Function at 0x140011de0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x6d0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov qword [rbp + 0x6b8], rbx
mov qword [rbp + 0x6c0], rsi
mov rax, qword [0x140176220]
xor rax, rbp
mov qword [rbp + 0x680], rax
mov r14, rcx
xor edi, edi
mov dword [rbp + 0x1c], edi
call fcn.140021170
mov rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x140011e3f
mov ecx, 0x80004005
call fcn.140020760
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp + 8], rbx
lea rdx, [0x1401444f8]
test rdx, 0xffffffffffff0000
jne 0x140011e7f
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.1400205f0
test rax, rax
je 0x140011e8f
mov r8d, esi
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140021f40
jmp 0x140011e8b
xor r8d, r8d
lea rcx, [rbp + 8]
call fcn.1400229f0
mov rbx, qword [rbp + 8]
mov word [rbp + 0x470], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x472]
call fcn.140057e20
mov word [rbp + 0x260], di
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x262]
call fcn.140057e20
mov dword [rbp + 0x10], edi
mov dword [rbp + 0x14], edi
mov dword [rbp + 0x18], edi
mov word [rbp + 0x50], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x52]
call fcn.140057e20
xor r9d, r9d
lea r8d, [r9 + 0x25]
lea rdx, [rbp + 0x50]
xor ecx, ecx
call fcn.14012b720
mov word [rbp + 0x56], di
mov dword [rbp + 0x31], 0x6c6c64
mov dword [rbp + 0x2b], 0x336c656e
mov word [rbp + 0x2f], 0x2e32
mov word [rbp + 0x28], 0x654b
mov byte [rbp + 0x2a], 0x72
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140011fd0
mov dword [rbp + 0x47], 0x6f697461
mov dword [rbp + 0x38], 0x56746547
mov dword [rbp + 0x42], 0x726f666e
mov dword [rbp + 0x3e], 0x49656d75
mov byte [rbp + 0x46], 0x6d
mov word [rbp + 0x4c], 0x57
mov word [rbp + 0x3c], 0x6c6f
mov byte [rbp + 0x4b], 0x6e
lea rdx, [rbp + 0x38]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140186160], rax
test rax, rax
je 0x140011fd0
mov dword [rsp + 0x38], 0x105
lea rcx, [rbp + 0x260]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x14]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x10]
mov r8d, 0x105
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x50]
call rax
test eax, eax
je 0x140011fd0
mov dword [rbp], 0x756c25
mov r8d, dword [rbp + 0x10]
lea rdx, [rbp]
lea rcx, [rbp + 8]
call fcn.140020c90
mov rbx, qword [rbp + 8]
or rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140012034
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x140011fe0
inc edx
cmp edx, 0x3fffffff
jg 0x140012034
movsxd rax, edx
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14001200c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14005b440
sub rsp, rcx
lea rcx, [rsp + 0x40]
mov r9d, 3
mov r8d, edx
mov rdx, rbx
call fcn.1400286b0
mov rdi, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400283c0
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140012055
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov rax, r14
mov rcx, qword [rbp + 0x680]
xor rcx, rbp
call fcn.140055550
mov rbx, qword [rbp + 0x6b8]
mov rsi, qword [rbp + 0x6c0]
lea rsp, [rbp + 0x690]
pop r14
pop rdi
pop rbp
ret