Function at 0x14004d38c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x310
mov rax, qword [0x1400a4088]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov ebx, r8d
mov rsi, rdx
mov r14d, dword [rdx]
cmp r14d, r8d
jbe 0x14004dce3
lea r15, [rdx + 8]
call fcn.14004c62c
mov dword [rsp + 0x30], eax
test eax, eax
je 0x14004dce3
mov r12d, 0x690077
mov dword [rsp + 0x2d8], r12d
mov dword [rsp + 0x2dc], 0x6c006e
mov dword [rsp + 0x2e0], 0x67006f
mov dword [rsp + 0x2e4], 0x6e006f
mov dword [rsp + 0x2e8], 0x65002e
mov dword [rsp + 0x2ec], 0x650078
and dword [rsp + 0x2f0], 0
mov dword [rsp + 0x248], 0x620077
mov r10d, 0x6d0065
mov dword [rsp + 0x24c], r10d
mov dword [rsp + 0x250], 0x57005c
mov dword [rsp + 0x254], 0x6e0069
mov dword [rsp + 0x258], 0x67004d
mov dword [rsp + 0x25c], 0x74006d
mov dword [rsp + 0x260], 0x2e0052
mov edx, 0x6c0064
mov dword [rsp + 0x264], edx
mov eax, 0x6c
mov dword [rsp + 0x268], eax
mov dword [rsp + 0xe0], 0x710074
mov dword [rsp + 0xe4], 0x650075
mov dword [rsp + 0xe8], 0x790072
mov ecx, 0x64002e
mov dword [rsp + 0xec], ecx
lea r13d, [rdx + 8]
mov dword [rsp + 0xf0], r13d
and dword [rsp + 0xf4], 0
mov dword [rsp + 0x298], 0x720070
mov dword [rsp + 0x29c], 0x66006f
mov edi, 0x760073
mov dword [rsp + 0x2a0], edi
mov r11d, 0x2e0063
mov dword [rsp + 0x2a4], r11d
mov dword [rsp + 0x2a8], edx
mov dword [rsp + 0x2ac], eax
mov dword [rsp + 0x2b8], 0x650077
mov dword [rsp + 0x2bc], 0x740076
mov dword [rsp + 0x2c0], 0x700061
mov dword [rsp + 0x2c4], 0x2e0069
mov dword [rsp + 0x2c8], edx
mov dword [rsp + 0x2cc], eax
mov dword [rsp + 0x110], r12d
mov dword [rsp + 0x114], 0x68006e
mov dword [rsp + 0x118], 0x740074
mov dword [rsp + 0x11c], 0x2e0070
mov dword [rsp + 0x120], edx
mov dword [rsp + 0x124], eax
mov dword [rsp + 0xf8], 0x650069
mov dword [rsp + 0xfc], 0x720066
mov dword [rsp + 0x100], 0x6d0061
mov dword [rsp + 0x104], 0x2e0065
mov dword [rsp + 0x108], edx
mov dword [rsp + 0x10c], eax
mov dword [rsp + 0x1c0], 0x6d0069
mov dword [rsp + 0x1c4], 0x670061
mov r8d, 0x720065
mov dword [rsp + 0x1c8], r8d
mov r9d, 0x730065
mov dword [rsp + 0x1cc], r9d
mov dword [rsp + 0x1d0], ecx
mov dword [rsp + 0x1d4], r13d
and dword [rsp + 0x1d8], 0
lea edx, [r8 - 1]
mov dword [rsp + 0x220], edx
lea ecx, [rdi - 0xa]
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0x228], r8d
mov eax, 0x5c0073
mov dword [rsp + 0x22c], eax
mov dword [rsp + 0x230], 0x75006c
mov dword [rsp + 0x234], 0x660061
mov dword [rsp + 0x238], 0x2e0073
mov dword [rsp + 0x23c], 0x790073
mov dword [rsp + 0x240], 0x73
mov dword [rsp + 0x270], edx
mov dword [rsp + 0x274], ecx
mov dword [rsp + 0x278], r8d
mov dword [rsp + 0x27c], eax
mov dword [rsp + 0x280], 0x6c0066
mov dword [rsp + 0x284], 0x6d0074
lea r8d, [rdx + 3]
mov dword [rsp + 0x288], r8d
mov dword [rsp + 0x28c], 0x73002e
mov dword [rsp + 0x290], 0x730079
and dword [rsp + 0x294], 0
mov dword [rsp + 0x1a0], 0x640061
mov dword [rsp + 0x1a4], 0x730074
mov dword [rsp + 0x1a8], 0x680063
mov dword [rsp + 0x1ac], r10d
mov dword [rsp + 0x1b0], 0x2e0061
mov dword [rsp + 0x1b4], 0x6c0064
mov r10d, 0x6c
mov dword [rsp + 0x1b8], r10d
mov dword [rsp + 0x40], 0x690063
mov edx, 0x64002e
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x48], r13d
and dword [rsp + 0x4c], 0
mov dword [rsp + 0x1e0], 0x630073
mov eax, 0x650068
mov dword [rsp + 0x1e4], eax
mov dword [rsp + 0x1e8], 0x730064
mov ecx, 0x630076
mov dword [rsp + 0x1ec], ecx
mov dword [rsp + 0x1f0], edx
mov dword [rsp + 0x1f4], r13d
and dword [rsp + 0x1f8], 0
lea edx, [rax + 0xb]
mov dword [rsp + 0x140], edx
mov dword [rsp + 0x144], 0x760072
mov dword [rsp + 0x148], 0x630069
mov dword [rsp + 0x14c], r9d
mov dword [rsp + 0x150], 0x65002e
mov dword [rsp + 0x154], 0x650078
and dword [rsp + 0x158], 0
mov dword [rsp + 0xb0], 0x750077
mov dword [rsp + 0xb4], 0x750061
mov dword [rsp + 0xb8], 0x6e0065
mov dword [rsp + 0xbc], 0x2e0067
lea r9d, [r13 - 8]
mov dword [rsp + 0xc0], r9d
mov dword [rsp + 0xc4], r10d
mov dword [rsp + 0xc8], r12d
mov dword [rsp + 0xcc], 0x73006e
mov dword [rsp + 0xd0], 0x740061
mov dword [rsp + 0xd4], 0x65002e
lea r12d, [rax + 0x10]
mov dword [rsp + 0xd8], r12d
and dword [rsp + 0xdc], 0
mov dword [rsp + 0x50], 0x730070
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x58], 0x2e0064
mov dword [rsp + 0x5c], r9d
mov dword [rsp + 0x60], r10d
mov dword [rsp + 0x68], 0x6d0071
mov dword [rsp + 0x6c], r8d
mov eax, 0x64002e
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x74], r13
mov dword [rsp + 0x98], 0x620074
mov dword [rsp + 0x9c], 0x730073
mov dword [rsp + 0xa0], ecx
mov dword [rsp + 0xa4], eax
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0x80], 0x700067
mov dword [rsp + 0x84], edi
mov dword [rsp + 0x88], r11d
mov dword [rsp + 0x8c], r9d
mov dword [rsp + 0x90], r10d
mov dword [rsp + 0x128], 0x690064
mov dword [rsp + 0x12c], 0x73006d
mov dword [rsp + 0x130], 0x6f006a
mov dword [rsp + 0x134], 0x2e0062
mov dword [rsp + 0x138], r9d
mov dword [rsp + 0x13c], r10d
mov dword [rsp + 0x200], edx
mov dword [rsp + 0x204], 0x750074
mov dword [rsp + 0x208], 0x610070
mov dword [rsp + 0x20c], 0x690070
mov dword [rsp + 0x210], eax
mov qword [rsp + 0x214], r13
mov dword [rsp + 0x180], 0x610072
mov dword [rsp + 0x184], 0x610063
mov dword [rsp + 0x188], 0x650067
mov dword [rsp + 0x18c], 0x74006e
lea eax, [rdx - 0x45]
mov dword [rsp + 0x190], eax
mov qword [rsp + 0x194], r12
mov dword [rsp + 0x160], 0x70006c
mov dword [rsp + 0x164], 0x73006b
mov dword [rsp + 0x168], 0x740065
mov dword [rsp + 0x16c], 0x700075
mov dword [rsp + 0x170], eax
mov qword [rsp + 0x174], r12
call fcn.14003a2ec
mov r12, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14004dce3
mov rcx, rax
call fcn.14007d45c
mov r13d, eax
mov dword [rsp + 0x20], ebx
cmp ebx, dword [rsi]
jae 0x14004dcd4
mov edi, ebx
imul rax, rdi, 0x220
add rax, r15
mov qword [rsp + 0x28], rax
lea rdx, [rax + 0x20]
mov r8d, r13d
mov rcx, r12
call fcn.14007d544
test eax, eax
jne 0x14004dccd
imul rdx, rdi, 0x110
lea rax, [rdx + r13]
mov ecx, 0x5c
cmp cx, word [r15 + rax*2 + 0x20]
jne 0x14004dccd
mov ecx, dword [rsp + 0x30]
dec ecx
je 0x14004dab3
dec ecx
je 0x14004da9a
dec ecx
je 0x14004da79
dec ecx
jne 0x14004dccd
lea ecx, [r13 + 1]
add rcx, 0x10
add rcx, rdx
lea rdx, [r15 + rcx*2]
lea rcx, [rsp + 0x1c0]
call fcn.14007d400
test eax, eax
jne 0x14004dccd
or edi, 0xffffffff
add dword [rsi], edi
lea eax, [r14 - 1]
cmp ebx, eax
je 0x14004dcc7
lea edx, [rbx + 1]
imul rdx, rdx, 0x220
jmp 0x14004dcac
lea ecx, [r13 + 1]
add rcx, 0x10
add rcx, rdx
lea rdx, [r15 + rcx*2]
lea rcx, [rsp + 0xf8]
call fcn.14007d400
jmp 0x14004dc91
lea ecx, [r13 + 1]
add rcx, 0x10
add rcx, rdx
lea rdx, [r15 + rcx*2]
lea rcx, [rsp + 0x110]
jmp 0x14004da90
lea ecx, [r13 + 1]
add rcx, 0x10
add rcx, rdx
lea rdi, [r15 + rcx*2]
mov rdx, rdi
lea rcx, [rsp + 0x2d8]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x248]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0xe0]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x298]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x2b8]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x220]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x270]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x1a0]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x1e0]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x140]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0xb0]
call fcn.14007d400
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0xc8]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x50]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x68]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x98]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x80]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x128]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x200]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x180]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
je 0x14004dc95
mov rdx, rdi
lea rcx, [rsp + 0x160]
call sub.ntoskrnl.exe__wcsicmp
test eax, eax
jne 0x14004dccd
or edi, 0xffffffff
add dword [rsi], edi
lea eax, [r14 - 1]
cmp ebx, eax
je 0x14004dcc7
lea ecx, [rbx + 1]
imul rdx, rcx, 0x220
mov eax, r14d
sub eax, ebx
dec eax
imul r8, rax, 0x220
add rdx, r15
mov rcx, qword [rsp + 0x28]
call fcn.1400010a0
add ebx, edi
mov dword [rsp + 0x20], ebx
inc ebx
jmp 0x14004d9c9
jmp 0x14004dcdb
mov rcx, r12
call fcn.140077564
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.14008c320
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret