Function at 0x1400043b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14016e010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov dword [rbp - 0x29], 0x67626153
mov eax, ebx
mov dword [rbp - 0x25], 0x60666064
mov cl, 0x53
mov dword [rbp - 0x21], 0x676b62
nop dword [rax + rax]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 0xa
jae 0x140004403
movzx ecx, byte [rbp - 0x29]
jmp 0x1400043f0
mov ecx, 0x3e
mov byte [rbp - 0x1e], bl
lea r9, [rbp - 0x28]
call fcn.140004340
movzx r8d, byte [rbp - 0x28]
mov r10, rax
cmp r8b, 0x30
jl 0x14000444e
cmp r8b, 0x39
jg 0x14000444e
mov ecx, 0x630
call fcn.140004340
imul eax, r10d
inc r9
movsx r10d, r8b
add r10d, 0xffffffd0
movzx r8d, byte [r9]
add r10d, eax
cmp r8b, 0x30
jge 0x140004422
movsxd rax, r10d
mov dword [rbp - 0x29], 0x363f3706
mov word [rbp - 0x25], 0x3732
mov ecx, dword [rax]
xor eax, eax
mov dword [0x14045dbc8], ecx
mov cl, 6
mov byte [rbp - 0x23], al
nop dword [rax]
xor byte [rbp + rax - 0x28], cl
inc rax
cmp rax, 5
jae 0x140004483
movzx ecx, byte [rbp - 0x29]
jmp 0x140004470
mov ecx, 0x3e
mov byte [rbp - 0x23], bl
lea r9, [rbp - 0x28]
call fcn.140004340
movzx r8d, byte [rbp - 0x28]
mov r10, rax
cmp r8b, 0x30
jl 0x1400044ce
cmp r8b, 0x39
jg 0x1400044ce
mov ecx, 0x630
call fcn.140004340
imul eax, r10d
inc r9
movsx r10d, r8b
add r10d, 0xffffffd0
movzx r8d, byte [r9]
add r10d, eax
cmp r8b, 0x30
jge 0x1400044a2
cmp dword [0x14045dbc8], r10d
jb 0x14000470f
movzx eax, word [0x140163b16]
mov ecx, 0x68
xor ax, cx
mov dword [rbp - 0x11], 0x1f0068
mov word [rbp + 7], ax
movzx eax, word [0x140163b18]
xor ax, cx
mov dword [rbp - 0xd], 0x60001
mov word [rbp + 9], ax
movzx eax, word [0x140163b1a]
xor ax, cx
mov dword [rbp - 9], 0x5a005b
mov word [rbp + 0xb], ax
movzx eax, word [0x140163b1c]
xor ax, cx
mov dword [rbp - 5], 0x46001d
mov word [rbp + 0xd], ax
movzx eax, word [0x140163b1e]
xor ax, cx
mov dword [rbp - 1], 0x4000c
mov word [rbp + 0xf], ax
movzx eax, word [0x140163b20]
xor ax, cx
mov dword [rbp + 3], 0x680004
mov word [rbp + 0x11], ax
movzx eax, word [0x140163b22]
xor ax, cx
mov word [rbp + 0x13], ax
movzx eax, word [0x140163b24]
xor ax, cx
mov word [rbp + 0x15], ax
movzx eax, word [0x140163b26]
xor ax, cx
mov word [rbp + 0x17], ax
movzx eax, word [0x140163b28]
xor ax, cx
mov word [rbp + 0x19], ax
xor eax, eax
mov word [rbp + 0x1b], ax
nop dword [rax]
xor word [rbp + rax*2 - 0xf], cx
inc rax
cmp rax, 0x15
jae 0x1400045b4
movzx ecx, word [rbp - 0x11]
jmp 0x1400045a0
lea rcx, [rbp - 0xf]
mov word [rbp + 0x1b], bx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
test rax, rax
jne 0x1400046ba
lea ecx, [rax + 0x44]
mov dword [rbp + 0x1f], 0x330044
movzx eax, word [0x140163b16]
xor ax, cx
mov dword [rbp + 0x23], 0x2a002d
mov word [rbp + 0x37], ax
movzx eax, word [0x140163b18]
xor ax, cx
mov dword [rbp + 0x27], 0x760077
mov word [rbp + 0x39], ax
movzx eax, word [0x140163b1a]
xor ax, cx
mov dword [rbp + 0x2b], 0x6a0031
mov word [rbp + 0x3b], ax
movzx eax, word [0x140163b1c]
xor ax, cx
mov dword [rbp + 0x2f], 0x280020
mov word [rbp + 0x3d], ax
movzx eax, word [0x140163b1e]
xor ax, cx
mov dword [rbp + 0x33], 0x440028
mov word [rbp + 0x3f], ax
movzx eax, word [0x140163b20]
xor ax, cx
mov word [rbp + 0x41], ax
movzx eax, word [0x140163b22]
xor ax, cx
mov word [rbp + 0x43], ax
movzx eax, word [0x140163b24]
xor ax, cx
mov word [rbp + 0x45], ax
movzx eax, word [0x140163b26]
xor ax, cx
mov word [rbp + 0x47], ax
movzx eax, word [0x140163b28]
xor ax, cx
mov word [rbp + 0x49], ax
xor eax, eax
mov word [rbp + 0x4b], ax
nop dword [rax]
xor word [rbp + rax*2 + 0x21], cx
inc rax
cmp rax, 0x15
jae 0x1400046a4
movzx ecx, word [rbp + 0x1f]
jmp 0x140004690
lea rcx, [rbp + 0x21]
mov word [rbp + 0x4b], bx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
test rax, rax
je 0x14000470f
movdqa xmm0, xmmword [0x1401640c0]
xor eax, eax
movdqu xmmword [rbp - 0x29], xmm0
mov byte [rbp - 0x17], al
mov word [rbp - 0x19], 0x7167
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x29]
xor byte [rbp + rbx - 0x28], al
inc rbx
cmp rbx, 0x11
jb 0x1400046e0
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x17], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000470f
mov qword [0x14045dc10], rax
mov al, 1
jmp 0x140004711
xor al, al
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14000b980
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret