Function at 0x140001000
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r15
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movdqa xmm0, xmmword [str.ABCDEFGHIJKLMNOP]
lea rax, [rbp - 1]
mov rbx, 0xffffffffffffffff
mov dword [rbp - 0x19], 0
movdqu xmmword [rbp + 0x2f], xmm0
mov rdx, rbx
mov dword [rbp + 0x3f], 0x54535251
mov dword [rbp + 0x43], 0x58575655
mov word [rbp + 0x47], 0x5a59
mov dword [rbp + 0x1f], 0x30312b17
mov dword [rbp + 0x23], 0x182b2730
mov dword [rbp + 0x27], 0x293f253b
mov word [rbp + 0x2b], 0x3a2e
mov dword [rbp - 1], 0x30312b17
mov dword [rbp + 3], 0x92b2730
mov dword [rbp + 7], 0x2f242625
mov dword [rbp + 0xf], 0x92f3613
mov dword [rbp + 0x13], 0x522302a
mov dword [rbp + 0x17], 0x3e24272c
mov byte [rbp + 0x1b], 0x34
mov dword [rbp - 0x11], 0x25263002
mov dword [rbp - 0xd], 0x20132331
mov dword [rbp - 9], 0x282a2f3b
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400010c3
xor r9d, r9d
xor r11d, r11d
test rdx, rdx
je 0x140001114
xor r10d, r10d
lea r8, [rbp - 1]
nop
xor ecx, ecx
lea r8, [r8 + 1]
cmp r10, 0x1a
cmovne rcx, r10
movzx eax, byte [rbp + rcx + 0x2f]
xor byte [r8 - 1], al
xor eax, eax
cmp r10, 0x1a
lea r10, [rcx + 1]
cmovne eax, r9d
inc r11d
lea r9d, [rax + 1]
movsxd rax, r11d
cmp rax, rdx
jb 0x1400010e0
lea rcx, [rbp - 1]
mov rax, rbx
nop dword [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140001120
lea rcx, str.kernel32.dll
mov byte [rbp + rax - 1], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 1]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov edx, 0x1cc
mov r8d, 0x3000
lea r9d, [rcx + 4]
call rax
mov rsi, rax
mov rdx, rbx
lea rax, [rbp + 0xf]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140001167
xor r9d, r9d
xor r11d, r11d
test rdx, rdx
je 0x1400011b6
xor r10d, r10d
lea r8, [rbp + 0xf]
xor ecx, ecx
lea r8, [r8 + 1]
cmp r10, 0x1a
cmovne rcx, r10
movzx eax, byte [rbp + rcx + 0x2f]
xor byte [r8 - 1], al
xor eax, eax
cmp r10, 0x1a
lea r10, [rcx + 1]
cmovne eax, r9d
inc r11d
lea r9d, [rax + 1]
movsxd rax, r11d
cmp rax, rdx
jb 0x140001182
lea rcx, [rbp + 0xf]
mov rax, rbx
nop dword [rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400011c0
lea rcx, str.Ntdll.dll
mov byte [rbp + rax + 0xf], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r15, [0x140004040]
xor r11d, r11d
mov rdi, rax
xor r10d, r10d
mov r9, r15
xor edx, edx
lea r9, [r9 + 1]
cmp r10, 0x1a
cmovne rdx, r10
xor eax, eax
movzx ecx, byte [rbp + rdx + 0x2f]
xor byte [r9 - 1], cl
cmp r10, 0x1a
lea r10, [rdx + 1]
cmovne eax, r8d
inc r11d
lea r8d, [rax + 1]
cmp r11d, 0x1cc
jb 0x140001200
mov rax, rbx
nop dword [rax + rax]
cmp byte [r15 + rax + 1], 0
lea rax, [rax + 1]
jne 0x140001240
mov r8d, 0x1cc
mov byte [rax + r15], 0
mov rdx, r15
mov rcx, rsi
call rdi
lea rax, [rbp + 0x1f]
mov rdx, rbx
inc rdx
cmp byte [rax + rdx], 0
jne 0x140001266
xor r9d, r9d
xor r11d, r11d
test rdx, rdx
je 0x1400012b5
xor r10d, r10d
lea r8, [rbp + 0x1f]
xor ecx, ecx
lea r8, [r8 + 1]
cmp r10, 0x1a
cmovne rcx, r10
movzx eax, byte [rbp + rcx + 0x2f]
xor byte [r8 - 1], al
xor eax, eax
cmp r10, 0x1a
lea r10, [rcx + 1]
cmovne eax, r9d
inc r11d
lea r9d, [rax + 1]
movsxd rax, r11d
cmp rax, rdx
jb 0x140001281
lea rcx, [rbp + 0x1f]
mov rax, rbx
nop dword [rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400012c0
lea rcx, str.kernel32.dll
mov byte [rbp + rax + 0x1f], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp + 0x1f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp - 0x19]
mov edx, 0x1cc
mov r8d, 0x20
mov rcx, rsi
call rax
mov edi, eax
mov rdx, rbx
lea rax, [rbp - 0x11]
inc rdx
cmp byte [rax + rdx], 0
jne 0x140001307
xor r9d, r9d
xor r11d, r11d
test rdx, rdx
je 0x140001356
xor r10d, r10d
lea r8, [rbp - 0x11]
xor ecx, ecx
lea r8, [r8 + 1]
cmp r10, 0x1a
cmovne rcx, r10
movzx eax, byte [rbp + rcx + 0x2f]
xor byte [r8 - 1], al
xor eax, eax
cmp r10, 0x1a
lea r10, [rcx + 1]
cmovne eax, r9d
inc r11d
lea r9d, [rax + 1]
movsxd rax, r11d
cmp rax, rdx
jb 0x140001322
lea rcx, [rbp - 0x11]
mov rax, rbx
nop dword [rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x140001360
mov byte [rbp + rax - 0x11], 0
test edi, edi
je 0x140001454
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call rax
mov rdi, rax
mov rdx, rbx
lea rax, [rbp - 0x11]
nop dword [rax]
inc rdx
cmp byte [rax + rdx], 0
jne 0x1400013c0
xor r9d, r9d
xor r11d, r11d
test rdx, rdx
je 0x140001414
xor r10d, r10d
lea r8, [rbp - 0x11]
nop dword [rax + rax]
xor ecx, ecx
lea r8, [r8 + 1]
cmp r10, 0x1a
cmovne rcx, r10
movzx eax, byte [rbp + rcx + 0x2f]
xor byte [r8 - 1], al
xor eax, eax
cmp r10, 0x1a
lea r10, [rcx + 1]
cmovne eax, r9d
inc r11d
lea r9d, [rax + 1]
movsxd rax, r11d
cmp rax, rdx
jb 0x1400013e0
lea rax, [rbp - 0x11]
nop dword [rax + rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140001420
lea rcx, str.kernel32.dll
mov byte [rbp + rbx - 0x11], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xffffffff
mov rcx, rdi
call rax
xor eax, eax
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140001490
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret