Function at 0x140182d14
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
xor eax, eax
mov dword [rbp - 9], 0x1e001c
xor esi, esi
mov dword [rbp - 0x39], 0x45005c
mov ecx, esi
mov dword [rbp - 0x35], 0x750067
mov dword [rbp - 0x31], 0x66006d
mov dword [rbp - 0x2d], 0x5b0063
mov dword [rbp - 0x29], 0x7a0043
mov dword [rbp - 0x25], 0x68006f
mov dword [rbp - 0x21], 0x490048
mov word [rbp - 0x1d], ax
movsxd rax, ecx
xor word [rbp + rax*2 - 0x39], cx
inc ecx
cmp ecx, 0xe
jb 0x140182d69
lea rax, [rbp - 0x39]
mov dword [rbp + 7], 0x30
mov qword [rbp - 1], rax
mov ecx, esi
xor eax, eax
mov qword [rbp + 0xf], rsi
mov byte [rbp + 0x69], al
mov word [rbp + 0x67], 0x3731
movsxd rax, ecx
xor byte [rbp + rax + 0x67], cl
inc ecx
cmp ecx, 2
jb 0x140182d98
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x69], sil
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x59], 0x33327930
xor eax, eax
mov dword [rbp - 0x55], 0x37363534
mov byte [rbp - 0x4f], al
mov ecx, esi
mov word [rbp - 0x51], 0x393c
movsxd rax, ecx
xor byte [rbp + rax - 0x59], cl
inc ecx
cmp ecx, 0xa
jb 0x140182dd1
xor edx, edx
mov byte [rbp - 0x4f], sil
lea rcx, [rbp - 0x59]
call fcn.1403d6cb0
mov dword [rbp + 0x1f], eax
xorps xmm0, xmm0
lea rax, [rbp - 9]
mov word [rbp + 0x67], 0x3731
mov qword [rbp + 0x17], rax
mov ecx, esi
xor eax, eax
mov byte [rbp + 0x69], al
movdqu xmmword [rbp + 0x27], xmm0
movsxd rax, ecx
xor byte [rbp + rax + 0x67], cl
inc ecx
cmp ecx, 2
jb 0x140182e0e
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x69], sil
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x49], 0x33327930
xor eax, eax
mov dword [rbp - 0x45], 0x37363534
mov byte [rbp - 0x3f], al
mov ecx, esi
mov word [rbp - 0x41], 0x393a
movsxd rax, ecx
xor byte [rbp + rax - 0x49], cl
inc ecx
cmp ecx, 0xa
jb 0x140182e47
xor edx, edx
mov byte [rbp - 0x3f], sil
lea rcx, [rbp - 0x49]
call fcn.1403d6cb0
mov edi, eax
mov word [rbp + 0x6f], 0x3731
xor eax, eax
mov edx, esi
mov byte [rbp + 0x71], al
movsxd rcx, edx
xor byte [rbp + rcx + 0x6f], dl
inc edx
cmp edx, 2
jb 0x140182e73
lea rcx, [rbp + 0x6f]
mov byte [rbp + 0x71], sil
call fcn.1403d6dc0
mov edx, esi
mov dword [rbp + 0x7f], 0x357930
movsxd rcx, edx
xor byte [rbp + rcx + 0x7f], dl
inc edx
cmp edx, 3
jb 0x140182e97
mov r8d, eax
mov byte [rbp + 0x82], sil
xor edx, edx
lea rcx, [rbp + 0x7f]
call fcn.1403d6cb0
mov ebx, eax
mov word [rbp + 0x77], 0x3731
xor eax, eax
mov edx, esi
mov byte [rbp + 0x79], al
movsxd rcx, edx
xor byte [rbp + rcx + 0x77], dl
inc edx
cmp edx, 2
jb 0x140182ec9
lea rcx, [rbp + 0x77]
mov byte [rbp + 0x79], sil
call fcn.1403d6dc0
mov r8d, eax
mov dword [rbp - 0x59], 0x33337930
xor eax, eax
mov dword [rbp - 0x55], 0x34363534
mov byte [rbp - 0x51], al
mov ecx, esi
movsxd rax, ecx
xor byte [rbp + rax - 0x59], cl
inc ecx
cmp ecx, 8
jb 0x140182efc
xor edx, edx
mov byte [rbp - 0x51], sil
lea rcx, [rbp - 0x59]
call fcn.1403d6cb0
lea r9, [rbp - 0x39]
mov dword [rsp + 0x28], edi
lea r8, [rbp + 7]
mov dword [rsp + 0x20], ebx
mov edx, eax
lea rcx, [0x140548a18]
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov ecx, dword [0x140548de8]
lea r8, [rbp - 0x19]
mov qword [rbp - 0x11], rsi
lea rdx, [rbp - 0x49]
mov qword [rbp - 0x19], 1
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x49], xmm0
call fcn.140194ee8
xor eax, eax
mov word [rbp + 0x67], 0x3731
mov byte [rbp + 0x69], al
mov ecx, esi
movsxd rax, ecx
xor byte [rbp + rax + 0x67], cl
inc ecx
cmp ecx, 2
jb 0x140182f6d
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x69], sil
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rbp + 0x6f], 0x40437930
mov byte [rbp + 0x75], cl
mov edx, esi
mov word [rbp + 0x73], 0x4047
movsxd rcx, edx
xor byte [rbp + rcx + 0x6f], dl
inc edx
cmp edx, 6
jb 0x140182f9c
mov r8d, eax
mov byte [rbp + 0x75], sil
xor edx, edx
lea rcx, [rbp + 0x6f]
call fcn.1403d6cb0
movsxd rcx, eax
cmp qword [rbp - 0x19], rcx
sete al
add rsp, 0xc0
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret