Function at 0x140001b50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov edx, 0x7865
movabs rax, 0x7265726f6c707865
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
mov r14, rcx
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov ecx, 0xc0
movabs rax, 0x6e6f676f6c6e6977
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x70], rax
movabs rax, 0x78652e737361736c
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x90], rax
movabs rax, 0x7365636976726573
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0xb0], rax
movabs rax, 0x2e74736f68637673
mov qword [rsp + 0xc0], rax
mov eax, 0x7865
mov word [rsp + 0xc8], ax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0xd0], rax
movabs rax, 0x2e76736c6f6f7073
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x48], 0x6578652e
mov qword [rsp + 0x38], 0xc
mov byte [rsp + 0x4c], 0
mov dword [rsp + 0x68], 0x6578652e
mov qword [rsp + 0x58], 0xc
mov byte [rsp + 0x6c], 0
mov byte [rsp + 0x88], 0x65
mov qword [rsp + 0x78], 9
mov byte [rsp + 0x89], 0
mov dword [rsp + 0xa8], 0x6578652e
mov qword [rsp + 0x98], 0xc
mov byte [rsp + 0xac], 0
mov byte [rsp + 0xca], 0x65
mov qword [rsp + 0xb8], 0xb
mov byte [rsp + 0xcb], 0
mov qword [rsp + 0xe0], rax
mov word [rsp + 0xe8], dx
mov byte [rsp + 0xea], 0x65
mov qword [rsp + 0xd8], 0xb
mov byte [rsp + 0xeb], 0
call fcn.1400c6c40
lea rdi, [rsp + 0x30]
mov r13, rax
lea r12, [rax + 0xc0]
mov rbx, rax
mov rsi, rdi
nop word [rax + rax]
lea rax, [rbx + 0x10]
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, rbx
mov qword [rbx], rax
add r8, rdx
call fcn.1400015f0
add rbx, 0x20
add rsi, 0x20
cmp rbx, r12
jne 0x140001cf8
lea r12, [rsp + 0xf0]
nop word cs:[rax + rax]
sub r12, 0x20
mov rcx, qword [r12]
lea rax, [r12 + 0x10]
cmp rcx, rax
je 0x140001d50
mov rax, qword [r12 + 0x10]
lea rdx, [rax + 1]
call fcn.1400c6c00
cmp r12, rdi
jne 0x140001d30
lea r15, [r14 + 0x2c]
mov qword [rsp + 0x30], rbp
mov rcx, r15
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x28], rax
mov rsi, rax
cmp rax, 0xf
ja 0x140001e70
cmp rax, 1
jne 0x140001e50
movzx edx, byte [r14 + 0x2c]
mov byte [rsp + 0x40], dl
mov rdx, rbp
mov qword [rsp + 0x38], rax
mov byte [rdx + rax], 0
cmp r13, rbx
je 0x140001eac
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, r13
jmp 0x140001dbd
add rsi, 0x20
cmp rbx, rsi
je 0x140001e60
cmp rdi, qword [rsi + 8]
jne 0x140001db0
test rdi, rdi
je 0x140001dda
mov rdx, qword [rsi]
mov r8, rdi
mov rcx, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140001db0
mov r12d, 1
cmp r14, rbp
je 0x140001df6
mov rax, qword [rsp + 0x40]
mov rcx, r14
lea rdx, [rax + 1]
call fcn.1400c6c00
mov rsi, r13
nop dword [rax]
mov rcx, qword [rsi]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x140001e19
mov rax, qword [rsi + 0x10]
lea rdx, [rax + 1]
call fcn.1400c6c00
add rsi, 0x20
cmp rbx, rsi
jne 0x140001e00
mov edx, 0xc0
mov rcx, r13
call fcn.1400c6c00
mov eax, r12d
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rax, rax
jne 0x140001ecc
mov rdx, rbp
jmp 0x140001d8e
xor r12d, r12d
jmp 0x140001de0
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, r12
call fcn.1400a8ff0
mov qword [rsp + 0x30], rax
mov rcx, rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rdx, r15
mov r8, rsi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
jmp 0x140001d8e
mov rcx, qword [rsp + 0x30]
cmp rcx, rbp
je 0x140001ec4
mov rax, qword [rsp + 0x40]
lea rdx, [rax + 1]
call fcn.1400c6c00
xor r12d, r12d
jmp 0x140001e22
mov rcx, rbp
jmp 0x140001e92