Function at 0x1402151b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
xor eax, eax
mov dword [rsp + 0x40], 0x6d70646b
xor r14d, r14d
mov dword [rsp + 0x44], 0x35356961
mov rdi, rcx
mov dword [rsp + 0x48], 0x67666d26
mov ecx, r14d
mov byte [rsp + 0x4c], al
mov r12, r8
mov r15, rdx
xor byte [rsp + rcx + 0x40], al
inc eax
movsxd rcx, eax
cmp rcx, 0xc
jb 0x140215201
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x140215272
xor eax, eax
mov dword [rsp + 0x50], 0x6d70646b
mov byte [rsp + 0x5c], al
mov rcx, r14
mov dword [rsp + 0x54], 0x35356961
mov dword [rsp + 0x58], 0x67666d26
nop word [rax + rax]
xor byte [rsp + rcx + 0x50], al
inc eax
movsxd rcx, eax
cmp rcx, 0xc
jb 0x140215250
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5c], r14b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r8, rax
movdqa xmm0, xmmword [0x1404cee90]
mov eax, r14d
movdqu xmmword [rbp + 0x10], xmm0
mov rcx, r14
nop word [rax + rax]
xor byte [rbp + rcx + 0x10], al
inc eax
movsxd rcx, eax
cmp rcx, 0xf
jb 0x140215290
lea rdx, [rbp + 0x10]
mov byte [rbp + 0x1f], r14b
mov rcx, r8
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [rsp + 0x40], 0x6d70646b
mov rcx, r14
mov qword [rbp - 0x18], rax
xor eax, eax
mov byte [rsp + 0x4c], al
mov dword [rsp + 0x44], 0x35356961
mov dword [rsp + 0x48], 0x67666d26
nop word [rax + rax]
xor byte [rsp + rcx + 0x40], al
inc eax
movsxd rcx, eax
cmp rcx, 0xc
jb 0x1402152e0
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x140215352
xor eax, eax
mov dword [rsp + 0x50], 0x6d70646b
mov byte [rsp + 0x5c], al
mov rcx, r14
mov dword [rsp + 0x54], 0x35356961
mov dword [rsp + 0x58], 0x67666d26
nop dword [rax]
xor byte [rsp + rcx + 0x50], al
inc eax
movsxd rcx, eax
cmp rcx, 0xc
jb 0x140215330
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x5c], r14b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r8, rax
mov dword [rbp - 0x70], 0x62677343
mov eax, r14d
mov dword [rbp - 0x6c], 0x6e406070
mov rcx, r14
mov dword [rbp - 0x68], 0x4b6c64
nop dword [rax]
xor byte [rbp + rcx - 0x70], al
inc eax
movsxd rcx, eax
cmp rcx, 0xb
jb 0x140215370
lea rdx, [rbp - 0x70]
mov byte [rbp - 0x65], r14b
mov rcx, r8
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [rsp + 0x40], 0x6d70646b
mov rcx, r14
mov rsi, rax
mov qword [rbp + 8], rax
xor eax, eax
mov dword [rsp + 0x44], 0x35356961
mov byte [rsp + 0x4c], al
mov dword [rsp + 0x48], 0x67666d26
nop dword [rax + rax]
xor byte [rsp + rcx + 0x40], al
inc eax
movsxd rcx, eax
cmp rcx, 0xc
jb 0x1402153c0
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x4c], r14b
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov r8, rax
cmp rax, 0xffffffffffffffff
jne 0x140215430
xor eax, eax
mov dword [rbp - 0x80], 0x6d70646b
mov byte [rbp - 0x74], al
mov rcx, r14
mov dword [rbp - 0x7c], 0x35356961
mov dword [rbp - 0x78], 0x67666d26
nop word [rax + rax]
xor byte [rbp + rcx - 0x80], al
inc eax
movsxd rcx, eax
cmp rcx, 0xc
jb 0x140215410
lea rcx, [rbp - 0x80]
mov byte [rbp - 0x74], r14b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov r8, rax
mov dword [rsp + 0x50], 0x706d6d43
mov eax, r14d
mov dword [rsp + 0x54], 0x69674d61
mov rcx, r14
mov dword [rsp + 0x58], 0x6f656c
nop
xor byte [rsp + rcx + 0x50], al
inc eax
movsxd rcx, eax
cmp rcx, 0xb
jb 0x140215450
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x5b], r14b
mov rcx, r8
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [rdi], r14
lea rcx, [rbp + 0x4e8]
mov qword [rbp - 0x80], rax
mov rdx, r15
xor eax, eax
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
mov qword [r15], rax
mov byte [rbp + 0x4e8], al
lea rax, [rbp + 0x4e8]
sub rdx, rax
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1402154a0
xorps xmm0, xmm0
lea rcx, [rbp + 0xa0]
xor edx, edx
mov r8d, 0x100
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
call fcn.1403ccc50
mov ebx, r14d
mov r13, 0xffffffffffffffff
mov dword [rsp + 0x78], ebx
nop dword [rax]
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0xff
call fcn.1403ccc50
movdqa xmm0, xmmword [0x1404d0360]
mov eax, r14d
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0x763475
mov rcx, r14
nop
xor byte [rbp + rcx - 0x60], al
inc eax
movsxd rcx, eax
cmp rcx, 0x13
jb 0x140215530
mov byte [rbp - 0x4d], 0
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rbp + rcx - 0x60]
mov byte [rbp + rcx + 0x1a0], al
lea rcx, [rcx + 1]
test al, al
jne 0x140215550
mov r8d, ebx
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x3a0]
call fcn.140215db0
xor r9d, r9d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
lea rcx, [rbp + 0x3a0]
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call rsi
mov qword [rbp - 8], rax
mov r14, rax
cmp rax, r13
je 0x140215cff
mov ecx, 0x1000
call fcn.1403caeb8
mov ecx, 0x1000
mov qword [rbp - 0x10], rax
mov rsi, rax
call fcn.1403caeb8
xor edx, edx
mov qword [rbp], rax
mov r8d, 0x1000
mov rcx, rsi
call fcn.1403ccc50
xor eax, eax
mov word [rbp + 0x4f8], 0x3131
xor ecx, ecx
mov byte [rbp + 0x4fa], al
xor edx, edx
nop word [rax + rax]
xor byte [rbp + rdx + 0x4f8], cl
inc ecx
movsxd rdx, ecx
cmp rdx, 2
jb 0x140215600
lea rcx, [rbp + 0x4f8]
mov byte [rbp + 0x4fa], al
call fcn.1403d6dc0
movzx ecx, byte [0x1404c9774]
mov byte [rbp + 0x4e8], cl
xor ecx, ecx
mov byte [rbp + 0x4e9], cl
xor edx, edx
nop dword [rax + rax]
xor byte [rbp + rdx + 0x4e8], cl
inc ecx
movsxd rdx, ecx
cmp rdx, 1
jb 0x140215640
mov r8d, eax
mov byte [rbp + 0x4e9], 0
xor edx, edx
lea rcx, [rbp + 0x4e8]
call fcn.1403d6cb0
mov dword [rsp + 0x40], eax
xor eax, eax
mov byte [rsp + 0x5f], al
xor ecx, ecx
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x48], 0
mov word [rsp + 0x5d], 0x3731
nop word [rax + rax]
xor byte [rsp + rcx + 0x5d], al
inc eax
movsxd rcx, eax
cmp rcx, 2
jb 0x140215690
lea rcx, [rsp + 0x5d]
mov byte [rsp + 0x5f], 0
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rsp + 0x69], 0x36327930
mov byte [rsp + 0x6f], cl
xor edx, edx
mov word [rsp + 0x6d], 0x3534
nop word [rax + rax]
xor byte [rsp + rdx + 0x69], cl
inc ecx
movsxd rdx, ecx
cmp rdx, 6
jb 0x1402156d0
mov r8d, eax
mov byte [rsp + 0x6f], 0
xor edx, edx
lea rcx, [rsp + 0x69]
call fcn.1403d6cb0
mov qword [rsp + 0x38], 0
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
or eax, 0xb4000
mov dword [rsp + 0x28], 0x1000
shl eax, 2
mov r9d, 0xc
mov edx, eax
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [rbp - 0x18]
test al, al
je 0x140215cfb
mov eax, dword [rsi + 0x1c]
cmp eax, 0xf
ja 0x14021574b
mov ecx, 0xf181
bt ecx, eax
jb 0x140215ce4
xor eax, eax
mov word [rsp + 0x60], 0x3131
xor ebx, ebx
mov qword [rsp + 0x40], rax
mov ecx, ebx
mov dword [rsp + 0x48], eax
mov byte [rsp + 0x62], al
nop word [rax + rax]
xor byte [rsp + rcx + 0x60], al
inc eax
movsxd rcx, eax
cmp rcx, 2
jb 0x140215770
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x62], bl
call fcn.1403d6dc0
xor ecx, ecx
mov word [rsp + 0x63], 0x3635
mov byte [rsp + 0x65], cl
mov rdx, rbx
nop dword [rax]
