Function at 0x1401c025c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x1402c6178]
mov rcx, qword [0x1402c6180]
cmp rax, rcx
je 0x1401c0292
sub rcx, rax
jmp 0x1401c0526
mov qword [0x1402c6180], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor esi, esi
mov eax, dword [rdx + rcx]
cmp dword [0x1402d52b8], eax
jle 0x1401c04b4
lea rcx, [0x1402d52b8]
call fcn.14027b540
or rbx, 0xffffffffffffffff
cmp dword [0x1402d52b8], ebx
jne 0x1401c04b4
lea rax, [rbp - 0x11]
mov qword [rbp + 0x6f], rax
mov dword [rbp - 0x41], 0x15
mov byte [rbp - 0x3d], 0x50
mov byte [rbp - 0x3c], 0x7b
mov byte [rbp - 0x3b], 0x60
mov byte [rbp - 0x3a], 0x78
mov byte [rbp - 0x39], 0x42
mov byte [rbp - 0x38], 0x7c
mov byte [rbp - 0x37], 0x7b
mov byte [rbp - 0x36], 0x71
mov byte [rbp - 0x35], 0x7a
mov byte [rbp - 0x34], 0x62
mov byte [rbp - 0x33], 0x66
xor eax, eax
mov byte [rbp - 0x32], al
mov al, byte [rbp - 0x3d]
mov edx, esi
mov al, byte [rbp + rdx - 0x3d]
mov ecx, dword [rbp - 0x41]
xor cl, al
mov byte [rbp + rdx - 0x3d], cl
inc rdx
cmp rdx, 0xb
jb 0x1401c031c
mov byte [rbp - 0x32], sil
mov qword [rbp - 0x11], rsi
mov qword [rbp - 1], rsi
mov r14d, 0xf
mov qword [rbp + 7], r14
lea rax, [rbp - 0x3d]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], sil
jne 0x1401c034f
lea rcx, [rbp - 0x11]
cmp rdi, r14
ja 0x1401c0379
mov qword [rbp - 1], rdi
mov r8, rdi
lea rdx, [rbp - 0x3d]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rdi - 0x11], sil
jmp 0x1401c0386
lea r9, [rbp - 0x3d]
mov rdx, rdi
call fcn.1400ada10
nop
mov byte [rbp + 0x67], 0x7c
mov byte [rbp + 0x68], 0x7a
mov byte [rbp + 0x69], 0x6c
mov byte [rbp + 0x6a], 0x79
mov byte [rbp + 0x6b], 0x3a
mov byte [rbp + 0x6c], 0x39
mov byte [rbp + 0x6d], sil
mov al, byte [rbp + 0x67]
mov rcx, rsi
mov al, byte [rbp + rcx + 0x67]
sub al, 7
mov byte [rbp + rcx + 0x67], al
inc rcx
cmp rcx, 6
jb 0x1401c03a8
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], r14
mov byte [rbp - 0x31], sil
lea rax, [rbp + 0x67]
inc rbx
cmp byte [rax + rbx], sil
jne 0x1401c03cf
lea rcx, [rbp - 0x31]
cmp rbx, r14
ja 0x1401c03f9
mov qword [rbp - 0x21], rbx
mov r8, rbx
lea rdx, [rbp + 0x67]
call qword [sym.imp.VCRUNTIME140.dll_memmove]
mov byte [rbp + rbx - 0x31], sil
jmp 0x1401c0406
lea r9, [rbp + 0x67]
mov rdx, rbx
call fcn.1400ada10
nop
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0xf]
call fcn.1401a82ac
nop
mov qword [rsp + 0x20], rsi
mov r9b, 1
lea r8, [rbp - 0x11]
mov rdx, rax
lea rcx, [0x1402d68b0]
call fcn.1401ce914
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x1401c046e
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c0469
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c0469
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14027b384
mov qword [rbp - 0x21], rsi
mov qword [rbp - 0x19], r14
mov byte [rbp - 0x31], sil
xor edx, edx
lea r8d, [rdx + 7]
lea rcx, [rbp + 0x67]
call qword [sym.imp.VCRUNTIME140.dll_memset]
nop
xor edx, edx
lea r8d, [rdx + 0xc]
lea rcx, [rbp - 0x3d]
call qword [sym.imp.VCRUNTIME140.dll_memset]
lea rcx, [0x14028f2f4]
call fcn.14027b36c
nop
lea rcx, [0x1402d52b8]
call fcn.14027b4e0
lea rbx, [0x1402d68c8]
mov rcx, rbx
cmp qword [0x1402d68e0], 0x10
cmovae rcx, qword [0x1402d68c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1401c0504
mov rcx, rbx
cmp qword [0x1402d68e0], 0x10
cmovae rcx, qword [0x1402d68c8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402d68c0], rax
mov r8, rax
mov rdx, rbx
call fcn.1400bc1a0
xor edx, edx
lea rcx, [0x1401bfc88]
call qword [0x1402d68b8]
call fcn.140214838
mov rcx, qword [0x1402c6180]
sub rcx, qword [0x1402c6178]
movabs rax, 0x5254e78ecb419ba9
imul rcx
sar rdx, 9
mov rax, rdx
shr rax, 0x3f
add rax, rdx
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret