Function at 0x1401a8e90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x390]
sub rsp, 0x490
xor edx, edx
lea rcx, [rbp + 0x190]
mov r8d, 0x1fe
call fcn.1403ccc50
call fcn.140141104
lea rdx, [rbp + 0x190]
call fcn.1401a5d30
call fcn.140141104
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rbp + 0x190]
xor edi, edi
lea rcx, [rsp + 0x50]
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rbp + 0x3a0], rdi
mov qword [rsp + 0x50], rdi
call fcn.14013edcc
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.shlwapi.dll_PathGetDriveNumberW]
mov edx, eax
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.shlwapi.dll_PathBuildRootW]
movzx eax, word [rbp + 0x3a0]
mov ecx, edi
mov qword [rbp + 0x3a8], rdi
mov word [rbp + 0x3a8], ax
movzx eax, word [rbp + 0x3a2]
mov word [rbp + 0x3aa], ax
nop dword [rax]
movzx eax, word [rbp + rcx + 0x3a8]
mov word [rbp + rcx + 0x3a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1401a8f50
movdqa xmm0, xmmword [0x1404cec10]
lea rdx, [rbp + 0x3a0]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
movdqu xmmword [rbp - 0x80], xmm0
call fcn.14013edcc
lea rcx, [rsp + 0x50]
call fcn.14013ed68
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x1fe
call fcn.1403ccc50
xor eax, eax
mov dword [rsp + 0x40], 0x5d005c
mov word [rsp + 0x48], ax
mov ecx, edi
mov dword [rsp + 0x44], 0x5f002c
movsxd rax, ecx
xor word [rsp + rax*2 + 0x40], cx
inc ecx
cmp ecx, 4
jb 0x1401a8fc0
lea rcx, [rbp - 0x70]
mov word [rsp + 0x48], di
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1401a8fe0
lea r8, [rsp + 0x40]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1401a9000
cmp qword [rbp - 0x78], 8
lea r8, [rsp + 0x70]
lea rcx, [rbp - 0x70]
cmovae r8, qword [rsp + 0x70]
sub rcx, 2
nop word [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x1401a9030
xor edx, edx
nop dword [rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1401a9040
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
lea rcx, [rbp - 0x70]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.kernel32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1401a9195
call fcn.140141298
movdqa xmm0, xmmword [0x1404cf920]
mov ecx, edi
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x46327466
mov dword [rsp + 0x64], 0x73365747
mov dword [rsp + 0x68], 0x7e6c706a
mov word [rsp + 0x6c], 0x32
nop
movsxd rax, ecx
xor byte [rsp + rax + 0x50], cl
inc ecx
cmp ecx, 0x1d
jb 0x1401a90c0
xor eax, eax
mov byte [rsp + 0x6d], dil
mov byte [rbp + 0x3a6], al
mov ecx, edi
mov dword [rbp + 0x3a0], 0x67636e4c
mov word [rbp + 0x3a4], 0x7761
movsxd rax, ecx
xor byte [rbp + rax + 0x3a0], cl
inc ecx
cmp ecx, 6
jb 0x1401a90f0
mov byte [rbp + 0x3a6], dil
call fcn.140141298
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x3a0]
call fcn.14019d8a0
call fcn.140140f70
lea rcx, [rax + 0x42d0]
call fcn.140182638
test al, al
jne 0x1401a9195
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x2d4808
mov qword [rsp + 0x20], rdi
mov rcx, rbx
mov dword [rbp + 0x3a0], edi
call qword [sym.imp.kernel32.dll_DeviceIoControl]
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov edx, 0x90020
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.kernel32.dll_DeviceIoControl]
lea rcx, [rsp + 0x70]
call fcn.14013ed68
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret