Function at 0x140009c60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x158]
sub rsp, 0x240
movaps xmmword [rax - 0x38], xmm7
lea rcx, [rbp + 0x160]
movaps xmmword [rax - 0x48], xmm8
mov rdi, rdx
movaps xmmword [rax - 0x58], xmm9
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ecx, 0xfa52400e
mov dword [rsp + 0x54], 0x10007
xor r14d, r14d
mov dword [rsp + 0x50], ecx
mov eax, r14d
mov dword [rsp + 0x58], 0x2f6cc00e
mov dword [rsp + 0x5c], 0xfbcff1d0
nop word [rax + rax]
xor dword [rsp + rax*4 + 0x58], ecx
inc rax
cmp rax, 2
je 0x140009ce3
mov ecx, dword [rsp + 0x50]
jmp 0x140009cd0
movdqa xmm0, xmmword [0x140025d70]
movabs rax, 0xd6bf94d5e57a42bd
movdqa xmm1, xmmword [0x140025d80]
mov rcx, qword [rbp + 0x160]
sub rcx, qword [rsp + 0x58]
mul rcx
movups xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x140025e50]
movups xmmword [rbp - 0x10], xmm1
mov rcx, qword [rdi + 0x10]
movdqa xmm1, xmmword [0x140025da0]
mov rsi, rdx
movups xmmword [rbp - 0x50], xmm0
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x80], 0x1a8a69bf
movdqa xmm0, xmmword [0x140025df0]
movups xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x7c], 0x10027
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x78], 0x3ac53aec
mov dword [rbp - 0x74], 0x2dbb598d
mov dword [rbp - 0x70], 0x69aa449f
mov dword [rbp - 0x6c], 0x76ed07d6
mov dword [rbp - 0x68], 0x7be619da
mov dword [rbp - 0x64], 0x3af80cc6
mov dword [rbp - 0x60], 0x3aee07de
mov dword [rbp - 0x5c], 0x6ee61cd2
mov dword [rbp - 0x58], 0x7be619d6
mov dword [rbp - 0x54], 0x1af80cc6
mov rax, qword [rcx]
shr rsi, 0x17
call qword [rax + 0x40]
movss xmm3, dword [0x140025c28]
mov rcx, qword [rdi + 8]
movss xmm1, dword [0x140025d20]
movss xmm2, dword [0x140025c7c]
movss xmm0, dword [0x140025bd4]
mov rax, qword [rcx]
mov r9, qword [rdi + 0x10]
unpcklps xmm1, xmm3
unpcklps xmm2, xmm3
movq r8, xmm1
mov qword [rsp + 0x28], r14
movq rdx, xmm2
movss dword [rsp + 0x20], xmm0
call qword [rax + 0x78]
cmp word [rbp - 0x7a], r14w
je 0x140009e24
movzx ecx, word [rbp - 0x7c]
mov eax, r14d
inc ecx
test cl, 3
setne al
shr ecx, 2
add eax, ecx
mov rcx, r14
mov edx, eax
je 0x140009e1f
nop dword [rax]
mov eax, dword [rbp - 0x80]
xor dword [rbp + rcx*4 - 0x78], eax
inc rcx
cmp rcx, rdx
jne 0x140009e10
mov word [rbp - 0x7a], r14w
movss xmm0, dword [0x140025c00]
lea rax, [rbp - 0x50]
movss xmm8, dword [0x140025ce0]
mov ebx, 1
movss xmm3, dword [0x140025d08]
movaps xmm1, xmm8
movss xmm2, dword [0x140025c10]
mov rcx, rdi
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x78]
mov dword [rsp + 0x40], ebx
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [0x140025c20]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x230], xmm6
call fcn.140007aa0
mov rcx, qword [rdi + 0x10]
lea rdx, [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x50]
movdqa xmm0, xmmword [0x140025e70]
mov r8, qword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm0
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rax, qword [0x140029948]
xorps xmm7, xmm7
movss xmm9, dword [0x140025bf0]
test rax, rax
je 0x14000a0df
movdqa xmm0, xmmword [0x140025e40]
lea rcx, [rsp + 0x50]
movss xmm6, dword [0x140025bec]
movss xmm3, dword [0x140025cc4]
movss xmm2, dword [0x140025c30]
movss xmm1, dword [0x140025c9c]
mov qword [rsp + 0x48], rcx
mov rcx, rdi
mov dword [rsp + 0x40], 0x20
movss dword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x30], r14
movss xmm0, dword [0x140025c84]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm0
call fcn.140007aa0
mov edx, dword [0x140029954]
lea rcx, [rsp + 0x60]
inc edx
call fcn.1400053c0
mov edx, dword [0x140029958]
lea rcx, [rsp + 0x61]
mov eax, eax
add rcx, rax
mov byte [rsp + rax + 0x60], 0x2f
call fcn.1400053c0
movss xmm2, dword [0x140025cb8]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
xorps xmm3, xmm3
mov dword [rsp + 0x40], 3
lea rax, [rsp + 0x60]
movss dword [rsp + 0x38], xmm6
movaps xmm1, xmm8
mov qword [rsp + 0x30], r14
mov rcx, rdi
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm7
call fcn.140007aa0
mov eax, dword [0x140029954]
mov rcx, rdi
movss xmm6, dword [0x140025c04]
movss xmm8, dword [0x140025cb4]
movaps xmm3, xmm6
movss xmm1, dword [0x140025cd8]
movaps xmm2, xmm8
mov dword [rsp + 0x40], ebx
movss dword [rsp + 0x38], xmm9
mov dword [rsp + 0x30], eax
lea rax, [0x14001cfc8]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm6
call fcn.140007e10
test eax, eax
je 0x14000a055
mov rax, qword [0x140029948]
sub rax, 2
mov qword [0x140029948], rax
cmp byte [rax], r14b
je 0x14000a03b
mov rcx, qword [0x140029940]
nop
cmp rax, rcx
je 0x14000a036
dec rax
mov qword [0x140029948], rax
cmp byte [rax], r14b
jne 0x14000a020
jmp 0x14000a03b
cmp byte [rax], r14b
jne 0x14000a045
inc rax
mov qword [0x140029948], rax
mov edx, dword [0x140029954]
dec edx
mov dword [0x140029954], edx
jmp 0x14000a05b
mov edx, dword [0x140029954]
mov eax, dword [0x140029958]
mov ecx, r14d
movss xmm1, dword [0x140025cf4]
dec eax
mov dword [rsp + 0x40], ebx
cmp edx, eax
movss dword [rsp + 0x38], xmm9
lea rax, [0x14001cdd4]
setne cl
movaps xmm3, xmm6
mov dword [rsp + 0x30], ecx
movaps xmm2, xmm8
mov qword [rsp + 0x28], rax
mov rcx, rdi
movss dword [rsp + 0x20], xmm6
call fcn.140007e10
test eax, eax
je 0x14000a0df
mov rax, qword [0x140029948]
cmp byte [rax], r14b
je 0x14000a0cf
nop dword [rax]
nop word [rax + rax]
inc rax
mov qword [0x140029948], rax
cmp byte [rax], r14b
jne 0x14000a0c0
inc rax
inc dword [0x140029954]
mov qword [0x140029948], rax
mov eax, dword [0x140029a94]
test bl, al
je 0x14000a167
mov ecx, 0xc905ca6e
mov dword [rsp + 0x64], 0x10011
mov dword [rsp + 0x60], ecx
mov rax, r14
mov dword [rsp + 0x68], 0xaa60a22d
mov dword [rsp + 0x6c], 0xae6ba305
mov dword [rsp + 0x70], 0xa56cac4e
mov dword [rsp + 0x74], 0xe72bb90b
mov dword [rsp + 0x78], 0xc905ca40
nop word [rax + rax]
xor dword [rsp + rax*4 + 0x68], ecx
inc rax
cmp rax, 5
je 0x14000a143
mov ecx, dword [rsp + 0x60]
jmp 0x14000a130
movss xmm1, dword [0x140025be4]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x48], rax
movaps xmm2, xmm1
lea rax, [rsp + 0x68]
mov word [rsp + 0x66], r14w
jmp 0x14000a626
test al, 2
je 0x14000a2a0
cmp dword [0x140029aa4], r14d
mov ecx, 0xdfc2f087
mov edx, 0xef8f581f
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x54], 0x10004
mov dword [rsp + 0x58], 0xa6a39cd7
mov dword [rsp + 0x64], 0x10009
mov dword [rsp + 0x68], 0x96ee344f
mov dword [rsp + 0x6c], 0x82ea3c3f
mov dword [rsp + 0x70], 0xef8f5870
je 0x14000a1f0
cmp esi, dword [0x140029aa8]
jae 0x14000a1f0
mov rax, r14
nop dword [rax]
xor dword [rsp + rax*4 + 0x58], ecx
inc rax
cmp rax, 2
je 0x14000a1e3
mov ecx, dword [rsp + 0x50]
jmp 0x14000a1d0
mov word [rsp + 0x56], r14w
lea rsi, [rsp + 0x58]
jmp 0x14000a211
mov rax, r14
xor dword [rsp + rax*4 + 0x68], edx
inc rax
cmp rax, 3
je 0x14000a206
mov edx, dword [rsp + 0x60]
jmp 0x14000a1f3
mov word [rsp + 0x66], r14w
lea rsi, [rsp + 0x68]
mov rcx, qword [0x140029960]
test rcx, rcx
je 0x14000a244
lea rdx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x103
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [rbp + 0x160], 0x103
mov ebx, r14d
setne bl
movss xmm0, dword [0x140025bfc]
mov rcx, rdi
movss xmm3, dword [0x140025c4c]
movss xmm2, dword [0x140025ce8]
movss xmm1, dword [0x140025d14]
mov dword [rsp + 0x40], r14d
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [0x140025c24]
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
movss dword [rsp + 0x20], xmm0
call fcn.140007e10
test eax, eax
je 0x14000a64d
call section..text
jmp 0x14000a64d
mov ecx, 0x950ae16a
mov dword [rsp + 0x54], 0x10007
mov dword [rsp + 0x50], ecx
mov rax, r14
mov dword [rsp + 0x58], 0xe1798f23
mov dword [rsp + 0x5c], 0x95668d0b
nop dword [rax]
nop dword [rax + rax]
xor dword [rsp + rax*4 + 0x58], ecx
inc rax
cmp rax, 2
je 0x14000a2e3
mov ecx, dword [rsp + 0x50]
jmp 0x14000a2d0
movss xmm0, dword [0x140025bfc]
mov eax, r14d
cmp dword [0x140029bf0], r14d
mov rcx, rdi
movss xmm3, dword [0x140025c4c]
movss xmm2, dword [0x140025ce8]
sete al
movss xmm1, dword [0x140025d14]
mov dword [rsp + 0x40], r14d
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [0x140025c24]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm0
mov word [rsp + 0x56], r14w
call fcn.140007e10
test eax, eax
je 0x14000a370
mov edx, 8
mov dword [0x140029bf0], ebx
lea rcx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x40103
mov dword [rbp + 0x164], ebx
call fcn.140006fb0
cmp dword [0x140029bf0], r14d
je 0x14000a64d
mov eax, dword [0x140029d04]
add eax, 0xfffffffe
test eax, 0xfffffffd
jne 0x14000a64d
mov rcx, qword [rdi + 0x10]
lea rdx, [rbp - 0x40]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x50]
movdqa xmm0, xmmword [0x140025ea0]
mov r8, qword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm0
mov rax, qword [rcx]
call qword [rax + 0x88]
movss xmm6, dword [0x140029bfc]
comiss xmm6, dword [0x140025bc0]
movss xmm8, dword [0x140025c74]
jbe 0x14000a442
mov rcx, qword [rdi + 0x10]
lea r8, [rbp - 0x10]
cmp dword [0x140029d04], 2
lea rdx, [rbp - 0x20]
mulss xmm6, dword [0x140025cd4]
cmovne rdx, r8
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rcx, qword [rdi + 8]
addss xmm6, xmm8
mov r8, qword [rdi + 0x10]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x434e0000
mov dword [rsp + 0x54], 0x440f0000
mov dword [rsp + 0x5c], 0x44138000
movss dword [rsp + 0x58], xmm6
mov rax, qword [rcx]
call qword [rax + 0x88]
movss xmm6, dword [0x140029bfc]
cvtps2pd xmm0, xmm6
comisd xmm0, xmmword [0x140025bc8]
jbe 0x14000a64d
mov eax, dword [0x140029d04]
cmp eax, 4
jne 0x14000a513
mov ecx, 0x8cf80ba0
mov dword [0x140029bf0], ebx
mov dword [rsp + 0x60], ecx
mov rax, r14
mov dword [rsp + 0x74], ecx
mov dword [rsp + 0x64], 0x1000c
mov dword [rsp + 0x68], 0xfe8c73e5
mov dword [rsp + 0x6c], 0xe58c68c1
mov dword [rsp + 0x70], 0xacc26cce
nop dword [rax + rax]
xor dword [rsp + rax*4 + 0x68], ecx
inc rax
cmp rax, 4
je 0x14000a4b3
mov ecx, dword [rsp + 0x60]
jmp 0x14000a4a0
mov eax, dword [rsp + 0x70]
lea rcx, [0x140029c00]
movsd xmm0, qword [rsp + 0x68]
mov r8, 0xffffffffffffffff
mov dword [rbp + 8], eax
movzx eax, byte [rsp + 0x74]
mov byte [rbp + 0xc], al
movzx eax, word [rsp + 0x64]
movsd qword [rbp], xmm0
inc r8
cmp byte [rcx + r8], r14b
jne 0x14000a4e0
movzx edx, word [0x14001cb24]
lea rcx, [0x140029c01]
add rdx, rcx
lea rcx, [rbp]
add rcx, rax
call fcn.14001a970
movss xmm2, dword [0x140025cf0]
jmp 0x14000a615
cmp eax, 2
jne 0x14000a64d
mov ecx, 0x29e565ee
mov dword [0x140029bf0], ebx
mov dword [rsp + 0x60], ecx
mov rax, r14
mov dword [rsp + 0x64], 0x1000d
mov dword [rsp + 0x68], 0x47920aaa
mov dword [rsp + 0x6c], 0x4d840a82
mov dword [rsp + 0x70], 0x13820b87
mov dword [rsp + 0x74], 0x29e565ce
nop word [rax + rax]
xor dword [rsp + rax*4 + 0x68], ecx
inc rax
cmp rax, 4
je 0x14000a573
mov ecx, dword [rsp + 0x60]
jmp 0x14000a560
mov eax, dword [rsp + 0x70]
lea rcx, [rbp]
mulss xmm6, dword [0x140025c34]
movzx ebx, word [rsp + 0x64]
movsd xmm0, qword [rsp + 0x68]
add rcx, rbx
mov dword [rbp + 8], eax
movzx eax, word [rsp + 0x74]
cvttss2si edx, xmm6
mov word [rbp + 0xc], ax
movsd qword [rbp], xmm0
call fcn.1400053c0
mov edx, dword [0x140029bf4]
lea rcx, [rbp]
mov eax, eax
add rbx, rax
shr edx, 0x14
mov dword [rbp + rbx], 0x202d2025
add rbx, 4
add rcx, rbx
call fcn.1400053c0
mov edx, dword [0x140029bf8]
lea rcx, [rbp]
mov eax, eax
add rbx, rax
shr edx, 0x14
mov dword [rbp + rbx], 0x2f20424d
mov byte [rbp + rbx + 4], 0x20
add rbx, 5
add rcx, rbx
call fcn.1400053c0
movss xmm2, dword [0x140025cf8]
mov eax, eax
add rbx, rax
mov word [rbp + rbx], 0x424d
mov byte [rbp + rbx + 2], r14b
lea rax, [rbp - 0x50]
movaps xmm1, xmm8
mov qword [rsp + 0x48], rax
lea rax, [rbp]
mov dword [rsp + 0x40], r14d
movaps xmm3, xmm7
movss dword [rsp + 0x38], xmm9
mov rcx, rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm7
call fcn.140007aa0
movaps xmm6, xmmword [rsp + 0x230]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret