Function at 0x1401e32a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
xor ebx, ebx
mov dword [rsp + 0x50], 0x580053
mov qword [rcx], rbx
mov r15, rcx
mov qword [rcx + 8], rbx
mov qword [rcx + 0x10], rbx
mov ecx, ebx
mov dword [rsp + 0x54], 0x570051
mov dword [rsp + 0x58], 0x480041
mov dword [rsp + 0x5c], 0x44005a
mov dword [rsp + 0x60], 0x7b007d
mov dword [rsp + 0x64], 0x6e0078
mov dword [rsp + 0x68], 0x790062
mov dword [rsp + 0x6c], 0x60004d
mov dword [rsp + 0x70], 0x65007e
mov dword [rsp + 0x74], 0x7c0060
mov dword [rsp + 0x78], 0x460078
mov dword [rsp + 0x7c], 0x630073
mov dword [rbp - 0x80], 0x5c0044
mov dword [rbp - 0x7c], 0x6e0074
mov dword [rbp - 0x78], 0x410071
mov dword [rbp - 0x74], 0x4c004b
mov dword [rbp - 0x70], 0x720062
mov dword [rbp - 0x6c], 0x6c0076
mov dword [rbp - 0x68], 0x76
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0x25
jb 0x1401e3370
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x60]
mov word [rbp - 0x66], bx
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x60], rbx
call fcn.14013edcc
cmp qword [rbp - 0x48], 8
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x40], rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rsi, rbx
lea rcx, [rbp - 0x60]
test eax, eax
cmove rsi, qword [rbp + 0x40]
mov qword [rbp + 0x40], rsi
call fcn.14013ed68
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x40]
call fcn.1401de5b0
mov r13, qword [rbp - 0x40]
mov r14d, 0x80000000
cmp r13, qword [rbp - 0x38]
je 0x1401e36b6
xor eax, eax
mov dword [rsp + 0x50], 0x580053
mov word [rbp - 0x64], ax
mov ecx, ebx
mov dword [rsp + 0x54], 0x570051
mov dword [rsp + 0x58], 0x480041
mov dword [rsp + 0x5c], 0x44005a
mov dword [rsp + 0x60], 0x7b007d
mov dword [rsp + 0x64], 0x6e0078
mov dword [rsp + 0x68], 0x790062
mov dword [rsp + 0x6c], 0x60004d
mov dword [rsp + 0x70], 0x65007e
mov dword [rsp + 0x74], 0x7c0060
mov dword [rsp + 0x78], 0x460078
mov dword [rsp + 0x7c], 0x630073
mov dword [rbp - 0x80], 0x5c0044
mov dword [rbp - 0x7c], 0x6e0074
mov dword [rbp - 0x78], 0x410071
mov dword [rbp - 0x74], 0x4c004b
mov dword [rbp - 0x70], 0x720062
mov dword [rbp - 0x6c], 0x6c0076
mov dword [rbp - 0x68], 0x790076
nop word [rax + rax]
movsxd rax, ecx
xor word [rsp + rax*2 + 0x50], cx
inc ecx
cmp ecx, 0x26
jb 0x1401e34c0
lea rdx, [rsp + 0x50]
mov word [rbp - 0x64], bx
lea rcx, [rbp - 0x60]
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 7
call fcn.14013edcc
cmp qword [r13 + 0x18], 8
mov rdx, r13
jb 0x1401e34ff
mov rdx, qword [r13]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bx
jne 0x1401e3506
lea rcx, [rbp - 0x60]
call fcn.14013ec14
cmp qword [rbp - 0x48], 8
lea rax, [rbp + 0x40]
mov qword [rsp + 0x40], rbx
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
mov qword [rbp + 0x40], rbx
call qword [sym.imp.advapi32.dll_RegCreateKeyExW]
mov rdi, rbx
lea rdx, [rbp - 0x28]
test eax, eax
lea rcx, [rbp + 0x40]
cmove rdi, qword [rbp + 0x40]
mov qword [rbp + 0x40], rdi
call fcn.1401de5b0
mov r14, qword [rbp - 0x28]
mov r12, qword [rbp - 0x20]
cmp r14, r12
je 0x1401e362c
nop dword [rax]
call fcn.140141104
mov r8, r14
lea rdx, [rbp - 0x10]
call fcn.1401a5760
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x1401e35d9
mov qword [rdx], rbx
mov qword [rdx + 0x10], rbx
mov qword [rdx + 0x18], rbx
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], rbx
mov byte [rax], bl
mov qword [rax + 0x18], 0xf
add qword [r15 + 8], 0x20
jmp 0x1401e35e4
mov r8, rax
mov rcx, r15
call fcn.1401a6e50
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x1401e361f
mov rcx, qword [rbp - 0x10]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401e361a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401e374c
call fcn.1403cad84
add r14, 0x20
cmp r14, r12
jne 0x1401e3590
mov r14d, 0x80000000
test rdi, rdi
je 0x1401e3668
lea rax, [rdi + r14]
cmp rax, 5
jbe 0x1401e3665
cmp rdi, 0xffffffff80000007
je 0x1401e3665
cmp rdi, 0xffffffff80000060
je 0x1401e3665
cmp rdi, 0xffffffff80000050
je 0x1401e3665
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rdi, rbx
lea rcx, [rbp - 0x28]
call fcn.140194884
test rdi, rdi
je 0x1401e36a4
lea rax, [rdi + r14]
cmp rax, 5
jbe 0x1401e36a4
cmp rdi, 0xffffffff80000007
je 0x1401e36a4
cmp rdi, 0xffffffff80000060
je 0x1401e36a4
cmp rdi, 0xffffffff80000050
je 0x1401e36a4
mov rcx, rdi
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea rcx, [rbp - 0x60]
call fcn.14013ed68
add r13, 0x20
jmp 0x1401e3414
test rsi, rsi
je 0x1401e36ec
lea rax, [rsi + r14]
cmp rax, 5
jbe 0x1401e36e9
cmp rsi, 0xffffffff80000007
je 0x1401e36e9
cmp rsi, 0xffffffff80000060
je 0x1401e36e9
cmp rsi, 0xffffffff80000050
je 0x1401e36e9
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rsi, rbx
lea rcx, [rbp - 0x40]
call fcn.140194884
test rsi, rsi
je 0x1401e3728
lea rax, [rsi + r14]
cmp rax, 5
jbe 0x1401e3728
cmp rsi, 0xffffffff80000007
je 0x1401e3728
cmp rsi, 0xffffffff80000060
je 0x1401e3728
cmp rsi, 0xffffffff80000050
je 0x1401e3728
mov rcx, rsi
call qword [sym.imp.advapi32.dll_RegCloseKey]
lea r11, [rsp + 0x110]
mov rax, r15
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1403d7020
int3