Function at 0x14002a170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov dword [rbp - 0x40], 0x2a1fd734
mov dword [rbp - 0x3c], 0x3b115c03
mov dword [rbp - 0x38], 0x99396748
mov dword [rbp - 0x34], 0xa6b95187
mov dword [rbp - 0x30], 0x6a0ad280
mov dword [rbp - 0x2c], 0x74006e
mov dword [rbp - 0x28], 0x6c0064
mov dword [rbp - 0x24], 0x2e006c
mov dword [rbp - 0x20], 0x6c0064
mov dword [rbp - 0x1c], 0x6c
lea rcx, [rbp - 0x2c]
call qword [0x140062098]
mov rdi, rax
mov dword [rbp - 8], 0xc1b4481d
mov dword [rbp - 4], 0x747360a0
mov dword [rbp], 0x2e715460
mov dword [rbp + 4], 0xae9d2013
mov dword [rbp + 8], 0x7b316d9f
mov dword [rbp + 0xc], 0xa7581e9b
mov dword [rbp + 0x10], 0x6b8f30
mov dword [rbp + 0x14], 0x720065
mov dword [rbp + 0x18], 0x65006e
mov dword [rbp + 0x1c], 0x33006c
mov dword [rbp + 0x20], 0x2e0032
mov dword [rbp + 0x24], 0x6c0064
mov dword [rbp + 0x28], 0x6c
lea rcx, [rbp + 0x12]
call qword [0x140062098]
mov r14, rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078b00]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400791b0]
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x140079080]
movdqu xmmword [rbp - 0x80], xmm0
mov word [rbp - 0x70], 0x6e
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
lea rcx, [rsp + 0x20]
call fcn.140007af0
nop
lea rax, [rsp + 0x79]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14002a2a0
lea rdx, [rsp + 0x79]
lea rcx, [rsp + 0x20]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x20]
call fcn.140006090
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078aa0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140079160]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x140078d90]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x140079070]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [0x140079130]
movdqa xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x50], 0x72
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007af0
nop
lea rax, [rbp - 0x77]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14002a351
lea rdx, [rbp - 0x77]
lea rcx, [rsp + 0x20]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x20]
call fcn.140006090
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078ca0]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140078fb0]
movdqu xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x5365646f
mov dword [rbp - 0x7c], 0x6e697274
mov word [rbp - 0x78], 0x67
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007af0
nop
lea rax, [rsp + 0x75]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002a3f0
lea rdx, [rsp + 0x75]
lea rcx, [rsp + 0x20]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x20]
call fcn.140006090
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078af0]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x140078fa0]
movdqu xmmword [rsp + 0x70], xmm1
mov dword [rbp - 0x80], 0x5365646f
mov dword [rbp - 0x7c], 0x6e697274
mov word [rbp - 0x78], 0x67
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007af0
nop
lea rax, [rsp + 0x75]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002a490
lea rdx, [rsp + 0x75]
lea rcx, [rsp + 0x20]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x20]
call fcn.140006090
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x1400790c0]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [0x1400790d0]
movdqu xmmword [rsp + 0x70], xmm1
mov word [rbp - 0x80], 0x73
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007af0
nop
lea rax, [rsp + 0x71]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002a520
lea rdx, [rsp + 0x71]
lea rcx, [rsp + 0x20]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x20]
call fcn.140006090
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078b50]
movdqu xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [str.NtResumeProcess]
movdqu xmmword [rsp + 0x70], xmm1
lea rax, [rsp + 0x20]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x20]
call fcn.140007af0
nop
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14002a5a5
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x20]
call fcn.140006090
nop
lea rax, [rsp + 0x20]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078e40]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x4464616f
mov dword [rsp + 0x34], 0x65766972
mov word [rsp + 0x38], 0x72
lea rax, [rsp + 0x60]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x60]
call fcn.140007af0
nop
lea rax, [rsp + 0x2d]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14002a633
lea rdx, [rsp + 0x2d]
lea rcx, [rsp + 0x60]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rsi, rax
movdqa xmm0, xmmword [0x140078e60]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x6c6e5574
mov dword [rsp + 0x34], 0x4464616f
mov dword [rsp + 0x38], 0x65766972
mov word [rsp + 0x3c], 0x72
lea rax, [rsp + 0x60]
mov qword [rbp + 0x98], rax
lea rcx, [rsp + 0x60]
call fcn.140007af0
nop
lea rax, [rsp + 0x2f]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14002a6c6
mov r8, rbx
lea rdx, [rsp + 0x2f]
lea rcx, [rsp + 0x60]
call fcn.140007520
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x90], rax
call fcn.140027320
mov rbx, rax
movdqa xmm0, xmmword [0x140079140]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140079120]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x4d6c6175
mov dword [rsp + 0x44], 0x726f6d65
mov word [rsp + 0x48], 0x79
lea rdx, [rsp + 0x35]
lea rcx, [rsp + 0x60]
call fcn.140006120
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x98], rax
call fcn.140027320
mov rbx, rax
movdqa xmm0, xmmword [0x140078eb0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400790a0]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x140078fc0]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x737365
lea rdx, [rsp + 0x3a]
lea rcx, [rsp + 0x60]
call fcn.140006120
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0xa0], rax
call fcn.140027320
mov rbx, rax
movdqa xmm0, xmmword [0x1400790f0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x56746553
mov dword [rsp + 0x34], 0x65756c61
mov dword [rsp + 0x38], 0x79654b
lea rdx, [rsp + 0x2e]
lea rcx, [rsp + 0x60]
call fcn.140006120
nop
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0xa8], rax
call fcn.140027320
mov rbx, rax
movdqa xmm0, xmmword [0x140079040]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [str.DeviceIoControl]
movdqu xmmword [rsp + 0x30], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.140006120
nop
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x38], rax
call fcn.140027320
mov rbx, rax
movdqa xmm0, xmmword [0x140078dd0]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x746e6576
mov word [rsp + 0x34], 0x41
lea rdx, [rsp + 0x2b]
lea rcx, [rsp + 0x60]
call fcn.140006120
nop
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x40], rax
call fcn.140027320
mov rbx, rax
movdqa xmm0, xmmword [0x140078cc0]
movdqu xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [0x1400791a0]
movdqu xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [0x140078fe0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x656d614e
mov word [rbp - 0xc], 0x57
lea rdx, [rbp - 0x25]
lea rcx, [rsp + 0x60]
call fcn.140006120
nop
mov r8, r14
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.140029d30
nop
lea rcx, [rsp + 0x60]
call fcn.140006090
nop
lea rax, [rsp + 0x60]
mov qword [rbp + 0x48], rax
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret