Function at 0x14001ef20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
xor ebx, ebx
mov dword [rbp - 0x19], 0x2f3c2f3f
mov edx, ebx
mov dword [rbp - 0x15], 0x2f182f17
mov dword [rbp - 0x11], 0x2f1a2f19
mov esi, 0x2f35
mov dword [rbp - 0xd], 0x2f532f7c
mov dword [rbp - 9], 0x2f502f54
mov dword [rbp - 5], 0x2f602f58
mov dword [rbp - 1], 0x2f242f0e
mov dword [rbp + 3], 0x2f282f25
mov dword [rbp + 7], 0x2f282f2c
mov dword [rbp + 0xb], 0x2f682f22
mov dword [rbp + 0xf], 0x2f252f0f
mov dword [rbp + 0x13], 0x2f6c2f39
mov dword [rbp + 0x17], 0x2f6e2f0c
mov dword [rbp + 0x1b], 0x2f352f1c
mov dword [rbp + 0x1f], 0x2f3d2f32
mov dword [rbp + 0x23], 0x2f302f3d
mov dword [rbp + 0x27], 0x2f782f7b
mov dword [rbp + 0x2b], 0x2f782f79
mov dword [rbp + 0x2f], 0x2f79
mov byte [rbp + 0x33], 1
nop word [rax + rax]
lea eax, [rsi + rdx]
xor word [rbp + rdx*2 - 0x19], ax
inc rdx
cmp rdx, 0x25
jb 0x14001efe0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x19]
mov byte [rbp + 0x33], bl
call fcn.1400252c0
movdqa xmm0, xmmword [0x1400421e0]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x130316
mov byte [rbp - 0x55], 1
nop
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x13
jb 0x14001f020
mov rdi, 0xffffffffffffffff
mov byte [rbp - 0x55], bl
mov r8, rdi
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], 0xf
lea rax, [rbp - 0x69]
mov byte [rbp - 0x49], bl
inc r8
cmp byte [rax + r8], bl
jne 0x14001f050
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x1400421e0]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x130316
mov byte [rbp - 0x55], 1
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x13
jb 0x14001f090
mov byte [rbp - 0x55], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f0c0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [str.sckq]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x1001200
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x12
jb 0x14001f100
mov byte [rbp - 0x56], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f130
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140043720]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x7c11160c
mov dword [rbp - 0x55], 0x1f0e1869
mov dword [rbp - 0x51], 0x1001a08
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x1a
jb 0x14001f180
mov byte [rbp - 0x4e], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f1b0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140043720]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x7e11160c
mov dword [rbp - 0x55], 0x1f0e1869
mov dword [rbp - 0x51], 0x1001a08
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x1a
jb 0x14001f200
mov byte [rbp - 0x4e], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f230
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140043720]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x68170511
mov dword [rbp - 0x55], 0x9180f1b
mov word [rbp - 0x51], 0x19
mov byte [rbp - 0x4f], 1
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x19
jb 0x14001f280
mov byte [rbp - 0x4f], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f2b0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [str.ftwwr]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov word [rbp - 0x59], bx
mov byte [rbp - 0x57], 1
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x11
jb 0x14001f2f0
mov byte [rbp - 0x57], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f320
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140042020]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x100150b
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x12
jb 0x14001f360
mov byte [rbp - 0x56], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f390
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
mov rcx, rbx
mov dword [rbp - 0x69], 0x6b63747b
mov dword [rbp - 0x65], 0x1c6f7b6d
mov dword [rbp - 0x61], 0x1006c10
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xa
jb 0x14001f3d0
mov byte [rbp - 0x5e], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f400
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
mov rcx, rbx
mov dword [rbp - 0x69], 0x6b63747b
mov dword [rbp - 0x65], 0x1c6f7b6d
mov dword [rbp - 0x61], 0x6d6c10
mov byte [rbp - 0x5d], 1
nop dword [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xb
jb 0x14001f440
mov byte [rbp - 0x5d], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f470
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140042990]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400422d0]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x140042bd0]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x140042f50]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0x3a36253c
mov dword [rbp + 0x2b], 0x1003f35
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 0x46
jb 0x14001f4e0
mov byte [rbp + 0x2e], bl
lea rax, [rbp - 0x19]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f510
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140042990]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400422d0]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x140042bd0]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x140043020]
movdqa xmmword [rbp + 7], xmm0
movdqa xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0x3435373b
mov word [rbp + 0x2b], 0x3c
mov byte [rbp + 0x2d], 1
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 0x45
jb 0x14001f580
mov byte [rbp + 0x2d], bl
lea rax, [rbp - 0x19]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f5b0
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140042e30]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x2d356629
mov dword [rbp - 0x55], 0x3f2f3a
mov byte [rbp - 0x51], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x17
jb 0x14001f600
mov byte [rbp - 0x51], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f630
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140042ad0]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x332336
mov byte [rbp - 0x55], 1
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x13
jb 0x14001f670
mov byte [rbp - 0x55], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f6a0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x1400431e0]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x1003220
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x12
jb 0x14001f6e0
mov byte [rbp - 0x56], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f710
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x1400431d0]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov word [rbp - 0x59], 0x20
mov byte [rbp - 0x57], 1
nop dword [rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x11
jb 0x14001f750
mov byte [rbp - 0x57], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f780
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [str.FTWWR_]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov byte [rbp - 0x59], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0xf
jb 0x14001f7c0
mov byte [rbp - 0x59], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov r8, rdi
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x14001f7f0
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
movdqa xmm0, xmmword [0x140042a60]
mov rcx, rbx
movdqu xmmword [rbp - 0x69], xmm0
mov dword [rbp - 0x59], 0x100352b
nop word [rax + rax]
lea eax, [rcx + 0x35]
xor byte [rbp + rcx - 0x69], al
inc rcx
cmp rcx, 0x12
jb 0x14001f830
mov byte [rbp - 0x56], bl
lea rax, [rbp - 0x69]
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x31], 0xf
mov byte [rbp - 0x49], bl
inc rdi
cmp byte [rax + rdi], bl
jne 0x14001f856
mov r8, rdi
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x49]
call fcn.140023ea0
lea rcx, [rbp - 0x49]
call fcn.140005840
mov rdx, rbx
mov dword [rbp - 0x49], 0x2f162f3f
mov dword [rbp - 0x45], 0x2f182f17
mov dword [rbp - 0x41], 0x2f782f19
mov dword [rbp - 0x3d], 0x2f5f2f5a
mov dword [rbp - 0x39], 0x2f1e2f56
mov dword [rbp - 0x35], 0x2f2e2f70
mov dword [rbp - 0x31], 0x2f2b2f2d
mov dword [rbp - 0x2d], 0x2f212f2d
mov dword [rbp - 0x29], 0x2f662f64
mov dword [rbp - 0x25], 0x2f422f67
mov word [rbp - 0x21], bx
mov byte [rbp - 0x1f], 1
nop dword [rax + rax]
lea eax, [rsi + rdx]
xor word [rbp + rdx*2 - 0x49], ax
inc rdx
cmp rdx, 0x14
jb 0x14001f8d0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp - 0x49]
mov byte [rbp - 0x1f], bl
call fcn.1400252c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x67], 0x445a56
mov byte [rbp + 0x6b], 1
nop word [rax + rax]
lea eax, [rbx + 0x35]
xor byte [rbp + rbx + 0x67], al
inc rbx
cmp rbx, 3
jb 0x14001f910
lea rcx, [rbp + 0x67]
mov byte [rbp + 0x6b], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret