
mov ecx, 0x1400000
call sub.msvcrt.dll_malloc
mov r14, rax
test rax, rax
je 0x140002a17
mov r8d, 0x1400000
mov edx, 0
mov rcx, rax
call sub.msvcrt.dll_memset
cmp byte [rsp + 0x58], 0
je 0x14000268a
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r14
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x268]
cmp dword [rsp + 0x2c0], 0
je 0x1400026a8
mov ecx, dword [rsp + 0x2c0]
mov rax, qword [0x1401c3f10]
call qword [rax + 0x218]
cmp byte [rsp + 0x60], 0
je 0x140002976
movzx ebx, word [r13 + 0x14]
add rbx, qword [rsp + 0x70]
cmp word [r13 + 6], 0
je 0x140002a63
mov esi, 0
mov r12, qword [0x1401c3f10]
lea rax, [rsp + 0x22b]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x231]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
movzx r15d, byte [rsp + 0x7e]
jmp 0x1400027ba
mov byte [rsp + 0x22b], 0x1c
mov byte [rsp + 0x22c], 0x41
mov byte [rsp + 0x22d], 0x47
mov byte [rsp + 0x22e], 0x47
mov byte [rsp + 0x22f], 0x55
mov byte [rsp + 0x230], 0x37
lea rcx, [rsp + 0x22b]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4ec4ec4f
sar rax, 0x24
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x34
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x32]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 6
jne 0x14000273c
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x14000285f
mov edx, dword [rbx + 0xc]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r9d, ebp
mov r8, r14
mov rcx, rdi
call qword [r12 + 0x268]
add esi, 1
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp eax, esi
je 0x140002971
mov ebp, dword [rbx + 8]
test ebp, ebp
je 0x1400027a6
test r15b, r15b
jne 0x1400026ff
mov byte [rsp + 0x224], 0x1c
mov byte [rsp + 0x225], 0x43
mov byte [rsp + 0x226], 0x50
mov byte [rsp + 0x227], 0x54
mov byte [rsp + 0x228], 0x42
mov byte [rsp + 0x229], 0x56
mov byte [rsp + 0x22a], 0x38
lea rcx, [rsp + 0x224]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4ec4ec4f
sar rax, 0x24
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x34
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x32]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 7
jne 0x14000280f
lea rdx, [rsp + 0x224]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140002784
jmp 0x1400026ff
mov byte [rsp + 0x231], 0x1c
mov byte [rsp + 0x232], 0x41
mov byte [rsp + 0x233], 0x51
mov byte [rsp + 0x234], 0x59
mov byte [rsp + 0x235], 0x59
mov byte [rsp + 0x236], 0x54
mov byte [rsp + 0x237], 0x38
lea rcx, [rsp + 0x231]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4ec4ec4f
sar rax, 0x24
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x34
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x32]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 7
jne 0x1400028a4
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x140002784
mov byte [rsp + 0x238], 0x1c
mov byte [rsp + 0x239], 0x45
mov byte [rsp + 0x23a], 0x58
mov byte [rsp + 0x23b], 0x5c
mov byte [rsp + 0x23c], 0x4c
mov byte [rsp + 0x23d], 0x52
mov byte [rsp + 0x23e], 0x4a
mov byte [rsp + 0x23f], 0x39
lea rcx, [rsp + 0x238]
mov edx, 0
movsxd rax, edx
imul rax, rax, 0x4ec4ec4f
sar rax, 0x24
mov r8d, edx
sar r8d, 0x1f
sub eax, r8d
imul eax, eax, 0x34
mov r8d, edx
sub r8d, eax
lea eax, [r8 + 0x32]
xor byte [rcx], al
add edx, 1
add rcx, 1
cmp edx, 8
jne 0x140002939
jmp 0x1400027a6
mov r15, qword [rsp + 0x58]
cmp byte [rsp + 0x64], 0
je 0x140002aac
movzx ebx, word [r13 + 0x14]
add rbx, qword [rsp + 0x70]
cmp word [r13 + 6], 0
je 0x140002a6a
mov esi, 0
mov r12, qword [0x1401c3f10]
lea rbp, [rsp + 0xc0]
jmp 0x1400029dc
mov edx, dword [rbx + 0xc]
add rdx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, r8d
mov rcx, rdi
call qword [r12 + 0x258]
add esi, 1
add rbx, 0x28
movzx eax, word [r13 + 6]
cmp eax, esi
je 0x140002a6a
mov r8d, dword [rbx + 8]
test r8d, r8d
je 0x1400029c8
mov dword [rsp + 0xc0], 0
mov eax, dword [rbx + 0x24]
mov r9d, 4
test eax, eax
js 0x1400029ad
and eax, 0x20000000
cmp eax, 1
sbb r9d, r9d
and r9d, 0xffffffe2
add r9d, 0x20
jmp 0x1400029ad
mov ebp, 0
mov eax, ebp
add rsp, 0x248
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, 0
jmp 0x140002a17
mov ebp, 0
jmp 0x140002a17
cmp byte [rsp + 0x64], 0
je 0x140002aac
mov dword [rsp + 0xc0], 0
movzx eax, word [r13 + 0x14]
mov rsi, qword [rsp + 0x70]
mov r8d, dword [rax + rsi + 0xc]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 2
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
mov rax, qword [0x1401c3f10]
call qword [rax + 0x258]
mov rbx, qword [0x1401c3f10]
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r14
mov rsi, qword [rsp + 0x68]
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x268]
mov r9d, 0x8000
mov r8d, 0
mov rdx, rsi
mov rcx, rdi
call qword [rbx + 0x250]
mov r9d, 0x8000
mov r8d, 0
mov rdx, r15
mov rcx, rdi
call qword [rbx + 0x250]
mov rcx, r14
call fcn.140022eb0
mov ebp, 1
jmp 0x140002a17