Function at 0x14001cc00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov qword [rsp + 0x40], rcx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x62], 0x6c
lea rcx, [rsp + 0x58]
mov byte [rsp + 0x66], r15b
mov dword [rsp + 0x58], 0x696e6957
mov dword [rsp + 0x5c], 0x2e74656e
mov word [rsp + 0x60], 0x6c64
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x48]
mov word [rsp + 0x55], r15w
mov rcx, rax
mov dword [rsp + 0x48], 0x65746e49
mov rdi, rax
mov dword [rsp + 0x4c], 0x74656e72
mov dword [rsp + 0x50], 0x6e65704f
mov byte [rsp + 0x54], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x140023c50]
lea rdx, [rbp - 0x40]
mov rcx, rdi
mov qword [0x140028c80], rax
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x2f], r15w
mov byte [rbp - 0x2d], r15b
mov byte [rbp - 0x30], r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x140023d30]
lea rdx, [rbp - 0x28]
mov rcx, rdi
mov qword [0x140028c88], rax
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x17], r15w
mov byte [rbp - 0x15], r15b
mov byte [rbp - 0x18], r15b
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov dword [rsp + 0x20], r15d
xor r8d, r8d
mov qword [0x140028c90], rax
xor edx, edx
lea rcx, [0x140028bc0]
call qword [0x140028c80]
mov rsi, rax
xorps xmm0, xmm0
test rax, rax
je 0x14001cdcb
movdqu xmmword [rbp - 0x5b], xmm0
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x28], r15
movdqa xmm0, xmmword [0x140023d70]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp - 0x4b], r15d
mov rcx, rax
mov byte [rbp - 0x47], r15b
movdqu xmmword [rbp - 0x78], xmm0
mov dword [rbp - 0x68], 0x70696c61
mov dword [rbp - 0x64], 0x6d6f632e
mov dword [rbp - 0x60], 0x7761722f
mov byte [rbp - 0x5c], r15b
mov dword [rsp + 0x20], 0x80000000
call qword [0x140028c88]
mov rdi, rax
test rax, rax
je 0x14001cdbf
xor edx, edx
lea rcx, [rbp + 0x100]
mov r8d, 0xc4
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x40]
mov r8d, 0xc4
lea rdx, [rbp + 0x100]
mov rcx, rdi
call qword [0x140028c90]
mov rcx, rdi
test eax, eax
jne 0x14001cdf0
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
lea rdx, [0x140023bdc]
mov r8d, 2
mov qword [rbx + 0x18], r15
mov rcx, rbx
call fcn.140003cc0
jmp 0x14001cfa1
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdi, 0xffffffffffffffff
lea rcx, [rbp + 0x100]
mov rax, rdi
inc rax
cmp byte [rcx + rax], r15b
jne 0x14001ce07
mov rcx, rsi
cmp rax, 1
jae 0x14001d04c
movdqa xmm1, xmmword [0x140023d40]
lea rdx, [rbp - 0x10]
xorps xmm0, xmm0
mov qword [rsp + 0x28], r15
movdqu xmmword [rbp + 0x11], xmm0
xor r9d, r9d
xor r8d, r8d
movdqa xmm0, xmmword [0x140023dd0]
movdqu xmmword [rbp], xmm0
mov qword [rsp + 0x3d8], r14
mov byte [rbp + 0x21], r15b
movdqu xmmword [rbp - 0x10], xmm1
mov byte [rbp + 0x10], r15b
mov dword [rsp + 0x20], 0x80000000
call qword [0x140028c88]
mov r14, rax
test rax, rax
je 0x14001cf6d
xor edx, edx
lea rcx, [rbp + 0x30]
mov r8d, 0xc4
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], r15d
mov r8d, 0xc4
lea rdx, [rbp + 0x30]
mov rcx, r14
call qword [0x140028c90]
mov rcx, r14
test eax, eax
je 0x14001cf67
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0x30]
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], r15b
jne 0x14001cec0
mov rcx, rsi
cmp rax, 1
jae 0x14001d01f
movdqa xmm0, xmmword [0x140023d50]
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7f], r15d
movdqu xmmword [rsp + 0x68], xmm0
mov word [rbp - 0x7d], r15w
mov byte [rbp - 0x7b], r15b
mov dword [rsp + 0x78], 0x2f656d2e
mov word [rsp + 0x7c], 0x7069
mov byte [rsp + 0x7e], r15b
mov dword [rsp + 0x20], 0x80000000
call qword [0x140028c88]
mov r14, rax
test rax, rax
je 0x14001cf6d
xor edx, edx
lea rcx, [rbp + 0x1d0]
mov r8d, 0xc4
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x38]
mov dword [rsp + 0x38], r15d
mov r8d, 0xc4
lea rdx, [rbp + 0x1d0]
mov rcx, r14
call qword [0x140028c90]
mov rcx, r14
test eax, eax
jne 0x14001cfcb
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
lea rdx, [0x140023bdc]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov r8d, 2
mov qword [rbx + 0x18], r15
mov rcx, rbx
call fcn.140003cc0
mov r14, qword [rsp + 0x3d8]
mov rax, rbx
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.14001df90
lea r11, [rsp + 0x3b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rax, [rbp + 0x1d0]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14001cfe1
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
cmp rdi, 1
jae 0x14001d010
mov r8d, 2
lea rdx, [0x140023bdc]
jmp 0x14001cf94
mov r8, rdi
lea rdx, [rbp + 0x1d0]
jmp 0x14001cf94
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
lea rax, [rbp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14001d037
mov r8, rdi
lea rdx, [rbp + 0x30]
jmp 0x14001cf91
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
lea rax, [rbp + 0x100]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
inc rdi
cmp byte [rax + rdi], r15b
jne 0x14001d067
mov r8, rdi
lea rdx, [rbp + 0x100]
mov rcx, rbx
call fcn.140003cc0
jmp 0x14001cfa1