xor byte [rsp + rdx + 0x63], cl
inc ecx
movsxd rdx, ecx
cmp rdx, 2
jb 0x1402157a0
mov r8d, eax
mov byte [rsp + 0x65], bl
xor edx, edx
lea rcx, [rsp + 0x63]
call fcn.1403d6cb0
mov dword [rsp + 0x40], eax
mov rcx, rbx
xor eax, eax
mov dword [rsp + 0x44], ebx
mov byte [rsp + 0x68], al
mov byte [rsp + 0x48], bl
mov word [rsp + 0x66], 0x3731
nop
xor byte [rsp + rcx + 0x66], al
inc eax
movsxd rcx, eax
cmp rcx, 2
jb 0x1402157e0
lea rcx, [rsp + 0x66]
mov byte [rsp + 0x68], bl
call fcn.1403d6dc0
xor ecx, ecx
mov dword [rsp + 0x70], 0x36327930
mov byte [rsp + 0x76], cl
mov rdx, rbx
mov word [rsp + 0x74], 0x3534
nop word [rax + rax]
xor byte [rsp + rdx + 0x70], cl
inc ecx
movsxd rdx, ecx
cmp rdx, 6
jb 0x140215820
mov r8d, eax
mov byte [rsp + 0x76], bl
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1403d6cb0
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x40]
mov rbx, qword [rbp]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
or eax, 0xb4000
shl eax, 2
mov r9d, 0xc
mov edx, eax
mov dword [rsp + 0x28], 0x1000
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [rbp - 0x18]
test al, al
je 0x140215b05
lea rdx, [rbx + 8]
mov r8, r13
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140215890
lea rcx, [rbp + 0xa0]
call fcn.1403cc5a0
xor edx, edx
lea rcx, [rbp + 0x2a0]
mov r8d, 0x100
call fcn.1403ccc50
lea rax, [rbp + 0xa0]
mov r9, r13
inc r9
cmp word [rax + r9*2], 0
jne 0x1402158c5
xor ebx, ebx
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x38], rbx
lea r8, [rbp + 0xa0]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], 0x100
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp + rcx + 0x2a0]
mov byte [rbp + rcx + 0x20], al
lea rcx, [rcx + 1]
test al, al
jne 0x140215910
lea rdx, [rbp + 0x20]
mov qword [rbp - 0x38], rbx
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], 0xf
call fcn.14013eec4
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x60]
call fcn.140214f30
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x140215a1b
xor eax, eax
lea r14, [rbp - 0x60]
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
cmp qword [rbp - 0x48], 0x10
mov rsi, qword [rbp - 0x50]
cmovae r14, qword [rbp - 0x60]
cmp rsi, 0x10
jae 0x14021598d
movups xmm0, xmmword [r14]
lea edi, [rax + 0xf]
movups xmmword [rbx], xmm0
jmp 0x1402159fd
movabs rcx, 0x7fffffffffffffff
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
cmova rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1402159e1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140215d94
mov rcx, rax
call fcn.1403caaf4
mov rcx, rax
test rax, rax
je 0x140215d9a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1402159eb
test rcx, rcx
je 0x1402159eb
call fcn.1403caaf4
lea r8, [rsi + 1]
mov qword [rbx], rax
mov rdx, r14
mov rcx, rax
call fcn.1403cc5a0
mov r14, qword [rbp - 8]
mov qword [rbx + 0x10], rsi
mov rsi, qword [rbp - 0x10]
mov qword [rbx + 0x18], rdi
mov rdi, qword [rbp + 0x4e0]
add qword [rdi + 8], 0x20
jmp 0x140215a2a
lea r8, [rbp - 0x60]
mov rdx, rbx
mov rcx, rdi
call fcn.140195064
mov r9, qword [rbp - 0x48]
lea r8, [rbp - 0x60]
lea rcx, [r15 - 1]
cmp r9, 0x10
jb 0x140215ab6
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215a40
mov r8, qword [rbp - 0x60]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215a50
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215a64
xor edx, edx
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215a70
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140215aa9
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140215d9a
mov rcx, r8
call fcn.1403cad84
jmp 0x140215ce0
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215ab6
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215ad0
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215ae4
xor edx, edx
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215af0
jmp 0x140215ce0
mov edx, dword [rsi + 0x18]
lea rcx, [rbp - 0x60]
xor eax, eax
mov qword [rbp - 0x48], 0xf
add rdx, rsi
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rax
call fcn.14013eec4
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x38]
call fcn.140214f30
mov rbx, qword [rdi + 8]
cmp rbx, qword [rdi + 0x10]
je 0x140215c00
xor eax, eax
lea r14, [rbp - 0x38]
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
cmp qword [rbp - 0x20], 0x10
mov rsi, qword [rbp - 0x28]
cmovae r14, qword [rbp - 0x38]
cmp rsi, 0x10
jae 0x140215b72
movups xmm0, xmmword [r14]
lea edi, [rax + 0xf]
movups xmmword [rbx], xmm0
jmp 0x140215be2
movabs rcx, 0x7fffffffffffffff
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
cmova rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140215bc6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140215da0
mov rcx, rax
call fcn.1403caaf4
mov rcx, rax
test rax, rax
je 0x140215d8e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140215bd0
test rcx, rcx
je 0x140215bd0
call fcn.1403caaf4
lea r8, [rsi + 1]
mov qword [rbx], rax
mov rdx, r14
mov rcx, rax
call fcn.1403cc5a0
mov r14, qword [rbp - 8]
mov qword [rbx + 0x10], rsi
mov rsi, qword [rbp - 0x10]
mov qword [rbx + 0x18], rdi
mov rdi, qword [rbp + 0x4e0]
add qword [rdi + 8], 0x20
jmp 0x140215c0f
lea r8, [rbp - 0x38]
mov rdx, rbx
mov rcx, rdi
call fcn.140195064
mov r9, qword [rbp - 0x20]
lea r8, [rbp - 0x38]
lea rcx, [r15 - 1]
cmp r9, 0x10
jb 0x140215ca3
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215c25
mov r8, qword [rbp - 0x38]
xor edx, edx
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215c40
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215c54
xor edx, edx
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215c60
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x140215c99
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140215d8e
mov rcx, r8
call fcn.1403cad84
jmp 0x140215ce0
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215ca3
xor edx, edx
nop
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215cb0
lea rcx, [r15 - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140215cc4
xor edx, edx
movzx eax, byte [r12 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140215cd0
mov ebx, dword [rsp + 0x78]
mov rcx, rsi
call fcn.1403cad84
mov rcx, qword [rbp]
call fcn.1403cad84
mov rcx, r14
call qword [rbp - 0x80]
mov rsi, qword [rbp + 8]
inc ebx
mov dword [rsp + 0x78], ebx
cmp ebx, 0x10
jge 0x140215d12
xor r14d, r14d
jmp 0x140215500
inc r13
cmp byte [r15 + r13], 0
jne 0x140215d12
test r13d, r13d
jle 0x140215d2c
movsxd rax, r13d
mov byte [rax + r15 - 1], 0
jmp 0x140215d70
mov byte [rbp + 0x4e0], 0
dec r15
nop word [rax + rax]
cmp byte [r15 + 1], 0
lea r15, [r15 + 1]
jne 0x140215d40
lea rdx, [rbp + 0x4e0]
xor ecx, ecx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [r15 + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140215d60
mov rbx, qword [rsp + 0x5f0]
mov rax, rdi
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403d7020
int3
call fcn.1401391d8
int3
call fcn.1403d7020
int3
call fcn.1401391d8
int3