Function at 0x14000ecdc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1c8
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov rax, qword [0x140292900]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov dword [rsp + 0x48], 0
mov byte [rsp + 0x190], 0x4e
mov byte [rsp + 0x191], 0x74
mov byte [rsp + 0x192], 0x51
mov byte [rsp + 0x193], 0x75
mov byte [rsp + 0x194], 0x65
mov byte [rsp + 0x195], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x196], 0x79
mov byte [rsp + 0x197], 0x49
mov byte [rsp + 0x198], VarBstrFromDisp
mov byte [rsp + 0x199], 0x66
mov byte [rsp + 0x19a], VarBstrFromDisp
mov byte [rsp + 0x19b], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x19c], VarBstrFromDisp
mov byte [rsp + 0x19d], 0x61
mov byte [rsp + 0x19e], 0x74
mov byte [rsp + 0x19f], 0x69
mov byte [rsp + 0x1a0], VarBstrFromDisp
mov byte [rsp + 0x1a1], VarBstrFromDisp
mov byte [rsp + 0x1a2], 0x50
mov byte [rsp + 0x1a3], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + reloc.OLEAUT32.dll_OleTranslateColor], VarBstrFromDisp
mov byte [rsp + 0x1a5], 0x63
mov byte [rsp + 0x1a6], 0x65
mov byte [rsp + 0x1a7], 0x73
mov byte [rsp + 0x1a8], 0x73
mov byte [rsp + 0x1a9], 0
mov edx, 0x18
lea rcx, [rsp + 0x168]
call fcn.1400153fc
lea rax, [rsp + 0x100]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x190]
mov rcx, qword [rsp + 0x58]
call fcn.140004e98
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x1e0]
call fcn.1400062c8
mov dword [rsp + 0x20], 0x33
mov r9, qword [rax]
lea r8, [0x1401acb70]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x168]
call fcn.14000e8ec
nop
lea rcx, [rsp + 0x168]
call fcn.14000b000
mov qword [rsp + 0x50], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, [rsp + 0x140]
call fcn.1400153fc
lea rcx, [rsp + 0x140]
call fcn.14000dda0
nop
mov edx, 0x18
lea rcx, [rsp + 0x150]
call fcn.1400153fc
lea rcx, [rsp + 0x150]
call fcn.1400051c8
nop
mov dword [rsp + 0x44], 0
jmp 0x14000eebb
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx]
jae 0x14000f14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x68], rax
movsxd rcx, dword [rsp + 0x44]
imul rcx, rcx, 0x28
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x1e0]
call fcn.1400062c8
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov ecx, dword [rsp + 0x1e8]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x68]
mov r9, rcx
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
mov r8, qword [rcx + rdx + 0x10]
mov rdx, qword [rax]
lea rcx, [rsp + 0xb8]
call fcn.140015418
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x140]
call fcn.14000df58
lea rcx, [rsp + 0xb8]
call fcn.14000ded0
mov byte [rsp + 0x180], 0x4e
mov byte [rsp + 0x181], 0x74
mov byte [rsp + 0x182], 0x51
mov byte [rsp + 0x183], 0x75
mov byte [rsp + 0x184], 0x65
mov byte [rsp + 0x185], reloc.OLEAUT32.dll_VarBstrFromDisp
mov byte [rsp + 0x186], 0x79
mov byte [rsp + 0x187], 0x4f
mov byte [rsp + 0x188], 0x62
mov byte [rsp + 0x189], 0x6a
mov byte [rsp + 0x18a], 0x65
mov byte [rsp + 0x18b], 0x63
mov byte [rsp + 0x18c], 0x74
mov byte [rsp + 0x18d], 0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x180]
mov rcx, qword [rsp + 0x80]
call fcn.140004e98
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x140]
call fcn.1400062c8
mov dword [rsp + 0x20], 2
mov r9, qword [rax]
mov r8, qword [sym.imp.ntdll.dll_NtQueryObject]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0xc8]
call fcn.14000e72c
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x150]
call fcn.14000eabc
lea rcx, [rsp + 0xc8]
call fcn.140005d68
lea rcx, [rsp + 0x150]
call fcn.14000b000
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 8]
lea rcx, [rsp + 0xe0]
call fcn.140004f88
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0xa8], rax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x1d8]
call fcn.14000e604
mov byte [rsp + 0x40], al
mov al, byte [rsp + 0x40]
mov byte [rsp + 0x41], al
lea rcx, [rsp + 0xe0]
call fcn.140005cdc
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x14000f0d7
jmp 0x14000eeb1
lea rdx, [rsp + 0x140]
mov rcx, qword [rsp + 0x1d0]
call fcn.14000dd28
mov eax, dword [rsp + 0x48]
or eax, 1
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x150]
call fcn.140005d68
nop
lea rcx, [rsp + 0x140]
call fcn.14000ded0
nop
lea rcx, [rsp + 0x168]
call fcn.140005d68
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.140005cdc
nop
mov rcx, qword [rsp + 0x1e0]
call fcn.14000ded0
mov rax, qword [rsp + 0x1d0]
jmp 0x14000f192
lea rcx, [rsp + 0x150]
call fcn.140005d68
nop
lea rcx, [rsp + 0x140]
call fcn.14000ded0
nop
lea rcx, [rsp + 0x168]
call fcn.140005d68
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.140005cdc
nop
mov rcx, qword [rsp + 0x1e0]
call fcn.14000ded0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1401a82a0
add rsp, 0x1c8
ret