Function at 0x1401a8570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, rcx
mov ecx, 4
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
xor r14d, r14d
mov eax, dword [rcx + rdx]
cmp dword [0x1402d0b9c], eax
jle 0x1401a880e
lea rcx, [0x1402d0b9c]
call fcn.14027b540
or rbx, 0xffffffffffffffff
cmp dword [0x1402d0b9c], ebx
jne 0x1401a880e
lea rax, [rbp - 0x19]
mov qword [rbp + 0x77], rax
mov dword [rbp - 0x5d], 0x21
mov byte [rbp - 0x59], 0x6f
mov byte [rbp - 0x58], 0x55
mov byte [rbp - 0x57], 0x70
mov byte [rbp - 0x56], 0x54
mov byte [rbp - 0x55], 0x44
mov byte [rbp - 0x54], 0x53
mov byte [rbp - 0x53], 0x58
mov byte [rbp - 0x52], 0x72
mov byte [rbp - 0x51], 0x58
mov byte [rbp - 0x50], 0x52
mov byte [rbp - 0x4f], 0x55
mov byte [rbp - 0x4e], 0x44
mov byte [rbp - 0x4d], 0x4c
mov byte [rbp - 0x4c], 0x68
mov byte [rbp - 0x4b], 0x4f
mov byte [rbp - 0x4a], 0x47
mov byte [rbp - 0x49], 0x4e
mov byte [rbp - 0x48], 0x53
mov byte [rbp - 0x47], 0x4c
mov byte [rbp - 0x46], 0x40
mov byte [rbp - 0x45], 0x55
mov byte [rbp - 0x44], 0x48
mov byte [rbp - 0x43], 0x4e
mov byte [rbp - 0x42], 0x4f
xor eax, eax
mov byte [rbp - 0x41], al
mov al, byte [rbp - 0x59]
mov edx, r14d
mov al, byte [rbp + rdx - 0x59]
mov ecx, dword [rbp - 0x5d]
xor cl, al
mov byte [rbp + rdx - 0x59], cl
inc rdx
cmp rdx, 0x18
jb 0x1401a864d
mov byte [rbp - 0x41], r14b
mov qword [rbp - 0x19], r14
mov qword [rbp - 9], r14
mov r15d, 0xf
mov qword [rbp - 1], r15
lea rax, [rbp - 0x59]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], r14b
jne 0x1401a8680
lea rcx, [rbp - 0x19]
cmp rdi, r15
ja 0x1401a86aa
mov qword [rbp - 9], rdi
mov r8, rdi
lea rdx, [rbp - 0x59]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rdi - 0x19], r14b
jmp 0x1401a86b7
lea r9, [rbp - 0x59]
mov rdx, rdi
call fcn.1400ada10
nop
mov dword [rbp - 0x69], 0x17
mov eax, dword [rbp - 0x69]
xor al, 0x6e
mov byte [rbp - 0x65], al
mov eax, dword [rbp - 0x69]
inc al
xor al, 0x74
mov byte [rbp - 0x64], al
mov eax, dword [rbp - 0x69]
add al, 2
xor al, 0x64
mov byte [rbp - 0x63], al
mov eax, dword [rbp - 0x69]
add al, 3
xor al, 0x6c
mov byte [rbp - 0x62], al
mov eax, dword [rbp - 0x69]
add al, 4
xor al, 0x6c
mov byte [rbp - 0x61], al
xor eax, eax
mov byte [rbp - 0x60], al
mov al, byte [rbp - 0x65]
mov rdx, r14
mov al, byte [rbp + rdx - 0x65]
mov ecx, dword [rbp - 0x69]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x65], cl
inc rdx
cmp rdx, 5
jb 0x1401a86f9
mov byte [rbp - 0x60], r14b
mov qword [rbp - 0x39], r14
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r15
mov byte [rbp - 0x39], r14b
lea rax, [rbp - 0x65]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1401a8729
lea rcx, [rbp - 0x39]
cmp rbx, r15
ja 0x1401a8753
mov qword [rbp - 0x29], rbx
mov r8, rbx
lea rdx, [rbp - 0x65]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rbx - 0x39], r14b
jmp 0x1401a8760
lea r9, [rbp - 0x65]
mov rdx, rbx
call fcn.1400ada10
nop
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0xf]
call fcn.1401a82ac
nop
mov qword [rsp + 0x20], r14
mov r9b, 1
lea r8, [rbp - 0x19]
mov rdx, rax
lea rcx, [0x1402d0c90]
call fcn.1401dc5e8
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 0x10
jb 0x1401a87c8
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a87c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401a87c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r15
mov byte [rbp - 0x39], r14b
xor edx, edx
lea r8d, [rdx + 6]
lea rcx, [rbp - 0x65]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0x19]
lea rcx, [rbp - 0x59]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x14028ee8c]
call fcn.14027b36c
nop
lea rcx, [0x1402d0b9c]
call fcn.14027b4e0
mov rbx, qword [rsi + 8]
lea r15, [0x1402d0ca8]
test rbx, rbx
jne 0x1401a8839
mov edx, dword [rsi + 0x10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov qword [rsi + 8], rax
test rax, rax
je 0x1401a88c9
mov dword [rbp + 0x6f], r14d
mov edi, dword [rsi + 0x10]
mov rcx, r15
cmp qword [0x1402d0cc0], 0x10
cmovae rcx, qword [0x1402d0ca8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1401a8889
mov rcx, r15
cmp qword [0x1402d0cc0], 0x10
cmovae rcx, qword [0x1402d0ca8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402d0ca0], rax
mov r8, rax
mov rdx, r15
call fcn.1400bc1a0
mov rax, qword [0x1402d0c98]
lea r9, [rbp + 0x6f]
mov r8d, edi
mov rdx, rbx
mov ecx, 5
call rax
cmp eax, 0xc0000004
jne 0x1401a88cf
mov eax, dword [rbp + 0x6f]
add eax, 0xfa0
mov dword [rsi + 0x10], eax
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi + 8], r14
mov rbx, r14
jmp 0x1401a8819
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret